Compliance Guardrails & the Tool Stack

#1. Cold calling — the lowest-risk lane, if you follow it

• Call listed business lines, 8am–9pm local. B2B calls to a clearly-business number are generally exempt from the National Do-Not-Call registry.
• Watch for mobile numbers. Under the TCPA, a cell phone is treated as residential even when it's the number a business lists — and plenty of micro-businesses list a personal mobile as their only line. Manual-dial only, always — no autodialer, no AI or prerecorded voice — those require prior consent you don't have. If a number reads as personal, scrub it against the do-not-call registry or skip it.
• Keep a do-not-call log and honor any "don't call me" request immediately, not "next time." Real penalties attach here: $500–$1,500 per call, and up to roughly $50,000 per incident for a DNC violation.
• Check your own state's rules before assuming the general federal framework above is the whole picture — a handful of states run stricter "mini-TCPA" statutes than the federal baseline, and if you expand beyond your home state you inherit whichever set of rules is strictest for that call.

#2. Cold email — legal without prior consent, if you follow CAN-SPAM

• Honest "From" name and subject line — never disguise what the email is.
• A real physical mailing address in every single email.
• A working unsubscribe mechanism, honored within 10 business days — and honor it the moment it arrives, not at the deadline.
• Penalties run up to $53,088 per email that violates this. Keep volume low and genuinely personalized — it protects deliverability and compliance at the same time, not one at the expense of the other.

#3. SMS

Only text a business number after a call, or with explicit consent — never as a cold-open channel. Every text includes your name and an opt-out ("reply STOP"). Keep it short.

#4. The demo itself

Covered in full in the demo-as-bait mechanism lesson, and worth restating here because it's a compliance rule as much as a persuasion one: real business information plus clearly-labeled placeholders only. No fabricated reviews, logos, press mentions, or statistics — ever. Fabricated trust signals are an active enforcement target under the FTC's Consumer Review Rule, with per-violation penalties in the tens of thousands of dollars. Treat this as a bright line you never approach, not a risk you weigh case by case — the real business, honestly presented, is what sells; nothing here needs the fake version to work.

#5. The tool stack

You don't need most of this on day one. Buy up the stack only as volume actually demands it.

The all-in-one platform route (bundling CRM, dialer, site builder, booking, and reputation management in one tool) is genuinely useful — but buy it after you've closed a few deals by hand, not before. Module 6 covers exactly where that upgrade fits in the scaling sequence.