Skip to main content

Security and compliance

Rules by region

What changes when you call across a border.

What changes at a border

Finn doesn't change how it dials based on the destination country. It doesn't enforce calling hours, check national do-not-call registries, or add a recording notice. A deployment calls every number in its audience whenever it runs. Meeting each country's rules is your job, through how you build the audience, word the welcome message and schedule the deployment.

This page is a general overview, not legal advice. Before you run calls at volume in a new country, talk to a lawyer who knows its telemarketing rules.

Calling hours

Common limits, in the recipient's local time:

CountryTypical permitted windowRule
United States8:00 to 21:00TCPA and FTC Telemarketing Sales Rule. Some states are stricter.
India9:00 to 21:00TRAI, for commercial calls
Canada9:00 to 21:30 weekdays, 10:00 to 18:00 weekendsCRTC telemarketing rules

Finn doesn't apply these. To stay inside them, schedule deployments to start within the window and pause or stop them before it closes. If an audience spans time zones, split it by time zone into separate deployments. See outbound campaigns.

RegionGeneral positionRegistry to scrub against
United StatesAutomated or AI-voice marketing calls to mobiles generally need prior express written consent.National Do Not Call Registry, plus state lists
CanadaMarketing calls need consent, and the national list applies.National DNCL
EU and UKMarketing calls to consumers generally need prior consent. Other calls need a lawful basis under GDPR.Member-state and UK preference lists
IndiaCommercial calls are regulated by TRAI, including subscribers' do-not-disturb preferences.National Customer Preference Register
AustraliaMarketing calls are restricted, and the national register applies.Do Not Call Register

Scrub your list against the relevant registry before you upload it as an audience. Finn doesn't check any registry.

"Written consent" in the US can be an online form, provided its text says the person agrees to automated calls. A scraped number, a bought list without consent records, or a contact inferred from a profile doesn't count.

Recording disclosure

Several US states require everyone on a call to consent to recording, including California, Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Pennsylvania and Washington. Many countries have their own rules. The rule follows the person you call, not where your business is.

Finn doesn't add a recording notice. If you record, or a jurisdiction you call into requires a notice, put it in the Finn's welcome message. See recording consent.

India

Workspaces registered in India submit a compliance application under Settings → Compliance. Renting numbers is refused until the application is approved. See number capabilities.

An approved application lets you rent numbers. It doesn't cover your own obligations under TRAI's rules for commercial communication, such as registering as a telemarketer and respecting do-not-disturb preferences. Check those with your telecom adviser.

Data across borders

Your workspace's recordings and transcripts are stored in the region it was assigned at provisioning. That doesn't change the rules of the countries you call. See data residency.

What stays the same everywhere

  1. Hold a consent record before any marketing call. If you can't show how you got permission, don't call.
  2. Honor opt-outs quickly. Finn has no suppression list. Remove the number from every audience and keep it out of future uploads. A Yes/No post-call question such as opt_out makes requests easy to find in the CSV or webhook (analysis fields), but it doesn't stop calls on its own.
  3. Let the Finn say it's an AI when asked. Using an AI voice agent is generally legal. Denying it to someone who asks directly is not. Add a guardrail for honest disclosure. See guardrails.

For sector rules on top of these, see industry compliance. For what Finn covers, see compliance.