# FIXXO — Outreach Compliance (read before building anything) **Scope** every outbound call, text and email used to recruit plumbing and home-service partners in Herndon, Reston and Seattle. **Companions** `db/outreach_schema.sql` (the enforcement) · `VOICE_AGENT.md` · `SMS.md` · `EMAIL.md` · `db/SOURCING.md` (the lists). > This document is an engineering specification, not legal advice. The W−8 gate in `WOMEN_PILOT.md` applies here too: a Virginia and a Washington attorney review the scripts and the consent language before the first dial. --- ## 0 · The verdict, up front You asked for **AI cold calling**. The honest answer is that as commonly sold, it is the single highest-risk practice in outbound right now, and for our target list it is presumptively illegal: - The FCC ruled on **8 February 2024 (FCC 24-17)** that AI-generated and cloned voices are **"artificial or prerecorded voice"** under the TCPA. AI voice calls therefore need prior express consent — and **prior express *written* consent** when the call is marketing to a wireless number. - **There is no B2B carve-out.** The FTC's Telemarketing Sales Rule exempts most business-to-business calls from Do-Not-Call, but the TCPA does not. Its rules treat **every wireless number as residential** — and most independent plumbers' numbers are mobile. - Damages are **$500–$1,500 per call, with no aggregate cap, and a private right of action.** A 500-number AI cold-call campaign is a five-figure statutory exposure per recipient and a class-action magnet. - In **Washington** it is worse: RCW 80.36.400 prohibits using an automatic dialing-and-announcing device for **commercial solicitation at all**, synthetic voice falls inside that definition, RCW 19.86 treats undisclosed AI as a deceptive practice, and RCW 9.73.030 makes recording a private call **without all-party consent a crime**. **So we are not building an AI cold-caller. We are building the compliant version of the same outcome**, which reaches the same 50 partners: | Mode | Who speaks | Volume | Consent needed | Legal today? | |---|---|---|---|---| | **A · Human-dial cold** | A person, manually dialed | ~40–60 calls/day/rep | None beyond DNC + hours + identification (B2B lines) | **Yes** | | **B · AI copilot on a human call** | The human; AI listens, scripts, logs | same as A | same as A | **Yes** | | **C · AI voice on consented leads** | The AI | bounded by consent | PEWC naming Fixxo + AI disclosure + recording consent in WA | **Yes, if the gate passes** | | **D · Inbound AI + AI SMS** | The AI | unlimited | triggered by their inbound contact | **Yes** | **Mode B is the workhorse.** An AI that transcribes the call, surfaces the objection handler in real time, and writes the disposition gives you most of the leverage of an AI caller with none of the exposure. **Mode C is the upgrade** once we own consented leads. **Mode A is what we do this week** — it is legal today, needs no new infrastructure, and is how the 15 seeded Herndon numbers get called. --- ## 1 · The four modes in detail ### A · Human-dial cold (default) A person dials a business number by hand. Compliant when: 1. The number is **manually dialed** — no autodialer, no predictive dialer, no AI voice. 2. The number is **checked against the National DNC and our internal list within 31 days**. 3. The call is within **8:00–21:00 at the called party's local time**. 4. The caller **identifies themselves and Fixxo** and states the purpose in the opening. 5. The number is **not on our suppression list**. 6. If the number is a **cell phone**, we accept that a manual B2B call is the lower-risk surface but not risk-free — and never convert it to automated later without a written consent record. Mobile numbers in a B2B list are **consent-gated by default**. Office direct-dial landlines are the lower-risk surface. The schema flags `phone_type` so cold volume goes at landlines first. ### B · AI copilot (recommended) The human speaks; the AI assists. This is compliant everywhere because **a person is speaking** — the TCPA restriction is on artificial voice, not on software helping a human. - Live transcription and intent scoring - Real-time objection prompts pulled from `VOICE_AGENT.md` §5 - Auto-filled disposition, next action and CRM write-back - Post-call summary and follow-up draft - **Never speaks on the line.** If it does, the call becomes Mode C and the gate applies. ### C · AI voice on consented leads The AI places the call. Permitted only when **all** of the following are true and checked at dial time: 1. A `consent_records` row exists for **that phone number and that channel**, with `kind = 'pewc'` (or a lawful inbound trigger). 2. The consent language **named Fixxo**, was not a condition of purchase, and is stored with a timestamp and the exact text shown. 3. The consent has **not been revoked**. 4. **AI disclosure** is spoken in the opening. 5. **Recording consent** is obtained where required — mandatory in Washington (all-party) and California. 6. DNC, suppression and quiet hours all pass. 7. The correct caller identification and an opt-out mechanism are delivered. If any one of those fails, `can_contact()` returns false and **the dial does not happen**. Not a warning — a block. ### D · Inbound AI and AI SMS When the partner contacts us — calls our number, submits the partner form, replies to a message, downloads a lead magnet — the consent basis changes to an **inbound trigger**. The AI can run the conversation, answer questions, screen the licence and book a verification slot. Still disclosed as AI, still honouring STOP, still bound by quiet hours for anything outbound. --- ## 2 · Federal rules that apply to every mode | Rule | Requirement | Source | |---|---|---| | Artificial voice needs consent | AI voice = artificial voice; marketing to wireless needs prior express **written** consent | FCC 24-17; 47 U.S.C. § 227(b) | | Identification | Every artificial-voice call must identify the business and give a contact phone/address at the **start** of the call | 47 C.F.R. § 64.1200(b) | | Opt-out mechanism | Automated interactive opt-out offered within two seconds of identification for residential calls | 47 C.F.R. § 64.1200(b)(3) | | Calling hours | No solicitation before **8am or after 9pm at the called party's location** | 47 C.F.R. § 64.1200(c)(1) | | National DNC | Registry data no more than **31 days** old at dial time; purge every 31 days | 47 C.F.R. § 64.1200(c) | | Internal DNC | Written policy, trained staff, honour requests within **10 business days** | 47 C.F.R. § 64.1200(d) | | Revocation | Since **11 Apr 2025**, a person may revoke consent by **any reasonable means**; honour within **10 business days** | FCC 2025 | | Caller ID | Accurate caller ID; no spoofing | FTC TSR; TRACED Act | | Recording | Federal law is one-party **but state law preempts** — see §3 | 18 U.S.C. § 2511 | | Pending | The Aug-2024 NPRM (FCC 24-84) would mandate federal AI disclosure and AI-specific consent language. Not final as of now — **build to the proposed standard anyway** | FCC 24-84 | --- ## 3 · State rules that bind our two pilot states ### Washington — the strictest surface we touch | Law | What it does | Our behaviour | |---|---|---| | **RCW 80.36.400** | Prohibits automatic dialing-and-announcing devices **for commercial solicitation entirely**. Synthetic voice falls inside the definition. | **No AI voice, no autodialer, no ringless voicemail to WA numbers for solicitation.** Mode C is off in Washington unless a lawyer clears it for a specific consented use | | **RCW 19.190 (CEMA)** | Commercial texts and email to WA residents need prior affirmative consent; violations are per-message with private damages | WA texts only on a live `pewc` record | | **RCW 9.73.030** | **All-party consent to record.** Recording a private call without consent is a crime | Record only after an explicit spoken "yes"; otherwise **do not record**. On AI calls, recording is off by default | | **RCW 19.86 (CPA)** | Undisclosed AI can be a deceptive practice | Disclose AI in the first sentence, every time | | **E2SHB 1170 (eff. 1 Feb 2027)** | AI provenance + government-interaction disclosure; expressly does not regulate B2B | Watch item; no action for B2B today | **Net effect for Seattle:** Mode A and Mode B only. Human-dialed, human-spoken, DNC-scrubbed, 8–21 local, identified, **not recorded**. That is the plan until counsel says otherwise. ### Virginia Virginia follows the federal TCPA standard, with its own telephone privacy provisions. Mode A and B are the default; Mode C requires a clean PEWC record. No all-party recording rule, but we still announce recording and honour objections. ### Other states our lists reach | State | Requirement | Effect | |---|---|---| | Texas | AI disclosure within **30 seconds** (SB 140); TRAIGA from Jan 2026 | Disclose in the opening | | Florida | AI-specific **written** consent (FTSA) | Mode C blocked without FL-specific PEWC | | California | Bot disclosure (B.O.T. Act) where selling; all-party recording | Disclose; do not record | | Colorado, Illinois, Utah | AI-disclosure variants | Disclose at open | **Rule of thumb: disclose in the first eight seconds, everywhere, always.** It satisfies every state variant and costs nothing. --- ## 4 · The consent we capture (and how) Consent is only worth what we can prove. Every outbound AI call or marketing text requires an `consent_records` row where: - The language **names Fixxo** specifically. - The **specific number** being authorised is recorded. - It states that consent is **not a condition of any purchase**. - It references **AI-generated voice** where the call will use it (build to the pending federal standard). - The **exact text shown** is stored verbatim, with a timestamp, IP, and the page URL. - It can be **produced on demand** — a signed PDF, a form submission, or a recorded verbal "yes". **Where our consent actually comes from:** | Source | Basis | what it unlocks | |---|---|---| | Partner onboarding form (the `can_contact` checkbox next to the number) | `pewc` | AI voice + SMS for that number | | Inbound call to our line + verbal yes to a callback | `inbound_trigger` | one relationship-appropriate follow-up | | Reply `YES` to our short code after a compliant opt-in | `pewc` (confirmation SMS sent) | ongoing SMS | | Signed partner agreement | `pewc` | full channel access | | **Imported or purchased list** | `none` | **nothing. Mode A and B only** | Co-registration consents that say "and partners" generically do not survive litigation. If we cannot produce documentation for a number, **that number is cold** and can only ever be human-dialed. --- ## 5 · The dial-time gate `can_contact(phone, channel)` in `db/outreach_schema.sql` is the single function every send must pass. It returns true only when: 1. The number is **not on `suppression_list`** for that scope or channel. 2. A `dnc_checks` row shows **clear within 31 days**. 3. For `ai_call`, `sms`, `mms`: a **live, unrevoked consent record** exists for that number *and* that channel. 4. For calls: the **local hour is between 08 and 20**. Any false → the send is blocked and `message_log.blocked_reason` records why. **No queue may exist that a human can bypass.** There is no "force send" button in the ops console for this reason (`FIXXO_V2_OPS.html` O1 shows the flag queue read-only). --- ## 6 · Recording | State | Rule | Our default | |---|---|---| | Washington | All-party consent; recording a private call without it is a **crime** (RCW 9.73.030) | **Never record** unless a spoken yes is captured at the top and stored | | California | All-party | Same | | Elsewhere | One-party federal | Announce and record, honour any objection immediately | **Default posture: don't record.** Transcription for AI copilot runs on the fly and stores a summary, not the audio, unless consent exists. This removes the single biggest criminal exposure in the programme. --- ## 7 · Opt-outs - Honoured from **any reasonable means** — `STOP`, "take me off your list", a verbal request on a call, an email, a reply. - Written to `suppression_list` immediately, across **all** channels (the "revoke-all" rule is delayed to Jan 2027, but honouring broadly costs nothing and is hard to regret). - `honored_at` must be set within **10 business days**; the upsert is instant, the SLA is the backstop. - A single shared suppression write is read by every channel — calls, SMS, email, and the AI. --- ## 8 · Keep a log you could hand to a regulator Per contact, we retain: consent basis and language, the number, the mode, whether the caller was identified, whether AI was disclosed, whether recording consent was asked and given, the local hour, the DNC result, the outcome, and the transcript or summary. That is exactly the `call_log` shape. **If we did it, it is written down.** This is the same audit discipline as the QC photo packet, applied to outreach. --- ## 9 · Penalties (why this is not pedantry) - TCPA statutory damages: **$500–$1,500 per call or text, no aggregate cap**, private right of action. Class actions are the real risk, not the FCC. - FTC Do Not Call: up to **$53,088 per violation**. - Texas SB140 / state mini-TCPAs: up to **$5,000 per violation**. - Washington CEMA: per-message private damages plus CPA exposure. - Washington RCW 9.73.030: a **criminal** offence for unlawful recording. A single careless AI cold-call campaign to our 50-partner list is a materially larger liability than the entire pilot's cash budget. --- ## 10 · The operating checklist **Before the first dial (W−8)** - [ ] Attorney review of scripts, consent language and the AI disclosure (VA + WA) - [ ] Written internal DNC policy; staff training recorded - [ ] National DNC access + scrub cadence documented (31 days) - [ ] `can_contact()` deployed and wired to **every** outbound path - [ ] Suppression write-back tested across all channels - [ ] AI disclosure line locked and non-configurable - [ ] Recording **disabled** by default; enable path requires spoken consent **Every day** - [ ] Scrub against DNC + internal before dialing - [ ] Dial only 8:00–21:00 local at the prospect's location - [ ] Identify Fixxo and the purpose in the opening - [ ] Log every call to `call_log`, every message to `message_log` - [ ] Honour opt-outs within one hour internally, ten business days formally **Never** - [ ] Never AI-voice a Washington number for solicitation - [ ] Never autodial a cell phone without a written consent record - [ ] Never record a Washington or California call without spoken all-party consent - [ ] Never text a cold number - [ ] Never dial a suppressed number "just this once" - [ ] Never buy a list and treat it as consented --- ## 11 · Sources FCC Declaratory Ruling **FCC 24-17** (8 Feb 2024, CG Docket 23-362) · FCC NPRM **FCC 24-84** (Aug 2024) · 47 U.S.C. § 227 · 47 C.F.R. § 64.1200 · FTC Telemarketing Sales Rule, 16 C.F.R. § 310 · National Do Not Call Registry rules · FCC revocation order (eff. 11 Apr 2025) · *Insurance Marketing Coalition Ltd. v. FCC* (11th Cir., 24 Jan 2025) · *Bradford v. Sovereign Pest Control of Texas* (5th Cir., 25 Feb 2026) · RCW 80.36.400 · RCW 19.190.060/.070 (CEMA) · RCW 9.73.030 · RCW 19.86 · WA E2SHB 1170 (2026, eff. 1 Feb 2027) · Texas SB 140 · Florida FTSA · California Pub. Util. Code § 2874 (AB 2905) · B.O.T. Act.