For B2B outbound, the dates that matter between now and mid 2027 are September 30, 2026, when the FCC is scheduled to vote on a draft rewrite of TCPA consent revocation rules and California's Governor must act on two deletion bills; January 1 and January 31, 2027, for new state laws and the TCPA revoke-all date; and May 2027, when India's DPDP consent and notice duties begin.
Below is one calendar for cold email, calling, texting and contact data use in the US, Canada and India, followed by what each rule changes in practice. We checked every date against the regulator, legislature or official gazette on September 14, 2026.
The calendar: what is in force and what is coming
Status key: in force means it applies now; adopted means it is law or a final rule with a set start date; pending means it depends on an action not yet taken; draft means a proposal that could change.
| Date | Jurisdiction | Rule or event | Status | What it changes for B2B outbound |
|---|---|---|---|---|
| February 12, 2025 | India (TRAI) | Second amendment to the telemarketing regulations (TCCCPR) | In force | Promotional calls on the 140 series, service and transactional calls on the 1600 series, no ordinary 10-digit numbers for telemarketing |
| April 11, 2025 | US federal (FCC) | TCPA consent revocation rules | In force | Opt-outs by any reasonable method must be honored within ten business days for autodialed calls, texts and prerecorded calls |
| March 13, 2026 | India (TRAI) | Draft third amendment to the TCCCPR | Draft | Consultation closed; no final regulations published as of September 14, 2026 |
| June 15, 2026 | Canada | Bill C-36, Protecting Privacy and Consumer Data Act, first reading | Pending | Would replace Part 1 of PIPEDA; no second reading recorded yet; CASL still governs cold email |
| September 30, 2026 | US federal (FCC) | Open meeting vote on draft TCPA revocation order and further notice | Draft | Could limit an opt-out to one category of informational robocall and let callers set an exclusive opt-out method |
| September 30, 2026 | California | Governor's deadline to act on SB 923 and AB 883 | Pending | Decides whether bought contact data becomes deletable on request and whether the DROP cycle shortens |
| 30 days after Federal Register publication | US federal (FCC) | Revised revocation rule takes effect, if adopted | Pending | Would supersede the January 31, 2027 revoke-all date |
| November 13, 2026 | India | DPDP Act Consent Manager provisions | Adopted | Registered Consent Managers can start operating as the consent layer individuals use |
| January 1, 2027 | California | CCPA regulations on automated decisionmaking technology (ADMT) | Adopted | Applies to ADMT used for significant decisions; review AI scoring that affects consumers |
| January 1, 2027 | California | SB 923: right to delete covers personal information from any source | Pending | California contacts could ask you to delete records you bought or enriched |
| January 1, 2027 | California | AB 883: DROP deletion cycle moves from 45 days to 30 days | Pending | California records would leave data vendors faster |
| January 1, 2027 | Oklahoma | Oklahoma Consumer Data Privacy Act (SB 546) takes effect | Adopted | Excludes people acting in a commercial or employment context, so little direct effect on B2B lists |
| January 31, 2027 | US federal (FCC) | Delayed TCPA revoke-all provision (DA 26-12) | Adopted, under review | An opt-out from one informational message would stop all robocalls and robotexts from that caller |
| May 1, 2027 | Alabama | Alabama Personal Data Protection Act (HB 351) takes effect | Adopted | Same commercial and employment context exclusion as Oklahoma |
| May 2027 | India | DPDP Act core obligations: notice, consent, rights, security | Adopted | Outreach using Indian individuals' personal data needs a lawful basis, a clear notice and working withdrawal |
| July 1, 2027 | California | AB 883 provisions for elected officials and judges | Pending | Notice and enforcement of their DROP deletion requests, if AB 883 becomes law |
United States federal: TCPA and the FCC
The TCPA consent rules cover what the FCC calls robocalls: calls or texts made with an autodialer and calls using an artificial or prerecorded voice, including to wireless numbers. Nothing in them turns on whether the person answering is a buyer at work, so treat work mobiles as covered. Hand-dialed calls without a recorded message fall outside that definition, though other telemarketing rules can still apply.
What already applies
Since April 11, 2025, section 64.1200(a)(10) says that if a called party uses any reasonable method to revoke consent, the consent is revoked, and callers must honor it within ten business days. One piece was held back: the requirement to treat an opt-out from one type of informational message as covering all future robocalls and robotexts on unrelated matters. In order DA 26-12, released January 6, 2026, the FCC's Consumer and Governmental Affairs Bureau delayed that piece to January 31, 2027.
What the September 30 draft would do
On September 9, 2026, the FCC released a fact sheet and draft Report and Order for its September 30, 2026 open meeting. As drafted, it would:
- Let callers treat a revocation as applying only to the category of informational robocalls it was directed at.
- Let callers designate an exclusive means to revoke consent.
- Take effect 30 days after Federal Register publication and supersede the January 31, 2027 date.
The further notice would seek comment on shortening the ten business day window (a joint industry and consumer group letter suggested seven), requiring two-way texting so people can opt out by reply, requiring a method to revoke consent to all robocalls, and how affiliates are treated. The FCC states the draft is not official action and may change.
In practice: if you run autodialed calls or texts, do not rebuild opt-out flows until the vote, but keep processing within ten business days and prepare to disclose one clear opt-out method.
US states: California and the new state privacy laws
California
California has no business-to-business carve-out. The CCPA's B2B exemption expired on December 31, 2022, and our post on DROP and B2B contact data covers the data broker enforcement and 45-day deletion cycle already running. Two bills now sit with the Governor:
- SB 923 was presented on September 2, 2026. Its enrolled text would expand the right to delete to any personal information a business has collected about the consumer, while letting a business that got the data elsewhere keep a record of the request and the minimum data needed to keep it deleted.
- AB 883 was presented on September 4, 2026. Its digest says it would change the 45-day DROP period to 30 days, with provisions on elected officials and judges operative July 1, 2027.
Under the California Constitution, a bill passed before September 1 and not returned by September 30 becomes a statute, and statutes from a regular session generally take effect on January 1 after a 90-day period. Neither bill had been signed or vetoed as of September 14, 2026.
Separately, CalPrivacy's regulations require businesses that use automated decisionmaking technology to make significant decisions to comply from January 1, 2027. The rule is aimed at significant decisions, so check with counsel before any automated scoring decides something material about a consumer.
Oklahoma and Alabama
Oklahoma's SB 546 takes effect January 1, 2027 and applies to businesses processing data of over 100,000 consumers, or 25,000 while earning most of their revenue from selling data. Alabama's HB 351 takes effect May 1, 2027 with a 25,000 consumer threshold. Both define a consumer to exclude an individual acting in a commercial or employment context. A buyer contacted in their work role is outside those definitions, so the direct effect falls on consumer lists and ad audiences, not B2B prospecting.
Canada: CASL and Bill C-36
CASL is the rule for cold email into Canada today. Section 6 bars sending a commercial electronic message without consent. Section 10(9) allows implied consent when a person has conspicuously published their address, has not said they do not want unsolicited messages, and the message relates to their business role. Section 11(3) requires unsubscribes to take effect within ten business days. Section 20(4) sets maximum penalties of $10,000,000 per violation for organizations.
Bill C-36 had its first reading on June 15, 2026, and LEGISinfo showed no second reading activity as of September 14, 2026. The first reading text would enact the Protecting Privacy and Consumer Data Act, repeal Part 1 of PIPEDA and designate a Privacy and Consumer Data Commissioner within the Digital Safety and Data Protection Commission of Canada. Administrative penalties could reach the greater of $10,000,000 and 3% of gross global revenue. It would come into force by order in council, and its CASL amendments update references to the new commissioner and Act.
In practice: record which implied consent basis applies to each Canadian contact, keep unsubscribes inside ten business days, and treat C-36 as a watch item. Our Canada B2B lead generation page explains how we build CASL-aware programs.
India: DPDP Rules and TRAI telemarketing rules
DPDP Act and Rules
The Gazette notification of November 13, 2025 phased in the Digital Personal Data Protection Act. Consent Manager provisions start one year after publication, on November 13, 2026. The core obligations start eighteen months after publication, in May 2027, including sections 3 to 17 on applicability, notice, consent, legitimate uses, obligations and rights. PIB's summary adds that the Rules require standalone, clear consent notices and that Consent Managers must be Indian companies.
Three parts of the Act matter for B2B teams:
- Section 4 allows processing only with consent or for certain legitimate uses, and section 5 requires a notice with any consent request.
- Section 3 reaches processing outside India when it is connected with offering goods or services to people in India.
- Section 3 also excludes personal data the person has made publicly available. Whether a work email found on a profile or bought from a vendor qualifies is a question for counsel.
TRAI telemarketing rules
TRAI's second amendment of February 12, 2025 reshaped calling into India. Per PIB, promotional calls use the 140 series, service and transactional calls use the 1600 series, and senders cannot use ordinary 10-digit numbers for telemarketing. Recipients can complain within 7 days, and action against a sender now triggers at 5 complaints in 10 days. A draft third amendment released March 13, 2026 has closed consultation, with no final regulations published yet.
In practice: promotional calling into India should run through registered channels, and email or LinkedIn outreach using Indian personal data needs a documented basis and notice by May 2027. See our India B2B lead generation page for how we run programs there.
What to do this quarter
- Map rules to listsTag each list and channel by country, state and whether it uses calls, texts or email.
- Document the basisRecord consent, implied consent or other legal basis and its source for every contact.
- Use the strictest timingProcess opt-outs within ten business days everywhere, and faster where you can.
- Review data vendorsCheck contracts for deletion files, source dates and notice of enforcement.
- Separate call typesSplit informational and marketing calls and texts into labeled programs.
- Set a review dateBook a quarterly review, with extra checks after September 30, 2026.
Map which rules touch which lists. A Texas CFO, an Ontario IT director and a Bengaluru founder fall under different rules. Tag country, state or province, channel and number type so a new rule is one filter away.
Document consent and legitimate basis. For Canada, note the implied consent ground. For India, prepare notices and consent capture before May 2027. For California, record source and capture date so deletion requests can be traced.
Set opt-out handling to the strictest applicable timing. TCPA and CASL both allow ten business days, and the FCC is asking about seven. One global suppression list, applied before every send and import, avoids juggling clocks by country.
Review data vendor contracts. Ask for source and collection dates, deletion files and DROP status for California data.
Separate informational and marketing calls and texts. Meeting reminders and account notices should not share a program or number with prospecting. Appointment setting teams feel this first.
Set a quarterly review date. Revisit this calendar after September 30, before January 1, 2027 and before May 2027.
This is not legal advice
This calendar summarizes public regulator releases, bill texts and gazette notifications as of September 14, 2026. It is not legal advice. Pending bills and draft rules may change or fail, and whether a law applies to you depends on your size, data flows, channels and contracts. Confirm your obligations with qualified counsel in each jurisdiction before changing how you call, text, email or handle contact data.
Where Lemniscate fits
Lemniscate Growth runs outbound B2B lead generation, appointment setting and account-based marketing for companies selling into the US, Canada, India, Singapore and the GCC, with sourcing recorded for each contact and one suppression list across channels. For ITT Digital, a healthcare IT services firm, we generated 54 leads in a year for its US sales team. For more on running meetings programs, read the B2B appointment setting guide.
Book a free growth audit and we will map which of your lists and channels each date on this calendar touches.
