DNC Compliance: The 2026 Operator's Guide to Do-Not-Call Rules

Most companies think DNC compliance is a list.

Buy access to the National Do Not Call Registry. Run your file against it. Ship the campaign.

That is not DNC compliance. That is one control out of six, and it is not the one that gets you sued.

In 2025, plaintiffs filed 2,628 TCPA cases — up 60% over 2024. Insurance filings rose 53%. In April 2026 alone, 255 TCPA class actions were filed, the highest single month on record. Meanwhile the FTC brought exactly one do-not-call enforcement action in 2025 and none through August of 2026.

Read that pairing again, because it is the whole story. The federal cop went quiet. The private bar took the beat. If your DNC program was built to survive an FTC inquiry, it was built for the wrong adversary.

This guide covers what DNC compliance actually requires in 2026 — the two federal rulebooks, the internal list that drives most litigation, the state layer that now overrides federal law in a dozen states, the safe harbor you have to be able to prove, and the three open questions that will decide a lot of cases over the next eighteen months.

Written for people who run outbound: lead generators, insurance agencies and carriers, mortgage marketers, and the platforms that dial on their behalf.

What DNC Compliance Means

DNC compliance is the set of legal obligations that govern which phone numbers you may call or text for marketing, how you suppress numbers you may not contact, and what records you keep to prove it. It is a part of your TCPA compliance program. It has six components: the National Do Not Call Registry, your own internal do-not-call list, calling-hour limits, caller identification requirements, state registry and registration rules, and the documentation that supports a safe harbor defense.

The Registry is the component everyone knows. It is not the component that generates most of the liability.

Two Rulebooks, One Phone Call

Two federal agencies regulate the same call.

The FTC enforces the Telemarketing Sales Rule, 16 C.F.R. Part 310, under the Telemarketing and Consumer Fraud and Abuse Prevention Act.

The FCC enforces the TCPA rules at 47 C.F.R. § 64.1200, under 47 U.S.C. § 227.

They overlap heavily. They are not identical. And the gaps between them are where compliance programs fail.

The jurisdictional gap

The FTC can only reach entities it has authority over under the FTC Act. Section 5(a)(2) carves out banks, savings and loans, federal credit unions, common carriers, and air carriers. Bona fide nonprofits fall outside the definition of "corporation" entirely. And McCarran-Ferguson, 15 U.S.C. § 1012(b), displaces the TSR for the business of insurance to the extent state law regulates it.

The TCPA has no such carve-outs. Section 227 reaches "any person or entity."

So an insurance carrier may sit outside the TSR and squarely inside the TCPA. That is not an exemption. That is a change of rulebook.

Two traps close the gap from the other direction. First, vendor pull-through: a bank is exempt, but the call center the bank hires is not. Per FTC guidance, any company contracting with an exempt entity to provide telemarketing services must comply with the Rule. Second, insurance is fact-specific: McCarran-Ferguson displaces the TSR only to the extent state law regulates the conduct at issue. "We're an insurance business" is not a compliance memo. It is the beginning of one.

The practical consequence: the FTC and FCC safe harbors are not the same, and neither are their recordkeeping rules. A program built to satisfy one will fail the other. Build to the union.

The National Do Not Call Registry

The prohibition

FTC: It is an abusive practice to call a number on the Registry unless the seller can demonstrate express written agreement signed by the consumer identifying the number to be called, or an established business relationship the consumer has not terminated. 16 C.F.R. § 310.4(b)(1)(iii)(B).

FCC: "No person or entity shall initiate any telephone solicitation to a residential telephone subscriber who has registered his or her telephone number on the national do-not-call registry." 47 C.F.R. § 64.1200(c)(2).

Section 64.1200(e) extends both the Registry rule and the internal-list rule to wireless numbers, and the FCC has long read "call" to include text messages — an interpretation now under pressure, as discussed below. Cell phones can be registered. Registration never expires. As of September 30, 2025, 258.5 million numbers were on the Registry — an all-time high.

The 31-day scrub, and where it actually lives

Here is a detail almost every guide gets wrong.

The 31-day scrubbing requirement is not in the prohibition. It sits inside the safe harbor — 16 C.F.R. § 310.4(b)(3)(iv) on the FTC side, 47 C.F.R. § 64.1200(c)(2)(i)(D) on the FCC side. Both require that you employ a version of the Registry obtained no more than 31 days before the call, and that you maintain records documenting the process.

Why it matters: scrubbing on day 30 does not make a call to a registered number lawful. It makes your defense available if the call was the result of error. The obligation is not to scrub. The obligation is not to call. Scrubbing is how you prove the miss was a mistake rather than a business model.

Treat 31 days as a ceiling, not a target. Most operators who get this right scrub daily or per-campaign.

The Internal DNC List: Where the Lawsuits Actually Come From

If you read one section, read this one.

The Registry rule requires a registered number. The internal list rule requires nothing but a telemarketing call. No autodialer. No prerecorded voice. No Registry listing. It applies to every company that makes marketing calls, full stop.

Most § 227(c) exposure runs through 47 C.F.R. § 64.1200(d), not § 64.1200(c).

The rule has six requirements. Not five. Not "have a suppression list."

1. Written policy — § 64.1200(d)(1). You must have a written do-not-call policy, available on demand. "Available upon demand" means a plaintiff's lawyer can ask for it in discovery and you produce it. If it was drafted after the complaint was filed, everyone will know.

2. Training — § 64.1200(d)(2). Personnel engaged in any aspect of telemarketing must be informed and trained in the existence and use of the list. Document the training. Date it. Keep the roster.

3. Record the request at the time it is made — § 64.1200(d)(3). When a consumer asks not to be called, you record the name and number at the time the request is made and honor it within a reasonable time, not to exceed ten business days. Using a third party to maintain the list does not shift your liability.

4. Identify yourself — § 64.1200(d)(4). Every call must provide the individual caller's name, the name of the entity on whose behalf the call is made, and a phone number or address for that entity. The number cannot be a 900 number or any number charged above standard transmission rates.

5. Affiliates — § 64.1200(d)(5). A do-not-call request applies to the entity making the call and does not extend to affiliates unless the consumer would reasonably expect it to. Shared branding pulls affiliates in. If you run six DBAs off one brand, assume one opt-out kills all six.

6. Five years — § 64.1200(d)(6). A do-not-call request must be honored for five years from the date made.

One more thing worth knowing: the TSR contains no expiration for an entity-specific do-not-call request. 16 C.F.R. § 310.4(b)(1)(iii)(A) sets no time limit. The FCC says five years; the FTC's text says nothing. The conservative posture — and the one we recommend to clients — is to treat internal suppressions as permanent. Nobody has ever been sued for suppressing a number too long.

Courts have held that the internal-list requirements are privately enforceable under § 227(c) because they were promulgated under the privacy provisions of the statute. Powers v. One Technologies, LLC (N.D. Tex. 2022) is the canonical decision, consistent with the Third, Sixth, and Eleventh Circuits.

The proof it bites: the $28 million Campbell v. SiriusXM class was defined to include consumers who asked to be placed on SiriusXM's internal list — independent of Registry status. Internal-DNC failure was a standalone route into the class.

Established Business Relationship: What It Does and Doesn't Do

The EBR is the most misunderstood concept in do-not-call law.

The durations are identical under both regimes:

18 months from the consumer's purchase, transaction, payment, or delivery

3 months from the consumer's inquiry or application

Where it sits in the rule matters. Under the FCC framework, the EBR is not an enumerated exception inside § 64.1200(c)(2). It operates one level up, through the definition of "telephone solicitation" at § 64.1200(f)(15)(ii), which excludes calls to a person with whom the caller has an established business relationship. No solicitation, no Registry violation. Writers routinely miscite this. Courts do not.

What the EBR does not do — and this is the part that costs money:

An EBR is an exception to the Registry rule only. It is not an exception to the internal list rule. It is not an exception to the separate § 227(b) rules governing autodialers and prerecorded or artificial voice. Because of this, an EBR is not a pass to use AI voice if you don’t have consent. And it is expressly terminated by an entity-specific do-not-call request.

Section 64.1200(f)(5)(i) says it directly: a seller-specific do-not-call request "terminates an established business relationship for purposes of telemarketing and telephone solicitation even if the subscriber continues to do business with the seller."

Translation: your customer can keep buying from you and still be permanently off-limits for outbound marketing. The relationship survives. The right to call does not.

Calling Hours

FTC — 16 C.F.R. § 310.4(c): no outbound calls to a residence "at any time other than between 8:00 a.m. and 9:00 p.m. local time at the called person's location."

FCC — 47 C.F.R. § 64.1200(c)(1): no telephone solicitation "before the hour of 8 a.m. or after 9 p.m. (local time at the called party's location)."

Two things operators get wrong.

First: local time means the called party's actual location, not the area code. The 480 number belongs to someone who moved to Boston three years ago and never changed it. Your 8:30 p.m. Arizona text landed at 11:30 p.m. Massachusetts. That is a live class action theory right now.

The Ecommerce Innovation Alliance petitioned the FCC in 2025 to make the NPA-NXX conclusive for wireless time zones, or in the alternative to waive the rule for consented texts (Public Notice DA 25-216, CG Docket Nos. 02-278 and 21-402). Comments closed in April 2025. No order has issued. Until one does, actual location controls.

Second: the FTC rule has a consent qualifier and the FCC rule does not. The TSR restriction applies "without the prior consent of a person." Section 64.1200(c)(1) contains no such language. Consent to receive marketing texts is not, on the face of the FCC rule, consent to receive them at 10 p.m.

And several states are tighter than the federal window. See below.

The DNC Safe Harbor: Six Things You Must Be Able to Prove

Both agencies offer a safe harbor for violations that are "the result of error." Both are conjunctive. Miss one element and you lose the whole defense.

They are not the same list.

FTC — 16 C.F.R. § 310.4(b)(3):

  1. Written procedures to comply

  2. Trained personnel and any entity assisting in compliance

  3. A maintained and recorded list of numbers not to contact

  4. A process that prevents calls to listed numbers, using a Registry version no more than 31 days old, with records documenting the process

  5. Monitoring and enforcement of the procedures

FCC — 47 C.F.R. § 64.1200(c)(2)(i):

  1. Written procedures to comply

  2. Trained personnel and any entity assisting in compliance

  3. A maintained and recorded list of numbers not to contact

  4. A process that prevents calls to listed numbers, using a Registry version no more than 31 days old, with records documenting the process

  5. A process ensuring the Registry data is never sold, rented, leased, purchased, or used for any purpose other than DNC compliance

The FTC requires monitoring and enforcement. The FCC does not. The FCC requires database-misuse controls. The FTC does not.

Build to the union. Six elements, not five:

  1. Written procedures

  2. Training, documented

  3. Internal suppression list, maintained and recorded

  4. 31-day-maximum scrub, with process records

  5. Monitoring and enforcement

  6. Registry data-use controls

There is also a separate statutory safe harbor at 47 U.S.C. § 227(c)(5): a defendant may show it "established and implemented, with due care, reasonable practices and procedures to effectively prevent telephone solicitations" in violation of the DNC rules. That is an affirmative defense in private litigation. It is distinct from the regulatory harbor, and it is the one that actually shows up in class action briefing.

Records

Under the amended TSR, retention is five years. 16 C.F.R. § 310.5(a)(10) requires a record of each person who asked not to be called — name, phone numbers, the seller, the telemarketer's identity, the request date, and the goods or services involved. Section 310.5(a)(11) separately requires Registry access records: entity accessing, access date, subscription account number, campaign name.

And § 310.5(e) is the clause that ends arguments between sellers and vendors: recordkeeping duties can be allocated by written agreement. Absent a clear written allocation, both the seller and the telemarketer are responsible. If your vendor contract is silent on who keeps the DNC records, the answer is you.

What the Reassigned Numbers Database does not do

The RND safe harbor lives at 47 C.F.R. § 64.1200(m), and it protects against the § 227(b) prohibitions — calls to numbers that were reassigned after you obtained consent. It does not reach § 64.1200(c) or (d).

The RND is a reassignment shield. It is not a substitute for scrubbing. A number that is both reassigned and registered still generates DNC liability.

The State Layer

Federal compliance is the floor. In a dozen states it is not the ceiling.

States with their own registries

Roughly ten states still operate do-not-call registries separate from the federal one, each with its own subscription, cadence, and scrub deadline: Colorado, Florida, Indiana, Louisiana, Massachusetts, Missouri, Oklahoma, Pennsylvania, Tennessee, and Texas. Add Wyoming to your scrub plan as well — it has no state registry, but its statute bars calling numbers enrolled in the DMA Telephone Preference Service for more than 60 days.

The cadences differ and the deadlines are not the federal 31 days. Tennessee updates monthly with 30 days to scrub. Pennsylvania publishes quarterly with 30 days to purge. Texas publishes quarterly and allows 60. Massachusetts distributes quarterly. Miss a cycle in any of these states and the hole in your suppression file does not heal on its own.

Registration and bonding

Several states require you to register, and post a bond, before you dial their residents. Florida requires an annual Commercial Telephone Seller license, a $1,500 fee, and a $50,000 bond, and separately licenses each salesperson. Pennsylvania requires registration at least 30 days before soliciting, with a $50,000 bond; failure to register is a second-degree misdemeanor. Mississippi requires a $75,000 bond. Texas requires a Secretary of State filing with a $10,000 security deposit.

Registration failures have become a plaintiff's theory in their own right, particularly in Texas after SB 140.

The mini-TCPA wave

Pennsylvania — Act 47 of 2026 (SB 992), signed July 20, 2026, effective October 18, 2026. This is the most consequential state development of the year and most operators have not staffed for it. Prior express written consent replaces "express request." The calling window narrows to 9:00 a.m. to 7:00 p.m., and telemarketing is banned outright on Sundays — the tightest window in the country. Scope expands to texts, voicemails, and ringless voicemails. Seven opt-out keywords are recognized by statute: STOP, QUIT, END, REVOKE, OPT OUT, CANCEL, UNSUBSCRIBE. Liability extends to the company that hired the telemarketer, not just the dialer. Penalties run to $1,000 per violation, $3,000 where the recipient is 60 or older, and violations also violate the UTPCPL — which carries a private right of action.

Florida — FTSA, Fla. Stat. § 501.059. The 2023 amendments narrowed the "automated system" definition to require selection and dialing, which gutted the original theory. Damages are $500, trebled to $1,500 for willful violations. Texts get a safe harbor: the consumer must reply STOP and you have 15 days to cease before a claim exists. Note that calling hours and the three-call cap live in a different statute — § 501.616(6) — 8 a.m. to 8 p.m., three calls per 24 hours on the same subject regardless of which number you use. The plaintiffs' bar has pivoted to the caller-ID provision.

Oklahoma — 15 O.S. §§ 775C.1–775C.6. Oklahoma did not follow Florida's narrowing. The statute reaches an automated system for the selection or dialing of numbers, which makes it broader than the FTSA. There is a rebuttable presumption that any call to an Oklahoma area code reaches an Oklahoma resident. Calling hours 8 to 8, three-call cap, $500 per violation minimum.

Maryland — Stop the Spam Calls Act, effective January 1, 2024. Prior express written consent for calls using an "automated system," a term the statute leaves undefined and which is broader than federal ATDS. Calling window 8 a.m. to 8 p.m. in the called party's time zone with no consent exception. Three-call cap. No standalone private right of action in the subtitle — violations are unfair, abusive, or deceptive trade practices under the Maryland Consumer Protection Act, which supplies the remedy.

Texas — SB 140, effective September 1, 2025. "Telephone solicitation" now expressly includes text, graphic, and image transmissions. More importantly, SB 140 killed the gatekeeping: consumers previously had to notify the telemarketer, file a state complaint, and wait 120 days before suing. Now violations are DTPA violations, with direct private litigation, treble damages for knowing conduct, and attorney's fees. The statute says explicitly that prior recoveries "may not limit recovery in a future legal proceeding." That is serial-plaintiff enabling by design. One partial defense emerged: in E-Commerce Innovation Alliance v. Texas, settled November 6, 2025, the Texas Secretary of State agreed to publish guidance that businesses sending consent-based texts need not file the registration statement.

Oregon — HB 3865, effective January 1, 2026. Telephone solicitation redefined to include texts. Window narrowed to 8 a.m.–8 p.m. Three calls per subscriber per 24 hours. Eighteen-month EBR. Enforced as an unlawful practice under the Oregon UTPA, which carries a private right of action and fees.

Washington — HB 1051. Statutory damages raised to at least $1,000 per violation. Ringless voicemail and artificial-voice messages delivered to voicemail are covered. And critically: calling a number on the federal DNC Registry is itself a violation of Washington law, actionable under the Washington Consumer Protection Act. There is also assisting-and-facilitating liability for anyone providing substantial assistance while consciously avoiding knowledge of the violation.

A word of caution on state calling hours generally. The widely circulated "state calling hours" charts are unreliable. We pulled two of the most-linked ones and found fabricated citations in both — several states' telemarketing hours attributed to that state's general legal-holidays statute. If you are building a dialing calendar, pull the code sections. Do not trust the chart.

Where the Risk Actually Lives in 2026

The federal enforcement picture

Federal DNC enforcement against sellers has slowed to a trickle. New do-not-call actions against sellers now come a couple a year, and the FTC's January 2026 biennial report describes an explicit pivot toward VoIP providers, dialing platforms, and soundboard vendors rather than individual sellers.

That is not good news. It is a change of adversary.

The seller cases that did come from the FTC are worth studying, because all three turned on the same defect:

Response Tree LLC (January 2024) — $7 million judgment, suspended. Operated 50+ "consent farm" websites offering mortgage refinance quotes, selling an average of 10,000 leads a day and peaking near 50,000, while representing that consumers had consented. Permanently banned from robocalling and Registry calls.

Day Pacer / EduTrek (January 2024) — $28.7 million in civil penalties, a permanent telemarketing ban, and individual liability for three executives. Consumers submitted information to job-search and public-benefits sites and received education-program telemarketing at Registry-listed numbers.

The throughline: every one of these defendants had a consent record. None had a consent record that matched the call that was actually made.

Vicarious liability is where the money is

If you buy leads, franchise your brand, or let downstream agents dial under your name, their DNC file is your DNC file under the vicarious liability theory.

Bumpus v. Realogy (N.D. Cal.) — $20 million. Coldwell Banker-affiliated agents using third-party dialers. Two classes: one built on two or more calls to numbers listed on the Registry for 31+ days, and a second covering prerecorded or artificial-voice calls, where a single call sufficed.

Starling v. Farmers Insurance Exchange (Mo. Cir. Ct., 2026) — $2.875 million for the calling of a single agency. Class expressly limited to numbers registered to individuals, not businesses.

Heckathorn v. Farmers Insurance Exchange (Mo. Cir. Ct., 2026) — $1.25 million, covering seven named agents.

Two DNC class settlements against the same carrier, in the same courthouse, in the same year, both built on downstream agent conduct.

Campbell v. SiriusXM — $28 million, on the dual theory: Registry numbers and consumers who had asked for internal-list placement.

Who is suing

In 2025, 397 serial plaintiffs — 24.7% of all filers — drove 54% of case volume, averaging 3.6 cases each. Nearly 90% of the most active filers are diversified across four or more industries. This is portfolio construction, not consumer grievance.

Repeat defendants are a real category too: 247 companies were sued more than once in 2025 alone, and 80 were sued in each of 2023, 2024, and 2025. Of those 80, nearly half were financial services and a fifth were insurance.

If you have been sued once and changed nothing, you are on a list.

Three Open Questions That Will Decide a Lot of Cases

In June 2025 the Supreme Court decided McLaughlin Chiropractic Associates v. McKesson Corp., 606 U.S. 146 (2025), holding that district courts in civil enforcement proceedings are not bound by the FCC's interpretation of the TCPA. Courts now read the statute themselves.

Everything below is downstream of that.

1. Are text messages "calls" under § 227(c)(5)?

In July 2026 the Seventh Circuit held in Steidinger v. Blackstone Medical Services that they are not. The reasoning: § 227(a)(4) defines "telephone solicitation" to cover calls and messages, but § 227(c)(5) creates a private right of action only for "calls." Congress amended § 227(e) in 2018 to reach texts and left § 227(c)(5) alone. Post-McLaughlin, the FCC's contrary reading gets no deference.

District courts in the Eleventh Circuit have reached the same result, and one of them — Radvansky v. Kendo Holdings — is now on appeal to the Eleventh Circuit, briefed and undecided. The Ninth Circuit has held texts are calls under § 227(b), a different provision. The split is real and it is about to get bigger.

What this means operationally: do not restructure your program around it. Steidinger narrows one federal private right of action in one circuit. It does not touch the FTC, the FCC's enforcement authority, § 227(b), or any state mini-TCPA — and the states are precisely where text liability has been migrating.

2. Is a cell phone a "residential" subscriber?

Unresolved, and no federal appellate court has decided it. In July 2026, McGonigle v. Dickey's Barbecue Restaurants (E.D. Va.) held that DNC protection is not limited to landlines. Other courts have gone the other way.

The emerging test is how the number is actually used — personal versus business — not the technology and not who pays the bill. Plaintiffs' counsel are already drafting around it: the Starling class expressly excluded numbers registered to businesses.

Practical posture: treat registered wireless numbers as protected. The upside of being right is small and the downside of being wrong is a class.

3. How broad is "telephone solicitation"?

Two appellate decisions pull in opposite directions.

Hulce v. Zipongo, 132 F.4th 493 (7th Cir. 2025), read it narrowly: a telephone solicitation requires an intent to persuade the recipient to pay for something.

Coffey v. Fast Easy Offer, LLC (9th Cir. June 4, 2026) read it broadly, and read it at lead generators specifically. Texts asking only "Have you given up on selling your property?" were adequately pleaded as solicitations, where the alleged business model routed non-purchased homes into brokerage leads. The relevant purpose is the purpose of initiating the message, and explicit mention of a good or service is not required.

For anyone running a lead funnel, Coffey is the one to read. "We weren't selling anything, we were just asking a question" is not a defense in the Ninth Circuit. Purpose is judged by the funnel, not the wording of the message.

What Changed Recently — And What Didn't

Three regulatory developments people keep getting backwards.

One-to-one consent is dead. The Eleventh Circuit vacated the FCC's one-to-one consent rule in Insurance Marketing Coalition Ltd. v. FCC, 127 F.4th 303 (11th Cir. Jan. 24, 2025). The rule never took effect. The FCC formally removed the vacated language in August 2025 and has not re-proposed it. Do not cite one-to-one consent as operative law.

But understand what the vacatur removed: a federal regulatory requirement about how consent forms are structured. It removed nothing from § 227(c), the TSR, state law, or the class bar's playbook. Response Tree was a consent-provenance case and it would have been brought identically after the vacatur.

Revocation rules are in effect — mostly. The FCC's 2024 revocation order took effect April 11, 2025. Since then you must honor a revocation within ten business days, recognize the statutory keywords, accept revocation by any reasonable means, and you may not designate an exclusive revocation method.

One narrow piece is delayed: the cross-channel requirement at § 64.1200(a)(10), which would make an opt-out from one message type apply to all robocalls and robotexts on unrelated matters. That was pushed to January 31, 2027 (Order DA 26-12, January 6, 2026). The deferral is narrow. Reading it as "the revocation rules are paused" is the trap.

The DNC rules survived the deregulatory push. The FCC's October 2025 further notice on unlawful robocalls (FCC 25-76) proposed relaxing a range of TCPA rules. The draft contemplated eliminating or streamlining the company-specific DNC requirements at § 64.1200(d). Those proposals were cut from the adopted text. Section 64.1200(c) and (d) are untouched. The internal list, the five-year retention, the ten-business-day deadline, the written policy, and the training requirement all stand.

The DNC Compliance Checklist

Everything above, as a build list.

Registry

  • Active Registry subscription covering every area code you dial

  • Automated scrub, no more than 31 days old — daily or per-campaign is the standard

  • Scrub logs retained with date, file version, and campaign identifier

  • Separate subscriptions and scrub cadences for every state registry you touch

  • Controls preventing Registry data from being used for anything but suppression

Internal list

  • Written do-not-call policy, dated, produced on demand

  • Documented training for everyone touching outbound, with a dated roster

  • Opt-out capture at the moment of the request, across every channel — call, text, email, web, chat

  • Suppression applied within ten business days; target same-day

  • Suppressions treated as permanent, not five-year

  • Affiliate and DBA mapping so one opt-out suppresses every brand a consumer would reasonably associate

Consent

  • Consent record for every number that ties to the specific call being made

  • Lead source documented at the record level: which page, which form, which language, which timestamp

  • EBR windows tracked as data — 18 months from transaction, 3 months from inquiry — not assumed

  • Consent revocation honored across channels even before January 2027

Calling

  • Time-zone logic keyed to the consumer's actual location, not the area code

  • State-specific windows enforced at the dialer: Florida, Oklahoma, Maryland and Oregon at 8–8; Pennsylvania at 9–7 with no Sundays as of October 18, 2026

  • Per-consumer frequency caps where states impose them

  • Caller identification on every call: individual name, entity name, callback number that is not a 900 number

Vendors and downstream

  • Written allocation of recordkeeping duties in every vendor agreement — silence means you own it

  • Audit rights over lead sources, exercised, with the findings documented

  • Downstream agents, franchisees, and affiliates contractually bound to your suppression file

  • Suppression file pushed to every party that dials on your behalf, on a defined cadence

Proof

  • Five-year retention on entity-specific DNC records and Registry access records

  • Monitoring and enforcement — someone reviews compliance and there is a record of the review

  • A named owner. Not a department. A person.

If you cannot check a box, that is not a gap in your paperwork. That is a missing element of your safe harbor.

Frequently Asked Questions

What is DNC compliance?

DNC compliance is the set of legal obligations governing which numbers you may call or text for marketing, how you suppress numbers you may not contact, and what records you keep to prove it. It includes the National Do Not Call Registry, an internal company-specific do-not-call list, calling-hour limits, caller identification, state registry and registration requirements, and the documentation that supports a safe harbor defense.

How often do I have to scrub against the National Do Not Call Registry?

At least every 31 days. The requirement appears in the safe harbor provisions at 16 C.F.R. § 310.4(b)(3)(iv) and 47 C.F.R. § 64.1200(c)(2)(i)(D). Because 31 days is the outer limit of the defense rather than a compliance target, most well-run programs scrub daily or before each campaign.

Do I need an internal do-not-call list if I already scrub the National Registry?

Yes. They are separate obligations. The internal list requirement at 47 C.F.R. § 64.1200(d) applies to any company making telemarketing calls, regardless of whether the number is on the National Registry and regardless of what technology you use to dial. Most do-not-call litigation runs through the internal list rule, not the Registry rule.

Does an established business relationship let me call someone on the Do Not Call Registry?

Yes, but only within the applicable window and only if the consumer has not asked you to stop. The windows are 18 months from a purchase or transaction and 3 months from an inquiry or application. An EBR is an exception to the Registry rule only — it does not excuse internal-list obligations or the separate consent rules governing autodialed and prerecorded calls. And a company-specific do-not-call request terminates the EBR even if the consumer keeps doing business with you.

How long must I honor a do-not-call request?

Under FCC rules, five years from the date of the request. The FTC's rule states no expiration at all. The conservative approach — and the one that survives a class action — is to treat internal suppressions as permanent.

What are the penalties for DNC violations?

The FTC can seek civil penalties of up to $53,088 per violating call under the Telemarketing Sales Rule. Private plaintiffs suing under 47 U.S.C. § 227(c)(5) can recover up to $500 per violation, which a court may treble to $1,500 for willful or knowing violations. Section 227(c)(5) requires more than one call within a 12-month period. State laws add their own damages, and several — Florida, Oklahoma, Washington, Texas, Pennsylvania — carry independent private rights of action.

Are cell phones covered by do-not-call rules?

Yes. Wireless numbers can be registered on the National Do Not Call Registry, registration never expires, and 47 C.F.R. § 64.1200(e) applies both the Registry rule and the internal-list rule to wireless numbers. Whether a cell phone counts as a "residential subscriber" for purposes of the private right of action is currently split in the courts, with the emerging test turning on how the number is actually used rather than the technology.

Do do-not-call rules apply to text messages?

The FCC's rules apply to texts. Whether a consumer can privately sue over texts under § 227(c)(5) is now split — the Seventh Circuit held in 2026 that texts are not "calls" for purposes of that private right of action. That holding does not affect FCC or FTC enforcement, does not affect § 227(b) claims, and does not affect state mini-TCPA statutes, which is where most text litigation has migrated.

Does my lead vendor's consent protect me?

Only if it is real, documented, and matches the call you actually made. Every major federal do-not-call enforcement action of the last three years involved a defendant who had a consent record that did not match the call. You are responsible for the calls you make. Buying the lead does not buy the defense.