DNC Compliance for Outbound Sales Teams: Rules, Penalties, and What Changed in 2026

TL;DR

DNC compliance means scrubbing every calling list against the National Do Not Call Registry at least every 31 days, keeping your own internal do-not-call list, honoring opt-out requests within 10 business days, and documenting consent for every number you dial. Miss any one of those and each call becomes a separately punishable violation.

• Scrub cadence: every 31 days minimum, against the federal registry and any applicable state list.
• Opt-out window: 10 business days, in force since April 11, 2025.
• Calling hours: 8:00 a.m. to 9:00 p.m. in the recipient's local time.
• Federal exposure: up to $53,088 per violation under the FTC's penalty schedule, plus $500 to $1,500 per call in private TCPA damages.
• The rule that was struck down: one-to-one consent was vacated in January 2025 and never took effect.
• New on September 30, 2026: the FCC adopted FCC 26-67. Once it takes effect, an opt-out from one informational category may stay in that category, and a caller may designate one or more disclosed revocation methods. It takes effect 30 days after Federal Register publication, on a date a later FCC Public Notice will set, and supersedes the January 31, 2027 revoke-all date.

Your reps are dialing a list somebody exported six weeks ago. One of those numbers asked you to stop calling in March, on a different phone, from a contact record that has since been deleted and re-imported. That single call is worth more in statutory damages than the rep is worth in monthly quota, and nothing in the dialer stopped it.

That gap between "we scrub our lists" and "we can prove we scrubbed this number" is where outbound teams get hit.

What DNC Compliance Actually Requires

DNC compliance is the practice of following federal and state Do Not Call regulations when making outbound sales calls. It requires you to avoid calling numbers on the National Do Not Call Registry, maintain an internal do-not-call list, and honor consumer opt-out requests permanently.

The Federal Trade Commission created the registry in 2003. By the end of fiscal year 2025 it held more than 258 million phone numbers, up more than 4.8 million year over year, and the FTC logged more than 2.6 million DNC complaints that year. If you want the consumer-side explanation of how numbers get on that list, start with what a do-not-call list is.

Two federal regulations govern the work:

Both apply to most outbound sales teams at the same time. The TSR governs how you telemarket; the TCPA governs consent and the technology you dial with.

Key takeaway: registry scrubbing satisfies the TSR. It does not satisfy the TCPA. Consent is a separate obligation with separate damages attached.

The Three Lists You Have To Manage

Compliance fails at the seams between three separate lists. Manage all three or the program does not hold.

1. The National Do Not Call Registry

Telemarketers subscribe and download at telemarketing.donotcall.gov, and must scrub against the registry at least every 31 days. The FY 2026 fee schedule charges $82 per area code, with the first five area codes free and a nationwide cap of $22,626. Keep the download receipts. A scrub you cannot date is a scrub you cannot defend.

2. State Do Not Call Lists

Eleven states run their own registries on top of the federal one: Colorado, Florida, Indiana, Louisiana, Massachusetts, Missouri, Oklahoma, Pennsylvania, Tennessee, Texas, and Wyoming. State penalties run from $100 to $25,000 per call, and state attorneys general enforce independently of the FTC. If you dial Florida or Texas at volume, scrub those lists on the same cadence as the federal one.

3. Your Internal Do Not Call List

This is the list teams get wrong, and it is the one that produces the lawsuits. Every company making outbound calls must keep an internal DNC list capturing anyone who asked not to be called, from any channel, with a timestamp and a source.

The failure is almost always architectural. Most systems record the opt-out against the phone number that received it, so a contact with a mobile, a direct line, and a spouse's number stays reachable on two of the three.

Wrong: suppress the number. Right: suppress the contact, then every number attached to it.

The same flaw shows up in list hygiene. A contact gets deleted, re-imported from a CRM sync three weeks later, and arrives with a clean record. The opt-out is gone. The rep dials in good faith. The violation is identical to a deliberate one, because intent is not an element of the offense.

Financial services, recruiting, real estate, and healthcare outreach teams carry the most risk here, because they run the largest multi-number contact records and the longest re-engagement cycles. Insurance and home-services teams run a close second.

Key takeaway: an opt-out belongs to the person, not the handset. If your suppression logic is keyed to a phone number, you have a compliance gap you cannot see from a dashboard.

The Rules Governing Every Outbound Call

Calling Time Restrictions

Call only between 8:00 a.m. and 9:00 p.m. local time at the called person's location. The FTC's Telemarketing Sales Rule at 16 CFR 310.4(c) makes an outbound call to a residence outside that window an abusive practice absent that person's prior consent. Separately, 47 CFR 64.1200 caps abandoned calls at 3% of calls answered live by a person, measured over a 30-day period for a single campaign, which is the rule that makes predictive dialing hazardous.

Required Disclosures

Within the first few seconds of every call, disclose:

1. The caller's name
2. The company being represented
3. The purpose of the call, when it is sales-related
4. A callback number or address

Consent Requirements By Call Type

What you need depends entirely on how you are dialing:

The Established Business Relationship Exemption

You may call a registry-listed consumer if you hold an established business relationship, defined as a transaction or payment within the past 18 months, or an inquiry or application within the past 3 months.

Document every EBR at the moment it forms. Reconstructing one after a demand letter arrives is where this exemption collapses.

Key takeaway: the EBR clock is 18 months for customers and 3 months for inquiries. Both are shorter than most CRMs' definition of an active contact.

DNC Compliance vs. TCPA Compliance

The two are related and routinely conflated. Here is the split:

The distinction matters because the enforcement mechanisms differ. The FTC and state AGs bring TSR actions. Private plaintiffs bring TCPA class actions, and they bring a great many of them. Our TCPA compliance checklist covers the consent side in depth.

Key takeaway: a clean registry scrub is no defense to a TCPA consent claim. The two regimes are enforced by different parties and you can win one while losing the other.

What DNC Violations Actually Cost

Federal Penalties

• TSR violations: up to $53,088 per violation. TSR violations are penalized through the FTC Act, where the FTC raised the maximum civil penalty from $51,744 to $53,088 effective January 2025.
• TCPA statutory damages: $500 per violation, trebled to $1,500 for willful or knowing violations.
• No damages cap: statutory damages multiply by call volume with no ceiling.

State Penalties

State fines run from $100 to $25,000 per violation, and a state action can proceed in parallel with a federal one on the same call records. Florida enforces its registry aggressively. California runs no separate registry but pursues telemarketing claims under its own statutes, so absence from the eleven-state list is not absence of risk.

Class Action Exposure

Private TCPA litigation is the real exposure, and it is climbing. 856 TCPA class actions were filed through April 2026, against 691 through April 2025, a 23% year-over-year increase, with April 2026 alone producing 330 TCPA cases.

The arithmetic is what makes these cases existential. In Wakefield v. ViSalus, a jury found the supplement marketer had placed 1,850,440 prerecorded calls in violation of the TCPA. At the $500 statutory minimum, the award came to $925,220,000. The Ninth Circuit later vacated the district court's denial of ViSalus's due-process challenge and remanded for a fresh assessment of whether an award that size is constitutionally excessive, which is a real check but not one any board wants to plan around.

Key takeaway: no single call is expensive. A list is. Multiply your worst uncorrected list error by your dial volume and you have your actual exposure number.

What Changed in 2025 and 2026

Three regulatory developments changed the compliance picture, and two of them are widely misreported.

One-to-One Consent Was Vacated, Not Delayed

The FCC's one-to-one consent rule would have required separate consent for each individual seller and limited consent to interactions logically and topically related to the original request. It never took effect. On January 24, 2025 the Eleventh Circuit vacated both requirements in Insurance Marketing Coalition Ltd. v. FCC, holding that the FCC had exceeded its statutory authority, and the Commission has since removed the language from its rules.

If your compliance calendar still carries an April 2026 deadline for one-to-one consent, delete it. The prior definition of prior express written consent governs.

The 10-Business-Day Opt-Out Rule Is Live

Since April 11, 2025 you must process a revocation within 10 business days, down from 30. Until FCC 26-67 takes effect, a revocation made by any reasonable method counts. Some methods are automatically reasonable, including a STOP-family reply keyword, an interactive voice response opt-out, and any website or phone number you designate for the purpose. Others, including voicemail and email, are treated as reasonable unless you can rebut it. Once the order is in force, you may name one or more of those three methods as the only ones you accept, as long as you disclose them on the call or in the text. A caller that designates nothing still owes every reasonable method. A verbal request to a rep mid-call is the one that breaks programs, because it only enters the system if the rep logs it.

The Revoke-All Rule Was Rewritten on September 30, 2026

The rule the FCC kept delaying was the one requiring a revocation made in response to one type of informational message to apply to all future calls and texts from that caller, including those on unrelated subjects. The Consumer and Governmental Affairs Bureau pushed it to April 11, 2026, then extended the waiver to January 31, 2027 while the Commission reviewed it.

The Commission has now ruled. On September 30, 2026 the FCC adopted FCC 26-67, released October 1, which rewrites 47 CFR 64.1200(a)(10) and takes effect 30 days after Federal Register publication. The order states that on that day it supersedes the January 31, 2027 date, and that the Commission will name the exact date in a later Public Notice. Until then, nothing has changed on the ground.

What changes for a sales team once it is in force:

• A revocation sent in reply to an informational call or text may be read as covering that category only. A revocation in reply to a marketing call or text still revokes consent to every marketing call and text from your company.
• You may designate the way consent is revoked. The three choices are an automated voice or key-press opt-out on the call, a reply text using any of stop, quit, end, revoke, opt out, cancel or unsubscribe, or a website or phone number you name. Designate one or more, disclose it clearly on the call or in the text, and you are not required to process revocations made any other way. A text sender that designates the reply keyword meets the disclosure duty by carrying one of those seven words in every message.
• Designate nothing and the old standard stays. You must honor a revocation made by any reasonable means. A request made some other way, once the consumer shows it was made, carries a rebuttable presumption that consent was revoked.
• Ten business days to honor a request is unchanged. So is the confirmation text: one sent within five minutes is presumed to fall inside the consumer's consent, as long as it only confirms the opt-out and carries no marketing.

Should a sales team designate? For texting, yes, and it is cheap. Put one of the seven words in every text, such as "Reply STOP to opt out." The order says one word per text satisfies the disclosure, as long as you honor all seven. That takes the reasonableness guesswork out of consent revocation. It does not take the judgment out of a marketing text. 47 CFR 64.1200(e) applies the company-specific do-not-call rules to telemarketing texts. So a reply like "don't text me again" is a do-not-call request under 64.1200(d)(3), whatever you designated. For prerecorded or AI voice telemarketing calls it changes less. 47 CFR 64.1200(b)(3) still requires an automated, interactive voice or key-press opt-out on those calls, and the order says the designation does not alter that. One more thing to build for: the same order asks for comment on cutting the ten business days to seven. A process that needs all ten is already behind.

The designation covers consent to autodialed and prerecorded calls and to texts, and the signed written permission that lets you call a number on the registry. It does not touch the do-not-call request a prospect makes to a live rep. Under 47 CFR 64.1200(d)(3), a residential subscriber who tells your rep not to call goes on your internal list at the time of the request and must be honored within 10 business days. The TSR at 16 CFR 310.4(b)(1)(iii)(A) separately bars calling a person who has said they do not want your calls. Neither depends on the revocation method you designated, and the same (d)(3) duty covers a marketing text that asks you to stop. Build the designation into your texting and your dialer. Keep a one-keystroke suppression in front of every rep.

Plaintiffs' firms already argue that a consumer who opts out of one message stream meant all of them, and the same order asks whether to require a one-step way to revoke everything. Building account-wide revocation now costs less than retrofitting it under a consent decree.

Key takeaway: one-to-one consent is dead, the 10-business-day clock is running, and on September 30, 2026 the FCC rewrote the revoke-all rule: once it takes effect, an opt-out from one informational category may stay in that category, and you may designate one or more disclosed revocation methods. Compliance calendars written before mid-2025 have all three wrong.

How To Build a DNC Compliance Program

Five components, in the order they fail:

1. Scrub On A Schedule You Can Prove

Scrub against the federal registry every 31 days at minimum, and against state lists for every state you dial. Scrub again immediately before each campaign launch, and log every scrub with a timestamp and the file it produced.

2. Centralize The Internal List

One internal DNC list, fed by every channel: calls, texts, emails, web forms, and verbal requests. It must survive contact deletion, re-import, and CRM sync, and it must apply to every number on a contact rather than the one that opted out.

3. Document Consent For Five Years

Retain timestamps and IP addresses for web forms, recordings of verbal consent where recording is lawful, signed written consent, and the specific scope of what was agreed. Keep it for at least five years, which clears the TCPA's four-year statute of limitations with margin.

4. Train Reps On The Verbal Opt-Out

Most compliance training covers disclosures and ignores the moment that actually matters: a prospect saying "take me off your list" mid-call. Every rep needs one keystroke that suppresses the contact, and needs to know that "I'll pass it along" is not compliance.

5. Enforce In The Dialer, Not The Policy Doc

Controls that live in a policy document are controls that depend on a tired rep at 4:45 p.m. Controls that live in the dialing platform block the call before it connects. Push time-zone rules, suppression checks, and consent status into the system that places the call.

Key takeaway: every one of these five is auditable. If you cannot produce the artifact, an investigator will treat the control as absent.

Your DNC Compliance Audit Checklist

Run this against your current program. Anything you cannot evidence is a finding.

The Safe Harbor You Are Auditing Against

There is a national DNC safe harbor, and it only covers mistakes. The TSR sets it out at 16 CFR 310.4(b)(3). A seller that calls a registered number, or a person who asked not to be called, escapes liability only when it can show all six of these as routine business practice:

1. Written procedures to comply with the do-not-call rules.
2. Personnel trained in those procedures, including any vendor assisting with compliance.
3. An internal list of numbers the seller may not contact, maintained and recorded.
4. A process that suppresses every number on that list and on a version of the national registry obtained no more than 31 days before the call, with records documenting it.
5. Monitoring and enforcement of those procedures.
6. A call that resulted from error, not from failing to capture a do-not-call request.

The FCC's version at 47 CFR 64.1200(c)(2)(i) covers calls to registered numbers. It uses the same error test, written procedures, training, internal list and 31-day registry process. It has no separate monitoring line. It adds that you buy registry access from the administrator and use it for compliance only. In the checklist below, the safe harbor turns on the List Management lines, the rep-training line, the compliance-audits line and the written-policies line.

List Management

• Scrubbing against the National DNC Registry every 31 days, with dated records
• Checking every applicable state DNC list
• Internal DNC list capturing all channels, with timestamps and sources
• Suppression applied at the contact level, across all of a contact's numbers
• EBR status documented at the moment the relationship forms

Calling Practices

• Calling only between 8:00 a.m. and 9:00 p.m. in the recipient's local time
• Required disclosures delivered on every call
• Accurate caller ID transmitted on every call
• Opt-out requests processed within 10 business days
• Abandoned calls held under the 3% per-campaign cap

Consent and Records

• Appropriate consent obtained for cell phone calls
• Express written consent obtained for prerecorded calls and robocalls
• Consent records retained for five years or longer
• Compliance state surviving contact deletion and CRM re-import

Technology and Training

• Suppression enforced by the dialing platform, not by rep discipline
• Reps trained on handling a verbal opt-out mid-call
• Regular compliance audits with written findings
• Written policies and procedures kept current with the 2025 and 2026 rule changes

Key takeaway: score this checklist on evidence, not intent. Any line you cannot produce an artifact for is a line an investigator will treat as a control you do not have.

Where Your Dialer Has To Do The Work

Split the job honestly, because no single vendor covers all of it.

Registry scrubbing is a data service. Federal registry access comes from telemarketing.donotcall.gov, and state lists come from each state. Many teams add a dedicated scrubbing vendor to automate the 31-day cycle across both. That is a separate purchase from your phone system, and any vendor claiming to have replaced it deserves a hard question.

Internal suppression is a platform job. This is the half that lives inside the system placing the calls, and the half where the architectural failure described earlier actually happens.

Aloware enforces DNC and SMS opt-out at the contact level rather than the phone-number level. When any long-code or toll-free number on a contact replies STOP, every number on that contact is blocked for SMS immediately. A DNC flag blocks all calls and texts from every line and every agent on the account, and it cascades automatically to SMS opt-out. Removing a DNC flag requires an admin on a waiver-approved account to enter a written reason, and every removal is permanently logged.

On the texting side, the keyword list matters more once FCC 26-67 is in force. A sender that designates the reply keyword as its revocation method has to recognize all seven of the FCC's standardized words. On long-code and toll-free numbers, Aloware recognizes STOP, STOPALL, STOP ALL, UNSUBSCRIBE, CANCEL, END, QUIT, REVOKE, OPTOUT, OPT OUT and REMOVE, which covers the seven. The match is exact keyword only: "please stop texting me" does not trigger an opt-out. The order does not say whether a sentence that contains one of the seven words counts as a reply with that word. On a marketing text, any reply asking you to stop is a do-not-call request under 64.1200(d)(3) anyway. Route every reply that asks you to stop, keyword or not, to a person and honor it within 10 business days.

The deletion problem is handled by storing compliance state in a per-account suppression table keyed to the phone number rather than the contact record. Delete a contact and re-import them, or let a HubSpot sync recreate them, and the DNC and opt-out flags are restored automatically. Sequences and lines cannot route around any of it, and a contact who opts out mid-sequence stops receiving messages on every number at once.

For the surrounding controls, our compliant calling page covers caller ID legitimacy, time-of-day enforcement, and abandoned-call limits, and A2P 10DLC registration governs the texting side. If you are weighing platforms on this dimension, our breakdown of the best sales dialers compares how each handles suppression. Teams adding automation should also read whether AI voice agents can call purchased lead lists, because consent rules apply identically whether a human or a machine places the call.

Key takeaway: buy registry scrubbing as a data service and enforce internal suppression in the dialer. Teams that assume one vendor covers both end up covered on neither.

Scrub every 31 days, suppress at the contact level, process opt-outs within 10 business days, and document all of it. That is the whole program, and it is cheaper than one certified class.

See how contact-level DNC enforcement works in Aloware