TCPA Compliance Checklist for Dialer Operators

If you run a predictive dialer, you need a TCPA compliance checklist — because you live under the TCPA whether you think about it or not. The Telephone Consumer Protection Act is one of the largest sources of legal risk for outbound calling in the United States. Statutory damages run $500 per violation, and up to $1,500 when the conduct is willful or knowing. A single campaign touching 50,000 numbers can rack up 50,000 separate violations. Class action firms specialize in these cases because the math is simple and the settlements are large.

This TCPA compliance checklist comes from SIPNEX, an FCC-licensed carrier. We provide SIP trunks for predictive dialers and VICIdial operations. We are not lawyers, and this is not legal advice. We are the carrier that sees compliance from the infrastructure side. We watch the call traffic, handle the STIR/SHAKEN attestation, and field questions from operators trying to stay legal while dialing at scale.

What is a TCPA compliance checklist?

A TCPA compliance checklist is a documented set of controls that keeps outbound calling within the Telephone Consumer Protection Act. The core controls: consent capture, DNC scrubbing every 31 days, 8 a.m.–9 p.m. recipient-local calling hours, abandon rates at or below 3 percent, and litigation-ready records that prove each control.

The condensed TCPA compliance checklist for business dialer operations:

1. Capture prior express written consent before autodialed telemarketing calls to cell phones.
2. Store consent proof — disclosure language, timestamp, method, phone number.
3. Honor revocation made by any reasonable means — the legal ceiling is 10 business days; aim for one.
4. Scrub the National DNC Registry every 31 days.
5. Maintain a company-specific DNC list; honor requests for 5 years.
6. Scrub state DNC registries (Indiana, Pennsylvania, Colorado, others).
7. Dial only 8 a.m.–9 p.m. in the recipient’s local time zone.
8. Keep the abandon rate at or below 3 percent per campaign, measured over 30 days.
9. Include caller identity, purpose, and opt-out in prerecorded messages.
10. Document policy, train staff, audit CDRs quarterly.

The full audited checklist, with the proof each control needs, is in the sectioned checklist below.

What the TCPA is and why the risk stays high

The Telephone Consumer Protection Act (47 U.S.C. § 227) became law in 1991 to shield consumers from unwanted sales calls. The FCC’s rules under it sit in 47 CFR 64.1200. Both have been amended or reinterpreted since, most notably by the FCC’s 2012 written-consent order (FCC 12-21), its 2024 revocation order (FCC 24-24), and the Supreme Court’s 2021 Facebook v. Duguid decision. The statute covers autodialed calls, prerecorded or artificial voice messages, and unsolicited fax ads. The FCC has applied it to text messages since 2003.

The core rule: you cannot call or text a cell phone with an automatic telephone dialing system (ATDS) or a prerecorded voice without the called party’s prior express consent. For telemarketing calls, the bar is higher — you need prior express written consent. The texting rules, including the 2025 revocation order, get their own treatment in TCPA text message compliance.

Damages are statutory. The plaintiff does not need to prove real harm. Each call or text is a separate violation. The baseline is $500 per violation. Courts can triple that to $1,500 for willful or knowing conduct. A campaign that dials 10,000 cell phones without valid consent faces $5 million to $15 million in exposure — before legal fees.

Three things keep the risk high. First, the FCC’s revocation rules took effect in April 2025. They let people opt out by any reasonable means, which gives callers more opt-outs to catch. Second, the plaintiffs’ bar treats TCPA cases as a volume business: per-call statutory damages make one campaign’s call logs worth a lawsuit. Third, state attorneys general can sue under the TCPA itself (47 U.S.C. § 227(g)) and under their own state telemarketing laws. That opens a second front of risk.

The practical point for operators: TCPA compliance is not a box you check once during campaign setup. It is an ongoing discipline. It touches your consent capture, your data handling, your dialer setup, your DNC process, and your carrier relationship.

The consent framework

TCPA consent comes in two tiers, and mixing them up is one of the most common failures. Getting consent at the right tier — and proving it later — decides most TCPA cases before they start.

Prior express consent is the baseline. It means the person gave you their number by choice, in a setting where they would expect calls. Example: a customer fills out a form on your website and lists a cell number as their contact. By sharing the number, they consent to informational calls tied to that transaction or relationship. Think appointment reminders, account updates, or service notices. This consent does NOT cover telemarketing.

Prior express written consent is the higher tier. It applies to telemarketing calls made with an autodialer or prerecorded voice to cell phones. It requires a written agreement, on paper or electronic. The agreement must clearly state that the person will get autodialed or prerecorded telemarketing calls. It must name the exact phone number to be called. And it must carry the person’s signature or e-sign equivalent.

The agreement cannot hide inside a terms of service. It must be a standalone disclosure the person actively accepts. And it cannot be a condition of purchase — you cannot demand consent before someone can buy from you.

A sample disclosure — have your counsel review before use:

By checking this box, I agree to receive marketing calls and texts from [Company] at the number provided, including via autodialer and prerecorded voice. Consent is not a condition of purchase. Message and data rates may apply. Reply STOP to opt out.

The tiers at a glance:

Consent capture and storage is where operators lose lawsuits. You may hold valid consent. But if you cannot prove it two years later when the lawsuit arrives, it does not matter. Store the exact disclosure text the person agreed to, the timestamp, the method (web form, verbal recording, paper), the phone number, and any transaction ID. For web forms, keep the page URL, form version, IP address, and browser details. For verbal consent, record the call and store the recording with metadata that links it to the consent event.

Revocation is a right the person can use at any time, by any reasonable means. The FCC’s revocation rules, in effect since April 11, 2025, made this explicit. Someone can revoke by telling your agent on the phone, texting “stop,” sending an email, or any other clear method. The rule says a revocation must be honored “within a reasonable time not to exceed ten business days from receipt” (47 CFR 64.1200(a)(10)). This checklist holds you to one business day, because every call after a revocation is a fresh risk.

Build revocation into your dialer workflow. When an agent hears a verbal opt-out, the number must land on your internal DNC list during the call — not after it.

Obtaining consent on a phone call: what holds up

Obtaining consent is the first line on the checklist. It is also the control most often done half-right.

Written consent does not have to arrive on paper. The FCC’s rule defines a “signature” to include an electronic or digital form, as long as federal law or state contract law recognizes it. The FCC’s 2012 order (FCC 12-21) spells out the accepted forms: consent obtained under the E-SIGN Act counts, “including permission obtained via an email, website form, text message, telephone keypress, or voice recording.”

That means a phone call can produce valid written consent. The agent reads the full disclosure. The person agrees in clear words. You keep the recording. Then you log the date, the time, the number, and the exact disclosure read. The same order puts the burden of proof on the seller. If any piece of that record is missing, treat the number as unconsented and re-obtain consent before the next telemarketing call.

The call that collects the consent must itself be lawful — a manually dialed call with a live agent, never an autodialed or prerecorded pitch to a cell number with no consent on file.

The ATDS question after Facebook v. Duguid

The meaning of “automatic telephone dialing system” has been one of the most litigated questions in TCPA law for a decade. The statute defines an ATDS as equipment that can store or produce phone numbers using a random or sequential number generator, and then dial them.

In April 2021, the Supreme Court decided Facebook v. Duguid and narrowed that definition. A device must have the capacity to store or produce numbers using a random or sequential number generator. Equipment that merely stores and dials numbers from a list does not qualify. This was a big win for businesses. It took most modern dialers, which work from uploaded lead lists rather than random numbers, outside the federal definition.

The story did not end there. Duguid settles only the federal definition, and state laws set their own. Florida’s Telephone Solicitation Act, for example, reached any automated system for the “selection or dialing” of numbers until a 2023 amendment (HB 761) changed that to “selection and dialing.” And the plaintiffs’ bar changed tactics. Instead of arguing ATDS, many suits now target consent defects, revocation failures, or DNC violations — issues Duguid did not affect.

For VICIdial and predictive dialer operators: VICIdial dials from uploaded lead lists, not random numbers. Under Duguid, that likely means VICIdial is not an ATDS for federal purposes. But “likely” is not “certainly,” and state laws may differ. The safe path is to treat your dialer as an ATDS and get prior express written consent for telemarketing calls. With written consent on file, the label no longer matters — you already met the higher standard.

Bottom line: treat every dialer as an ATDS and get written consent — then the classification fight never touches you.

DNC compliance: federal and state

The Do Not Call rules sit apart from the ATDS and consent framework. They trip up operators who focus only on consent.

The National Do Not Call Registry is run by the FTC. Before placing telemarketing calls, scrub your lists against it. Do it at least every 31 days: the FCC’s safe harbor requires a copy of the registry obtained no more than 31 days before the call (47 CFR 64.1200(c)(2)). Numbers can be added at any time, so a stale list puts you at risk. Access it at telemarketing.donotcall.gov. There is a per-area-code fee, and it is trivial next to the cost of one violation.

Company-specific DNC lists are separate from the National Registry. When a person tells you to stop calling — by any means — add them to your internal DNC list. The rules allow at most ten business days to process the request and require you to honor it for five years (47 CFR 64.1200(d)(3) and (d)(6)). This applies even if they never joined the National Registry. The list is yours to keep; the FCC offers no central system for it. Build it into your CRM. When an agent marks a call “do not call,” that number must drop out of every future campaign, not just the current one.

State DNC lists add another layer, and many operators miss it. Indiana, Pennsylvania, Colorado, and several other states keep their own do-not-call registries. If you call into those states, scrub against the state registry too. Penalties vary, but some states allow private lawsuits much like the federal TCPA.

Litigator scrubbing is optional. Commercial databases track serial TCPA plaintiffs and numbers tied to past TCPA suits, and a litigator scrub suppresses them the way a DNC scrub suppresses registry numbers. No law requires it. It is risk management layered on top of the required scrubs.

EBR (Established Business Relationship) exceptions exist, but they are narrower than most operators think. An existing customer relationship exempts you from the National Registry for 18 months after the last transaction, or 3 months after the last inquiry. The exception does NOT override a company DNC request. If the customer says “do not call me,” the EBR is gone, no matter how fresh the relationship. And some states do not recognize the exception at all.

Vendors, lead sellers, and calls made on your behalf

The TCPA does not stop at your own dialer. Courts apply vicarious liability: you can be on the hook for calls that agencies, lead vendors, and outside call centers place for you. “The vendor did it” is not a defense when the campaign runs in your name and for your benefit.

Three controls close most of the gap. First, demand consent proof from every lead seller — the disclosure text the person saw, the timestamp, and the source URL. If a vendor cannot produce that for each record, treat the list as unconsented. Second, audit vendor contracts for TCPA warranty and indemnification language. Make compliance a term of the deal, not a handshake.

Third, test purchased lists before a campaign, not after. Run them against your own company DNC list and the National Registry, and spot-check consent records for a sample of numbers. A vendor’s “pre-scrubbed” label is marketing, not evidence — the scrub that matters legally is your own.

Calling hours and restrictions

The federal TCPA rules limit telemarketing calls to 8:00 a.m.–9:00 p.m., local time of the called party (47 CFR 64.1200(c)(1)). This is one of the most violated rules. The time zone that matters is not yours — it is the recipient’s.

Say your call center is in Texas (Central Time) and you start dialing at 8:00 a.m. Central. You are calling at 9:00 a.m. Eastern — fine. But you are also calling at 6:00 a.m. Pacific. That is a violation for every call landing in California, Oregon, Washington, Nevada, or any other Pacific Time state. By 9:00 p.m. Central, it is 10:00 p.m. Eastern — and every East Coast call in that last hour was a violation.

The fix is not hard, but it needs deliberate setup. Work out the time zone of each lead, starting from the area code. Then apply NPA-NXX (area code plus prefix) data for better accuracy. Some area codes span two time zones — 219 in Indiana covers both Eastern and Central. When in doubt, use the stricter zone.

In VICIdial, set your hopper filters to enforce calling windows by time zone. Set campaign hours to the most restrictive window. For lower-48 campaigns, that means 11:00 a.m.–9:00 p.m. Eastern, which is 8:00 a.m.–6:00 p.m. Pacific. Then adjust per list or per filter based on where your leads live.

State rules vary. Some states trim the window further — Oregon ends telemarketing calls at 8:00 p.m. (ORS 646.563, as amended in 2025 by HB 3865, which also brought texts under the law), an hour before the federal cutoff. Kentucky bars solicitation calls to residences before 10:00 a.m. (KRS 367.46955(16)). Some bar calls on certain holidays or Sundays. If you dial nationally, build a state-level calling-hours matrix and wire it into your hopper setup.

What changed in 2025

Two changes matter most for the checklist. Both are already baked into the items below.

Revocation got teeth. Most of the FCC’s 2024 revocation order (FCC 24-24) took effect on April 11, 2025. People may now revoke consent by any reasonable means — no special keyword, no single channel. Callers must honor the request within a reasonable time, and never more than 10 business days. Our checklist holds you to one business day. That is stricter than the legal outer bound on purpose: every call after a revocation is a fresh violation.

One-to-one consent died in court. The FCC’s one-to-one consent rule for lead generators was vacated by the Eleventh Circuit on January 24, 2025, in Insurance Marketing Coalition v. FCC — just before its effective date. The older written-consent standard governs again. Do not relax, though. Lead buyers still carry the burden of proving valid consent for every purchased record. The full story is in our answer to what happened to the one-to-one consent rule.

The carrier’s role vs your role

Most operators skip this section. It is also the part that decides whether you picked the right carrier. The full carrier-vs-operator duty matrix lives on our TCPA compliance for operators page — the short version follows.

What the carrier provides (carrier-level compliance infrastructure):

STIR/SHAKEN attestation — we sign your calls with our own SP-KI certificate. If your DIDs are verified, you get A-level attestation. This does not make you TCPA-compliant. It does keep partial (B) attestation, which analytics engines treat as a lower-trust signal, off your calls while you manage your TCPA duties.

Call recording — whether it runs in your dialer or at the carrier, use it for consent proof, quality assurance, and dispute resolution. Recording is a tool. How you use it — including state recording consent laws — is on you.

CDR (Call Detail Record) access — call records with timestamps, durations, and disposition codes. Ask your carrier how fast its CDRs are available and how long it keeps them. These records are core evidence when you need to prove compliance in court.

Opt-out signaling — on SMS, the carrier-layer plumbing that processes STOP replies automatically.

What is YOUR responsibility (campaign-level compliance):

Consent capture and storage. DNC scrubbing against federal and state registries. Company DNC list upkeep. Calling-hour enforcement by recipient time zone. Campaign content rules — required disclosures and opt-out instructions. Abandon-rate control (the FCC caps abandoned telemarketing calls at 3 percent of live-answered calls per campaign, measured over 30 days). Records strong enough to prove compliance in court.

What a carrier cannot do: capture your consent, scrub your lists, or enforce your calling hours. Those duties live in your data and your dialer, which your carrier never sees. A carrier that claims its trunk makes you TCPA-compliant is describing a product that does not exist.

We give you the infrastructure. You own the policy. SIPNEX is not your lawyer, your compliance officer, or your insurance policy. We are the carrier that gives you a sound technical base — clean attestation and accurate call records — so your compliance work does not sit on a reseller trunk that cannot even tell you its attestation level.

The full TCPA compliance checklist

Use this as the starting point for your own program. Every item should be checkable — if you cannot produce proof for a line item, you have a gap. Each line exists to protect you from statutory damages that multiply per call.

Consent

• Written consent forms capture phone number, disclosure language, signature/e-sign, and timestamp
• Consent records stored with unique identifiers linked to call records
• Consent language reviewed by legal counsel within the past 12 months
• Revocation process documented and tested
• Revocation honored within one business day (legal ceiling: ten business days)

DNC

• National DNC Registry scrubbed within the past 31 days
• Company-specific DNC list kept current and suppressed across all campaigns
• State DNC registries scrubbed for applicable states
• DNC additions processed within 24 hours of request (legal ceiling: ten business days)
• DNC records retained for minimum 5 years
• Optional: litigator scrub run before each campaign

Calling hours

• Time zone assigned to every lead record
• Hopper filters enforce 8am-9pm recipient local time
• State-specific limits applied where they exist
• No calls placed outside permitted windows in the past 90 days (audit your CDRs)

Dialer configuration

• Abandon rate tracked and held at or below 3 percent per campaign in each 30-day period
• Prerecorded messages include required disclosures (caller identity, purpose, opt-out mechanism)
• Live agent connects within 2 seconds of the called person’s completed greeting, or the prerecorded identification and opt-out message plays (47 CFR 64.1200(a)(7))
• Ringless voicemail to cell phones treated as a call that needs consent (FCC 22-85, 2022)

Documentation

• All of the above documented in a written TCPA compliance policy
• Policy reviewed and updated at least annually
• Staff trained on TCPA duties, with training records kept
• Compliance audits run quarterly using CDR data and DNC records

The SMS side of the checklist

Texts can carry the same per-message exposure as calls, plus carrier rules of their own:

• Written consent captured before any marketing text goes out
• STOP and the FCC’s standardized revocation keywords honored automatically
• One opt-out confirmation message sent, then silence
• Texting quiet hours enforced — the same 8 a.m.–9 p.m. recipient-local rule
• Consent records tied to each individual number

The full texting framework, including the 2025 revocation rules, is in TCPA text message compliance.

Frequently asked questions

What is TCPA compliance?

TCPA compliance means running your outbound calls and texts within the Telephone Consumer Protection Act (47 U.S.C. § 227) and its FCC rules. In practice, that means getting consent before you call or text. It means honoring the National and company-specific Do Not Call lists, keeping calls inside permitted hours for the recipient’s time zone, and holding abandon rates within FCC limits. It also means documenting all of it well enough to defend a lawsuit. It is not a one-time setup. It is an ongoing discipline of audits, list scrubbing, and policy updates as the FCC issues new guidance.

What are the penalties for TCPA violations?

Statutory damages are $500 per violation — per call or text — for negligent violations, and up to $1,500 per violation for willful or knowing ones. There is no cap on total damages. A campaign that calls 20,000 numbers without valid consent faces $10 million to $30 million in exposure. TCPA cases can run as class actions, which is why plaintiffs’ lawyers chase them so hard.

The FCC can also impose forfeiture penalties on its own. State attorneys general can sue under the TCPA itself and under state telemarketing laws with their own penalty structures. For most calling operations, the financial risk of non-compliance is existential.

Do I need written consent for all outbound calls?

Not all, but for the calls most dialer operators make, yes. Prior express written consent is required for telemarketing calls made with an autodialer or prerecorded voice to cell phones. If you are selling, promoting a service, or soliciting donations with a predictive dialer, you need written consent.

Informational calls — appointment reminders, account alerts, service notices — need only prior express consent: the person gave you their number in a relevant context. Landline calls with live agents and no recordings follow different rules. The safest practice for any marketing or sales dialer: get written consent for every number you dial.

Is STIR/SHAKEN attestation the same as TCPA compliance?

No. They operate at different layers. STIR/SHAKEN is a carrier-level technical framework that verifies caller ID with cryptography. It feeds the verified-caller display some phones show, and it is one of several signals analytics engines weigh when they label calls. TCPA is a federal consumer protection law. It governs consent, do-not-call duties, calling hours, and autodialer use.

You can have perfect A-level attestation and still be deep in TCPA violation if you call without consent. You can also have bulletproof consent and still send calls that analytics engines treat as lower-trust if your carrier only signs at B-level. You need both: the right carrier for attestation, and your own TCPA program for consent and DNC.

Is VICIdial considered an ATDS under TCPA?

After the Supreme Court’s 2021 ruling in Facebook v. Duguid, the federal ATDS definition requires the capacity to store or produce numbers using a random or sequential number generator. VICIdial dials from uploaded lead lists, not random numbers, so it likely does not qualify as an ATDS under the federal Duguid standard.

But Duguid settles only the federal definition. State laws set their own autodialer tests and calling rules, and plaintiffs keep testing the edges in court. The safe move: treat VICIdial as an ATDS and get prior express written consent for telemarketing calls. With valid written consent, the label stops mattering.

Am I liable if a lead vendor or agency violates the TCPA on my behalf?

Yes, you can be. Courts apply vicarious liability under the TCPA. When an agency, lead seller, or outside call center dials in your name and for your benefit, the violations can land on you. Plaintiffs usually sue the brand, not the vendor — the brand has deeper pockets, and the campaign ran for its products.

The controls that hold up: demand consent proof (disclosure text, timestamp, source URL) for every purchased record. Put TCPA warranty and indemnification terms in vendor contracts. And run purchased lists through your own DNC suppression before dialing. If a vendor cannot document consent, treat the list as unconsented.

What hours can I legally make telemarketing calls under the TCPA?

Federal law allows telemarketing calls between 8 a.m. and 9 p.m. in the recipient’s local time zone — not yours. A Texas call center dialing at 8 a.m. Central reaches Pacific numbers at 6 a.m., and each of those calls is a violation. State rules can be tighter: Oregon ends calls at 8 p.m. (ORS 646.563), and Kentucky bars solicitation calls to residences before 10 a.m. (KRS 367.46955(16)). Enforce the windows with time-zone-aware hopper filters, and use NPA-NXX data where an area code spans two zones.

---

SIPNEX is an FCC-licensed carrier with its own STIR/SHAKEN Service Provider certificate. We provide the carrier layer — A-level attestation for verified numbers on our SIP trunks — so your TCPA compliance checklist runs on a solid technical base.