The TCPA Compliance Checklist — Six Checks, Every Campaign

The TCPA compliance checklist: six checks to run before every campaign

A TCPA compliance checklist is the set of process checks an outbound team runs before every campaign: consent verified, lists scrubbed inside 31 days, dials held to 8 a.m.–9 p.m. where the prospect is, opt-outs honored within ten business days, agents identifying themselves, and records that prove it. Miss a check and exposure is priced per call — $500 to $1,500 under 47 U.S.C. § 227. Six checks, each with its rule, as of July 2026.

This page is education, not legal advice. A dialer is a tool — compliance depends on how you use it. Enzo does not scrub lists against national or state DNC registries — run every list through a third-party scrubbing service before uploading. Enzo’s internal DNC is campaign-level only. Have a TCPA attorney review this checklist against the states you call.

Check 1: Consent inventory

Before a list is loaded, tag it with its consent basis under 47 C.F.R. § 64.1200(a)(1)–(3):

• Live, manually dialed cold calls — no prior consent required under federal law; DNC rules and calling hours still apply.
• Autodialed, prerecorded, or AI-voice marketing to cells (and prerecorded telemarketing to residential landlines) — prior express written consent (PEWC): a written agreement bearing the called person’s signature, per 47 C.F.R. § 64.1200(f)(9). Informational versions of these calls need prior express consent, which need not be written.

Two notes. The FCC’s one-to-one consent rule is dead — vacated January 24, 2025, deleted from the CFR effective August 29, 2025 — so bundled multi-seller lead-gen consent is again permissible federally; state mini-TCPA laws may still be stricter. And whether a predictive dialer is an “autodialer” depends on the court, as of July 2026 — most federal courts after Facebook v. Duguid (2021) say dialers calling stored lead lists are not an ATDS, the Second Circuit reads stored numbers more broadly, and the law is unsettled; ask a TCPA attorney before relying on either answer. Since February 2024, the FCC treats AI-generated and cloned voices as “artificial” voices — AI-voice telemarketing needs PEWC.

• Every list tagged: PEWC, prior express consent, or manual cold list
• Signed PEWC on file for every autodialed, prerecorded, or AI-voice marketing contact
• Lead-gen consent reviewed against the mini-TCPA states you call
• No prerecorded or AI-voice content without PEWC

Check 2: Scrub cadence — national, state, internal, litigator

The FCC’s safe harbor requires a national registry version obtained no more than 31 days before any call, plus documented written procedures and training; the FTC’s Telemarketing Sales Rule runs the same clock at 16 C.F.R. § 310.4(b)(3)(iv). Texas, Florida, Missouri, and Colorado are among the states running their own paid do-not-call lists, so the scrub stack is four layers: national, state, your internal suppression file, and optionally a commercial litigator list — which no statute requires and which carries no safe harbor; it only cuts the odds of dialing a serial plaintiff. The established business relationship exemption — a purchase within the prior 18 months or an inquiry within the prior 3 — covers your own customers until a company-specific do-not-call request ends it. Fees, SANs, and mechanics: the DNC registry guide for callers.

• National DNC data less than 31 days old, download date logged
• State DNC lists checked for every state on the dial plan
• Master suppression file applied before upload
• Scrubbing run through a third-party service — Enzo does not scrub any registry

Check 3: Calling hours

Federal rules bar telephone solicitations before 8 a.m. or after 9 p.m., local time at the called party’s location — 47 C.F.R. § 64.1200(c)(1). The caller bears the burden of determining that time; there is no weekend or holiday exception. Area code is not location — a 212 number can ring in California, and quiet-hours suits built on that gap surged in 2025 — so schedule uncertain numbers inside the window for every zone they could sit in. States can be stricter — see calling hours by state.

• Schedules capped at 8 a.m.–9 p.m. in the called party’s zone
• Time zones assigned from more than area code
• Stricter state windows reviewed for every state called

Check 4: Revocation and internal DNC

Since April 11, 2025, consumers may revoke consent in any reasonable manner — a “stop” or “unsubscribe” text reply is per se reasonable — and callers must honor it within a reasonable time not to exceed ten business days, per 47 C.F.R. § 64.1200(a)(10). The same deadline now applies to company-specific do-not-call requests (down from 30 days), and § 64.1200(d) requires a written internal DNC policy, trained staff, requests recorded when made, and each honored for five years. The “revoke-all” provision is waived until January 31, 2027 and under active FCC reconsideration — the date and the rule could change again; check FCC.gov before relying on it.

• Opt-outs recorded the day they arrive, on any channel
• Every revocation and DNC request honored within ten business days
• Master suppression file re-applied to every new campaign — Enzo’s DNC marks are per-campaign only

Check 5: Script disclosures

On a telemarketing call, the agent must give the individual caller’s name, the company on whose behalf the call is made, and a telephone number or address for it — 47 C.F.R. § 64.1200(d)(4). Script all three into the opener. If recording is on, the announcement belongs in the first line too — the all-party consent states make that the safest habit.

• Opener states agent name, company, and a callback number or address
• Recording announcement scripted into the first line wherever recording is on
• Agents trained to log a do-not-call request the moment it is spoken

Check 6: Recordkeeping

The DNC safe harbor exists only for callers who can show written procedures, training, and a documented process — the records are the defense. Courts apply the federal four-year catch-all limitations period (28 U.S.C. § 1658(a)) to TCPA claims, so retain records at least four years — five for DNC requests.

• Signed consent records retrievable by phone number
• Scrub logs with download dates and registry versions
• Written DNC policy, training records, and a dated opt-out log on file
• Records kept at least four years; DNC requests at least five

The checklist at a glance

What a failed check costs

$500 per violation, up to $1,500 for willful or knowing conduct, under 47 U.S.C. § 227(b)(3) — and up to $53,088 per violation when the FTC enforces the Telemarketing Sales Rule, as of 2026 (the figure adjusts for inflation in most years — verify it). The full damages picture is in TCPA for Cold Callers.

Where Enzo fits — and where it doesn’t

Enzo’s role here is narrow: campaign-level internal DNC, campaign scheduling, CSV import, and optional call recording. It does not scrub against any registry or litigator list — the dialer itself is compliant software, but no dialer makes your calling lawful; compliance depends on user behavior, and the lists, records, and habits above are yours. The wider legal picture lives in the call center compliance hub. Run the six checks before every campaign, log what you did, and TCPA compliance becomes a standing routine instead of a scramble.

See how campaign-level DNC fits a real calling workflow — book a free discovery call.

Not legal advice. This guide is general information for outbound calling teams, not legal advice. Rules change and apply differently by state, industry, and call type — confirm your program with qualified telemarketing compliance counsel.

Rules and figures from 47 U.S.C. § 227, 28 U.S.C. § 1658, 47 C.F.R. § 64.1200, 16 C.F.R. Part 310, and FCC orders and court decisions as of July 2026.