Phase 6: Real-Time Transport & Telephony · 45 min · Python · Twilio SDK

Telephony Compliance: STIR-SHAKEN, A2P 10DLC, TCPA

Compliance is the #1 blocker for voice agent deployments. Navigate it or your agent never goes live.

Hiring signal: Telephony compliance knowledge (STIR-SHAKEN, A2P 10DLC, TCPA) is rare and highly valued in enterprise voice AI roles.

What you will learn

Navigate STIR-SHAKEN caller ID authentication: attestation levels A/B/C
Complete A2P 10DLC campaign registration (4-6 week process)
Understand TCPA consent requirements, DNC list, calling hours
Handle recording consent: one-party vs two-party consent states

The Problem

Carriers (AT&T, Verizon, T-Mobile) block billions of spam calls per day. If your voice agent's calls don't pass authentication and compliance checks, they'll be silently blocked or labeled "Scam Likely." Worse, violating TCPA (Telephone Consumer Protection Act) can result in $500-$1,500 per call in fines.

The Concept

STIR-SHAKEN

STIR-SHAKEN is the FCC-mandated framework for caller ID authentication. It cryptographically signs calls to prove the caller is who they claim to be.

Component	Full Name	Role
STIR	Secure Telephone Identity Revisited	Signs the caller ID in the SIP header
SHAKEN	Signature-based Handling of Asserted information using toKENs	The implementation framework for STIR

Attestation Levels

Level	Meaning	Use Case
A (Full)	Carrier knows the caller and they're authorized to use this number	Your own numbers
B (Partial)	Carrier knows the caller but not if they own the number	Customer numbers
C (Gateway)	Carrier received the call from another carrier	International/transit

What happens if your voice agent makes outbound calls without STIR-SHAKEN attestation?

Calls get blocked or labeled as spam

A2P 10DLC

A2P 10DLC (Application-to-Person 10-Digit Long Code) is the registration system for businesses sending messages or making calls from regular phone numbers (not toll-free).

Requirement	Description	Cost
Brand registration	Register your business with The Campaign Registry	$4-$40/brand
Campaign registration	Register each use case (booking, support, etc.)	$10-$50/campaign
Phone number registration	Link numbers to campaigns	Varies
Message class	Determines throughput limits	Standard/High

TCPA Compliance

TCPA (Telephone Consumer Protection Act) regulates automated calls:

Rule	Requirement	Penalty
Prior consent	Express written consent for automated calls	$500/call
Do Not Call	Honor National DNC registry	$500/call
Time restrictions	No calls before 8am or after 9pm (local time)	$500/call
Identification	State your identity at call start	$500/call
Opt-out mechanism	Must provide opt-out during call	$500/call
Willful violation	Knowing/intentional violation	$1,500/call

Compliance Gate Flow

Compliance Checklist

class ComplianceChecker:
    def __init__(self):
        self.checks = {
            "stir_shaken": False,
            "a2p_10dlc": False,
            "tcpa_consent": False,
            "dnc_check": False,
            "time_restriction": False,
            "identification": False,
            "opt_out": False,
        }

    def check_call(self, phone_number, consent_record, call_time, dnc_list):
        """Check all compliance requirements before making a call."""
        results = {}

        # STIR-SHAKEN
        results["stir_shaken"] = self._check_stir_shaken()

        # A2P 10DLC
        results["a2p_10dlc"] = self._check_a2p_registration(phone_number)

        # TCPA consent
        results["tcpa_consent"] = consent_record is not None

        # DNC check
        results["dnc_check"] = phone_number not in dnc_list

        # Time restriction (8am-9pm local)
        hour = call_time.hour
        results["time_restriction"] = 8 <= hour < 21

        # All checks must pass
        all_pass = all(results.values())
        return {"passed": all_pass, "checks": results}

Consent Management

class ConsentManager:
    """Track and verify TCPA consent."""

    def __init__(self):
        self.consent_records = {}

    def record_consent(self, phone_number, consent_type, timestamp, source):
        """Record express written consent."""
        self.consent_records[phone_number] = {
            "type": consent_type,
            "timestamp": timestamp,
            "source": source,  # web form, app, verbal
            "valid": True,
        }

    def has_consent(self, phone_number):
        """Check if valid consent exists."""
        record = self.consent_records.get(phone_number)
        return record is not None and record["valid"]

    def revoke_consent(self, phone_number):
        """Revoke consent (opt-out)."""
        if phone_number in self.consent_records:
            self.consent_records[phone_number]["valid"] = False

Unlock the full lesson

You've read the first 2 sections. The rest of this lesson covers Build It, Use It, Ship It, Evaluation, Key Terms, Common Pitfalls, Interview Framing — plus a hands-on lab, quiz, and project artifact.

Create a free account to unlock Phase 0 and Phase 1 of every course — no credit card.