DNC Registry Compliance for Sales Calls and SMS Prospecting

DNC registry compliance for sales calls and SMS prospecting depends on several controls working together. Federal and state registries, company-wide opt-outs, and separate SMS consent requirements each address a different risk. A compliant outbound program must satisfy all of them simultaneously, while preserving the records needed to show why a call or message was permitted.

What the DNC compliance stack actually consists of

A team that equates compliance with list scrubbing sees only part of its exposure. Teams must follow the rules for three lists at once, the National Do Not Call Registry, company-specific internal DNC lists, and state registries. Each addresses a different source of restrictions. A federal registry check can miss requests made directly to a company, and teams with an internal suppression record still need state-list screening.

Federal oversight also spans two distinct rule sets. The Federal Trade Commission enforces the Telemarketing Sales Rule, which covers outbound telemarketing calls. The Federal Communications Commission enforces the Telephone Consumer Protection Act, which sets rules for automated calls, robocalls, and consumer consent. Most outbound sales teams operate under both frameworks, so meeting a registry-scrubbing requirement does not establish TCPA consent.

SMS adds a parallel set of obligations. Text marketing must follow TCPA consent requirements, CTIA Messaging Principles, and each carrier’s own rules, so the registry check used for voice outreach is not enough. Compliance therefore depends on both permission and suppression. One establishes the basis for contact, while the other records when contact must stop.

How the National Do Not Call Registry works and what it does not cover

The FTC’s TSR Q&A defines covered activity as any plan, program, or campaign to sell goods or services through interstate phone calls, including telemarketers calling for third-party sellers. The registry is free for consumers, and registration is permanent. It does not technically block incoming calls. Instead, it creates restrictions that callers must observe, with state registries adding requirements above the federal floor.

The TSR exempts calls from political organizations, charities calling on their own behalf, telephone surveyors, and companies with an established business relationship. A survey that includes a sales pitch loses its survey exemption. An established business relationship lasts 18 months from the consumer’s last purchase, rental, lease, or financial transaction, or three months from an inquiry or application. A direct request not to be called overrides that relationship immediately.

Registry access is itself a prerequisite to covered calling. The FTC states that a company can be liable for telemarketing calls even to unlisted numbers if it has not accessed the registry and paid required fees. The caller’s access status counts independently of the number’s registration status.

Why the internal DNC list is where most violations actually originate

The internal DNC list is the highest-probability failure point because it depends on how systems preserve a consumer’s request. Every company making outbound calls must capture requests not to be called, including the timestamp and source. The TSR requires the whole company to honor those requests. An opt-out held in one representative’s notes or one sequence’s suppression file does not meet that requirement.

The deeper weakness is often the suppression key. Most systems attach an opt-out to the specific phone number involved, leaving other numbers on the same contact record reachable. A contact with a mobile number, a direct line, and another number can therefore remain in circulation after asking for calls to stop. Contact-level suppression stops calls to every number on that contact record. Multi-number records and long re-engagement cycles make financial services, recruiting, real estate, and healthcare particularly exposed, with insurance and home services close behind.

A contact is deleted, returns through a CRM sync weeks later, and arrives without the previous opt-out. The representative then dials in good faith. Intent is not an element of the offense, so the lost record can produce the same violation as a deliberate call. The defect sits in the architecture.

How lead generator supply chains extend liability to the contracting company

External sourcing extends this architectural risk beyond the CRM. Lead generators may collect contact details through sweepstakes, coupons, and service offers without disclosing that the information will support telemarketing. The contracting company remains exposed to how the leads were obtained and whether their numbers appear on a registry.

The FTC alleged that Citizens Disability, LLC, a Massachusetts-based company assisting SSDI applicants, and its subsidiary CD Media placed more than 109 million outbound calls between January 2019 and July 2022. Those calls included numbers on the DNC Registry. The companies used lead generators whose websites, the FTC alleged, deceptively induced consumers to provide contact information.

A consent order filed September 30, 2025, required Citizens Disability to pay a large civil penalty. A larger total penalty was suspended after that payment but would become payable in full if the defendants misrepresented their financial condition. Vendor arrangements did not insulate the principal from enforcement. Companies buying leads must therefore check the consent disclosures and how the leads were collected, as well as the finished list, as part of their due diligence.

Where the DNC framework ends and SMS consent rules begin

A number’s absence from the registry does not authorize a marketing text. SMS requires a separate consent record under the TCPA framework, with CTIA principles and carrier rules adding their own conditions. These obligations run in parallel with call-list controls. They do not replace the need to honor existing opt-outs.

Prior express written consent is required for most marketing texts and auto-dialed sales calls to mobile phones. That consent must be physical or digital writing that clearly authorizes contact. Express verbal consent applies in limited non-marketing situations, with records covering its date, time, and nature. Implied consent from an established business relationship does not cover most automated marketing outreach.

CTIA principles are technically voluntary, but carriers can refuse to work with non-compliant senders. State-specific quiet hours also restrict when messages may be sent. Florida and Oklahoma restrict messaging between 8 PM and 8 AM local time. Every marketing SMS must include a clear opt-out instruction, and SMS opt-out requests must be honored immediately.

The 10DLC registration requirement that now blocks unregistered SMS traffic entirely

Businesses sending that traffic must register with The Campaign Registry. Registration is now a technical prerequisite to delivery. Without it, the operational consequence is immediate blocking rather than merely the possibility of a later penalty.

The registration process connects campaign infrastructure to consent documentation. It requires brand registration and campaign-level registration describing the use case, message content, and opt-in method. The campaign’s explanation of how recipients opted in forms part of the registration requirement.

Registration establishes the required brand and campaign records, while the sender still needs a valid basis for contacting each recipient. This distinction prevents a second version of the registry-scrubbing error. A registered route for sending messages is not proof that every message sent through it is permitted.

How the opt-out rules changed in April 2025 and what teams must update

Since April 2025, FCC rules have required businesses to accept revocation through any reasonable method and process it within 10 business days. Reasonable methods include email, phone calls, website forms, chatbots, and in-person requests. A keyword-only workflow is no longer sufficient. A consumer does not have to reply “STOP” for a request to require action.

This expansion returns the analysis to internal-list architecture. A CRM that flags only keyword replies can miss requests delivered by phone, email, or a form, leaving the contact eligible for later outreach. The result resembles the re-import failure described earlier. In both cases, the dialing or messaging system acts on a record that lacks a restriction the company has already received. The operational response is to capture requests across channels and preserve their timestamp and source in organization-wide suppression.

FCC 26-67, adopted September 30, 2026, provides that, once effective, an opt-out from one informational category may remain scoped to that category. It also permits a caller to designate one or more disclosed revocation methods. Those rules take effect after adoption, so teams must keep the April 2025 requirements separate from changes that have yet to take effect.

The one-to-one consent reversal and what it means for lead-gen consent models

The one-to-one consent rule was vacated before taking effect. It would have required separate consent for each marketing sender rather than allowing one consent to cover multiple senders. Multi-seller consent is therefore still lawful under the rules described here. The reversal left the existing obligation to obtain and document valid consent in place.

A multi-seller form’s disclosures determine what the consumer authorized. The Citizens Disability allegations illustrate the separate risk of collecting contact details without disclosing telemarketing use. Permitting a consent model does not legitimize a deceptive collection flow.

The strongest misreading is that the reversal permits weaker documentation. The existing TCPA written-consent requirements still apply. For teams buying leads or operating multi-sender campaigns, the practical lesson is to retain scrutiny of landing-page disclosures and the permission they establish.

How carrier-level enforcement is creating compliance risk that falls outside the legal rule set

Network access is becoming a separate source of compliance pressure. The FCC removed over 1,200 voice service providers from the Robocall Mitigation Database in August 2025 for failing to comply with mitigation-plan requirements, effectively disconnecting them from the U.S. phone network. In March 2026, the FCC approved a Notice of Proposed Rulemaking seeking comment on rules concerning communications providers using overseas call centers. That proposal targeted the pipeline of scam calls from foreign operations.

The FCC’s Consumer and Governmental Affairs Bureau issued a Public Notice on September 2, 2026, seeking comment on a proposed Robocall Scorecard. The public-facing tool would assess how effectively voice providers protect customers from illegal robocalls. Proposed measures include complaint volume and traceback responsiveness. One measures outcomes, while the other measures conduct.

The scorecard’s proposed design creates a reason for carriers to scrutinize customers whose campaigns generate complaints, even when those campaigns are legally compliant. High hang-up rates, low answer rates, and high complaint rates can make a customer appear commercially risky. The planning implication is that legal permission and continued carrier acceptance are distinct conditions, and the final scorecard’s form remains uncertain.

Building the compliance stack in practice — what each layer requires operationally

For practitioners, the framework becomes five connected operational requirements. Federal registry access comes first, including payment of required fees and scrubbing call lists every 31 days. Teams must keep download receipts to show when they screened the lists. For high-volume campaigns in Florida, Texas, or the other nine state-registry states, state lists should be scrubbed on the same cadence.

Internal suppression must then survive the contact’s lifecycle. Teams should suppress the contact and every attached number, capture requests from every channel with timestamp and source, and apply the restriction organization-wide. Suppression must persist through CRM deletion, re-import, and vendor handoffs. These controls address the gap between receiving a request and reliably preventing the next call.

Teams should get and store prior express written consent before sending marketing texts, complete 10DLC brand and campaign registration, and include opt-out instructions in every message. Lead-generator due diligence completes the operational stack. It should examine vendor landing pages and opt-in flows for clear disclosure of telemarketing use, rather than accepting registry scrubbing as evidence of consent.

Tooling should support these controls without fragmenting their records. Platforms that centralize suppression across channels, automate registry scrubbing, and retain auditable consent records reduce the architectural failures described above. Aloware’s outbound compliance platform is built to address those scrubbing, suppression, and audit-trail requirements. Teams should also track complaint volume and answer rates alongside those legal controls. The proposed scorecard suggests that carriers may put more weight on how consumers respond to outbound programs, even when those programs have a clean compliance record.