> For the complete documentation index, see [llms.txt](https://docs.11x.ai/llms.txt).
> Use it to discover all available pages before exploring further.

# Regional compliance

What changes by market when a digital worker contacts people: US TCPA and Do-Not-Call, EU and UK GDPR, Canada CASL, and which obligations stay with you.


Outbound obligations change by market, and the differences are material enough to affect which channels you can run where. This page describes **what to configure and consider**, not what the law requires of you.

<Callout kind="alert">
**This is not legal advice.** Requirements differ by country, and in the US by state, and they change. Get sign-off from whoever owns compliance at your company before enabling any channel in any market. The governing documents are the [autodial terms](https://www.11x.ai/legal/autodial-terms), [terms](https://www.11x.ai/legal/terms), and [privacy policy](https://www.11x.ai/legal/privacy-policy).
</Callout>

## The platform rule that applies everywhere

Per the 11x autodial terms, subscribers must obtain **prior express written consent** from recipients before initiating communications regulated under telemarketing laws. The terms explicitly prohibit **cold outbound calls and texts without proper consent**.

<Callout kind="info">
This is a contractual obligation on you, not only a legal one, and it is stricter than many teams assume. **Email outbound and regulated calling and texting are not the same thing.** A cold email programme can be entirely legitimate while cold dialling the same list is not permitted.
</Callout>

## Where responsibility sits

| Responsibility | Owner |
| --- | --- |
| Obtaining and evidencing consent | **You** - sole responsibility per the terms |
| Compliance with TCPA, TSR, Do-Not-Call rules | **You** |
| Informing recipients that calls may be recorded | **You** |
| Lawful basis for processing and outreach | **You** |
| Platform certifications and infrastructure security | 11x |
| Providing tools for lawful use | 11x |

The terms state subscribers assume full liability for communications sent through the platform. 11x provides tools intended for responsible and lawful use; verification sits with the subscriber.

## What differs by market

<Tabs>
  <Tab title="United States" icon="flag">
    Calling and texting are the regulated surface. Consider **TCPA**, the **Telemarketing Sales Rule**, and **Do-Not-Call** obligations, plus state-level rules that can be stricter than federal.

    Call recording consent also varies by state - some require all-party consent. Configure your recording disclosure in the [call flow](/julian/call-flows) accordingly.
  </Tab>
  <Tab title="EU and UK" icon="flag">
    The centre of gravity is **lawful basis for processing** rather than a dialling rule. Relevant to:

    - Prospect data used for targeting and research
    - [Website visitor tracking](/data/website-visitor-tracking), where identifying individuals and then contacting them has a materially different profile from the US
    - Data processing agreements - custom DPAs are an Enterprise capability

    11x maintains DPAs for EU-based customers and aligns retention with GDPR protocols.
  </Tab>
  <Tab title="Canada" icon="flag">
    **CASL** governs commercial electronic messages and is generally stricter on consent than US email rules. Treat Canadian contacts as a distinct segment rather than folding them into a North America list.
  </Tab>
  <Tab title="Everywhere else" icon="globe">
    Channel preference also varies independently of law - WhatsApp is the default business channel in much of EMEA, LATAM, and APAC. See [multichannel](/julian/multichannel).
  </Tab>
</Tabs>

## How to configure for multiple markets

<Steps>
  <Step title="Segment by geography" icon="map-pin">
    Not by continent. Canada and the US need different treatment despite sharing a market in most GTM plans.
  </Step>
  <Step title="Enable channels per segment" icon="share-2">
    Do not run one global channel mix. Email-only is a legitimate configuration for markets where you cannot evidence calling consent.
  </Step>
  <Step title="Map consent state per channel into the CRM" icon="database">
    So exclusions can enforce it. See [opt-outs and suppression](/security/opt-outs-and-suppression).
  </Step>
  <Step title="Configure recording disclosure per jurisdiction" icon="mic">
    Including all-party-consent states.
  </Step>
  <Step title="Exclude markets you cannot support" icon="ban">
    Cleaner than running a channel you cannot justify there.
  </Step>
  <Step title="Get sign-off before launch, not after" icon="check-circle">
    From whoever owns compliance.
  </Step>
</Steps>

## Frequently Asked Questions

<Expandable title="Can we cold call a purchased list through 11x?">
No. The autodial terms require prior express written consent before regulated calls and texts, and explicitly prohibit cold calls and texts without it.
</Expandable>

<Expandable title="Does a form submission count as consent to call?">
Not automatically, and this is the most common misconception. Consent is channel-specific and jurisdiction-specific. Confirm with your compliance owner before enabling callbacks.
</Expandable>

<Expandable title="Can we run cold email if we cannot run cold calling?">
Frequently yes - they are different regulatory surfaces. Many teams run email-only in markets where calling consent cannot be evidenced. Confirm for your specific markets.
</Expandable>

<Expandable title="Do we need all-party consent for call recording?">
It depends on jurisdiction, including by US state. Confirm with your compliance owner and configure the disclosure in your call flow to match.
</Expandable>

<Expandable title="How do we handle several countries with different rules?">
Segment by geography and enable channels per segment. One global channel mix will be wrong somewhere.
</Expandable>

<Expandable title="Who is liable if a message breaches a regulation?">
Per the terms, the subscriber assumes full liability for communications sent through the platform and bears sole responsibility for legal compliance.
</Expandable>

<Expandable title="Can we get a custom DPA?">
Yes, on the Enterprise tier. See [which plan is right for me](/help-center/overview/which-plan-is-right-for-me).
</Expandable>

## Next steps

<Columns cols={2}>
  <Card title="Consent and calling compliance" icon="scale" href="/security/consent-and-calling-compliance" horizontal>
    The configuration detail.
  </Card>
  <Card title="Opt-outs and suppression" icon="hand" href="/security/opt-outs-and-suppression" horizontal>
    Making consent enforceable.
  </Card>
  <Card title="Audit and oversight" icon="file-search" href="/security/audit-and-oversight" horizontal>
    Evidencing what happened.
  </Card>
  <Card title="Security and compliance" icon="shield-check" href="/help-center/overview/security-and-compliance" horizontal>
    Certifications for procurement.
  </Card>
</Columns>

## Need help?

Email [support@11x.ai](mailto:support@11x.ai), or [book time with the team](https://www.11x.ai/demo).