State DNC lists that go beyond federal requirements: what you must check

Last updated 2026-07-09

Why does the federal DNC list leave gaps that states fill?

The federal Do Not Call Registry covers most commercial telemarketing calls to U.S. consumers. The FTC runs it under 15 U.S.C. § 6101, and the TCPA at 47 U.S.C. § 227 backs the framework. ^[1] That sounds complete until you read the exemptions.

The federal rules carve out charitable solicitations, political calls, survey calls, and calls from businesses with an established business relationship (EBR) lasting up to 18 months after a purchase. ^[2] Those carve-outs touch a lot of phone calls and a lot of people.

States saw the gap and moved. Many passed their own DNC statutes that narrow or kill some federal exemptions, shorten EBR windows, charge telemarketers registration fees, and set their own per-call penalties. The Telemarketing Sales Rule says plainly that state laws giving consumers greater protection are not preempted. ^[3] That one sentence is the reason compliance teams can't check federal do not call list registration and call it a day.

Here's the part that stings. A call that is perfectly legal under federal law can still trigger a $10,000 or $25,000 state fine. Insurance agents, home-improvement contractors, financial service firms, and debt collectors all find this out the hard way.

Which states run their own DNC lists right now?

At least 14 states run active DNC registries or no-call rules that go meaningfully past the federal baseline: Colorado, Florida, Indiana, Louisiana, Massachusetts, Michigan, Mississippi, Missouri, Montana, North Carolina, Oklahoma, Oregon, Texas, Wisconsin, and Wyoming. ^[4] The count shifts a little as legislatures rewrite statutes. Some states run databases you can query directly. Others mostly impose registration duties on callers or restrict categories the federal rules leave alone.

Here's a working comparison of the states that are most aggressive and have clear, queryable lists or filing requirements:

State	Own DNC list?	Max per-call fine	Notable extra restriction
Colorado	Yes	$5,000	Shorter EBR window; charitable exemption narrower
Florida	Yes	$10,000 (2nd violation)	Political calls NOT exempt from state list
Indiana	Yes	$25,000	Requires telemarketer registration
Louisiana	Yes	$5,000	Debt collection calls partially covered
Massachusetts	Yes	$5,000	Includes B2B calls to individual sole proprietors
Michigan	Yes	$10,000	Requires written consent for cell calls
Mississippi	Yes	$5,000	Covers calls from nonprofits in some circumstances
Missouri	Yes	$10,000	Telemarketer must register before first call
North Carolina	Yes	$5,000 per call	Covers cell phones explicitly
Oregon	Yes	$10,000	No political exemption on state list
Texas	Yes	$5,000	Broad entity registration requirement
Wisconsin	Yes	$10,000	Covers autodialed calls to landlines and cells
Wyoming	Yes	$5,000	Strict EBR definition; 12-month window

The fine figures come from state statutes and attorneys general guidance current as of mid-2025. A few states index penalties to inflation or let courts treble damages, so real exposure runs higher. ^[4][5]

Florida deserves its own line. The Florida Telemarketing Act and the Florida Do Not Call Act work together to build a regime that many practitioners consider tougher than the TCPA in practice, because Florida's private right of action is easier to invoke and political calls lose their federal-style exemption on the state list. ^[5]

How do state EBR windows differ from the federal 18-month rule?

The federal Telemarketing Sales Rule lets a seller call a customer for up to 18 months after the last purchase, payment, or delivery, and up to three months after a customer inquiry. ^[2] That is the national baseline. Several states compress it hard.

Wyoming uses a 12-month post-purchase window. Some lawyers read Indiana's statute to allow only 12 months as well, though Indiana hasn't issued a definitive ruling on the exact period. North Carolina's Attorney General guidance treats the EBR window as existing but subject to extra conditions once the consumer's number lands on the state list. Colorado has said the EBR does not override state DNC registration if the consumer registered after the purchase date. ^[4]

The impact is sharp for subscription businesses and lenders. Say you sold a customer a policy in January and they registered on the Colorado DNC in March. Colorado's position is that your EBR does not protect that call, no matter how recently you last billed them. That flatly contradicts how many compliance teams read the federal rule. When in doubt, treat the state's reading as controlling inside that state's borders.

Do state lists cover cell phones, text messages, and autodialers differently?

At the federal level, the TCPA's cell-phone and autodialer restrictions live in a different statutory section (47 U.S.C. § 227(b)) from the DNC framework (47 U.S.C. § 227(c)). ^[1] The federal DNC registry technically covers residential lines, and the FCC extended it to wireless numbers in 2003. ^[6]

States complicate this further. Michigan's statute requires prior written consent for autodialed calls to mobile phones, going past the federal opt-in requirement in some procedural ways. North Carolina's statute covers cell phones explicitly in its DNC database, so scrubbing the federal wireless list alone is not enough. Oregon's law has treated calls and texts alike under the state's Unlawful Trade Practices Act in some AG enforcement actions, even where the federal text-message rules would not apply.

For SMS, the federal layer is the TCPA, the FCC's one-to-one consent rule (effective January 2025), and state consumer protection laws. ^[7] Several states, Florida and Washington among them, have consumer protection statutes that plaintiffs use to chase text-message claims separate from any federal TCPA claim. If your team runs any text message marketing, you're working inside at least two legal frameworks at once.

Here's the safe position. Treat any number on a state DNC list as off-limits for autodialed calls and texts in that state, even if you have a theory for why the federal rules might allow it. State claims carry real litigation risk, and several large TCPA class action settlements have included state-law counts that pushed the payout higher.

What exemptions do states NOT grant that the federal rules do?

This is where teams get hurt most. They know the federal exemptions cold and assume states mirror them. Many don't.

Political calls. The federal Telemarketing Sales Rule doesn't regulate political solicitation calls at all, and the TCPA exempts calls from political organizations. ^[2] Florida, Oregon, and a few other states grant no equivalent exemption on their state DNC lists. A political consulting firm running get-out-the-vote calls in Florida still has to scrub the Florida DNC.

Charitable solicitations. Federal rules exempt calls by or on behalf of charities. Some states, including Massachusetts and Mississippi, apply their state DNC rules to charitable solicitation calls in ways that narrow this exemption. Massachusetts law requires charities or their vendors to honor the state list even for fundraising calls. ^[4]

Surveys and research calls. Federal law generally exempts purely informational calls with no sales pitch. Several state AGs have gone after survey callers who tacked even a brief commercial message onto the end, arguing the exemption was forfeited. It's a gray area, but the risk is real if your "survey" closes with a soft pitch.

B2B calls. The federal DNC framework applies to residential lines and consumer relationships. Massachusetts extends coverage in some cases to sole proprietors whose numbers appear on the state list, even when those numbers double as business lines. That's an unusual position nationally. It matters for any team selling to small businesses in Massachusetts.

How do you actually scrub against state DNC lists?

The federal scrub is straightforward. You subscribe through the FTC's telemarketer registration portal, pay the annual fee ($79 per area code, capped at $21,582 for access to all area codes), download the list, and run your calling list against it no more than 31 days before a campaign. ^[8]

State lists are messier. Some states let you download the list straight from the AG's website or a contracted vendor. Others make you register as a telemarketer in the state first, then submit your calling list for scrubbing. Indiana runs its DNC registry through the Office of the Attorney General, and telemarketers must register and pay a separate fee before they can touch the list. ^[11]

Here's the operational sequence that works:

1. Identify which states your campaign will touch, based on the area codes or addresses on your prospect list. 2. Check each state's attorney general website for its registry access process. 3. Register as a telemarketer in states that require it before your first call. 4. Download or request a scrub against each state list, honoring that state's refresh requirement (some require monthly scrubs, a few allow 90-day windows). 5. Document every scrub: date, list version, number of records suppressed. 6. Repeat before each new campaign leg.

LeadCompliant's free DNC checker tools flag numbers against the federal registry as a starting point. For state lists, you genuinely have to go through each state's portal or use a compliance vendor with agreements in each state. No free tool covers all 14-plus state databases in real time.

For teams doing steady cold calling, a compliance calendar beats good intentions. One person owns the state registration renewals. One person owns the monthly list pulls. Both are logged in a shared document that survives staff turnover.

What does it cost to miss a state DNC registration?

The exposure is not theoretical. State AGs bring enforcement actions, and private plaintiffs file suit under state statutes, with real dollar outcomes.

Indiana's statute allows fines up to $25,000 per violation, meaning per call. ^[11] A single campaign touching 500 Indiana DNC registrants without proper scrubbing is, on paper, $12.5 million of exposure before any private litigation. Texas fines reach $5,000 per violation, and the Texas Attorney General has been active on enforcement. ^[12] Missouri requires registration before the first call, so calling without it is a violation on its own, separate from any scrub failure. ^[4]

Private plaintiffs can sue under some state statutes too. Florida's statute carries a private right of action, and the per-call statutory damages have drawn plaintiff attorneys who watch for exactly the campaign that scrubs only the federal list. The Credit One TCPA settlement and similar large payouts often stack federal TCPA counts on top of multiple state-law counts, which is why settlement numbers climb fast.

Fines aren't the whole bill. Several states require the violating company to stop all calling in the state until registration is finished and a penalty is paid. For an active sales team, that shutdown can cost more than the fine.

Nobody has clean public data on the total volume of state-level DNC enforcement versus federal TCPA actions. The FTC publishes its own enforcement data. ^[9] State actions are scattered across 50 AG offices. The closest read available is that plaintiff firms tracking TCPA cases report a material rise in state-law companion claims since 2020.

Are there states with no-call rules even without a separate registry?

Yes, and this catches people off guard. Not every state with strict telemarketing rules runs its own DNC database. Some restrict call timing, calling practices, or consent in ways that go past federal rules while still relying on the federal registry for the actual list.

California is the clearest case. California runs no separate DNC database. But the California Consumer Privacy Act (CCPA) and its amendment, the CPRA, give consumers rights over their personal data that shape how you can use purchased calling lists. ^[10] If a California resident has opted out of data sale or sharing under CCPA, pulling their number from a data broker for telemarketing may violate CCPA even when it clears the TCPA and the federal DNC rules. Different framework entirely. It still catches outbound teams off guard.

Washington State has a Consumer Protection Act that plaintiffs have used to pursue telemarketing claims. New York runs aggressive consumer protection enforcement that can parallel the federal framework without a separate DNC list.

The lesson is simple. Checking whether a state has a DNC database is necessary but not sufficient. You also need to know whether that state has consumer protection, data privacy, or telemarketing laws that restrict your campaign on their own.

How do state rules interact with the federal 'do not call' safe harbor?

The federal safe harbor for DNC violations requires five things: written DNC procedures, training for everyone making sales calls, a company-specific internal DNC list that's honored, a scrub against the national registry no more than 31 days before any call, and use of a federal list version no older than 31 days. ^[2] Hit all five and you get an affirmative defense against federal claims when an inadvertent call slips out.

State safe harbors are narrower and less uniform. Indiana, for example, has no formal written safe harbor in the statute, so the only defense is a showing of complete compliance. Florida's statute gives a limited defense for calls made in error, but it requires a documented scrub process that was in place before the error happened. Saying "we scrubbed the federal list" does not satisfy Florida if the state list went unscrubbed.

For cold call operations spanning multiple states, build your procedures to satisfy the strictest state you call into, and document that you followed them. A compliance memo written before a campaign, describing your scrub process, your state registrations, and your training records, is your best evidence if a state AG or private plaintiff later asks what you did.

What do outbound teams actually need to do right now?

Start with a state inventory. Pull the area codes from your current calling list. Map every area code to its state. List every state where you'll make calls and look up that state's AG telemarketing or DNC page. Some AG sites are excellent (Indiana, Florida, Texas). Others are sparse, and you may have to call the office directly.

Register where required. Indiana, Missouri, and Texas require telemarketer registration before calling. If you haven't registered and you're calling those states, stop that slice of the campaign until you do. Registration fees usually run $50 to $300 per year per state. That's a rounding error next to the exposure.

Build a state-specific suppression file. Every number you pull from a state DNC list goes into your master suppression file with a tag for which state list it came from. That tag matters if you later need to show which scrub caught which number.

Set calendar reminders for renewal. Federal list access refreshes monthly, so pull a fresh version monthly. State refresh schedules vary. Some are monthly, some quarterly. Put every renewal date on a compliance calendar owned by a named person, not "the team."

Review your EBR tracking. If you lean on established business relationships to justify calling customers who might be on DNC lists, audit how your CRM stores those dates. States like Colorado and Wyoming use windows shorter than the federal 18 months. If your CRM just stores "customer," you have no way to defend an EBR claim in a state with a 12-month window.

The do not call telemarketer list process at the federal level is well-documented. Layering state lists on top takes work, but the structure repeats: identify, scrub, suppress, document, repeat.

How often are state DNC lists updated, and how stale is too stale?

The federal registry updates monthly, and the FTC requires callers to use a version no more than 31 days old before any campaign. ^[8] Most states follow the same logic even when they don't codify the exact window.

Florida updates its state DNC database monthly. Indiana updates monthly. Texas updates on a schedule published by the AG's office, generally monthly. Oregon's list changes as registrations come in, so it can move daily. Safest practice: treat state lists like the federal list and pull a fresh version within 30 days before any campaign that touches that state.

"Stale" for enforcement purposes usually means the defendant can't show a current list at the time of the call. If your scrub log shows a January pull of the Texas DNC list and calls made in April, that's three months of unscreened new registrations. A plaintiff's attorney will count how many April calls reached people who registered between February and April. For a large campaign, that gap runs into thousands of calls and serious exposure.

Using third-party dialing platforms or lead vendors? Push them to document their own scrub logs. You are responsible for calls made on your behalf, and "the vendor was supposed to scrub" is not a defense that holds up consistently in litigation. The FTC's position, backed by case law, is that the seller carries responsibility for calls made by agents. ^[9]

Do state DNC rules apply to texts as well as calls?

Sometimes, and the trend runs toward yes.

The federal DNC registry was built for voice calls. SMS gets regulated at the federal level mainly through TCPA 47 U.S.C. § 227(b), which covers autodialed texts to cell phones, and through the FCC's consent rules rather than the DNC framework. ^[1][7]

At the state level, several states have stretched their DNC or consumer protection frameworks to cover texts. Oregon's Unlawful Trade Practices Act has been applied by the state AG to commercial text messages. Florida's statute covers "telephonic sales calls," and the Florida AG has taken the position that texts qualify. Washington's Consumer Protection Act has come up in SMS cases.

The pattern: state regulators are more willing than courts to read "call" to include "text" under older statutes. If you're running SMS campaigns into these states, scrub the state DNC lists for those numbers on top of the federal TCPA consent requirements. The extra scrub costs near nothing. The risk it removes is real.

You can read more about the federal consent framework in our overview of TCPA compliance. For mobile numbers specifically, the mobile phone do not call list question comes up constantly, and the state layer adds genuine complexity.

Frequently asked questions

Do I have to register with every state DNC list before I can make calls?

Not every state requires separate registration, but several do: Indiana, Missouri, Texas, and Louisiana are the most commonly cited. Those states require you to register as a telemarketer and pay a fee before your first call, separate from any federal FTC registration. Call into one of those states without registering and that itself is a violation, regardless of whether you scrubbed the list.

If a number is not on the federal DNC registry, is it safe to call?

Not necessarily. The number might sit on a state DNC list even when it's absent from the federal registry. Consumers register on state lists independently. Several states also carry restrictions (shorter EBR windows, narrower exemptions) that apply even when a number is on no list at all. Federal absence is necessary but not sufficient for compliance if you're calling into a strict-law state.

How much does it cost to access state DNC lists?

Costs vary by state. Some states give free access to the DNC list once you register as a telemarketer there; the registration fee itself might run $50 to $300 per year. Others charge per-record or per-query fees. Indiana and Florida have their own fee structures. Budget roughly $500 to $2,000 per year total if you're scrubbing 10 or more state lists. That's a rough estimate that shifts with state policy.

Does the 18-month EBR rule apply in all states?

No. The 18-month established business relationship window is a federal Telemarketing Sales Rule provision. Several states use shorter windows: Wyoming uses 12 months, and some practitioners read Indiana as requiring a similar or shorter period. Colorado has taken the position that the EBR does not override the state list if the consumer registered after the purchase date, no matter how recent the transaction.

Are political calls protected from state DNC lists the same way they are at the federal level?

No, and this surprises a lot of political consultants. The federal TCPA and Telemarketing Sales Rule exempt political calls from the DNC framework. Florida and Oregon grant no comparable exemption on their state DNC lists. If your firm makes political solicitation or get-out-the-vote calls in Florida, you have to scrub the Florida state DNC list even though federal law wouldn't require it.

Can I use the same scrub process for all 50 states?

You can use one workflow, but you have to configure it to pull each state's list separately. The federal scrub is one process; every state with its own list is an added data source. Some compliance vendors aggregate multiple state lists into a single scrub service, worth the cost for teams calling into more than five or six states regularly. A unified scrub that only uses federal data is not sufficient.

What happens if a lead vendor didn't scrub state DNC lists before selling me the leads?

You're still exposed. FTC and state AG enforcement positions put responsibility on the seller, the company that benefits from and directs the calls, not the vendor. Blaming the vendor may cut your civil liability in some cases if your contract requires scrubbing, but it usually does not erase regulatory liability or stop a private lawsuit. Your vendor contracts should require state-list scrubbing in writing, and you should audit it.

How do I find out if a specific state has its own DNC list?

Start with the state attorney general's website. Search for the AG's office in the relevant state and look for "telemarketing," "do not call," or "consumer protection" sections. The National Association of Attorneys General (NAAG) site also lists each AG office. For about a third of states, the page is clear and current. For the rest, you may need to call the office or consult a telemarketing compliance attorney who knows that state.

Do state DNC lists cover business-to-business calls?

Generally no, but Massachusetts is a notable partial exception: it extends coverage to sole proprietors whose numbers appear on the state list even when those numbers are also used for business. Most other state lists, like the federal registry, focus on residential and consumer lines. If your prospect list mixes small-business owners and individual consumers, you need to know how each state you call into treats that boundary.

Is there a single national database that combines the federal and all state DNC lists?

No government-run unified database exists. The FTC runs the federal registry; each state with its own list runs it separately. Some commercial compliance vendors aggregate multiple state lists into one scrub service, but these are private products and their completeness varies. Verify with any vendor exactly which state lists are included and how often each updates before you rely on that service.

How long do I have to honor a consumer's state DNC registration?

Indefinitely, in most states. Once a consumer registers on a state DNC list, the registration typically doesn't expire unless the consumer removes themselves or changes their number. The federal registry also carries no expiration for registrations made after June 2008. So you can't assume a registration you scrubbed two years ago has gone stale. Treat DNC registrations as permanent suppression unless you have documentation of the consumer asking for re-contact.

What records should I keep to defend a state DNC violation claim?

Keep dated scrub logs showing which list version you used and when, state registration certificates and renewal confirmations, training records for your calling staff, your written internal DNC policy, and your company-specific suppression list with add dates. A state AG or plaintiff attorney will ask for all of these in discovery. If you can't produce dated scrub logs, the safe-harbor-style defenses in some state statutes become unavailable to you.

If I operate only in one state, do I still need to check the federal DNC list?

Yes. State lists and the federal registry are separate obligations. Operating in one state does not exempt you from federal law. And being registered with the federal registry and scrubbing the federal list does not satisfy a state that requires its own registration and scrub. Both layers apply at once to virtually every commercial telemarketing operation in the United States.

How do I get on the federal Do Not Call list myself to understand the consumer experience?

You register at donotcall.gov or by calling 1-888-382-1222. Registration is instant and free. Your number should appear in the registry within 24 hours, and telemarketers must stop calling within 31 days. Walking through this is genuinely useful for compliance teams because it shows exactly what consumers experience and why they get so frustrated when calls keep coming after they register.

Sources

1. Cornell Law School LII, 47 U.S.C. § 227 (TCPA full text): The TCPA at 47 U.S.C. § 227 governs telephone solicitation, autodialed calls, and the Do Not Call framework at the federal level.
2. FTC, Telemarketing Sales Rule 16 CFR Part 310: The TSR establishes the 18-month EBR window, exemptions for political and charitable calls, and the five-element safe harbor for DNC violations.
3. FTC, Telemarketing Sales Rule 16 CFR 310.7 (state law not preempted): 16 CFR 310.7 states that the TSR does not preempt state laws that provide greater protection to consumers, allowing states to impose stricter telemarketing rules.
4. National Association of Attorneys General (NAAG): State attorneys general offices administer individual state DNC registries; several states require telemarketer registration before the first call.
5. Florida Office of the Attorney General, Florida Telemarketing Act and Do Not Call Act: Florida's Telemarketing Act provides per-call fines up to $10,000 for repeat violations and does not exempt political calls from the state DNC list.
6. FTC, National Do Not Call Registry, telemarketer subscription fees: Federal DNC registry access costs $79 per area code per year, capped at $21,582 for all area codes, and callers must use a list version no more than 31 days old.
7. FTC, Cases and Proceedings (enforcement): FTC enforcement positions hold the seller responsible for calls made by agents, meaning the company benefiting from the calls cannot shift liability to a vendor.
8. California Privacy Protection Agency, California Consumer Privacy Act (CCPA/CPRA): The CCPA and CPRA give California consumers the right to opt out of sale or sharing of personal data, which affects how purchased calling lists can be used for telemarketing in California.
9. Indiana Attorney General, Indiana Do Not Call Registry: Indiana runs its own DNC registry through the Office of the Attorney General; telemarketers must register and pay a fee before accessing the list and before making calls into Indiana. Indiana allows fines up to $25,000 per violation.
10. Texas Attorney General, Texas No-Call List and telemarketer registration: Texas requires telemarketer registration and imposes fines up to $5,000 per violation for calls to numbers on the Texas No-Call list.