What the product supports, and what the sender still owns

The rule that catches recruitment firms is the one about automated dialling and prerecorded or artificial voice calls to mobile numbers. Those need prior express consent from the person being called, and where the message is marketing rather than purely informational the standard is higher: prior express written consent, with a clear disclosure of what is being agreed to.

A candidate who submitted their mobile number on your application form for the purpose of being contacted about that role is a different case from a number bought in a list or scraped from a profile. The product records which it is: the source of the number, the consent basis, the wording shown at capture, the channel it arrived through, the timestamp and the capturing user or form.

Where consent has not been captured, automated calling and bulk texting to that number can be blocked at send rather than left to a recruiter's memory. That is a configuration your firm chooses, and it is the single most effective control on this page, because it moves the decision from the moment of sending to the moment of policy.

The AI calling agent identifies itself as an automated system at the beginning of the call, along with the firm on whose behalf it is calling. Not after the pitch, not if asked, at the start. Recruitment is a context where people answer calls from unknown numbers expecting a person about their livelihood, and a system that lets them realise three minutes later is doing something to them rather than for them.

The opt-out has to work in both directions the caller might use it. A keypress option is offered and honoured immediately. A spoken request to stop calling is recognised and honoured immediately, and the call ends rather than continuing to a scripted close. Both write suppression against the number and the candidate identity.

Where the jurisdiction requires it, recording carries its own spoken disclosure before recording begins, restricted by jurisdiction, with per-tenant retention limits. All-party-consent states are handled by disabling recording rather than by assuming consent, which is conservative by design and occasionally inconvenient.

Standard opt-out keywords are recognised on inbound SMS and WhatsApp, honoured immediately, and confirmed once. Suppression is written against the candidate identity rather than only against the message thread, so opting out of one recruiter's sequence stops the others rather than leaving the person to repeat themselves to a different desk.

The failure that catches most firms is re-import. A person opts out in March, the same list is uploaded again in July by somebody else, a fresh record is created and the sequence starts again. Suppression is held against the identity and survives import and deduplication, which is the difference between an opt-out that was honoured once and one that holds.

Quiet hours and frequency ceilings are configurable per market and enforced at send time. Sending at eleven at night is not the kind of mistake a recruiter should be able to make by clicking the wrong button, and a platform that permits it has quietly made a policy decision on its customer's behalf.

The CAN-SPAM requirements are short: do not falsify headers or the sender identity, do not use a deceptive subject line, identify the message as an advertisement where it is one, include a valid physical postal address, give a clear unsubscribe mechanism, and honour unsubscribes within ten business days without charging for it or asking for anything beyond an email address.

The product enforces the mechanical parts. A physical postal address is required in the footer of bulk email templates, unsubscribe links are inserted and cannot be removed from a bulk send, unsubscribes write to a suppression list that applies across every sequence, and honouring is immediate rather than taking the full statutory window because there is no reason to use time you are allowed rather than time you need.

The parts that stay with you are the ones that involve judgement: whether a message is commercial, whether your subject line describes what is inside, and whether a recruiter sending individually from their own mailbox is doing something the bulk controls never see. That last one is the real-world gap, and it is a training problem rather than a software problem.

SMS sending in the United States requires brand and campaign registration with the carriers through the 10DLC framework. That registration is yours. The product provides the fields and the sending integration; it cannot hold a registration on your behalf, and no vendor can, because the carriers require the sending entity to register.

Unregistered or misregistered traffic gets filtered, throttled or blocked, usually without a clear error and usually on the day a campaign mattered. Sample messages submitted during registration have to match what you actually send, which is a detail firms discover after their campaign is rejected for content that did not resemble the sample.

The same principle runs through the adjacent items: your WhatsApp Business number and its template approvals are yours, your caller ID reputation is yours, and the consequences of a poor sending reputation attach to your brand rather than to the platform. Reading this row of the compliance matrix before signing is considerably cheaper than reading it afterwards.

Outreach disputes surface months later, and the question is always the same: what did this person agree to, when, and what did you send them. Message history, consent events, opt-out events, the template version used and the sending user are retained against the candidate identity so the answer is a record rather than a recollection.

Retention of that evidence is configured separately from candidate-relationship retention, for the same reason application records are. Deleting the proof of consent under a general minimisation schedule leaves you unable to answer the one question that matters, and it is an easy mistake to make while doing something otherwise sensible.

None of this decides whether a campaign was lawful. It decides whether you can describe it accurately afterwards. That is a smaller claim than the ones usually made in this space, and it is the one that is actually true.

Several states run their own telemarketing and messaging rules that are stricter than the federal baseline, with narrower calling windows, additional registration and their own private rights of action. A national campaign run to a single federal standard is not automatically fine in every state it reaches.

The product supports per-market configuration of quiet hours, channel availability and recording permission, so a stricter rule can be applied to the states that need it rather than to the whole list. Setting those values is a policy decision your firm makes, ideally with counsel, and the defaults are conservative rather than permissive.

The general position on this page holds here too. The product provides the controls and the record. Whether a campaign complies with the rules of every jurisdiction it touches is a question about your consent, your content and your configuration, and it is answered by your counsel rather than by a vendor page.