Last updated: September 12, 2026
What a TCPA compliance checklist covers
A TCPA compliance checklist covers calling hours, the national do not call registry and how recently you scrubbed against it, your own internal list, the identification an agent gives, consent and how callers revoke it, abandonment limits on the dialer, and record retention. Nearly all of it lives in 47 CFR 64.1200.
None of this is legal advice. Every line carries the paragraph it came from, so you or your counsel can go read the text.
Why this rule gets its own checklist
Most obligations on an outbound floor reach you through a regulator or a client's auditor, where the bad outcome is a fine plus a corrective plan on a schedule you negotiate.
TCPA hands the person you called a case of their own. Under 47 USC 227(b)(3) a called party recovers actual loss or $500 per violation, whichever is greater, and a court finding the violation willful or knowing may raise that to three times the amount. The do not call side at 227(c)(5) gives the same right to anybody who got more than one call from you inside a 12 month period.
Damages that attach per call change the arithmetic. Say a campaign dials a purchased list of 4,000 numbers twice inside a month, and the registry file behind it was 40 days old, and 300 of those numbers had registered in the meantime. That is 600 calls, and 600 times $500 is $300,000. A statute paying by the call supports lawyers who work nothing else, which is the practical difference between this and a rule an agency enforces on its own timetable.
Both defenses here are made of paperwork. Section 227(c)(5) gives a defendant an affirmative defense for having "established and implemented, with due care, reasonable practices and procedures to effectively prevent telephone solicitations in violation of the regulations," and the registry safe harbor at 47 CFR 64.1200(c)(2)(i) works the same way. Your evidence is a written procedure, a training roster, a scrub log, and a timestamped suppression list, and it breaks on ordinary things: a training document nobody dated, a scrub log with one field in it.
State wiretap statutes answer the separate question of recording consent, covered on call recording laws by state. Where these rules sit next to HIPAA, CMS, and PCI on one floor is on the call center compliance checklist.
Calling hours
Solicitations go out between 8 a.m. and 9 p.m., local time at the called party's location. One sentence, and the failure is usually technical rather than deliberate.
Most dialers set that window from the area code, which worked when a number stayed where it was issued. A ported mobile carries its area code wherever its owner moves, so a campaign that looks clean in the dialer report can be reaching Sacramento at 7:15 in the morning. Use the zip or the address where your record holds one.
The registry and the 31 day clock
Four of the five parts of the safe harbor are documents: written procedures, trained personnel, a recorded list of numbers the seller may not contact, and an access arrangement that avoids sharing the database. The fifth, a registry version obtained no more than 31 days before the call, is what most people think of as the whole rule.
Your scrub log is where this gets specific. The FTC telemarketing rule wants a record of which registry version was used, and it names four fields: the accessing entity, the date of access, the subscription account number, and the campaign. A log holding a date covers one of them.
Your own list runs on a shorter clock
Six standards sit under paragraph (d), and an auditor asks for them first because none of them require access to your phone system. A request gets recorded with the number at the time it is made under (d)(3), then honored within a period that "may not exceed ten (10) business days from the receipt of such request."
Two of the six get missed on nearly every floor. A request has to be honored for 5 years under (d)(6), so the suppression list has to survive a CRM migration, and migrations are where suppression lists quietly die. Under (f)(5)(i) that same request terminates your established business relationship with the person even while they keep buying, which makes somebody a current customer and an off limits number at once. Affiliates get settled at (d)(5), worth reading before you assume it helps you.
What the agent says, and what the system sends
Identification under (d)(4) is three things in one breath: the name of the individual caller, the name of the entity the call is made for, and a number or address where that entity can be reached. Agents compress it under time pressure, and "Hi, this is Dana calling about your policy" delivers one of the three.
Prerecorded messages carry their own version at paragraph (b), where the name at the start has to be the one the business is registered under and telemarketing to a residence needs an automated opt out within two seconds of it.
Caller ID has a separate rule at 64.1601(e). Telemarketers transmit CPN or ANI, blocking the transmission is prohibited, and a substituted seller number has to accept do not call requests during business hours.
Consent, and the moment it gets revoked
Prior express written consent at (f)(9) is a signed agreement clearly authorizing the seller to deliver telemarketing calls using an autodialer or an artificial or prerecorded voice, naming the number those calls may go to. Two disclosures ride along, that signing authorizes the calls and that it is not required as a condition of buying anything.
Read that against a lead you bought. Where your company is not identifiable as the seller in the document the consumer signed, the consent record in a vendor's system is evidence about somebody else. Ask for the record itself and file it against the phone number.
Revocation lives at (a)(10) and runs broader than most scripts assume. A called party revokes "by using any reasonable method," stop words in a reply text and an interactive opt out count as reasonable per se, and designating an exclusive means is prohibited. The clock matches the internal list at ten business days from receipt, and (a)(12) allows one confirmation text with no marketing in it.
On your floor it arrives as somebody saying take me off your list halfway through a friendly call. That request counts, and whether it reached your suppression list is invisible from the audio.
Abandonment and what the dialer does when nobody is free
Abandoning more than three percent of live answered telemarketing calls is a violation, measured over 30 days per campaign and recalculated for each successive 30 day period it runs. A call is abandoned when it fails to connect to a live sales representative within two seconds of the called person's completed greeting.
When nobody is free inside those two seconds, (a)(7)(i) requires a recorded message naming the business and a number that takes do not call requests, plus an automated opt out that writes to the seller's list. Under (a)(6), an unanswered call rings at least 15 seconds or four rings before you drop it.
None of that shows up on a call scorecard. The abandonment rate is a dialer report and the ring time is a setting, so both get audited out of the phone system rather than the audio.
Records, and the five year floor
The FTC telemarketing rule sets five years for records of telemarketing activity, and the list runs longer than people expect: every substantially different script and prerecorded message, a record of each call with the numbers and the disposition, the consent records, and the contract with each service provider that dialed for you. Consent records have six parts under 310.5(a)(8), including a copy of the request in the format it was presented in. Periods for the other rules on your floor sit on call recording retention by industry.
The checklist
Twenty six items, grouped by the part of the operation they land on. The last column is what to go read.
| Area | Item | What satisfies it | Citation |
|---|---|---|---|
| Calling hours | Solicitations go out only between 8 a.m. and 9 p.m. at the called party's local time | A dialer window keyed to the called number's time zone rather than the floor's | 47 CFR 64.1200(c)(1) |
| Calling hours | Time zone comes from the best data you hold on the record | Zip or address where you have one, area code where you do not, written down either way | 47 CFR 64.1200(c)(1) |
| Registry | The registry version used was obtained no more than 31 days before the call | A download date per campaign, with a fresh pull mid campaign on anything that runs long | 47 CFR 64.1200(c)(2)(i)(D) |
| Registry | Written registry procedures exist and are current | The document, carrying a version and a date | 47 CFR 64.1200(c)(2)(i)(A) |
| Registry | Staff and any vendor assisting with compliance are trained on those procedures | A dated roster naming who was trained and on what | 47 CFR 64.1200(c)(2)(i)(B) |
| Registry | A list of numbers the seller may not contact is maintained and recorded | The suppression list itself, exportable | 47 CFR 64.1200(c)(2)(i)(C) |
| Registry | Registry access is not shared, resold, or cost split across sellers | Your own subscription, with no shared access arrangement | 47 CFR 64.1200(c)(2)(i)(E) |
| Registry | The scrub log carries four fields rather than one | Accessing entity, date of access, subscription account number, and campaign | 16 CFR 310.5(a)(11) |
| Internal list | A written do not call policy is available on demand | One document you can hand a client or a regulator the same day | 47 CFR 64.1200(d)(1) |
| Internal list | Everyone engaged in any aspect of telemarketing is trained on the list | A dated training record tied to each person on the dialer | 47 CFR 64.1200(d)(2) |
| Internal list | A request is recorded with the name and number at the time it is made | The list entry, timestamped to the call it came from | 47 CFR 64.1200(d)(3) |
| Internal list | The request is honored within ten business days of receipt | Suppression applied, with the date it took effect | 47 CFR 64.1200(d)(3) |
| Internal list | The request stays honored for 5 years | A suppression list that survives platform changes and CRM migrations | 47 CFR 64.1200(d)(6) |
| Internal list | A request ends the established business relationship for that seller | Suppression that holds even while the person keeps buying from you | 47 CFR 64.1200(f)(5)(i) |
| Internal list | Affiliate scope is decided in writing before somebody asks | A written rule on which affiliated entities a request covers and why | 47 CFR 64.1200(d)(5) |
| Identification | The agent gives their name, the entity called for, and a contact number | A script line, scored against the recording | 47 CFR 64.1200(d)(4) |
| Identification | Caller ID is transmitted on every telemarketing call and never blocked | CPN or ANI, with any substituted number accepting do not call requests in business hours | 47 CFR 64.1601(e) |
| Identification | Prerecorded messages name the registered business at the start and give a number | The message audio, checked against the corporate registration | 47 CFR 64.1200(b)(1) and (b)(2) |
| Identification | Prerecorded telemarketing to a residence carries an automated opt out | The opt out path, tested end to end into the suppression list | 47 CFR 64.1200(b)(3) |
| Consent | Written consent names your company as the seller and the number called | The signed agreement, retrievable by phone number | 47 CFR 64.1200(f)(9) |
| Consent | The consent document carries both required disclosures | Authorization language plus the statement that signing is not a condition of purchase | 47 CFR 64.1200(f)(9)(i)(A) and (B) |
| Consent | Revocation is accepted by any reasonable method, with no required channel | Stop words in texts, opt out on a call, and a written path for what an agent hears out loud | 47 CFR 64.1200(a)(10) |
| Consent | Revocation is honored within ten business days of receipt | A timestamp showing when suppression took effect, and one confirmation text at most | 47 CFR 64.1200(a)(10) and (a)(12) |
| Dialer | Abandonment stays under three percent of live answered calls per campaign over 30 days | The dialer's per campaign report, retained, with the recorded identification in place | 47 CFR 64.1200(a)(7) |
| Dialer | Unanswered calls ring at least 15 seconds or four rings before disconnect | The dialer setting plus a sample from the call log | 47 CFR 64.1200(a)(6) |
| Records | Telemarketing records are kept five years | Call detail, every script and prerecorded message, consent records, and vendor contracts | 16 CFR 310.5(a), (a)(8), (a)(9) |
Download the checklist
The same 26 rows download as a CSV with the citation column intact and no form in front of it.
What a recording proves, and what it does not
A recording is evidence of what was said on the call. The identification under (d)(4) either happened or it did not, and a transcript timestamp shows where it landed relative to the first sentence about the product. A caller saying take me off your list at 1:42 on a Tuesday is on the tape with the agent's response behind it.
What the audio cannot tell you is whether you were allowed to place the call. Consent was obtained before the phone rang, on a form or a web page or a signed document in a lead vendor's system. The registry version behind the campaign, the age of the scrub, the training roster, the suppression entry that should have caught the number two weeks earlier: none of it leaves a trace in the conversation, and it is where most of the exposure sits.
Call scoring covers one half of that, and it happens to be the half nobody gets to by hand at volume. A review of six months of your own recordings shows where the identification falls in your opening and how many do not call requests were spoken out loud last quarter. Whether those requests reached your suppression list is a question your records answer, and putting the two side by side is the comparison worth running first.
Frequently asked questions
What are the penalties for a TCPA violation?
A called party recovers actual loss or $500 per violation under 47 USC 227(b)(3), and a court may treble that where the violation was willful or knowing. State attorneys general have the same figure at 227(g)(1), and damages count per call, so exposure scales with the size of the list.
How often do I have to scrub against the do not call registry?
The safe harbor at 64.1200(c)(2)(i)(D) calls for a registry version obtained no more than 31 days before the call, so a campaign running longer than a month needs a fresh pull partway through. Your log names the date, the subscription account, and the campaign.
Does an existing customer relationship exempt me from the registry?
An established business relationship under (f)(5) rests on a purchase within the previous 18 months or an inquiry within the previous 3 months, and it is an exception to the registry rule rather than a pass on everything else. Somebody who asks you not to call ends that relationship under (f)(5)(i), even while they keep buying.
Can a caller revoke consent just by saying so on the phone?
Yes. Revocation happens by any reasonable method under (a)(10), an interactive opt out on a call is reasonable per se, and words a reasonable person would understand as a request to stop count wherever they arrive. Requiring a form as the only route is prohibited under the same paragraph.
Sources
- 47 CFR 64.1200, read from eCFR on 2026-09-12. Verified from primary text for calling hours, the registry safe harbor, internal do not call procedures, identification, prerecorded messages, consent, revocation, and abandonment.
- 47 CFR 64.1601(e), telemarketer caller ID transmission. eCFR, 2026-09-12. Verified from primary text. Its cross reference points at a definition paragraph that has since been renumbered.
- 16 CFR 310.5, FTC telemarketing recordkeeping, including consent records at (a)(8) and the registry version log at (a)(11). eCFR, 2026-09-12. Verified from primary text.
- 47 USC 227(b)(3), (c)(5), and (g)(1), the private right of action, the affirmative defense, and state actions. uscode.house.gov, 2026-09-12. Verified from primary text.
- Insurance Marketing Coalition v. FCC, Eleventh Circuit, 2025-01-24, vacating the FCC one to one consent rule. Third party reporting, unverified against the opinion itself.
- The enforcement framing in the opening section. Editorial, unverified, flagged for counsel review.