Industry regulator Ofcom produces regulations around what contact centres can and can't do when it comes to automatic dialling and CLI. On top of that sits the Privacy and Electronic Communications Regulations (PECR), enforced by the ICO. This covers consent, suppression against the TPS and CTPS registers, and fines for getting marketing calls wrong.

The regulations can be confusing, having undergone numerous iterations over many years. There is no single source of truth - there isn't even a complete version of all the regulations in one place. And as of 2026, the landscape has shifted again.

With that in mind, we've produced a no-nonsense guide to the current regulations surrounding the use of automatic calling equipment (ACS), updated to reflect the Data (Use and Access) Act 2025 (DUAA) changes now in force, the updated Ofcom CLI guidance applied from 29 January 2025, and the complaints provisions due to take effect from 19 June 2026.

It's important that you know these regulations, because neither Ofcom nor the ICO accept ignorance as a defence. And the penalties have changed significantly. The maximum PECR fine (which used to be capped at £500,000) is now £17.5 million or 4% of global annual turnover, whichever is higher. That's a 35-fold increase. Directors can also be held personally liable for serious breaches.

For reference:

  • ACS = Dialler software
  • Abandoned call = dropped call
  • Connect = Live call passed to an agent

The guide is split into two parts: the Ofcom rules that govern how you dial, and the ICO/PECR rules that govern who you can call and what it costs if you get it wrong.

Part 1: Ofcom rules for automated dialling

Silent calls

There are three main causes of silent calls:

  1. False positives
  2. Abandoned calls (with no message)
  3. Agents receiving calls and not speaking or being on mute, which is a reasonably significant cause.

Reference: Silent Calls (Page 4)

The 3% drop rate myth

In 2010 Ofcom said companies “should ensure their abandoned call rate is less than 3% of all live calls.”  

That seemed clear enough. If dropped (or abandoned) calls were less than 3% of your total, you were safe. Or so many of us thought.

But as it turned out, this was a misinterpretation. Ofcom has since clarified that 3% was meant as a measuring stick and the actual target is 0%. In other words, you can attract regulator scrutiny with any percentage of dropped calls.  

Despite Ofcom’s clarification, many people in the industry still think the 3% rule applies – and some even run their diallers with 3% in mind. We have even seen suppliers of dialler equipment advertise the 3% rule as compliant.  

It isn’t. This is why we developed our un-droppable algorithm, which helps contact centres stick to 0% dropped calls even in blended environments.

Reference – see Section A4.12

Drop call calculation

Knowing how to calculate the drop call rate accurately is essential if you want to remain compliant, and there are still quite a few systems that get it wrong. They either use the wrong formula or, knowingly or otherwise, add inbound and manual dial connects into the equation to artificially reduce the drop call rate.  

The correct formula is:

Drop rate = Drops/(Drops + Connects)

It’s worth checking Ofcom’s guidance (see Section A3.8) on calculating the drop call rate. It has examples with AMD both on and off.

15 second minimum ring time

This rule stipulates that you have to call a number for a minimum of 15s before disconnecting as a no answer.  

The rule was introduced to prevent the practice of “pinging”, whereby diallers would ring a number for 1 second to try and generate a missed call. The next day agents would dial all the numbers found to be “live”. You can imagine how annoying this was for customers.

The only contentious point around the 15s minimum ring revolves around preview calls, which are automated but in every other way are the same as a manual call. Manual calls are not restricted to the 15s minimum. Because of this, whether or not you need to adhere to the minimum ring time rule on preview calls is open to interpretation. The Ofcom wording is in Section A2.15.

Rotating CLI

Not long ago, there was a trend for calling line identification (CLI) calls to display local numbers. The system would present a Manchester number when calling a Manchester number, a Newcastle number when calling a Newcastle number, and so on.  

This was primarily done to increase connect rates, and it worked pretty well. It also rotated the numbers, so people didn’t recognise you.  

But because Ofcom and the ICO base complaints on the CLI, it was seen as a way of avoiding investigation because contact centres were presenting 150+ different numbers. So complaints to a single number were low, even when complaints about the call centre as a whole might have been very high.  

Ofcom acted, and carriers are no longer allowed to automatically rotate numbers, so the practice is vastly reduced. But you can still present different numbers if you have a valid reason. For example, a well-established car dealership with branches around the UK, but a central call centre, can present a local dealer’s number.

For more, see the Ofcom regulations, Section A1.20 – A1.23

Answer Machine Detection (AMD)

There’s a lot of controversy around AMD use. Ofcom now makes firms take false positive rates into consideration when calculating drop rates (though it has suggested it may drop this).  

This is because inadequate systems with poor AMD were causing silent calls on false positives. In other words, when the system thought a live person was an answering machine, no message played and the call was not passed to an agent (see below on leaving a message).  

But AMD use is not banned, and it can play an essential role in the productivity of contact centres. In fact, it can increase efficiency by 100% in some cases, but it must be used correctly.

For more, see Section 4.41 of the regulations.

Two second CPA rule

CPA stands for Call Progress Analysis and is part of the AMD function. Two seconds is the amount of time your CPA is given to determine whether the called party is an answering machine or a live person.  

Many providers say two seconds is not enough and, as a result, AMD can’t be used compliantly. They’re wrong. In our case, if we can’t determine whether the answered call is an answering machine or not, we pass the call through to an agent and play it safe.  

If your current system “holds” onto the call longer than two seconds you are non-compliant, which is why you often get recommended to turn AMD off rather than the vendor resolving the problem.

For more, see Section A2.19 of the regulations.

Leaving messages

In a silent call, someone answers the phone only to be met with silence from the other end. Needless to say, Ofcom is not in favour of silent calls.

It’s recommended that an answer phone message is left, so false positives would no longer result in silent calls. The problem here is the huge proliferation of answer phone messages, but Ofcom’s number one priority is to tackle silent calls. It all comes down to the contact centre: you have to make the choice.  

For more, see Section A1.6, A2.16

Drop call message

When dialling predictively you are calling more people than you have agents, which can occasionally result in dropped calls. Instead of silent calls, Ofcom insists a drop call message is played to the consumer. It also offers guidelines on what the message should and shouldn’t say.

For more, see Section A1.14 of the regulations.

False positive

In the context of AMD, a false positive occurs when the system detects an answer machine even though a person has answered the phone. This results in silent calls and complaints from consumers.  

The recommendation from Ofcom here is to play an answer machine message. Consumers will hang up, but at least they won’t experience a silent call that can be at best annoying and at worst frightening.  

See Section A1.6 – 1.8 of the regulations.

Call blocking from carriers

Carrier-level call blocking has moved from an emerging measure to an established part of Ofcom's approach to nuisance and silent calls, and it has intensified. What it means is that termination endpoint carriers such as EE, Vodafone, BT and O2 (Telefónica), can block you if they think you are making nuisance calls to their customers. This isn't the carrier you are using to make calls, it's the network the called party is on.

Carriers share a database of nuisance callers. If one blocks you, the others may follow.

This is an automated response to perceived nuisance calling, based on two main factors:

Connect rate or ASR (Answer Seizure Ratio). If your connect rate to Vodafone (for example) is low (i.e. people aren't answering the phone) then Vodafone will interpret this as people not wanting to talk to you.

ACD (Average call duration). Taking Vodafone again as an example, if call duration length is low Vodafone might view this as customers not wanting to speak to you. "Low" typically means less than 30 seconds. Leaving an answer machine message can help, as it increases the average call duration.

These factors will often result in an automatic calling block to Vodafone numbers from your CLI.

The only way to get around this is to change your number. You should also make a complaint to the termination carrier if you think they have blocked you by mistake, but be aware there is no formal appeals process, so prevention through disciplined call pacing, accurate targeting and message quality is a far better strategy than remediation.

What changed in January 2025

Ofcom's updated CLI guidance came into effect on 29 January 2025, closing a long-standing loophole that allowed scammers abroad to spoof UK numbers. Under the updated guidance, calls entering the UK from overseas that present a UK number as a Presentation Number must be blocked, with a limited number of legitimate exceptions (for example, UK mobile users genuinely roaming overseas).

For legitimate UK contact centres, the direct impact is small, but the indirect impact matters. Consumer trust in unknown numbers is at a historic low, carriers are more willing than ever to block, and the bar for what looks like "legitimate" dialling behaviour to a carrier algorithm keeps rising.

There is also a live Ofcom consultation (published July 2025) on extending blocking to calls from abroad that spoof UK mobile (+447) numbers. This is likely to land in 2026 and will tighten things further.

Unfortunately, as Ofcom makes clear, this blocking policy is actively encouraged:

  • Page 6 – Technical Measures (Ofcom forms Strategic Working Group)
  • Page 5 – Strategic Working Group (Ofcom confirms the SWG has blocked a large number of nuisance calls since its formation)
  • Page 4 – Formal Blocking Directions
  • A new focus on blocking

Automatic System Recalls

You are not allowed to call previous dropped calls within 72 hours, or answer machines the same day (note: not 24 hours), unless you can guarantee an operator is present. Preview or manual dialling is fine. This is one of the reasons MaxContact has mixed-mode dialling, which means we can automatically move records from “predictive” to “preview” and back again.

Drop Calls – Section A2.9

Harassment

What exactly “harassment” means is not clearly defined and is open to interpretation. The term “a reasonable amount” is often used, but it’s unclear what that means in practice.  

This needs Ofcom clarification. It can boil down to the nature of the calls. Debt collectors have a valid reason for calling but how much is too much? We have seen agreements in place between the FCA and some contact centres that allow X calls per day but no more than Y times per week, for example.

Maximum attempts to a user

Again, this is not defined in the regulations and needs clarification. Common sense should be applied, and the strategy modified in line with the nature of the call.

DNC list

Do you need an internal one? It's not in the Ofcom regulations, but it's good practice and operationally sensible. There does need to be a way for people to remove themselves from your calling lists, either by speaking to an agent or more commonly through self-service IVRs.

It's also worth being clear that the Telephone Preference Service (TPS) is the UK's official Do Not Call register for landlines and mobile numbers. If a number is registered with TPS, you are legally required under PECR to refrain from calling it for unsolicited sales and marketing purposes and this is not discretionary. Your internal DNC list and TPS suppression are separate obligations and both need to be in place. See Part 2 for the full PECR and TPS compliance picture.

The mention of DNC lists in the Ofcom regulations is in Section A1.25 here.

Part 2: ICO and PECR consent, suppression and fines

This is where things have changed the most. The rules on who you can call, and what evidence of consent you need, have been in place for years. But the financial consequences of getting them wrong are no longer what they were.

PECR fines explained

The Data (Use and Access) Act 2025 (DUAA) received Royal Assent on 19 June 2025, with key enforcement provisions coming into force on 5 February 2026. The headline change is the fine cap. Previously, the maximum PECR fine was £500,000. Under the DUAA, PECR fines are now aligned with UK GDPR: a maximum of £17.5 million or 4% of annual global turnover, whichever is higher. That's a 35-fold increase for calling TPS-registered numbers without consent, making automated marketing calls without consent, or failing to produce evidence of consent when the ICO asks.

Director personal liability also applies. Since 2018, the ICO has been able to issue personal fines directly to company directors for PECR breaches specifically to stop directors escaping penalties by dissolving firms and restarting under a new name. This is a board-level risk, not an operations one.

In September 2025, the ICO fined Home Improvement Marketing Ltd for instigating more than 2.4 million automated marketing calls without prior consent. The pattern is consistent: the ICO is fining fewer organisations but at higher individual values, and contact centres are over-represented. Making thousands of calls a day across multiple campaigns multiplies the opportunity for a TPS-registered number or a broken consent chain to slip through. Getting this right is now a commercial risk question, not a technical configuration one.

TPS compliance

If you are making unsolicited sales or marketing calls to UK consumers, you are required by law under PECR to screen against the Telephone Preference Service (TPS) the UK's central opt-out register for individuals, sole traders and partnerships who don't want to receive marketing calls. There is no threshold, no exemption for small volumes, and no grace period.

A few points that catch contact centres out in practice:

  • TPS applies at the point of the call, not the point of data purchase. "The data was TPS-screened when we bought it" is not compliant.
  • Consent overrides TPS. If someone has given valid, specific, evidenced consent to receive calls from you, you can call them even if they're on TPS. The burden of proof sits with you.
  • Screening means before the call, not after. You can't call to check whether someone is happy to be called - that call is the breach.

The ICO standard is that marketing lists must be screened at least every 28 days if the list is still being called. That's 28 days (four weeks) not "monthly". If you're still calling the same list, that's 13 screenings a year, not 12. Real-time screening via an API into the dialler is the strongest position to be in.

If your third-party data supplier says it screens against TPS, you're still responsible for confirming that it does. Spot-check the data, ask for screening logs, and ask what consent statement was presented at the point of data collection. If the answer is vague, you share responsibility for any breach.

See the TPS website and the ICO website for primary sources.

CTPS compliance

CTPS is the business-to-business equivalent of TPS. The Corporate Telephone Preference Service covers corporate subscribers. For example, limited companies, PLCs, LLPs, Scottish partnerships, government bodies, schools, colleges and charities, who have registered their objection to receiving unsolicited marketing calls.

If you're running B2B outbound, CTPS compliance is a legal requirement. The same PECR enforcement regime applies, which means the same £17.5m or 4% of turnover cap.

Two failure modes trip B2B contact centres up repeatedly. First, assuming B2B is exempt. It isn't. Second, screening against TPS but not CTPS; a B2B list screened only against TPS will still contain CTPS-registered numbers. If you're calling businesses, you need both.

Automated decision-making and AI in your dialler

This is a genuinely new area, and one that will matter more through 2026.

The DUAA makes it easier to deploy AI-driven processes in contact centres (automated lead scoring, AI-driven call routing, AI-assisted collections prioritisation, AI quality scoring) but introduces mandatory safeguards. If you're using AI to decide who gets called, in what order, or with what script, you now have specific obligations. Customers must be informed of significant automated decisions that affect them, must be able to challenge those decisions, and must be able to get a human to look at them. From 19 June 2026, they'll also have a new right to complain directly to you as the data controller.

In practice:

  • Map where AI is making decisions in your contact strategy
  • Document your lawful basis for each
  • Make sure there's a human-override route your agents and team leaders know how to action.

ICO guidance on ADM under the DUAA is expected through 2026.

MaxContact is your friend here. Our sophisticated customer engagement solution will keep dropped calls to an absolute minimum (in fact, close to zero), while helping you remain compliant.

The regulatory landscape for UK contact centres has shifted significantly, and it will keep shifting.

Download the UK Contact Centre Regulatory Guide 2025–2027 for a full breakdown of what Ofcom, the ICO, and the FCA now expect from your operation, and what the consequences look like if you get it wrong.