VICIdial TCPA Compliance: Settings, Risks, and Gaps

Written by: Matt Beucler, CEO, Plura AI

Key Takeaways

• VICIdial gives you core dialing controls, but you still configure TCPA-related settings yourself for abandoned call rates, timezone rules, DNC handling, and consent tracking.
• The 3% abandoned call rule is the main predictive dialing risk. Set adaptive_dropped_percentage to 2.0–2.5% and use ADAPT_HARD_LIMIT to keep a margin below the FCC ceiling.
• Timezone and safe-hours issues usually start with inaccurate gmt_offset_now values. Postal code-based timezone detection and buffered call times such as 8:05 AM–8:55 PM reduce the risk of calls outside the 8 AM–9 PM local window.
• VICIdial’s internal DNC lists do not scrub against the National DNC Registry or the Reassigned Numbers Database, so teams still run external scrubs every 31 days and manage consent records through custom lead fields or a CRM.
• Plura AI provides the enforcement layer VICIdial leaves to you: real-time DNC scrubbing, tamper-proof consent logs, and carrier-level STIR/SHAKEN signing. See how Plura’s AI Predictive Dialer handles carrier-level signing.

VICIdial Abandoned Call Rate TCPA: When Predictive Pacing Outruns Your Agents

Abandoned call exposure usually shows up first in your VICIdial stats. Drop rate climbs above 3%, agents sit idle between calls, and DROP dispositions stack up in the real-time report.

Symptom: Drop rate above 3% in campaign stats, idle agents, and growing DROP dispositions in the real-time report.

Root Cause in VICIdial: The interaction between auto_dial_level and the drop percentage limit drives this behavior. When dial_method uses an adaptive mode (ADAPT_TAPERED, ADAPT_AVERAGE, or ADAPT_HARD_LIMIT), auto_dial_level becomes the maximum level the system can reach. VICIdial then adjusts the actual dial level between 1.0 and that maximum based on five inputs: current drop rate percentage, average agent wait time, average talk time, number of available agents, and the adaptive_intensity modifier.

Settings and Data Fields: auto_dial_level, adaptive_dropped_percentage, adaptive_maximum_level, drop_rate_group, adaptive_intensity, adaptive_dl_diff_target, available_only_ratio_tally, and DROP dispositions in campaign stats.

Compliant Fix: The FCC’s predictive-dialer abandonment rule, codified at 47 C.F.R. § 64.1200(a)(7) and finalized in FCC 03-153, caps abandoned calls at 3% of all calls answered by a live person, measured per campaign over a rolling 30-day period.² Targeting that ceiling directly creates unnecessary risk, because a single bad afternoon can push a campaign over the limit. Set adaptive_dropped_percentage to 2.0–2.5% so the campaign can absorb short-term spikes. The measurement window matters as well, so set drop_rate_group to CAMPAIGN_ONLY and keep each campaign in its own window. For strict pacing, use ADAPT_HARD_LIMIT, which keeps the drop rate under the configured threshold. When the rate climbs, read DROP dispositions in the real-time report: a sudden spike usually points to too many agents pausing at once, a dial level set too high for the available staff, or a carrier delivery spike that connects a batch of calls together.

See how Plura’s per-minute rates compare to your current dialer spend.

Timezone and Safe-Hours Failures: When gmt_offset_now Goes Wrong

Drop rate is often the first control teams tune. The next exposure is timing, because even a campaign with no abandoned calls can create TCPA risk if it dials at the wrong hour.

Symptom: Calls placed outside the 8:00 AM–9:00 PM calling window, Central time leads reached at 7:00 AM local, and DST transition days with spikes in early or late calls.

Root Cause in VICIdial: The gmt_offset_now field in vicidial_list holds each lead’s current GMT offset, including DST adjustment. The AST_VDhopper.pl script updates this value, and the hopper uses it for time filtering. If gmt_offset_now is wrong, leads are dialed at the wrong time regardless of call_time settings. Area-code-only timezone lookup struggles with number portability, so a consumer with a 212 number who moved to Phoenix may sit in Mountain Standard Time year-round, not Eastern.

Settings and Data Fields: gmt_offset_now, vicidial_postal_codes table (postal_code, state, GMT_offset, DST, DST_range), campaign Local Call Time, state_call_time, and Use Campaign Timezone set to TZCODE.

Compliant Fix: FCC rules at 47 C.F.R. § 64.1200 prohibit telephone solicitations before 8:00 AM or after 9:00 PM in the called party’s local time zone, implementing the Telephone Consumer Protection Act (TCPA) at 47 U.S.C. § 227.² State rules can be stricter: Washington’s Commercial Telephone Solicitation law (RCW 19.158.040(2)) restricts calls to 8:00 AM–8:00 PM local time, and Texas permits telemarketing calls from 9:00 AM–9:00 PM Monday through Saturday and noon–9:00 PM on Sundays under Tex. Bus. & Com. Code § 301.051(b)(2). Start with Use Campaign Timezone set to TZCODE, which uses postal code for more accurate timezone detection. For states with stricter windows, configure state_call_time overrides; VICIdial evaluates both call_time and state_call_time and applies the more restrictive rule. Buffers form the final layer, so set call times such as 8:05 AM–8:55 PM instead of 8:00 AM–9:00 PM to protect against DST shifts and clock skew. After each DST transition, restart the hopper script to force a timezone recalculation.

VICIdial DNC Compliance: What the Internal List Does Not Do

DNC exposure often appears as cross-campaign leakage. Opt-outs from one campaign still receive calls from another, National DNC numbers show up in dial lists, and reassigned numbers receive calls meant for the prior subscriber.

Symptom: Company-level opt-outs continue to receive calls, National DNC numbers appear in lists, and reassigned numbers get dialed.

Root Cause in VICIdial: VICIdial’s internal DNC list applies across all campaigns, while campaign DNC lists handle campaign-level opt-outs. VICIdial does not natively integrate with the FTC’s National Do Not Call Registry in real time, so operators scrub lists externally before import and re-scrub every 31 days, which is the maximum interval allowed by law. The FCC Reassigned Numbers Database (RND) also sits outside the platform and requires separate queries.

Settings and Data Fields: Use Internal DNC List, Use Campaign DNC List, campaign DNC list fields, and the vicidial_dnc table.

Compliant Fix: Enable both Use Internal DNC List and Use Campaign DNC List in the Campaign Detail DNC/Filtering section. The internal list handles company-wide opt-outs, and campaign lists handle campaign-specific requests. Under 47 C.F.R. § 64.1200(l), callers query the Reassigned Numbers Database (RND) before placing autodialed or prerecorded calls to reduce calls to consumers who have not given consent. The RND query uses at least the phone number and the date consent was obtained. Federal DNC scrubbing occurs at least every 31 days, and internal opt-out requests are honored within 10 business days. A consumer who opts out of one campaign is treated as opted out of all autodialed marketing messages from the company, so internal DNC lists operate at the company level rather than the campaign level.

Consent and Recordkeeping: The Proof Gap VICIdial Cannot Close

Consent and recordkeeping issues usually surface when a demand letter arrives. You need to prove the call was compliant, and VICIdial shows the call but not the underlying consent record.

Symptom: Legal or regulatory inquiries require proof of consent, but the dialer only shows call activity.

Root Cause in VICIdial: The vicidial_log table records the exact time of every dial attempt, which allows queries that identify calls made outside the 8 AM–9 PM local window by joining vicidial_log to vicidial_list and computing local time as call_date plus gmt_offset_now hours. At the same time, VICIdial does not natively manage or tamper-proof prior express written consent logs, timestamped opt-ins, or lead-source URLs. Teams store consent records in custom lead fields or an external CRM, and VICIdial enforces consent-based dialing through list segmentation and campaign configuration.

Settings and Data Fields: Custom lead fields such as consent_timestamp, consent_source, consent_language, consent_company, consent_ip, and consent_method, validated before a lead enters the hopper through a custom lead filter that excludes records without required consent fields.

Compliant Fix: A defensible consent record includes the timestamp, the channel, the exact disclosure language the consumer saw, and the specific seller they authorized; without that structure the record may not withstand a legal challenge. VICIdial’s native logs do not capture that full picture, so build custom lead fields for each element and validate them before records enter the hopper. TCPA compliance records are often retained for at least 4 years to align with the statute of limitations, and some guidance recommends five years. Because the dialer database may purge call detail records after 90 days, store raw records outside the platform. TCPA violations can cost $500 to $1,500 per text or call, and the average securities class action settlement amount in 2023 reached $47.3 million, a 25% increase from 2022.³

Run your numbers through Plura’s calculator to check your ROI in real time.

Caller ID, STIR/SHAKEN, and Attestation: Why Open-Source Dialers Cannot Sign

Calls display as spam, answer rates drop, and carriers block or throttle traffic.

Symptom: Calls display as spam, answer rates drop, and carriers block or throttle traffic.

Root Cause in VICIdial: VICIdial’s documented STIR/SHAKEN support uses the official TILTX integration (svn/trunk 3449+). An AGI script runs before each outbound carrier dial and tags the call with X-TILTX-ID, Identity, and CAID headers for TILTX’s service. VICIdial itself does not hold a certificate or perform signing. Call centers running FreePBX or VICIdial as a dialer generally cannot obtain their own SHAKEN certificate, because they lack three elements: a numbering-eligible OCN, a 499A filing as a telecommunications provider, and RMD certification as a voice service provider.

Settings and Data Fields: Caller ID configuration in Campaign Detail, campaign_recording_message for recording notification, and TILTX integration headers.

Compliant Fix: STIR/SHAKEN is the FCC caller-ID authentication framework for IP and VoIP voice calls, described in 47 C.F.R. Part 64, Subpart CC. The FCC’s Third-Party Authentication Order, effective June 20, 2025, requires voice service providers with a STIR/SHAKEN obligation to obtain their own certificate(s) and authenticate their own calls instead of relying on a third-party vendor’s certificate. For outbound operations, weak or missing STIR/SHAKEN authentication can reduce answer rates because calls may appear as unverified, suspected spam, or blocked by carrier and handset reputation systems. Operators typically work with their carrier to secure the highest attestation level the carrier can support.

Prerecorded Messages and Voicemail Drops: Consent Before the Beep

Voicemail drops and prerecorded messages create a separate TCPA exposure from abandoned calls. Complaints often focus on messages left without clear consent or opt-out instructions.

Symptom: Voicemail drops trigger complaints, opt-out requests are not honored consistently, and script reviews reveal disclosure gaps.

Root Cause in VICIdial: Voicemail drops do not count as abandoned calls under the 3% rule, but leaving a prerecorded message on voicemail without prior express consent implicates 47 C.F.R. § 64.1200(a)(1), which is separate from the abandoned call rule. In February 2024, the FCC clarified that AI-generated voices qualify as artificial voices under the TCPA, so the consent standard aligns with robocalls.

Settings and Data Fields: Voicemail drop configuration in Campaign Detail, campaign_recording_message, and Safe Harbor Audio settings.

Compliant Fix: FCC guidance states that a recorded message should begin playing within two seconds of the called party’s completed greeting, state the name and phone number of the business on whose behalf the call was made, and include a do-not-call opt-out mechanism reachable during normal business hours; a website alone does not satisfy this requirement. Configure Drop Action: AUDIO, Safe Harbor Audio: safe_harbor_message_audio, and Safe Harbor Exten: 8300 in Campaign Detail, with the audio file stored in /var/lib/asterisk/sounds/. Consult qualified counsel on the consent standards that apply to your campaign type and jurisdictions.

Dialing Mode Branch: Predictive, Progressive, and Manual

Compliance exposure shifts as you change dialing modes. The list below maps each mode to its primary risk area.

• Predictive: The 3% abandoned call rule applies directly. auto_dial_level and adaptive_dropped_percentage act as the main controls, and DROP dispositions require real-time monitoring.
• Progressive: A pure power dialer that places one line per agent at a time does not generate abandoned calls by design, because a call only fires when an agent is ready. The 3% rule targets systems that dial multiple lines at once. What matters is whether a live person answered with no agent available, regardless of how the dialer is labeled.
• Manual/Click-to-Call: Timezone and safe-hours rules still apply, DNC scrubbing still apply, and consent requirements still apply. The abandoned call rate rule is less central because a human initiates each call.

VICIdial TCPA Compliance Settings: Quick-Reference Table

The table below connects key VICIdial settings to specific TCPA exposures and shows a safer configuration pattern. Use it as a checklist when you review existing campaigns.

VICIdial Setting or Data Field	TCPA Exposure	Compliant Configuration
auto_dial_level	Set too high, predictive pacing outruns available agents and spikes abandoned call rate above the 3% limit under 47 C.F.R. § 64.1200(a)(7)	Use adaptive mode (ADAPT_TAPERED or ADAPT_HARD_LIMIT) and treat auto_dial_level as a ceiling, not a fixed multiplier
adaptive_dropped_percentage	Targeting the 3.0% maximum leaves no margin for carrier delivery spikes or agent pause clusters	Set to 2.0–2.5% to preserve a safety margin below the 3% ceiling
adaptive_maximum_level	No absolute ceiling allows the adaptive algorithm to over-dial during high-connect-rate periods	Set to a level your agent pool can absorb without drops
gmt_offset_now	Wrong offset dials leads outside the 8:00 AM–9:00 PM local window under 47 C.F.R. § 64.1200(c)(1)	Verify vicidial_postal_codes mapping and force recalculation after DST transitions
Campaign Local Call Time	Assigned separately from general Call Time; only Local Call Time enforces timezone-aware dialing	Assign Local Call Time to every campaign and set buffers such as 8:05 AM–8:55 PM
DROP dispositions	Accumulating DROP dispositions indicate abandoned calls without agent connection	Monitor the real-time report and lower dial level when drop rate approaches 2.5%
Internal DNC fields	Internal DNC does not scrub against the National DNC Registry or RND	Enable both internal and campaign DNC lists, scrub externally every 31 days, and query RND before dialing
Caller ID configuration	Open-source dialers cannot natively sign STIR/SHAKEN, so calls may be labeled spam or blocked	Work with your carrier to ensure calls are signed at the highest attestation level supported

When Manual Configuration Stops Scaling: The Natural Next Step

Manual VICIdial tuning works for smaller programs, but it strains as volume, brands, and rule sets grow. VICIdial provides the dialing settings and logs, and you add the enforcement layer, consent records, and carrier-level identity on top.

For teams that have outgrown manual controls, Plura AI is an FCC-licensed platform of AI agents that run voice, SMS, RCS, and webchat conversations on 100% U.S. infrastructure. Plura’s Compliance Engine includes enforcement logic for TCPA, DNC, HIPAA, SOC 2, CAN-SPAM, and 50+ state rule sets.¹ Every outbound contact is checked against federal and state DNC registries in real time before dialing. Consent records are timestamped and immutable, quiet-hours enforcement runs automatically through timezone detection, and audit-ready exports are available in one click.

¹

Plura’s AI Predictive Dialer is a logical next step for operators who need carrier-level controls and branded caller ID issued through Plura’s FCC-licensed carrier. Plura supports customer compliance; customers remain responsible for their own regulatory obligations and certifications.

Review Plura pricing and see how it compares to your current stack.

Frequently Asked Questions

The questions below cover the TCPA topics contact center leaders most often raise after auditing a VICIdial deployment.

What Is the TCPA 3% Abandoned Call Limit and How Does VICIdial Track It?

The FCC’s predictive-dialer abandonment rule, codified at 47 C.F.R. § 64.1200(a)(7), caps abandoned calls at 3% of all calls answered by a live person, measured per campaign over a rolling 30-day period. VICIdial tracks drop rate in real time through the vicidial_drop_rate_groups system and calculates it as DROP-status calls divided by total answered calls, where answered calls include agent-routed calls, drops, and AMD-classified calls, while NA, B, and DC calls are excluded from both numerator and denominator.

How Do You Prove Your VICIdial Calls Were Compliant?

A defensible audit trail includes timestamp, source URL, consent language, and IP address for every consent record. VICIdial logs call detail records in vicidial_log, but it does not natively manage or tamper-proof consent logs. As noted above, VICIdial logs the call but not the consent, so the consent record lives in custom lead fields or an external CRM. Build custom fields for each consent element and validate them before a lead enters the hopper. Retain records for the 4-year window described above, and note that some guidance recommends five years. Store raw call detail records outside the dialer database, which may purge after 90 days by default.

VICIdial Timezone and Safe Hours Configuration for TCPA

Set Use Campaign Timezone to TZCODE so VICIdial uses the lead’s postal code for more precise timezone detection than area code. Configure state_call_time overrides for states with stricter windows, including Washington’s 8:00 PM cutoff under RCW 19.158.040(2) and Texas’s noon Sunday start under Tex. Bus. & Com. Code § 301.051(b)(2). Set call-time buffers such as 8:05 AM–8:55 PM to protect against DST transitions and server clock skew. After DST transitions, restart the hopper script to force a timezone recalculation.

Does the TCPA Apply to Debt Collection Calls Made From VICIdial?

Debt collection calls can fall within the TCPA framework. FCC orders have addressed arguments that debt collection calls sit outside TCPA coverage for non-marketing purposes when they use an ATDS to dial cell phones, and 47 U.S.C. § 227(b) ATDS provisions can apply to debt collection calls to cell phones without consent regardless of the abandoned call rate rule. The CFPB’s Regulation F at 12 C.F.R. Part 1006 applies a related framework to consumer debt collection with the same 8:00 AM–9:00 PM presumption. Consult qualified counsel for guidance on your specific program.

What Is the Maximum Fine for a TCPA Violation?

The TCPA sets statutory damages of $500 per violation and up to $1,500 per willful or knowing violation under 47 U.S.C. § 227(c)(5), with no cap on the number of violations in a class action. The FCC can impose administrative penalties under 47 U.S.C. § 503(b) of up to $23,755 per willful violation (inflation-adjusted as of 2024) for telemarketing rule violations. Review the regulation and consult qualified counsel for guidance on your specific exposure.

Which Calls Are Exempt From the TCPA?

The FTC’s Telemarketing Sales Rule jurisdictional exemptions cover banks, federal credit unions, federal savings and loans, common carriers acting as such, and genuine nonprofit organizations. The exemption belongs to the covered entity and does not extend automatically to third-party telemarketers calling on its behalf. B2B calls generally fall outside the TSR unless they involve retail sales of nondurable office or cleaning supplies or solicit sales or charitable contributions from a company’s employees. Consult the regulation or qualified counsel to understand how exemptions apply to your calling program.

What Is the Statute of Limitations for a TCPA Violation?

The statute of limitations for TCPA claims is four years under 28 U.S.C. § 1658, running from the date of each alleged violation. Retain call records for at least that 4-year period, and consider longer retention where state rules such as Virginia’s 10-year DNC record requirement apply.

Conclusion: The Controls Exist. The Enforcement Layer Is What You Add

VICIdial gives you auto_dial_level, gmt_offset_now, internal DNC lists, and call detail records. The enforcement layer sits above those controls and includes real-time DNC scrubbing against federal and state registries, tamper-proof consent logs, carrier-level STIR/SHAKEN signing, and automatic quiet-hours enforcement across 50+ state rule sets.

For operators who have outgrown manual configuration, Plura AI supplies that enforcement infrastructure on top of the dialer. Plura applies pre-loaded TCPA, DNC, HIPAA, SOC 2, and state rule sets on every outbound contact, maintains timestamped and immutable consent records, and delivers branded caller ID through Plura’s FCC-licensed carrier. Plura supports customer compliance, and customers remain responsible for their own regulatory obligations and certifications.

Explore Plura pricing and model your cost per connected conversation.

Use Plura’s ROI calculator to quantify the impact of an enforcement layer on your program.

---

Read Next

• TCPA-Compliant AI Predictive Dialer: 2026 Reference Guide
• VICIdial vs Readymode: The Operator’s Dialer Guide 2026
• TCPA Predictive Dialer Compliance: 2026 Checklist
• Voicemail Detection and TCPA: The 2026 Operator’s Guide
• What Is TCPA Compliance? Key Rules for Calls and Texts