Why Debt Collection Law Is a Patchwork
If you have ever wondered why one collection agency seems to operate by very different rules than another, the answer is usually geography and debt type. A consumer debt collected in New York follows tighter restrictions than the same debt collected in Texas. A commercial debt collected in Kansas is not subject to the same federal statute as a consumer debt in the same state. Medical debt, since 2023, has been on its own regulatory trajectory that has changed more than once in the last two years.
For creditors, property managers, healthcare providers, and small business owners, knowing which laws apply to which situations is the difference between recovering an account and inheriting a lawsuit. For consumers, knowing the same rules is the difference between paying a debt you owe and paying a debt that legally cannot be enforced. This is the short version of the rules that matter most.
The Federal Foundation: The Fair Debt Collection Practices Act
The single most important debt collection law in the country is the Fair Debt Collection Practices Act, passed by Congress in 1977 and codified at 15 U.S.C. 1692. The FDCPA applies to third-party debt collectors (not original creditors) attempting to collect consumer debts (not commercial debts). Within that scope, it does a lot of work.
It prohibits abusive, harassing, or oppressive conduct. It bans calls at unusual times, typically before 8 a.m. or after 9 p.m. in the consumer's time zone. It restricts when collectors can contact a debtor's employer or third parties, and what they can say when they do. It requires collectors to identify themselves, to validate the debt in writing within five days of first contact, and to honor a consumer's written cease-and-desist or dispute request. And it gives consumers a private right of action, meaning they can sue a collector who violates the statute and recover actual damages, up to $1,000 in statutory damages per action, plus attorney's fees.
We have written a plain-English breakdown of the FDCPA and a longer, deeper guide to the FDCPA for creditors and consumers. If you want the actual statute or a printable reference, our Fair Debt Collection Practices Act PDF guide collects the relevant text.
One important limit to know up front: the FDCPA only covers debts incurred primarily for personal, family, or household purposes. Business-to-business debts and commercial obligations are not covered. That distinction has practical consequences in commercial collection work, which operates under a looser set of rules.
Regulation F: The CFPB Rule That Modernized the FDCPA
The FDCPA was written in 1977, before answering machines were common, let alone email and text messaging. In 2021, after years of rulemaking, the Consumer Financial Protection Bureau finalized Regulation F, codified at 12 CFR Part 1006, which took effect on November 30, 2021. Regulation F is the operational rulebook that translates the FDCPA into 21st-century practice.
The headline rules are worth knowing. Regulation F caps phone contact at seven calls per consumer per debt within a seven-day period, and prohibits another call within seven days of a conversation. It permits collectors to communicate by email and text message, but only with reasonable procedures to avoid sending sensitive information to the wrong person and only if the consumer has not opted out. It requires a standardized model validation notice that includes itemization of the debt, the consumer's rights, and a tear-off response form. And it codifies the consumer's right to dispute the debt and to direct how the collector may (or may not) communicate going forward.
Regulation F is the framework most reputable collection agencies operate under, and it is the framework Advanced Collection Bureau has built our internal policies and procedures around. Our piece on how to create debt collection policies and procedures walks through what a Reg F-compliant process actually looks like in practice. The other piece worth reading alongside this is our explanation of what a validation notice is and why it matters, since the validation notice is the single most important compliance document in a consumer collection file.
The Fair Credit Reporting Act and What It Means for Collections
The Fair Credit Reporting Act (FCRA), codified at 15 U.S.C. 1681, governs how information is reported to and used by consumer reporting agencies like Equifax, Experian, and TransUnion. For debt collection, the FCRA matters in two main ways: it sets the rules under which a collection account can be reported on a consumer's credit file, and it gives consumers the right to dispute inaccurate information and require the furnisher (the collector) to investigate.
The FCRA has been the most active area of debt-related federal regulation over the last two years, with most of the action centered on medical debt. In January 2025, the CFPB finalized a rule under the FCRA that would have prohibited the reporting of most medical debt to credit bureaus and barred creditors from considering medical debt in credit eligibility decisions. The rule was scheduled to take effect in March 2025, then delayed to July 2025, and then struck down in July 2025 by a federal district court in Texas. As of early 2026, medical debt reporting at the federal level reverts to the pre-rule status quo, which means the three major credit bureaus' voluntary policies (no reporting of paid medical collections, a one-year delay on reporting unpaid medical collections, and no reporting of medical collections under $500) still apply, but the broader federal prohibition does not.
State law has moved faster than the federal government here. California's SB 1061 took effect on January 1, 2025, and prohibits medical debt reporting to credit bureaus at the state level. Colorado, Illinois, Minnesota, New Jersey, New York, Rhode Island, and Virginia have enacted similar laws. The result is a state-by-state patchwork where the same medical collection might be reportable in one state and invisible in another.
Telephone Consumer Protection Act and the Texting Question
The Telephone Consumer Protection Act (TCPA), 47 U.S.C. 227, restricts automated calls and pre-recorded messages, and also applies to text messages. For debt collection, the TCPA's most consequential rule is that an autodialed call or text to a cell phone generally requires the called party's prior express consent. TCPA violations are particularly painful because they carry statutory damages of $500 to $1,500 per violation, and class action exposure can be substantial.
In 2024 and 2025, the FCC tightened the consent rules under the TCPA, including requirements around one-to-one consent and the ability for consumers to revoke consent. Collectors who use text or automated dialing have had to update their consent management practices accordingly. Regulation F's permissive treatment of email and text does not override the TCPA's consent requirements; both apply simultaneously.
State-Level Layers
Federal law sets the floor. State law is where things get specific. A few of the most important state-level developments to know:
New York's Consumer Credit Fairness Act, effective April 7, 2022, shortened the statute of limitations on consumer credit transactions to three years and provides that making a partial payment on a time-barred debt does not revive it. New York also requires extensive disclosures and documentation in consumer collection lawsuits. This is one of the most aggressive consumer-protection regimes in the country.
California requires debt collectors to be licensed through the Department of Financial Protection and Innovation under the Debt Collection Licensing Act. California's Rosenthal Fair Debt Collection Practices Act (Cal. Civ. Code 1788) extends FDCPA-style protections to original creditors, which is unusual; in most states, original creditors are exempt from FDCPA-style restrictions.
Florida's Consumer Collection Practices Act, Chapter 559, Part VI, mirrors and in some respects exceeds the FDCPA, and requires consumer collection agencies to register with the Office of Financial Regulation. We cover Florida specifically in our piece on how to conduct a Florida debt collection license search.
State statutes of limitation are the other major variable. Florida is four to five years on most consumer debts; Texas is four years; Tennessee can be as short as three years for credit card accounts; Kansas is five years on written contracts and three on oral. We have written state-specific breakdowns for Tennessee, Kansas, Maryland, and Florida, and we will be expanding the state library through 2026.
About fourteen states do not require a general state license to operate a collection agency. The rest do, and the licensing requirements vary substantially. If you are evaluating an agency, asking about their licensing footprint by state is a reasonable diligence step.
Commercial Versus Consumer: Different Rules Entirely
The FDCPA, Regulation F, and most state debt collection statutes apply only to consumer debt. Commercial debt (one business collecting from another business) operates under a much lighter framework. The rules that do apply include state contract law, the Uniform Commercial Code Article 2 for sale of goods, state consumer protection statutes that occasionally reach commercial conduct, and federal antitrust and unfair-competition law. But the FDCPA itself does not apply, and most state licensing schemes either exempt commercial collection entirely or apply different rules to it.
This is why the right collection partner for an unpaid commercial invoice often looks very different from the right partner for a consumer account. We dug into this in our piece on how collection strategies differ between residential and commercial properties, which translates well to broader commercial work.
What Consumers Should Know About Their Rights
If you are on the consumer side of this, the laws above give you specific, enforceable rights. You can request validation of any debt within 30 days of first contact, and the collector must stop collection activity until they verify the debt. You can send a written cease-and-desist letter, and the collector must stop contacting you except to confirm that they have stopped, or to notify you of legal action. You can dispute inaccurate information on your credit report and require the furnisher to investigate. And you can sue for FDCPA violations.
The Consumer Financial Protection Bureau accepts complaints about debt collectors and publishes them in a searchable consumer complaint database. The Federal Trade Commission shares enforcement authority over the FDCPA. Most states also have an Attorney General's office or a state-level financial regulator that handles consumer complaints; in Florida, that is the Office of Financial Regulation, and in Kansas, the Office of the State Bank Commissioner.
If you are uncertain whether a specific debt is time-barred under your state's statute of limitations, our piece on whether ignoring debt collection makes the debt go away addresses some of the most common questions, and our pay-for-delete strategy guide covers what does and does not work when resolving an account.
What Creditors and Businesses Should Know
If you are the one trying to collect, the laws above are the boundary lines you have to operate within. The practical implications:
Pick a third-party partner that takes compliance seriously. If you place an account with an agency that violates the FDCPA, the consumer can name both the agency and the original creditor in many cases, depending on the theory of liability. Compliance discipline at the agency level protects you at the creditor level.
Keep clean records. Validation requires the agency to provide the consumer with the original creditor's name, the amount, and itemization. If your records are incomplete, validation fails and the account becomes uncollectible.
Know your state statute of limitations. Suing on a time-barred debt is itself an FDCPA violation, and so is threatening to sue on one. The CFPB issued an advisory opinion in 2023 reaffirming this.
Treat medical debt with particular care. The federal medical debt reporting rule is gone for now, but state-level prohibitions are spreading, and the political and regulatory pressure on medical debt collection is not going away.
Useful Resources and Where to Read More
The primary official sources for federal debt collection law are the CFPB's debt collection page, the FTC's debt collection FAQs, and Regulation F itself. For state-by-state survey work, the National Consumer Law Center is the best practitioner resource on the consumer side, and InsideARM is the leading trade publication on the industry side.
For state-specific guidance, your state's Attorney General's office and your state's banking or financial regulator are the right starting points. For private attorneys, the National Association of Consumer Advocates (NACA) maintains a directory of consumer protection lawyers by state.
The Bottom Line
Debt collection law is messy because it is layered. The federal floor (FDCPA, Regulation F, FCRA, TCPA) sets the baseline, and every state adds something on top. The right approach for both creditors and consumers is the same: know the specific rules that apply to your situation, document everything, and work with partners who treat compliance as foundational rather than optional.
Advanced Collection Bureau operates under Regulation F-compliant policies across every account we handle, applies the relevant state-specific rules to each placement, and treats licensing and registration in the states we work as the cost of doing business rather than the corner we cut. If you want to talk through whether your situation fits our model, or just understand the rules that apply to a specific account, you can reach us through our contact page.
