You can find a prospect’s mobile number for business calls legally when you get it from a source you can name (the person, your own records, or a B2B data provider that operates under data protection law) and then call it within the rules of the country you are dialing. The rules differ most on three points: automated dialing, do-not-call registers and data protection.
This guide covers the United States, the United Kingdom, the European Union and Australia, with five steps to run before every calling block.
Is it legal to find and call a prospect’s mobile number for business?
Usually yes, within conditions that depend on the country and on how you place the call. The US regulates automated calls to mobiles most tightly, the UK relies on opt-out registers, the EU applies the General Data Protection Regulation (GDPR) plus national calling rules, and Australia combines a Do Not Call Register with fixed calling hours.
Where the number came from matters too. Calling a named person uses their personal data, so in the UK and the EU the GDPR applies to the number and to the call, and the person can object at any time. Record the source and date of every number, so you can answer “where did you get my number?” in one sentence.
5 legal ways to find a prospect’s mobile number
The safest mobile numbers are the ones whose source you can name. All five below leave a clear record of where the number came from.
| Source | Example | What to record |
|---|---|---|
| The person | “Best number is my cell, +1 555 0163” in an email reply | The email, with its date |
| Shared for business | Email signature, business card, event badge scan | Where and when you got it |
| Your own records | A past deal, a support ticket, an earlier call | The CRM record it came from |
| A B2B data provider | A mobile finder that documents its compliance | Provider name and lookup date |
| An introduction | A customer or colleague who connects you | Who introduced you |
The first three sources come from the prospect directly, so they are the easiest to defend. The simplest ask comes late in an email thread, when a call is the natural next step: “What’s the best number to reach you on Thursday?”
For volume, use a provider that documents its compliance. Before you buy, ask for its Data Processing Agreement, its sub-processor list and how people in its data can opt out. Scalelist operates under the GDPR and Singapore’s PDPA, with a Data Processing Agreement, Standard Contractual Clauses and a published sub-processor list, and contact data you submit is never added to its database (Scalelist trust center).
Providers also draw different lines by region: Findymail states it does not provide phone numbers for EU contacts, citing the GDPR (Findymail).
Skip any source you could not name to the prospect: consumer people-search sites, lists of unknown origin, or numbers copied from other people’s phone contacts.
The rules by country: US, UK, EU and Australia
The rules for calling a business mobile vary most on autodialers, opt-out registers and calling hours. The table summarizes them; the sections below give the detail and the primary sources. For rules that apply to every B2B call, not only mobiles, see our guide to B2B cold calling laws.
United States: TCPA, Do Not Call and calling hours
Automated calls. Under the Telephone Consumer Protection Act (TCPA), calls to a cell number made with an automatic telephone dialing system (ATDS) or an artificial or prerecorded voice need the called party’s prior express consent (47 U.S.C. 227). Telemarketing calls of this kind need prior express written consent (47 CFR 64.1200). The rule protects the cell number, so it applies whatever the recipient’s job title.
AI voices count. The Federal Communications Commission (FCC) confirmed in February 2024 that the TCPA’s rules on artificial or prerecorded voices cover AI-generated voices (FCC 24-17).
What counts as an autodialer. Since the Supreme Court’s 2021 decision in Facebook v. Duguid, a device is an ATDS only if it can store or produce numbers using a random or sequential number generator (opinion). A person dialing a mobile by hand is not caught by this part of the TCPA, but the Do Not Call and calling-hour rules can still apply.
Do Not Call. The National Do Not Call Registry protects residential subscribers, and the FCC applies its Do Not Call rules to wireless numbers. The FTC’s Telemarketing Sales Rule exempts most business-to-business calls (16 CFR 310.6), except calls selling nondurable office or cleaning supplies. In the FTC’s words, “most phone calls to a business made with the intent to solicit sales from that business are exempt” (FTC).
The grey area is a personal mobile that belongs to a business buyer. Do Not Call protection follows the residential or personal nature of the number, not the purpose of your call.
Calling hours. No telephone solicitation to residential subscribers, wireless numbers included, before 8 a.m. or after 9 p.m. at the called party’s location.
Florida and Oklahoma set 8 a.m. to 8 p.m. and allow at most three commercial solicitation calls per 24 hours on the same subject (Florida s. 501.616, Oklahoma HB 3168). Oklahoma exempts B2B sales only in narrow cases; whether Florida’s hours and frequency limits reach B2B calls is not settled in the sources we checked.
Consent changes. The FCC’s 2023 “one-to-one” consent rule never took effect: a court vacated it in January 2025 (Eleventh Circuit) and the FCC removed it on 29 August 2025 (Federal Register).
Penalties. A private suit can recover 500 USD per violating call, up to three times that if the violation is willful or knowing. The FTC says Do Not Call violators may be fined up to 53,088 USD per violation, and each call may count separately.
United Kingdom: PECR, TPS and CTPS
Under the Privacy and Electronic Communications Regulations (PECR), live marketing calls work on an opt-out basis. The Information Commissioner’s Office (ICO) tells B2B callers to screen against both the Corporate Telephone Preference Service (CTPS) and the Telephone Preference Service (TPS), plus their own do-not-call list (ICO).
- Mobiles can be on the TPS. Registration is free for any number, and a number must be on the register for 28 days before it takes effect (ICO live calls).
- Sole traders and some partnerships are treated like individuals and have greater protection.
- Say who is calling and display your number, or an alternative contact number.
- Automated (recorded) marketing calls need consent that specifically covers them, including from businesses.
- UK GDPR applies to the named person you call.
The Data (Use and Access) Act 2025 widens the definition of a call to include attempts to connect, not only answered calls (ICO summary). The ICO says the Act lets it issue PECR fines of up to £17.5 million or 4% of global turnover (ICO statement). More on UK coverage and rules: UK business mobiles.
European Union: GDPR plus national rules
Calling a named person at a business uses their personal data, so the GDPR applies. Direct marketing can rest on legitimate interest after a balancing test: Recital 47 says such processing “may be regarded as carried out for a legitimate interest” (EDPB Guidelines 1/2024). The person’s right to object to direct marketing is unconditional.
Whether a live marketing call also needs consent is set by each country’s national rules. More on B2B contact data and the GDPR.
GDPR fines reach 20 million EUR or 4% of annual turnover, whichever is higher (EDPB Guidelines 04/2022). Two national examples:
- Germany: phone advertising to a business needs at least presumed consent (mutmaßliche Einwilligung), meaning a concrete reason to believe the business would want the call. Consumers need prior express consent, and automated calling machines need prior express consent from everyone (UWG section 7). The fine of up to 300,000 EUR applies to consumer calls without consent (UWG section 20). Detail: German business mobiles.
- France: since 11 August 2026, consumers may not be called for prospecting without prior consent, and the Bloctel opposition list articles were repealed (Code de la consommation). These consumer rules do not cover professionals: the CNIL allows B2B phone prospecting on legitimate interest when the offer relates to the person’s job, with an easy, free way to object (CNIL).
Australia: Do Not Call Register and the Industry Standard
Telemarketers must not call numbers on the Do Not Call Register. Business numbers cannot be registered, but a number used for both business and personal purposes can be if it is used mostly for private purposes (Do Not Call Register). That is how many owner-operators’ mobiles end up on it.
The Telemarketing and Research Calls Industry Standard 2017 applies to all voice calls to Australian numbers that promote goods or services, B2B included, and even to callers exempt from the Register (Industry Standard):
- Weekdays: 9 a.m. to 8 p.m.
- Saturday: 9 a.m. to 5 p.m.
- Sundays and national public holidays: no calls.
As published by the Register, courts can impose up to A$2.22 million per day of contravention, and Industry Standard contraventions carry penalties of up to A$250,000 each (compliance and breaches). More on Australian business mobiles.
How to find and call a business mobile, step by step
Five steps keep a mobile number defensible from the moment you find it to the moment you hang up.
1. Write down why the call fits the person’s job
Legitimate interest in the EU, presumed consent in Germany and the CNIL’s B2B position in France all turn on relevance to the person’s role. One line per segment is enough: “Plant managers in Ohio own maintenance staffing, which we fill.”
2. Get the number from a source you can name
Use one of the five sources above and store the source and date on the record. If you use a provider, keep its DPA on file. For volume, a mobile finder such as the Scalelist Mobile Finder returns mobiles for a list of names and companies, at 20 credits per mobile found and 0 when none is found.
3. Label the number and screen it
Mark each number as mobile or business line, and note its country from the code (+1, +44, +49, +33, +61).
Then screen it against the registers that apply: your own do-not-call list everywhere, the TPS and CTPS in the UK, and the Do Not Call Register in Australia for mobiles that may be mostly private. In the US, screen against the National Do Not Call Registry when a mobile may be personal.
4. Dial within the rules
For US mobiles, dial by hand or with a dialer that is not an ATDS, and use no prerecorded or AI voice without prior express written consent. In the UK and Germany, automated calls need consent too.
Call inside the prospect’s local hours from the table above, not yours.
5. Identify yourself and act on objections the same day
Say who you are and why you are calling in the first sentence, and show your number. When someone asks not to be called, add them to your do-not-call list the same day, in every tool that dials. In the EU, that right to object is unconditional.
Example: a compliant call record for a US prospect
A compliant record shows, at a glance, where the number came from, what kind of number it is and when you may call it. Here is one for Marcus Reyes, Plant Manager at Great Lakes Molding in Toledo, Ohio.
The opener does the compliance work in the first two sentences: who is calling, why this person, and an easy way out.
If he objects: Understood, I'll take your number off our list today. Thanks for telling me.
Common challenges (and the fix)
You cannot tell whether a mobile is business or personal
In the US, Do Not Call protection follows the personal nature of the number, and in Australia the Register accepts numbers that are mostly private. When a mobile might be personal, the cautious route is to screen it as if it were, and tag it so the next rep does not guess.
Your dialer might count as an autodialer
After Duguid, fewer dialers meet the ATDS definition, but prerecorded messages and AI voices are covered whatever dialer you use. Ask your dialer vendor how its system places calls, and have counsel confirm before anyone dials mobiles with it. For a side-by-side of dialer types, see power dialers compared.
Your prospects are in several countries
The rules follow the person you call, not your office. Label every number with its country code and time zone, and apply that country’s hours and registers. Coverage and rules for more markets: Brazilian business mobiles and South Korean business mobiles.
Someone asks where you got their number
Answer in one sentence from the source you recorded in step 2. If it came from a provider, name it and offer to remove the number; Scalelist offers an opt-out for the people in its data.
What to look for in a mobile number provider
A good provider makes the legal questions easy to answer: how it handles data, how people opt out, and what happens to your uploads.
- A Data Processing Agreement and, for EU data, Standard Contractual Clauses.
- A published sub-processor list.
- An opt-out for the people in its data.
- Your uploads stay yours: contact data you submit is not added to the provider’s database.
- Number type on every result, so you know which rules apply before you dial.
- Charged only when a number is found, with coverage published by region.
How Scalelist helps
Scalelist, an AI Lead Finder, is where you get the mobile number, not just the email. It finds and verifies contact details on demand rather than serving a pre-compiled list.
- Mobile Finder: 20 credits per mobile found, 0 when none is found. About 0.80 USD per mobile on the 5,000-credit plan.
- Documented compliance: GDPR and Singapore PDPA, a DPA, SCCs, a published sub-processor list and an opt-out.
- Your process stays in charge: whichever provider you use, screening against the TPS, CTPS or Do Not Call registers and honoring objections remain your steps.
To choose the right number once you have several, read direct dial vs mobile vs switchboard. For every other way to find numbers, see how to find direct dial phone numbers, and for the full contact record, our playbook on finding business contact information.
Find the mobiles for your call list from a provider with a DPA and a published sub-processor list, 20 credits per mobile found.
Find your first mobileFAQ
Is it legal to call a prospect’s mobile number in the US?
Often yes, with conditions. A live B2B call dialed by hand is not caught by the TCPA rule on autodialed calls, but autodialed, prerecorded or AI-voice calls to a cell number need prior express consent, written for telemarketing. Do Not Call rules extend to wireless numbers, while most B2B calls are exempt. This is not legal advice.
Do I need consent to cold call a business mobile in the UK?
Not for live calls, in most cases. PECR lets you make live marketing calls unless the number is on the TPS or CTPS or the person has objected, so screen both registers first. Mobiles can be on the TPS, and sole traders count as individuals. Automated marketing calls need specific consent, businesses included. This is not legal advice.
Does the GDPR allow B2B cold calls to mobiles?
It can. Direct marketing can rest on legitimate interest after a balancing test, but the person’s right to object is unconditional. Each EU country sets its own rules on marketing calls: Germany requires at least presumed consent for B2B calls, and France’s CNIL accepts legitimate interest when the offer relates to the person’s job. This is not legal advice.
Can I call Australian business mobiles?
Yes, within the rules. Business numbers cannot be on the Do Not Call Register, but a mobile used mostly for private purposes can be, so screen those. The Industry Standard applies to every sales call: weekdays 9 a.m. to 8 p.m., Saturday 9 a.m. to 5 p.m., and no calls on Sundays or national public holidays.
Where can I find a mobile number for business calls?
Ask the prospect, use numbers they shared for business such as email signatures or business cards, check your own records, get an introduction, or use a B2B data provider that documents its compliance. For a list, a mobile finder returns numbers from names and companies; Scalelist charges 20 credits per mobile found and nothing for a miss.
What happens if I call a number on the Do Not Call list?
In the US, a person who receives more than one violating call in 12 months can sue for up to 500 USD per call, trebled if willful, and the FTC can fine up to 53,088 USD per violation. In Australia, courts can impose up to A$2.22 million per day. Most US calls to businesses are exempt from the Do Not Call rules.
Sources
- 47 U.S.C. 227 (TCPA), Cornell LII
- 47 CFR 64.1200, Cornell LII
- Facebook, Inc. v. Duguid, No. 19-511 (2021)
- FCC Declaratory Ruling FCC 24-17 (2024)
- 16 CFR 310.6, Cornell LII
- FTC: Q&A for telemarketers and sellers about DNC provisions
- Insurance Marketing Coalition v. FCC, 11th Cir. (2025)
- Federal Register, 90 FR 42137 (29 Aug 2025)
- Florida Statutes s. 501.616
- Oklahoma HB 3168 (2022)
- ICO: Business-to-business marketing
- ICO: Rules on live direct marketing calls
- ICO on the Data (Use and Access) Act 2025: PECR changes and commencement statement
- EDPB Guidelines 1/2024 on legitimate interest
- EDPB Guidelines 04/2022 on administrative fines
- UWG section 7 and UWG section 20
- Légifrance: Code de la consommation, L223-1 (version from 11 Aug 2026)
- CNIL: Prospection commerciale par téléphone
- Do Not Call Register: About the Register, FAQs for consumers, Industry standards, Compliance and breaches
- Findymail: Phone finder
