The Concept
STIR-SHAKEN
STIR-SHAKEN is the FCC-mandated framework for caller ID authentication. It cryptographically signs calls to prove the caller is who they claim to be.
| Component | Full Name | Role |
|---|
| STIR | Secure Telephone Identity Revisited | Signs the caller ID in the SIP header |
| SHAKEN | Signature-based Handling of Asserted information using toKENs | The implementation framework for STIR |
Attestation Levels
| Level | Meaning | Use Case |
|---|
| A (Full) | Carrier knows the caller and they're authorized to use this number | Your own numbers |
| B (Partial) | Carrier knows the caller but not if they own the number | Customer numbers |
| C (Gateway) | Carrier received the call from another carrier | International/transit |
What happens if your voice agent makes outbound calls without STIR-SHAKEN attestation?
Carriers (AT&T, Verizon, T-Mobile) block or label calls without valid STIR-SHAKEN signatures. Without attestation, your calls may be: (1) Blocked entirely — never reach the customer, (2) Labeled "Scam Likely" — customer won't answer, (3) Sent to spam folder. The FCC mandates STIR-SHAKEN for all VoIP calls originating in the US. You need your telecom provider (Twilio, Bandwidth, etc.) to sign your calls with at least attestation level B, and level A for numbers you own and are authorized to use.
A2P 10DLC
A2P 10DLC (Application-to-Person 10-Digit Long Code) is the registration system for businesses sending messages or making calls from regular phone numbers (not toll-free).
| Requirement | Description | Cost |
|---|
| Brand registration | Register your business with The Campaign Registry | $4-$40/brand |
| Campaign registration | Register each use case (booking, support, etc.) | $10-$50/campaign |
| Phone number registration | Link numbers to campaigns | Varies |
| Message class | Determines throughput limits | Standard/High |
TCPA Compliance
TCPA (Telephone Consumer Protection Act) regulates automated calls:
| Rule | Requirement | Penalty |
|---|
| Prior consent | Express written consent for automated calls | $500/call |
| Do Not Call | Honor National DNC registry | $500/call |
| Time restrictions | No calls before 8am or after 9pm (local time) | $500/call |
| Identification | State your identity at call start | $500/call |
| Opt-out mechanism | Must provide opt-out during call | $500/call |
| Willful violation | Knowing/intentional violation | $1,500/call |
Compliance Gate Flow
Compliance Checklist
class ComplianceChecker:
def __init__(self):
self.checks = {
"stir_shaken": False,
"a2p_10dlc": False,
"tcpa_consent": False,
"dnc_check": False,
"time_restriction": False,
"identification": False,
"opt_out": False,
}
def check_call(self, phone_number, consent_record, call_time, dnc_list):
"""Check all compliance requirements before making a call."""
results = {}
# STIR-SHAKEN
results["stir_shaken"] = self._check_stir_shaken()
# A2P 10DLC
results["a2p_10dlc"] = self._check_a2p_registration(phone_number)
# TCPA consent
results["tcpa_consent"] = consent_record is not None
# DNC check
results["dnc_check"] = phone_number not in dnc_list
# Time restriction (8am-9pm local)
hour = call_time.hour
results["time_restriction"] = 8 <= hour < 21
# All checks must pass
all_pass = all(results.values())
return {"passed": all_pass, "checks": results}
Consent Management
class ConsentManager:
"""Track and verify TCPA consent."""
def __init__(self):
self.consent_records = {}
def record_consent(self, phone_number, consent_type, timestamp, source):
"""Record express written consent."""
self.consent_records[phone_number] = {
"type": consent_type,
"timestamp": timestamp,
"source": source, # web form, app, verbal
"valid": True,
}
def has_consent(self, phone_number):
"""Check if valid consent exists."""
record = self.consent_records.get(phone_number)
return record is not None and record["valid"]
def revoke_consent(self, phone_number):
"""Revoke consent (opt-out)."""
if phone_number in self.consent_records:
self.consent_records[phone_number]["valid"] = False