Trust & Compliance Center

Adoptiv operates globally. The table below shows current live coverage, near-term expansion, and jurisdictions that are explicitly out of scope.

The Telephone Consumer Protection Act (TCPA), 47 U.S.C. § 227, governs automated telephone dialing systems (ATDS), prerecorded messages, and artificial voice calls. It is administered by the FCC and enforced together with the FTC.

2025 rule change: one-to-one consent (effective January 27, 2025)

The FCC requires that TCPA prior express written consent (PEWC) name only one identified seller per consent interaction. Blanket consent across multiple sellers or lead generators is not valid. Adoptiv's consent fields record per-contact, per-seller consent as captured by the Customer.

2025 rule change: consent revocation (effective April 11, 2025)

Consumers may revoke consent in any reasonable manner — including words such as "Stop," "Quit," "Cancel," "Opt-Out," "Unsubscribe," or "End." Callers must honor revocations within ten business days. One confirmation text is permitted within ten minutes of the request. Adoptiv's DNC sync targets processing revocations within 24 hours.

TCPA key requirements

TCPA violation penalties

Platform controls. TCPA controls are embedded as platform features the Customer configures into its dialing workflow: time-zone enforcement, real-time DNC scrubbing, per-contact consent status enforcement, campaign compliance logs, and automated opt-out processing. Customers remain responsible for obtaining valid PEWC before uploading consent records.

A robocall is any call made using an ATDS or that delivers a prerecorded or artificial voice message. Under FCC rules, AI-generated voice calls are classified as robocalls regardless of how human-like the voice sounds.

FCC declaratory ruling: AI voice = robocall (February 8, 2024)

The FCC confirmed that calls using AI to generate a human voice are robocalls under TCPA 47 C.F.R. § 64.1200. AI-generated calls to mobile or residential lines require PEWC. Adoptiv enforces the consent record stored by the Customer before AI Voice Agent calls are initiated.

Robocall safeguards provided by the platform

Adoptiv's programmable communications APIs integrate with licensed upstream carriers. The Adoptiv Platform is not itself a carrier of record in any jurisdiction except where expressly registered with the relevant regulator. Customers using BYOV (see Section 13) retain their own carrier relationships.

United States — FCC

International telecom regulators

FCC enforcement. Forfeiture penalties can reach up to $1,000,000 per action (e.g., 2024 STIR/SHAKEN consent decrees). Adoptiv monitors enforcement and targets control updates within 30 days of material rule changes.

Adoptiv uses AES-256 (Advanced Encryption Standard, 256-bit keys) for customer data at rest and TLS 1.3-class protections in transit — the same class of standards used to protect highly sensitive data worldwide.

The GDPR (EU 2016/679) governs personal data of individuals in the EU, EEA, UK, and Switzerland. Adoptiv Inc acts as a Data Controller for account-holder data and as a Data Processor for customer CRM and telephony data processed on your instructions.

GDPR compliance matrix

Your GDPR rights

• Right to access — copy of your personal data
• Rectification — correct inaccurate data
• Erasure — right to be forgotten
• Restriction — limit processing
• Portability — machine-readable export
• Object — object to legitimate-interest processing
• No solely automated significant decisions — human review pathways
• Withdraw consent — at any time

Adoptiv AI — Voice Agents, Sales Agents, predictive analytics, transcription, sentiment, email parsing, and lead recovery — operates under a governance framework aligned with the EU AI Act, GDPR Article 22, FCC AI voice rulings, US state AI statutes, and current MeitY guidance.

Four AI governance principles

AI statutes monitored

• EU AI Act (Regulation (EU) 2024/1689) — limited-risk transparency for AI Voice Agents; synthetic-voice labelling; prohibited practices under Article 5; staged 2025–2027.
• Colorado AI Act (SB 24-205) — effective 1 February 2026; deployer impact assessments and consumer disclosures for consequential decisions.
• California AB 2905 — AI disclosure on voice calls when asked.
• Utah SB 149 — consumer-facing AI disclosure requirements in regulated industries.
• NYC Local Law 144 — automated employment decision tools bias audits (not offered for HR use cases on the Adoptiv Platform).
• MeitY AI Advisory (India, March 2024) — synthetic-media labelling and originator traceability.

CPNI is information a carrier obtains about a customer by virtue of providing telecommunications service. Under 47 U.S.C. § 222, Adoptiv protects and restricts use of CPNI.

CPNI usage & your rights. Adoptiv uses CPNI to provide and improve subscribed services. CPNI is not shared with third parties for marketing without explicit consent. Opt out of marketing use of CPNI by emailing [email protected] with subject "CPNI Opt-Out" — processed within 24 hours. CPNI breaches follow regulatory timelines and customer notification where permitted.

The National Do-Not-Call Registry (FTC / TSR) restricts telemarketing calls to registered numbers. Adoptiv provides DNC scrubbing as a platform control that Customers configure into their dialing workflows. The Customer remains the caller of record and retains TCPA responsibility for list hygiene.

STIR/SHAKEN (47 CFR § 64.6301) cryptographically signs outbound calls so terminating carriers can verify caller ID accuracy and originating authorization.

Data residency options help meet localization requirements, including GDPR expectations for EU data remaining in the EEA where required, and DPDPA 2023 expectations for Indian Data Principals.

Adoptiv maintains a Security Incident Response Plan (SIRP) aligned to NIST SP 800-61, GDPR/CCPA notification duties, and the Indian CERT-In Directive of 28 April 2022.

Compliance communications are handled by dedicated personnel — not automated systems — for privacy requests, regulatory questions, and legal inquiries.