Debt Collection Laws by State: 2026 Scorecard

The Federal Floor: FDCPA and Regulation F

Any analysis of debt collection compliance in 2026 must start with the federal framework that governs every collection agency operating in the United States. The Fair Debt Collection Practices Act (FDCPA), enacted in 1977, established the baseline rules for third-party collectors pursuing consumer debts. Its fundamental prohibitions — no harassment, no false or misleading representations, no unfair practices — remain the foundation of the regulatory structure.

But the FDCPA was written before email, text messages, or voicemail existed. Regulation F, which took effect November 30, 2021, was the CFPB's first comprehensive modernization of FDCPA implementation rules in the act's history. The key Regulation F changes that every collector must observe in 2026:

How State Laws Layer on Top

The FDCPA contains an express preemption provision — but it only preempts state laws that are inconsistent with the FDCPA, and only to the extent of the inconsistency. State laws that give consumers more protection than the FDCPA are explicitly preserved. This means the regulatory landscape for collection agencies isn't one set of rules — it's 50 sets of rules, each building on the federal floor in different ways.

The complexity compounds when you consider that the FDCPA applies only to third-party collectors — agencies collecting debts owed to others. Many state statutes apply to first-party collectors (creditors collecting their own receivables) as well. A hospital's in-house billing department is generally not subject to FDCPA, but it may be subject to state unfair debt collection statutes that are broader in scope.

For a collection agency with national scope, maintaining compliance means tracking legislation in all 50 states, identifying when state law is more restrictive than federal requirements on any dimension (communication rules, licensing, validation notice content, statute of limitations, garnishment limits), and applying the most restrictive applicable standard to every collection action. This is operationally complex in ways that regional agencies — which may only maintain licenses in a handful of states — don't face.

At Midwest Service Bureau, licensed in all 50 states for 55+ years with zero regulatory actions, this complexity is a daily operational reality. The discussion below reflects patterns we observe from managing compliance across every regulatory environment in the country.

High-Complexity States: The Strictest Environments

Five states consistently require the most intensive compliance attention in 2026. Collection agencies operating in these states face requirements that go substantially beyond Regulation F on multiple dimensions simultaneously.

California: The RFDCPA Standard

California's Rosenthal Fair Debt Collection Practices Act (RFDCPA) is the most expansive consumer debt protection statute in the country. Where the federal FDCPA applies only to third-party collectors, the RFDCPA applies to any person collecting consumer debts — including original creditors. A California hospital billing department is subject to the RFDCPA; a Kansas hospital billing the same patient is not (for state law purposes).

Key California differences in 2026:

• Licensing: The DFPI (Department of Financial Protection and Innovation) regulates collection agencies under the Debt Collection Licensing Act, effective January 1, 2022. All agencies collecting from California residents must hold an active DFPI license regardless of physical location.
• Statute of limitations on old debt: California courts have been particularly active in enforcing the rule that attempting to collect time-barred debt without specific disclosures violates the RFDCPA — exposure that has driven significant litigation.
• Medical debt protections: AB 1020 and subsequent legislation created additional restrictions on medical debt collection in California, including financial assistance screening requirements for hospitals before referring to collections.

Learn more about our specific California debt collection compliance approach and how we manage DFPI licensing requirements.

New York: Layered State and Local Rules

New York State's debt collection rules under General Business Law §601 parallel the FDCPA's structure but with stricter standards on several practices. New York City adds an additional local layer through its Department of Consumer and Worker Protection regulations — meaning collectors dealing with New York City residents must satisfy three regulatory frameworks simultaneously: FDCPA, New York State law, and New York City administrative rules.

Notable New York requirements beyond the FDCPA include stricter disclosure obligations for collecting on time-barred debt, specific requirements for substantiating the amount of debt claimed, and licensing requirements through the New York State Department of Financial Services. The NYC rules impose additional contact time restrictions and require specific Spanish-language disclosures for communications with Spanish-speaking consumers.

Illinois: The ICAA and Recent Amendments

Illinois's Collection Agency Act (ICAA) predates the FDCPA and has been updated repeatedly to address gaps in the federal framework. The ICAA applies to collection agencies operating in Illinois and imposes licensing requirements, bonding requirements, and practice restrictions that go beyond federal law in several areas. Illinois has also been active in medical debt legislation: HB 4706 (2024) created new restrictions on reporting and collecting medical debt below specified thresholds.

Colorado: 2022 Overhaul Still Reshaping Compliance

Colorado's comprehensive debt collection statute overhaul in 2022 (C.R.S. § 5-16-101 et seq.) created one of the most consumer-protective regimes in the country. Key changes included stricter communication restrictions, a clearer definition of prohibited practices, enhanced remedies for consumers (including actual damages and attorney fees), and a private right of action structure that has already generated significant litigation. Colorado collectors who applied FDCPA-baseline practices without reviewing the new state statute have faced enforcement action and class action exposure.

Texas, Florida, and Mid-Complexity States

Texas and Florida, despite their large populations, are generally considered mid-complexity collection environments — more aligned with the FDCPA baseline than California or New York, but with their own requirements that demand attention.

Complexity ratings reflect aggregate requirements including licensing burden, consumer protection scope, recent legislative activity, and enforcement intensity. Based on MSB's operational experience in all 50 states. Not legal advice — consult counsel for state-specific requirements.

Texas maintains its own collection statute — the Texas Debt Collection Act (TDCA) — which applies to original creditors collecting their own debts as well as third-party agencies. The TDCA is generally FDCPA-aligned but includes additional prohibited practices and gives the Texas AG active enforcement authority. See our Texas debt collection compliance guide for specifics.

Florida's Consumer Collection Practices Act (FCCPA) is notable for applying broadly to any person (not just third-party collectors) attempting to collect a consumer debt — creating state law exposure for original creditors and first-party collection departments. The FCCPA has been actively enforced by Florida's Office of Financial Regulation, and consumer attorneys in Florida are experienced at identifying FCCPA violations for private litigation. Our Florida compliance analysis covers the key divergences from FDCPA for healthcare and commercial collectors operating in the state.

Medical Debt: A Distinct Regulatory Category in 2026

Medical debt has emerged as the most active area of debt collection regulation in the past three years, at both the federal and state level. The CFPB finalized a rule in January 2025 removing medical debt from consumer credit reports — prohibiting credit reporting agencies from including medical debt information in consumer reports. While this rule was subject to legal challenges, its policy direction has been clear: regulators view medical debt as categorically different from other consumer obligations.

At the state level, more than a dozen states have enacted or are considering legislation that:

• Requires hospitals to screen patients for financial assistance eligibility before referring balances to a collection agency
• Prohibits referring accounts below specified thresholds (often $100–$500) to external collectors
• Restricts or prohibits wage garnishment for medical debt
• Imposes mandatory waiting periods (typically 90–180 days from discharge) before collection referral
• Requires specific disclosures about financial assistance programs at the point of collection contact

For hospitals and health systems, these rules are now a standard part of the compliance checklist for any patient collections program. A healthcare collections partner operating in multiple states must have specific compliance protocols for each state-specific medical debt statute — not just FDCPA and HIPAA compliance. Agencies that built their healthcare compliance framework on FDCPA alone are now exposed in states with more expansive medical debt protections.

The practical impact: hospitals working with a national collection partner need to verify that the partner's compliance framework accounts for the specific state laws applicable to their patient population — not just federal law. A single-state practice in California faces a very different medical debt regulatory environment than the same-size practice in Kansas.

The Licensing Landscape in 2026

Debt collection agency licensing requirements exist in most U.S. states, and the consequences of operating without required licenses are severe: in addition to regulatory penalties, some courts have held that collections conducted without proper licensure are unenforceable — meaning the entire balance may not be legally collectible.

The licensing landscape varies significantly by state:

• Most require agency-level licensure through a financial services or banking regulator, often renewed annually with bonding requirements
• Some require individual collector licenses — Georgia, for example, has required individual collector registration
• A few require local-level permits in addition to state licenses — New York City being the prominent example
• Costs vary widely — from nominal registration fees in some states to several thousand dollars for initial licensure plus bonding in high-regulatory states like California and Illinois
• Renewals have compliance prerequisites in some states — California's DFPI, for example, requires demonstration of compliance infrastructure as part of the licensing process

For creditors choosing a collection partner, verifying active licensure in every state where their debtors reside is a basic due diligence step. Asking for a license listing isn't bureaucratic — it's protection for the creditor. If a collection agency is operating without a required license, the creditor may have joint liability exposure, and any collections may be challenged as void.

What 50-State Licensure Actually Means

The phrase "licensed in all 50 states" appears in many collection agency marketing materials, but the operational reality behind it matters significantly. Holding licenses in all 50 states requires:

MSB's zero regulatory actions across 55+ years and all 50 states reflects the investment in compliance infrastructure required to operate at this scale. The HIPAA and FDCPA compliance framework we apply to healthcare collections is mirrored by equivalent state-specific compliance protocols for each jurisdiction where we operate. This isn't a marketing claim — it's a precondition for remaining licensed across all 50 states for over five decades.

Compliance Checklist for Creditors Selecting a Collection Partner

When evaluating a collection agency's compliance posture, ask these questions before placement:

MSB maintains BBB A+ accreditation, active ACA International membership, and licenses in all 50 states — with a zero-violation compliance record since 1970. For organizations placing accounts across multiple states, our national presence and deep state-specific compliance experience provides protection that regional agencies can't match.