TCPA compliance fix list: so it does not happen twice
Updated 2026-11-03. Fill in on screen or on paper.
How do you make sure this never happens again? Fourteen changes to consent, lists, dialing, texting, vendors and record-keeping. Each one closes a gap that produces demand letters. Most are configuration and paperwork rather than cost. Work through them after the current matter is handled, or alongside it with your lawyer's agreement.
0 of 14 done. Saved in this browser only.
Which to do first
If you only do three: stop automated contact with any number you cannot produce written consent for; scrub every list against the National Do Not Call Registry and log it; and make every stop request reach every system the same day. Those three remove the facts behind most letters: no consent, no scrub, and contact after a request to stop.
The consent form, in more detail
The form a person sees has to do four things. Name your business, not "our partners". Say that the person agrees to receive calls and texts at the number they provided, including by automated technology or prerecorded or artificial voice, so that § 227(b) consent is covered. Say that agreeing is not a condition of buying anything. And get an affirmative act: a box they tick themselves, a signature, or a typed confirmation. Then store what they saw and when.
Revocation has to be as easy as consent. A person who replies "stop", says it on a call, or emails it has revoked. Your systems need to hear it wherever it arrives.
Vendors
Most demand letters to businesses that outsourced their calling trace to a vendor that did not keep consent records, did not scrub, or dialed outside the rules. The claimant pursues the business the calls were made for. Your contract is how you recover afterwards, if you can. So the contract has to say what the vendor must do, that you can check, and who pays if they did not. If a vendor will not sign compliance terms, that is the answer to whether to use them.
Timing with an open matter. Fixing your practice now is not an admission about the past, and a court is unlikely to treat a compliance improvement as evidence of earlier fault. Tell your lawyer what you are changing before you change it, so nothing is lost that should have been preserved and nothing is phrased as a confession.
Reviewing the list
Put a date six months out on the calendar for the named owner. The review is short: run the quarterly audit again, check for rule changes at fcc.gov, and re-read the consent form as a customer would. The letters stop when the practice behind them does.
Short answers
What is prior express written consent?
Under 47 C.F.R. § 64.1200(f), a written agreement, signed by the person (electronic signatures count), that clearly authorises a specific seller to deliver marketing calls or texts to a specific number using an autodialer or an artificial or prerecorded voice, with a clear statement that consent is not a condition of purchase. It is required for marketing calls or texts of that kind to mobile numbers.
How long must a number be on the Do Not Call Registry before calling it is a violation?
A number is protected once it has been on the registry for 31 days. Sellers must scrub against a version of the registry that is no more than 31 days old. Numbers can stay on the registry indefinitely.
Does the ATDS ruling in Duguid mean my dialer is fine?
The Supreme Court held in 2021 that an autodialer must use a random or sequential number generator to store or produce numbers. Many list-based dialers fall outside that. The prerecorded and artificial voice rules, the Do Not Call rules and state statutes such as Florida’s apply regardless. Do not treat Duguid as a licence.
Are AI voice calls covered by the TCPA?
Yes. The FCC ruled in 2024 that calls using AI-generated voices are "artificial" voices under the statute, so they need the same consent as prerecorded calls.
Is there a safe harbour if I call a Do Not Call number by mistake?
The rules include a safe harbour for an erroneous call to a registered number where the seller can show written procedures, training, a maintained internal list, a registry scrub within the required window, and that the call was an error. The procedures and the records have to exist before the call.