The short answer is: they can make one contact to certain people, but with very strict limitations on what they can say.
What the FDCPA allows: A collector can contact a third party (your employer, family members, friends, neighbors) for the sole purpose of getting your contact information: your phone number, address, or where you work. That's it. They can make this contact once per person. They cannot reveal that they're collecting a debt. They cannot call the same person again (unless that person asks them to). And they cannot contact your employer for location purposes if they already have your contact information.
What they absolutely cannot do:
Tell your boss, family, or anyone else that you owe a debt. Discuss any details of your financial situation with anyone other than you, your spouse, your parents (if you're a minor), your attorney, or a co-signer. Call your workplace if you've told them your employer doesn't allow personal calls. Use third-party contact as a pressure tactic to embarrass you into paying.
The spouse exception: Collectors can discuss the debt with your spouse. In community property states (Arizona, California, Idaho, Louisiana, Nevada, New Mexico, Texas, Washington, Wisconsin), your spouse may actually be legally responsible for debts incurred during the marriage, so collectors have more reason to contact them.
The employer exception: If a collector has obtained a court judgment against you, they may contact your employer to set up wage garnishment. This is a legal process, not a collection call. Your employer is required to comply with a garnishment order.
What to do if this happens to you: If a collector tells your family, friends, or employer about your debt, they've violated the FDCPA. Document everything: who was contacted, when, what was said. File a complaint with the CFPB and your state Attorney General. Then consult a consumer rights attorney. FDCPA violations can result in $1,000 in statutory damages per lawsuit plus your attorney's fees. Many lawyers handle these cases at no cost to you because the collector pays the legal fees if they lose.
If you want to prevent any third-party contact entirely, send the collector a written cease-and-desist letter via certified mail stating that they may not contact anyone other than you about this matter.