DNC Compliance for Outbound Sales Teams: Rules, Penalties, and What Changed in 2026

TL;DR

DNC compliance means scrubbing every calling list against the National Do Not Call Registry at least every 31 days, keeping your own internal do-not-call list, honoring opt-out requests within 10 business days, and documenting consent for every number you dial. Miss any one of those and each call becomes a separately punishable violation.

• Scrub cadence: every 31 days minimum, against the federal registry and any applicable state list.
• Opt-out window: 10 business days, in force since April 11, 2025.
• Calling hours: 8:00 a.m. to 9:00 p.m. in the recipient's local time.
• Federal exposure: up to $53,088 per violation under the FTC's penalty schedule, plus $500 to $1,500 per call in private TCPA damages.
• The rule that was struck down: one-to-one consent was vacated in January 2025 and never took effect.

Your reps are dialing a list somebody exported six weeks ago. One of those numbers asked you to stop calling in March, on a different phone, from a contact record that has since been deleted and re-imported. That single call is worth more in statutory damages than the rep is worth in monthly quota, and nothing in the dialer stopped it.

That gap between "we scrub our lists" and "we can prove we scrubbed this number" is where outbound teams get hit.

What DNC Compliance Actually Requires

DNC compliance is the practice of following federal and state Do Not Call regulations when making outbound sales calls. It requires you to avoid calling numbers on the National Do Not Call Registry, maintain an internal do-not-call list, and honor consumer opt-out requests permanently.

The Federal Trade Commission created the registry in 2003. By the end of fiscal year 2025 it held more than 258 million phone numbers, up more than 4.8 million year over year, and the FTC logged more than 2.6 million DNC complaints that year. If you want the consumer-side explanation of how numbers get on that list, start with what a do-not-call list is.

Two federal regulations govern the work:

Both apply to most outbound sales teams at the same time. The TSR governs how you telemarket; the TCPA governs consent and the technology you dial with.

Key takeaway: registry scrubbing satisfies the TSR. It does not satisfy the TCPA. Consent is a separate obligation with separate damages attached.

The Three Lists You Have To Manage

Compliance fails at the seams between three separate lists. Manage all three or the program does not hold.

1. The National Do Not Call Registry

Telemarketers subscribe and download at telemarketing.donotcall.gov, and must scrub against the registry at least every 31 days. The FY 2026 fee schedule charges $82 per area code, with the first five area codes free and a nationwide cap of $22,626. Keep the download receipts. A scrub you cannot date is a scrub you cannot defend.

2. State Do Not Call Lists

Eleven states run their own registries on top of the federal one: Colorado, Florida, Indiana, Louisiana, Massachusetts, Missouri, Oklahoma, Pennsylvania, Tennessee, Texas, and Wyoming. State penalties run from $100 to $25,000 per call, and state attorneys general enforce independently of the FTC. If you dial Florida or Texas at volume, scrub those lists on the same cadence as the federal one.

3. Your Internal Do Not Call List

This is the list teams get wrong, and it is the one that produces the lawsuits. Every company making outbound calls must keep an internal DNC list capturing anyone who asked not to be called, from any channel, with a timestamp and a source.

The failure is almost always architectural. Most systems record the opt-out against the phone number that received it, so a contact with a mobile, a direct line, and a spouse's number stays reachable on two of the three.

Wrong: suppress the number. Right: suppress the contact, then every number attached to it.

The same flaw shows up in list hygiene. A contact gets deleted, re-imported from a CRM sync three weeks later, and arrives with a clean record. The opt-out is gone. The rep dials in good faith. The violation is identical to a deliberate one, because intent is not an element of the offense.

Financial services, recruiting, real estate, and healthcare outreach teams carry the most risk here, because they run the largest multi-number contact records and the longest re-engagement cycles. Insurance and home-services teams run a close second.

Key takeaway: an opt-out belongs to the person, not the handset. If your suppression logic is keyed to a phone number, you have a compliance gap you cannot see from a dashboard.

The Rules Governing Every Outbound Call

Calling Time Restrictions

Call only between 8:00 a.m. and 9:00 p.m. local time at the called person's location. The FTC's Telemarketing Sales Rule at 16 CFR 310.4(c) makes an outbound call to a residence outside that window an abusive practice absent that person's prior consent. Separately, 47 CFR 64.1200 caps abandoned calls at 3% of calls answered live by a person, measured over a 30-day period for a single campaign, which is the rule that makes predictive dialing hazardous.

Required Disclosures

Within the first few seconds of every call, disclose:

1. The caller's name
2. The company being represented
3. The purpose of the call, when it is sales-related
4. A callback number or address

Consent Requirements By Call Type

What you need depends entirely on how you are dialing:

The Established Business Relationship Exemption

You may call a registry-listed consumer if you hold an established business relationship, defined as a transaction or payment within the past 18 months, or an inquiry or application within the past 3 months.

Document every EBR at the moment it forms. Reconstructing one after a demand letter arrives is where this exemption collapses.

Key takeaway: the EBR clock is 18 months for customers and 3 months for inquiries. Both are shorter than most CRMs' definition of an active contact.

DNC Compliance vs. TCPA Compliance

The two are related and routinely conflated. Here is the split:

The distinction matters because the enforcement mechanisms differ. The FTC and state AGs bring TSR actions. Private plaintiffs bring TCPA class actions, and they bring a great many of them. Our TCPA compliance checklist covers the consent side in depth.

Key takeaway: a clean registry scrub is no defense to a TCPA consent claim. The two regimes are enforced by different parties and you can win one while losing the other.

What DNC Violations Actually Cost

Federal Penalties

• TSR violations: up to $53,088 per violation. TSR violations are penalized through the FTC Act, where the FTC raised the maximum civil penalty from $51,744 to $53,088 effective January 2025.
• TCPA statutory damages:$500 per violation, trebled to $1,500 for willful or knowing violations.
• No damages cap: statutory damages multiply by call volume with no ceiling.

State Penalties

State fines run from $100 to $25,000 per violation, and a state action can proceed in parallel with a federal one on the same call records. Florida enforces its registry aggressively. California runs no separate registry but pursues telemarketing claims under its own statutes, so absence from the eleven-state list is not absence of risk.

Class Action Exposure

Private TCPA litigation is the real exposure, and it is climbing. 856 TCPA class actions were filed through April 2026, against 691 through April 2025, a 23% year-over-year increase, with April 2026 alone producing 330 TCPA cases.

The arithmetic is what makes these cases existential. In Wakefield v. ViSalus, a jury found the supplement marketer had placed 1,850,440 prerecorded calls in violation of the TCPA. At the $500 statutory minimum, the award came to $925,220,000. The Ninth Circuit later vacated the district court's denial of ViSalus's due-process challenge and remanded for a fresh assessment of whether an award that size is constitutionally excessive, which is a real check but not one any board wants to plan around.

Key takeaway: no single call is expensive. A list is. Multiply your worst uncorrected list error by your dial volume and you have your actual exposure number.

What Changed in 2025 and 2026

Three regulatory developments changed the compliance picture, and two of them are widely misreported.

One-to-One Consent Was Vacated, Not Delayed

The FCC's one-to-one consent rule would have required separate consent for each individual seller and limited consent to interactions logically and topically related to the original request. It never took effect. On January 24, 2025 the Eleventh Circuit vacated both requirements in Insurance Marketing Coalition Ltd. v. FCC, holding that the FCC had exceeded its statutory authority, and the Commission has since removed the language from its rules.

If your compliance calendar still carries an April 2026 deadline for one-to-one consent, delete it. The prior definition of prior express written consent governs.

The 10-Business-Day Opt-Out Rule Is Live

Since April 11, 2025 you must process a revocation within 10 business days, down from 30. Some methods are automatically reasonable, including a STOP-family reply keyword, an interactive voice response opt-out, and any website or phone number you designate for the purpose. Others, including voicemail and email, are treated as reasonable unless you can rebut it. A verbal request to a rep mid-call is the one that breaks programs, because it only enters the system if the rep logs it.

The "Revoke-All" Provision Is Waived Until 2027

The genuinely delayed rule is the one requiring a revocation made in response to one type of informational message to apply to all future calls and texts from that caller, including those on unrelated subjects. The FCC's Consumer and Governmental Affairs Bureau pushed it to April 11, 2026, then extended the waiver again to January 31, 2027 while it reviews whether to modify the requirement.

Treat that as a reprieve on paper only. Plaintiffs' firms already argue that a consumer who opts out of one message stream meant all of them, and building account-wide revocation now costs less than retrofitting it under a consent decree.

Key takeaway: one-to-one consent is dead, the 10-business-day clock is running, and the cross-subject revoke-all rule is deferred to January 31, 2027. Compliance calendars written before mid-2025 have all three wrong.

How To Build a DNC Compliance Program

Five components, in the order they fail:

1. Scrub On A Schedule You Can Prove

Scrub against the federal registry every 31 days at minimum, and against state lists for every state you dial. Scrub again immediately before each campaign launch, and log every scrub with a timestamp and the file it produced.

2. Centralize The Internal List

One internal DNC list, fed by every channel: calls, texts, emails, web forms, and verbal requests. It must survive contact deletion, re-import, and CRM sync, and it must apply to every number on a contact rather than the one that opted out.

3. Document Consent For Five Years

Retain timestamps and IP addresses for web forms, recordings of verbal consent where recording is lawful, signed written consent, and the specific scope of what was agreed. Keep it for at least five years, which clears the TCPA's four-year statute of limitations with margin.

4. Train Reps On The Verbal Opt-Out

Most compliance training covers disclosures and ignores the moment that actually matters: a prospect saying "take me off your list" mid-call. Every rep needs one keystroke that suppresses the contact, and needs to know that "I'll pass it along" is not compliance.

5. Enforce In The Dialer, Not The Policy Doc

Controls that live in a policy document are controls that depend on a tired rep at 4:45 p.m. Controls that live in the dialing platform block the call before it connects. Push time-zone rules, suppression checks, and consent status into the system that places the call.

Key takeaway: every one of these five is auditable. If you cannot produce the artifact, an investigator will treat the control as absent.

Your DNC Compliance Audit Checklist

Run this against your current program. Anything you cannot evidence is a finding.

List Management

• Scrubbing against the National DNC Registry every 31 days, with dated records
• Checking every applicable state DNC list
• Internal DNC list capturing all channels, with timestamps and sources
• Suppression applied at the contact level, across all of a contact's numbers
• EBR status documented at the moment the relationship forms

Calling Practices

• Calling only between 8:00 a.m. and 9:00 p.m. in the recipient's local time
• Required disclosures delivered on every call
• Accurate caller ID transmitted on every call
• Opt-out requests processed within 10 business days
• Abandoned calls held under the 3% per-campaign cap

Consent and Records

• Appropriate consent obtained for cell phone calls
• Express written consent obtained for prerecorded calls and robocalls
• Consent records retained for five years or longer
• Compliance state surviving contact deletion and CRM re-import

Technology and Training

• Suppression enforced by the dialing platform, not by rep discipline
• Reps trained on handling a verbal opt-out mid-call
• Regular compliance audits with written findings
• Written policies and procedures kept current with the 2025 and 2026 rule changes

Key takeaway: score this checklist on evidence, not intent. Any line you cannot produce an artifact for is a line an investigator will treat as a control you do not have.

Where Your Dialer Has To Do The Work

Split the job honestly, because no single vendor covers all of it.

Registry scrubbing is a data service. Federal registry access comes from telemarketing.donotcall.gov, and state lists come from each state. Many teams add a dedicated scrubbing vendor to automate the 31-day cycle across both. That is a separate purchase from your phone system, and any vendor claiming to have replaced it deserves a hard question.

Internal suppression is a platform job. This is the half that lives inside the system placing the calls, and the half where the architectural failure described earlier actually happens.

Aloware enforces DNC and SMS opt-out at the contact level rather than the phone-number level. When any long-code or toll-free number on a contact replies STOP, every number on that contact is blocked for SMS immediately. A DNC flag blocks all calls and texts from every line and every agent on the account, and it cascades automatically to SMS opt-out. Removing a DNC flag requires an admin on a waiver-approved account to enter a written reason, and every removal is permanently logged.

The deletion problem is handled by storing compliance state in a per-account suppression table keyed to the phone number rather than the contact record. Delete a contact and re-import them, or let a HubSpot sync recreate them, and the DNC and opt-out flags are restored automatically. Sequences and lines cannot route around any of it, and a contact who opts out mid-sequence stops receiving messages on every number at once.

For the surrounding controls, our compliant calling page covers caller ID legitimacy, time-of-day enforcement, and abandoned-call limits, and A2P 10DLC registration governs the texting side. If you are weighing platforms on this dimension, our breakdown of the best sales dialers compares how each handles suppression. Teams adding automation should also read whether AI voice agents can call purchased lead lists, because consent rules apply identically whether a human or a machine places the call.

Key takeaway: buy registry scrubbing as a data service and enforce internal suppression in the dialer. Teams that assume one vendor covers both end up covered on neither.

Scrub every 31 days, suppress at the contact level, process opt-outs within 10 business days, and document all of it. That is the whole program, and it is cheaper than one certified class.

See how contact-level DNC enforcement works in Aloware