TCPA

Voice and SMS are where a CRM most easily creates legal exposure, so Pact enforces TCPA controls in code, on the send path, rather than leaving them to operator discipline. Every outbound dial routes through a single pre-dial gate, and every outbound text carries brand identification and an opt-out mechanism that writes straight to the suppression list.

The pre-dial gate

core/voice_compliance/enforcement.py exposes pre_dial_check(...), the single entry point every outbound dial path (campaign engine and click-to-call alike) passes through. It runs two hard checks in order and returns a machine-readable block reason so the UI can distinguish, e.g., "TCPA: missing consent" from "DNC: national registry":

The result is a discriminated dataclass — allowed=True, or a ComplianceBlock carrying reason, detail, and the source table (suppression_entries vs consent_records).

The calling-window is enforced upstream

TCPA's time-of-day restriction is enforced by the campaign engine (core/voice_campaigns/engine.py), not by pre_dial_check. A target reached outside the window is deferred to the next window open rather than skipped — so no legitimate contact is dropped, they're just held until it's legal to dial.

The window is evaluated in the called party's local timezone, which is what 47 CFR 64.1200(c)(1) actually requires. The rules, all in core/voice_campaigns/tcpa.py:

• The statutory window is 08:00–21:00 local. A campaign may narrow it (e.g. 10:00–16:00 weekdays); effective_window clamps any attempt to widen it back to 8am–9pm, so no config row — hand-edited or otherwise — can authorize an illegal dial.
• Each target's zone is resolved from its phone number's NANP area code at enqueue time and stored on voice_campaign_targets.timezone. The NPA→IANA map covers the US, Canada, and Puerto Rico / USVI.
• An unresolvable zone refuses to dial. A non-NANP number on a campaign with no explicit business_hours.tz is failed with skipped_unknown_timezone rather than guessed into a US zone. enqueue returns unresolved_timezone so the operator sees the count up front; setting business_hours.tz on the campaign is the documented fix.
• A campaign-level tz is an override, not the default. It applies only where a target has no resolved zone of its own.

Daily pacing caps

Independently of the window, each campaign carries two per-day ceilings, counted over the target's local day (not a UTC day that rolls over mid-afternoon on the west coast):

• config.daily_call_cap — maximum dials per day. 0 disables it.
• config.daily_budget_cents — maximum spend per day. Defaults to $5.00, the demo cap; override per campaign, or globally via VOICE_CAMPAIGN_DAILY_BUDGET_CENTS.

Tripping either holds the target until the next local midnight and records a daily_cap_stop / daily_budget_stop run. The campaign stays active — this is pacing, not failure. The lifetime budget_cents cap is separate and does pause the campaign.

Do-Not-Call lists

Tenants register DNC lists through /v1/admin/voice-compliance/dnc-lists (providers: national_ftc, state_registry, custom). Each list tracks its sync status and entry count; a number on an enabled, synced list is treated as a hard suppression and fails the first stage of the pre-dial gate.

SMS: brand ID, STOP, and suppression

core/sms/compliance.py encodes the CTIA/TCPA text rules:

• Brand prefix — prepare_message prepends the tenant name so recipients know who is texting.
• Opt-out footer — an opt-out instruction is appended per CTIA guidelines.
• STOP keywords — STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, QUIT are recognized. A received STOP writes a hard suppression_entries row (channel='sms', reason='stop', source='twilio_stop').
• Pre-send check — is_opted_out is consulted before every send, so a suppressed number is never texted again.

Consumer phone onboarding (core/phone_enrollment.py) captures un-pre-checked, versioned consent: Pact refuses to SMS a number without an explicit opt-in in the same request, and the durable consent record is written only after the code is verified — proving the user controls the number. The consent grant is append-only and survives phone removal for TCPA proof retention.

What's next