Federal FDCPA and Regulation F set a floor, not a ceiling. California's Rosenthal Act defines "debt collector" broadly enough to reach original-creditor collection activity in many cases, not just third-party collectors. New York bans using social media to collect debts. Florida applies the same 8am-9pm window as a direct prohibition rather than a rebuttable presumption. Texas uses an intent-based harassment standard instead of Reg F's numeric presumption. A compliance program built only to the federal baseline will miss real state-specific obligations in at least these four states.
On this page
The federal baseline: FDCPA and Regulation F
Two federal sources set the default rules for debt collection calling and communication: the Fair Debt Collection Practices Act (FDCPA) itself, and the CFPB's Regulation F, which took effect November 30, 2021.
- Calling hours (FDCPA, 15 U.S.C. § 1692c(a)(1)): absent knowledge to the contrary, a debt collector must assume the convenient time to call is after 8am and before 9pm, local time at the consumer's location. This is framed as a presumption, not an outright ban.
- Call frequency (Regulation F, 12 CFR § 1006.14(b)): a debt collector is presumed to violate the rule against harassment if they call a particular person, about a particular debt, more than 7 times within 7 consecutive days, or within 7 days of a conversation about that debt.
- Coverage limitation: FDCPA generally applies to third-party debt collectors — not to original creditors collecting their own debts in their own name, with some exceptions.
State-by-state comparison table
| State | Statute | Key difference from federal baseline |
|---|---|---|
| Federal (baseline) | 15 U.S.C. § 1692c(a)(1); 12 CFR § 1006.14(b) | 8am-9pm presumption; 7-in-7 call frequency presumption; generally third-party collectors only |
| California | Civil Code § 1788 et seq. (Rosenthal Act) | Extends FDCPA-style conduct rules to original creditors, not just third-party collectors |
| New York | General Business Law § 601 | Explicitly prohibits using social media platforms to collect debts (§601(12)); requires 5-year record retention for high-volume information subpoenas (§601(11)) |
| Florida | Fla. Stat. § 559.72 | Converts the federal calling-hours presumption into a direct prohibition (9pm-8am, §559.72(17)); explicit ban on publishing "deadbeat lists" (§559.72(14)) |
| Texas | Fin. Code § 392.302 | Uses an intent-based repeated-call harassment standard rather than a specific numeric frequency cap |
Sources: California Legislative Information (leginfo.legislature.ca.gov, Cal. Civ. Code §§1788.2(c), 1788.17), NY State Senate OpenLegislation (nysenate.gov, GBL §601), The Florida Senate (flsenate.gov, F.S. §559.72), Texas Finance Code §392.302 via texas.public.law (a statute mirror — cross-check against statutes.capitol.texas.gov before relying on this for legal decisions). This page summarizes cited provisions in plain English; it is not a verbatim reproduction and is not legal advice.
California: original creditors are covered too
California's Rosenthal Fair Debt Collection Practices Act (Civil Code § 1788, added 1977) is one of the most-cited "mini-FDCPA" statutes for a specific reason: it doesn't limit itself to third-party debt collectors the way federal FDCPA does. Original creditors collecting their own consumer debts in California can be subject to Rosenthal Act conduct rules that a purely-federal compliance program would not apply to them at all. Any AI voice or outreach system built only around FDCPA logic needs a separate California-specific check for whether the caller is an original creditor, since that status doesn't exempt them the way it typically would under federal law alone.
New York: the social media prohibition
New York General Business Law § 601 lists prohibited debt collection practices, and one entry has no direct federal equivalent: § 601(12) bars using a "social media platform" — defined in the statute as a public or semi-public internet service where a substantial function is connecting users socially — as a means to collect on a consumer claim. For any AI-driven outreach system that might route through messaging or social channels, this is a hard stop specific to New York, not something FDCPA itself addresses. Separately, § 601(11) requires principal creditors or agents sending more than 50 information subpoenas per month to keep detailed, certified records for 5 years, with civil penalties up to $50 per subpoena (max $5,000 per violation) for non-compliance.
Florida: presumption becomes prohibition
Federal FDCPA's calling-hours rule is a rebuttable presumption — a debt collector is presumed to know 8am-9pm local time is convenient, but the presumption can theoretically be rebutted with contrary knowledge. Florida Statute § 559.72(17) uses the same practical hours but a different legal structure: it directly prohibits communicating with a debtor between 9pm and 8am in the debtor's time zone without prior consent, full stop, with specific rules for how to determine the applicable time zone when working from area codes or last-known residence. Florida also explicitly bans publishing or threatening to publish a "deadbeat list" of debtors (§559.72(14)) and bars embarrassing mail markings like writing "Deadbeat" on an envelope (§559.72(16)) — practices not enumerated as specifically in the federal statute.
Texas: intent-based, not numeric
Texas Finance Code § 392.302(4) prohibits "causing a telephone to ring repeatedly or continuously, or making repeated or continuous telephone calls, with the intent to harass a person at the called number." Notice what's absent: no specific number of calls, no defined time window. This is an intent-based standard — enforcement turns on whether the pattern and intent look like harassment, not on crossing a numeric threshold the way federal Regulation F's 7-in-7 rule works. For an AI dialer, this means Texas calls need behavioral pattern review (are we calling this number in a way that looks like harassment, regardless of raw count?), not just a frequency counter tuned to the federal number.
Where Colorado's AI-specific law fits in
None of the four states above have debt-collection-specific AI disclosure requirements yet. Colorado is the notable exception at the state level: Colorado SB 26-189 (signed into law May 14, 2026, most obligations effective January 1, 2027) requires notice, explanation, data access, and meaningful human review rights for AI systems used in "consequential decisions" — a definition that explicitly includes financial and lending services. Whether AI-influenced collections decisions like contact prioritization fall within that definition is an interpretive question the statute does not answer directly — compliance teams should treat it as a plausible extension worth legal review, not a settled fact. Compliance teams operating in Colorado need to layer SB 26-189's AI-specific obligations on top of whatever debt-collection-specific state statute already applies there; the two are separate legal regimes addressing different things.
Want the full statute citations and section numbers for all four states in one reference sheet, plus notes on how each interacts with AI-driven outreach?
FAQ
Does federal FDCPA preempt stricter state debt collection laws?
No. FDCPA sets a federal floor, not a ceiling. States are free to impose stricter rules, and several — including California, New York, and Florida — have their own debt collection statutes with additional or stricter requirements than the federal baseline.
Does California's Rosenthal Act cover original creditors, not just third-party collectors?
Yes — this is one of the most consequential differences. The federal FDCPA generally applies only to third-party debt collectors, not original creditors collecting their own debts. California's Rosenthal Fair Debt Collection Practices Act (Civil Code section 1788 et seq.) defines "debt collector" broadly and incorporates many FDCPA conduct provisions, which can reach original-creditor collection activity.
Does New York restrict using social media to collect debts?
Yes. New York General Business Law section 601(12) prohibits using a social media platform as a means to collect on a consumer claim from a debtor — a rule with no direct federal FDCPA equivalent.
Is Florida's calling-hours rule the same as the federal FDCPA presumption?
Similar window, different legal structure. Federal FDCPA (15 U.S.C. 1692c(a)(1)) treats 8am-9pm local time as a rebuttable presumption of a convenient calling time. Florida Statute 559.72(17) instead directly prohibits communication between 9pm and 8am without the debtor's prior consent — a harder-edged prohibition rather than a presumption.
Does Texas have a numeric call-frequency cap like federal Reg F's 7-in-7 rule?
No. Texas Finance Code section 392.302(4) prohibits causing a phone to ring repeatedly or continuously, or making repeated or continuous calls, with intent to harass — an intent-based standard, not a numeric presumption. Federal Regulation F (12 CFR 1006.14(b)) instead sets a numeric presumption of violation above 7 calls within 7 consecutive days per particular debt — Texas being non-numeric means less predictable enforcement, not necessarily weaker protection.
Related reading: FDCPA-compliant AI voice agent, TCPA compliance for AI outbound calls, Regulation F and AI voice automation, Colorado SB 26-189 and debt collection AI.
Building AI Voice Compliance for Multi-State Collections?
We can help you map state-specific rules into your control logic before you scale outreach across jurisdictions.