Regulatory Report: July 2026

July was an active month across nearly every layer of the compliance stack, from federal robocall rulemakings and a circuit split on text messages, to state legislation, debt collection trends, and time-sensitive customer alerts. Regulators, courts, and state attorneys general all moved at once, often in conflicting directions, which means compliance teams have several fast-developing threads to track heading into August. Below, Gryphon AI rounds up the month’s most consequential developments.

Reminders:

Texts Are Not “Calls,” Seventh Circuit Rules: A First for Any Federal Appeals Court

Track this case and the growing circuit split in our TCPA §227(c) SMS Tracker — By Circuit.

On July 14, the Seventh Circuit became the first federal appellate court to squarely hold that text messages are not “telephone calls” under TCPA Section 227(c)(5), the Do-Not-Call private right of action. In Steidinger v. Blackstone Medical Services (No. 25-2398), Judge Kirsch applied a textualist reading: in 1991, “telephone call” meant communication via sound, and texts don’t reproduce sound. The court also noted that the statute uses different terms deliberately, since “telephone solicitation” is defined elsewhere as covering “a call or message,” Congress’s narrower “call” language in (c)(5) was presumably intentional.

The court also set aside Campbell-Ewald, an earlier case plaintiffs leaned on, noting it never actually settled whether texts count as calls, since nobody had argued the point. And it declined to follow the Ninth Circuit’s opposite ruling in Howard v. RNC from earlier this year, since that case dealt with a different part of the law. As for the FCC’s own view that texts should count as calls, the court said it didn’t owe the agency any deference, since a recent Supreme Court case, McLaughlin Chiropractic, allows judges to decide these questions on their own now.

Result: businesses in Illinois, Indiana, and Wisconsin can no longer be sued under this specific TCPA provision just for sending unwanted marketing texts, but that’s not the whole story nationally. The Ninth Circuit had already ruled the opposite way, so now there’s a real disagreement between courts on this exact question. And it’s not just theoretical: one day before the Seventh Circuit’s ruling, a court in Washington state, in Hopkins v. HomeLight, went the other direction entirely, letting a similar case move forward. Don’t be surprised if the Supreme Court eventually has to settle this.

Compliance takeaway: this narrows one lane, not the whole highway. Section 227(b) claims, FCC enforcement, and state mini-TCPAs still fully apply. See additional case analysis and ongoing text-message coverage for the latest filings.

ECAC Responds to FCC’s “Onshoring” NPRM with Comments and Survey Data

The Enterprise Communications Advocacy Coalition (ECAC) is pushing back on the Federal Communications Commission’s (FCC) call center “onshoring” proposal (CG Docket Nos. 26-52, 17-59, 02-278, 22-2) with what appears to be the only submission in the docket grounded in independently commissioned survey data, rather than the anecdotal member citations offered elsewhere in the record.

ECAC’s engagement on this NPRM spans several filings:

• An initial March 19 ex parte notice raised early concerns: wait times, English-testing standards, and the treatment of native-English-speaking countries like Ireland and South Africa, without submitting written data.
• ECAC’s May 26 comments then laid out the legal groundwork, arguing the NPRM exceeds the FCC’s statutory authority under the TCPA and Communications Act Section 201 and is arbitrary and capricious for relying on geography as a proxy for service quality without evidence linking location to consumer harm.
• ECAC’s June 22 reply comments built on that argument with data: CMP Research’s 2026 Future of Outsourcing Survey, a Q1 2026 poll of 200 enterprise customer-contact and CX executives, and cited supporting reply comments from R.E.A.C.H. (Responsible Enterprises Against Consumer Harassment) and the Ad Hoc Telecom Users Committee, both of which separately argued offshore operations are well-run and operationally necessary.
• On July 13, ECAC founding members Stuart Discount and Bob Kobek, along with counsel, met with FCC staff to reiterate those points. A July 15 ex parte notice documenting that meeting distributed the survey again as a leave-behind.

The topline numbers:

• 42% of frontline customer contact is outsourced today, projected to hit 51% by 2027 and 57% by 2029.
• Satisfaction runs high: 89% are satisfied with their current BPO, and 84% with its global-coverage capability.
• A follow-up Q2 CMP exhibit added that agents with above-average tenure post a 75.5% CSAT score versus 65.9% for below-average tenure, a 9.6-point gap ECAC says tracks experience, not geography.

ECAC’s core argument is that the NPRM assumes offshore service means worse quality, higher fraud risk, and weaker data security, but the record doesn’t back that up. It points to countries like Ireland and South Africa as native-English-speaking hubs, argues mandatory transfer rights could actually hurt multilingual consumers, and notes standard frameworks (PCI-DSS, SOC, ISO 27001, GDPR) protect data regardless of agent location. ECAC also flagged that stricter onshoring rules might push companies toward AI automation rather than U.S. hiring.

By contrast, other filers largely lean on single-company anecdotes: CTIA’s reply comments cite an SCIC member with 90 million-plus customers reporting higher offshore satisfaction scores, and a USTelecom member reporting an all-time-high NPS from its offshore operations. The U.S. Chamber of Commerce cites one member’s cost estimate running into the billions. ECAC’s data remains the only survey-based evidence in the record.

Industry and 49 State AGs Clash Over FCC’s Robocall Numbering Crackdown

Three reply comments landed on the FCC’s docket on the very same day, July 7, 2026, in its numbering rulemaking (FCC 26-17, WC Docket No. 26-49 et al., adopted March 26), revealing a sharp split between state enforcers and industry over how far the agency should go in restricting access to phone numbers to fight robocalls.

Scammers increasingly rely on legitimate phone numbers to make illegal robocalls and text scams appear trustworthy, according to a bipartisan coalition of 49 state and territory attorneys general (announced on LinkedIn), led by Colorado, New Jersey, North Carolina, Ohio, and Pennsylvania, in their July 7 filing. The coalition pushed the FCC to go further than its own proposal: broaden the definition of “telephone number reseller,” ban the resale of standalone numbers not tied to a communications service, and prohibit number cycling outright. The AGs cited a scale problem: Americans received roughly 29.6 billion scam robocalls and texts last year, losing nearly $2 billion, and one case where a single phone company carried 17.3 million calls in a day, largely on numbers used no more than twice. On the single-level resale question specifically, the AGs’ letter states they’d favor the restriction because it would ease tracing calls back through multiple resale hops.

Industry filed its own reply comments that same day, pushing back hard. Incompas told the FCC, also on July 7, that the agency doesn’t need new origination-side tools at all. It should instead force terminating providers to actually use the Rich Call Data/STIR-SHAKEN framework already in place, calling a single-level resale cap disruptive to “procompetitive wholesale arrangements” while doing “little to curb illegal robocalling.”

USTelecom’s reply comments, the third of the three July 7 filings, went further on legal grounds, arguing the FCC likely lacks authority to impose a single-level resale cap at all, citing the Communications Act’s anti-discrimination provisions on resale and noting neither the TRACED Act nor the TCPA independently authorizes it. USTelecom also opposed a blanket number-cycling ban, arguing cycling has legitimate uses and enforcement should target abusive end users, not provisioning carriers, and proposed number tracing as an alternative, while urging the FCC to keep numbering authority away from state PUCs entirely.

Worth distinguishing: this reply-comment letter is a separate track from the AG coalition’s ongoing “Operation Robocall Roundup” enforcement campaign, which has sent warning letters to voice providers directly (37 smaller providers in Phase 1, then four major carriers, Intelliquent, Bandwidth, Lumen, and Peerless, in Phase 2). This is not a “Phase 3.” It’s the same broader coalition following up on a request it first made to the FCC back in 2021, now that an actual proposed rule is open for comment.

State Watch: NYC Delay, PA’s New Mini-TCPA, and Bills to Track in NC and CO

New York City: The SHIELD debt collection rule, finalized in February and set to take effect September 1, has been pushed to January 1, 2027.

• The rule caps consumer contact at three communications per week across channels.
• It lets consumers dispute debts at any point, not just the FDCPA’s 30-day window.
• It gives collectors 60 days to verify or issue a Notice of Unverified Debt.
• It’s enforced by DCWP administratively, with no private right of action.

Pennsylvania: Governor Shapiro signed SB 992 on July 20, 2026, now Act No. 47 of 2026, after passing both chambers unanimously (Senate 50-0, House 202-0) on July 12. It amends the 1996 Telemarketer Registration Act, effective October 18, 2026 (90 days after signing).

Per the signed bill text, “telephone solicitation” now expressly covers calls, voicemails, ringless voicemails, and texts. The law adds:

• A formal “prior express written consent” definition: a signed agreement (electronic signatures allowed) identifying the phone number, disclosing that consent isn’t a condition of purchase, and stating the subscriber agrees to receive solicitations, including robocalls or texts.
• A ban on solicitations on Sundays or before 9 a.m./after 7 p.m. other days, and a separate prohibition on robocalls without that written consent, unless exempt.
• For texts specifically, consumers can opt out simply by replying STOP, QUIT, END, REVOKE, OPT OUT, CANCEL, or UNSUBSCRIBE.
• A bar on synthetic or computer-generated messaging meant to defraud or deceive, and a prohibition on falsifying a telemarketer’s name or number to a recipient.

The consent safe harbor holds:

• Solicitations tied to an existing debt/contract, made with prior written consent, or covered by an established business relationship (past 12 months) fall outside the “telephone solicitation” definition.
• Robocalls also require an immediate in-call opt-out mechanism, available within two seconds of the caller’s disclosure, that can’t condition opting out on written consent.
• Exemptions also include tax-exempt 501(c)(3)/(5)/(8) organizations and political candidates/parties.

North Carolina: House Bill 936, “Robocall Solicitation Modifications,” remains pending in the Senate (currently in Judiciary as of a June 17 Senate floor amendment). It would:

• extend existing telephone-solicitation rules to robocalls, texts, and messaging apps;
• require prior express written consent;
• ban government-official impersonation; and
• allow per-violation penalties within a single call.

A June 3 Senate committee substitute pushed the bill’s effective date from October 1, 2025 to October 1, 2026. This is worth watching since the bill hasn’t reached the floor yet.

Colorado: SB26-174, prohibiting lead-generation marketing for legal services, was signed June 3 and is now law. It makes paying for legal-services leads a deceptive trade practice enforceable under the Colorado Consumer Protection Act, with both civil and criminal exposure, unless the marketer is a licensed attorney, working directly for one, or a nonprofit legal services provider.

Separately, the Public Utilities Commission (PUC) has moved to implement HB26-1326 (the PUC Sunset Bill), which raised the statutory cap on No-Call List registration fees. A Notice of Proposed Rulemaking (NOPR) filed July 15 proposes:

• doubling the maximum annual fee from $500 to $1,000 for telemarketers with more than 1,000 employees;
• creating a new $250 annual fee for “conforming list brokers,” a category not previously charged; and
• keeping smaller telemarketers (fewer than five employees) and nonprofits exempt.

The was published in the Colorado Register on July 25, with a hearing set for October 1, 2026; initial comments are due August 28, with reply comments September 18. This is a proposed rule, not yet final. The fee increase isn’t locked in until the Commission acts after the hearing.

FCC’s Robocall Compliance Stack: KYC, KYUP, and Now RMD

The Federal Communications Commission’s (FCC) enhanced Know-Your-Customer (KYC) rulemaking for originating voice providers, adopted April 30, 2026, is drawing a sharp divide in the comment record.

KYC: A coalition led by the American Bankers Association, Bank Policy Institute, and other financial trades filed in support of stronger KYC requirements, citing nearly $200 billion in 2024 fraud and scam losses and arguing the financial sector already spends billions annually fighting it.

On the other side, the Consumer Access & Choice Coalition urged the FCC to adopt a flexible, risk-based framework rather than uniform identity-verification, data-retention, and per-call-forfeiture rules, warning the proposal could disproportionately burden small, consumer-focused providers without meaningfully reducing robocall abuse. Reply comments on the KYC FNPRM are due July 27, 2026.

KYUP: The KYC proceeding isn’t standing alone. A Mintz analysis notes the FCC’s related Know-Your-Upstream-Provider (KYUP) Further Notice, adopted in May 2026, would require providers to verify upstream providers’ Robocall Mitigation Database (RMD) status, robocall mitigation plans, and STIR/SHAKEN tokens, part of a broader strategy to push accountability further up the call path rather than targeting only the callers themselves. Womble Bond Dickinson reads the KYUP FNPRM as a shift from flexible, principles-based expectations to a prescriptive regime, one that would expand obligations to cover all illegal calls, not just high-volume robocall traffic, and make continuous monitoring a baseline expectation rather than a best practice.

RMD Gets Its Own FNPRM

The FCC added a third front in its July 22, 2026 open meeting: the Commission unanimously adopted, with editorial privileges, a Further Notice of Proposed Rulemaking (FNPRM) on the RMD, proposing measures to ensure only legitimate, transparent, and accountable providers gain or maintain access to the database, and tying RMD filings more directly to the FCC’s KYC and KYUP frameworks. ABA had urged support for the RMD proposal ahead of the vote, pressing the FCC to also speed up removal of bad-actor providers from the database.

Additionally, in a July 16 ex parte meeting with FCC staff, Numeracle argued the RMD’s roughly 11,000 filings are largely unverified self-assertions, and demonstrated an analytics tool that cross-references filing data to expose shared addresses, phones, and other links between carriers, the kind of scalable verification the current “six separate credentialing chokepoints” (from FCC Registration Number (FRN) to Service Provider Code (SPC) token) don’t provide.

Quick Takes

FTC Loses Its Independence Shield

Per a Law360 analysis, the Supreme Court ruled on June 29, 2026 in Trump v. Slaughter that Federal Trade Commission (FTC) commissioners no longer have for-cause removal protection, overturning the 90-year-old Humphrey’s Executor precedent and placing the agency under direct presidential removal authority (the Federal Reserve Board was carved out separately).

• The FTC and DOJ’s Antitrust Division now look a lot more alike legally, which is breathing new life into the idea of merging FTC antitrust work into DOJ (the long-pending One Agency Act).
• Expect more legal challenges to FTC enforcement actions, since it’s now less clear the agency can bring suits without more direct White House control.
• Legal experts don’t agree on what this means day to day. Some think it weakens the FTC’s independence in a real way. Others see it as just tightening up how separation of powers works. Either way, it raises bigger questions about how the FTC should be structured, questions Congress may eventually have to sort out.

Foreign Robocall Elimination Act Picks Up Steam

H.R. 6152, introduced November 19, 2025 by Rep. Addison McDowell (R-NC), added three cosponsors on July 21, 2026 (Reps. Dunn, Harrigan, and Kean), bringing its total to 24, split 15 Republican and 9 Democratic. The bill remains in the House Energy and Commerce Committee, with no floor action yet.

• The bill would direct the Federal Communications Commission (FCC) to stand up a 15-member interagency and industry taskforce, within 270 days of enactment, to study foreign-originated unlawful robocalls and report to Congress within 360 days of formation.
• It would also let the FCC require certain voice providers to post a bond of up to $100,000 before certifying with the Robocall Mitigation Database, if the FCC finds it necessary. Established, compliant providers would be exempt.
• It would grant the industry-run Traceback Consortium immunity from lawsuits over sharing traceback data and let the FCC or Consortium publish a list of providers that refuse to cooperate or are tied to substantial unlawful robocall traffic.

FCC Moves to Cut Off Telecom Over Fake Numbering Authorization

The FCC’s Enforcement Bureau issued a show-cause order on June 11, 2026 against Mexico IP, accusing the company of filing a fake FCC document to gain direct access to U.S. phone numbers. The same order proposed expedited mandatory call blocking against the company, and the company had 10 days to respond or lose its Robocall Mitigation Database certification.

Update: no final order has surfaced confirming whether Mexico IP responded, was removed from the database, or had call blocking imposed. The case did resurface, though, in the FCC’s July 1, 2026 Further Notice of Proposed Rulemaking, which cited the Mexico IP show-cause order as precedent while proposing a new rule that would give the FCC a more direct basis to remove providers who submit false information to the FCC or NANPA.

Google Targets Caller ID Spoofing on Android

Google confirmed on May 13, 2026 it was building a new anti-spoofing feature for Android, framed against a reported $980 million in annual global losses to spoofing-enabled scams, and launched it before the end of June as previewed by Techopedia. The feature uses an encrypted RCS “handshake” to silently verify a call was genuinely placed by a saved contact, surfacing a warning if the signal didn’t check out.

• ACA International, the debt collection industry’s trade association, covered the launch directly on June 8, 2026, confirming it reached the ARM industry’s own channels, not just consumer tech press.
• The tool only verifies calls between two Phone by Google users with RCS and saved contacts, so it doesn’t restrict outbound calls to unknown numbers today. Worth watching if similar verification expands to unsaved numbers or gets adopted more broadly by carriers, since that could affect answer rates for compliant callers using accurate caller ID.

PA Moves to Ban Text-Based Toll Collection

Since April 2024, scam texts impersonating the PA Turnpike over unpaid tolls had circulated statewide, so the agency had long told residents it never texts about tolls. Rep. Mary Isaacson’s bill, House Bill 2551, responded by proposing to bar every state agency, including the Turnpike Commission, from using text messages to collect or notify residents about unpaid fines, fees, or tolls, unless the resident opted in. It passed the PA House unanimously, 202-0, on June 23, 2026, and is now pending in the Senate Communications & Technology Committee.

The Turnpike Commission didn’t wait for the bill: it voluntarily halted its own pilot texting program on June 9, 2026, with a spokesperson saying it couldn’t yet “clearly distinguish ourselves from scammers.” Worth pausing on that too: an agency abandoned a live collection tool not because a court or regulator forced it to, but because the optics of a still-pending bill made the channel itself too risky to keep using.

TCPA and FCRA Class Claims Are Getting Certified at a 100% Clip, So Far in 2026

Per Duane Morris’s mid-year class certification review, of the class action certification rulings courts issued in the first half of 2026, FCRA and TCPA were both granted 100% in each category.

• So far in 2026, courts have been granting fewer class action certification motions overall compared to 2025.
• The gap between filing and a certification ruling under the standard Rule 23 process, which governs TCPA and FCRA cases alike, tends to run long. Given that lag, a class action filed today will rarely be reported as certified within the same reporting period, and often not even within the same year.

Collections Corner

Debt Collection: AccountsRecovery.net’s Digital Communications Pulse Report

AccountsRecovery.net’s Digital Communications Pulse Report (fielded February to April 2026) found the ARM industry averaged 7.4 of 10 on optimism.

• 75% expect placement volume to rise over six months; only 24% expect collection rates to keep pace.
• SMS ranked the top engagement channel, landing in respondents’ top three 77% of the time.
• Just 21% used automated or AI-driven channel selection; 36% cited technology integration as their biggest barrier.

More Accounts, Harder to Reach:

Debt Collection Lawsuits Keep Climbing, and States Are Responding

A Pew Charitable Trusts analysis published July 16, 2026 found debt collection filings kept rising through 2025 as consumer debt hit record highs. See Pew’s interactive state-by-state filing trends figure in the source article for the full picture.

• Utah was on track to surpass its post-2008-recession peak; Alabama already hit its highest level on record.
• Debt buyer LVNV Funding accounted for 23% of all 2025 filings across states with available data.
• Virginia and Washington passed 2026 laws requiring supporting documentation before judgment; Virginia became the 14th state to shield $1,000 from garnishment automatically.

CFPB Regulatory Agenda and Reform Act Signal a Lighter Touch Ahead, Compliance Stays As-Is

The CFPB released its 2026 regulatory agenda on July 6, 2026, dominated by mortgage-related items aimed at reducing compliance costs.

• A final rule streamlining mortgage servicing is anticipated as early as August 2026.
• Separately, House Financial Services Chairman French Hill unveiled the CFPB Reform Act of 2026 during Acting Director Vought’s testimony.
• The draft would move the Bureau to congressional appropriations and raise the large institution threshold from $10 billion to $21 billion in assets.
• Nothing here is final. Current mortgage servicing, ATR/QM, and UDAAP rules stay in force until replaced, and the reform bill is still a draft.
• Earlier predictions that the FTC would backfill CFPB enforcement haven’t materialized; the FTC has no jurisdiction over national banks, member banks, or federal credit unions, a structural carve-out unaffected by 2026 developments. Instead, state AGs and regulators are filling the gap, including California’s new BCSA launched July 1, 2026 under former CFPB Director Rohit Chopra.

CFPB Workforce Fight Grinds On as a New Director Awaits Confirmation

The D.C. Circuit declined on June 21, 2026 to let the administration immediately lay off roughly half the CFPB’s workforce, sending the matter back to the district court.

• On July 10, 2026, the court paused litigation entirely, leaving staffing in place until nominee Brian Johnson’s confirmation.
• Johnson, a Capital One VP and former CFPB deputy director, pledged a two-year Capital One recusal if confirmed.

Bank Regulators Tie Immigration Status to Lending and AML Risk

The CFPB and other federal regulators issued guidance on June 5, 2026 addressing how immigration status intersects with lending and financial crime compliance.

• The CFPB said ability-to-repay rules may require weighing whether immigration status could disrupt a borrower’s future income.
• FinCEN flagged red-flag patterns tied to unauthorized employment for banks to monitor.
• This followed the CFPB’s January 2026 withdrawal of a statement discouraging immigration-status considerations; advocates called the shift a debanking risk.

CFPB Overhauled Its Consumer Complaint Portal Amid Record Volume

The CFPB overhauled its consumer complaint portal on June 24, 2026, citing abuse tied to credit reporting complaints, which grew from about 150,000 in 2019 to over 5 million in 2025.

• Credit reporting made up 88% of all complaints filed; the CFPB attributed much of the rise to credit repair firms and influencers.
• The portal now requires two-factor authentication at sign-up, verifying both email and phone number instead of email alone, and consumers must exhaust disputes with the credit reporting agency before filing with the CFPB.
• Consumer group NCLC argued the changes create new barriers for legitimate disputes.

August 2026 Holiday Solicitation Bans

Please be aware of the following U.S. holiday telephone solicitation bans for the month of August 2026:

• On August 10th, 2026, Rhode Island prohibits unsolicited sales and marketing calls to residents in observance of Victory Day.

Other holidays may be proclaimed by the Governor in each state throughout the year.

Please be aware of the following Canadian holiday telephone solicitation bans for the month of August 2026:

• On August 3rd, 2026, unsolicited sales and marketing calls to residents of British Columbia (“British Columbia Day”), Manitoba (“Terry Fox Day”), New Brunswick (“New Brunswick Day”), Saskatchewan (“Saskatchewan Day”), Northwest Territories (“Civic Day”), and Nunavut (“Civic Day”) are prohibited.
• On August 17th, 2026, unsolicited sales and marketing calls to residents of the territory of Yukon are prohibited in observance of Discovery Day.

Gryphon AI has updated its existing service parameters to reflect these solicitation bans.

Customer Alert: NY State of Emergency Issued Through August 16, 2026

Consistent with prior communications, Executive Orders declaring disaster emergencies in the State of New York trigger telemarketing restrictions under the Nuisance Call Act.

The Nuisance Call Act makes it unlawful for any telemarketer to make unsolicited telemarketing sales calls to areas of the state under an emergency declaration.

Executive Order 47.20 declaring a State Disaster Emergency in the State of New York, ordering into active service the New York National Guard to assist authorities in guaranteeing public order (correctional facilities), is in effect through August 16, 2026.

Gryphon AI has extended State of Emergency blocks for New York to August 16, 2026, to ensure compliance with the above Executive Orders.

About Gryphon AI

Taken together, July’s developments point to a compliance landscape moving on multiple fronts at once: federal agencies tightening numbering and upstream-provider oversight even as courts narrow certain private rights of action, and states stepping in with their own telemarketing and debt collection rules regardless of what happens in Washington. Compliance leaders should watch the widening circuit split on texts versus calls, the FCC’s KYC/KYUP/RMD stack as reply comments come due, and the growing patchwork of state mini-TCPAs and debt collection rules taking effect through early 2027.

Staying updated with the latest regulatory changes is crucial for any enterprise aiming to minimize risk and maximize reach. 

With Gryphon AI, enterprises can stay ahead of the regulatory curve and efficiently manage all regulatory changes, ensuring seamless compliance and operational excellence.

To learn more about how Gryphon AI can help you manage these updates, reach out to us today. 

This blog is provided for general informational and marketing purposes only and does not constitute legal advice. The information may reflect an interpretation of applicable laws and regulations as of the publication date and may not reflect subsequent changes. Laws and regulations vary by jurisdiction, and this content may not apply to your specific circumstances. Nothing in this blog should be relied upon as a substitute for legal advice, and we disclaim any liability for actions taken based on the content provided. Please consult qualified legal counsel for advice specific to your situation.