Cross-channel suppression list management for compliance

Last updated 2026-07-11

What is a suppression list, and why does it have to cover every channel?

A suppression list is a database of contacts your team cannot legally reach. Phone numbers on the National Do Not Call Registry belong there. So do people who texted STOP, people who sent a written opt-out by email, and people your own reps logged as "do not contact" after a call.

The problem most small teams run into is that each channel keeps its own list. The email platform has one unsubscribe list. The SMS provider has a separate STOP list. The dialer or CRM has yet another DNC flag. Nobody connects them. So a prospect who texted STOP on Tuesday gets a cold call on Wednesday from a rep who had no idea.

That Wednesday call is a TCPA violation. The Telephone Consumer Protection Act, codified at 47 USC 227, makes it unlawful to call or text someone after they have withdrawn consent ^[1]. Consent and revocation of consent are channel-agnostic in the FCC's reading. The agency's 2024 one-to-one consent rule reinforced that opt-outs get honored promptly, and the FCC has held for years that the burden of proving consent sits with the caller, not the consumer ^[9].

Cross-channel suppression fixes this by making one opt-out event propagate everywhere, fast. It sounds simple. In practice it takes deliberate architecture, because most off-the-shelf tools do not do it on their own.

What laws actually require you to keep a suppression list?

Several federal rules create hard obligations, and a handful of state laws stack more on top.

The TCPA (47 USC 227) requires companies to keep an internal Do Not Call list and honor requests within a reasonable time, which the FCC has set at no more than 30 days for the internal list ^[1]. The FTC's Telemarketing Sales Rule (TSR), 16 CFR Part 310, requires telemarketers to scrub against the National DNC Registry before calling and to honor company-specific DNC requests immediately ^[3]. CAN-SPAM covers email opt-outs and requires you to honor them within 10 business days ^[4].

SMS has its own layer. The CTIA's messaging guidelines are not statutes, but carriers enforce them and can block your traffic if you ignore STOP requests ^[10]. The FCC's 2024 one-to-one consent order tightened how prior express written consent works for robotexts and robocalls, making it harder to argue that consent obtained in one context covers outreach in another ^[2].

State laws add more. Florida's Mini-TCPA (FTSA), Section 501.059, allows a private right of action for calls or texts to Florida numbers with no consent, with statutory damages of $500 per violation ^[5]. Oklahoma, Washington, and several other states run their own telemarketing acts. If your list spans multiple states, every number plays by the strictest rule that applies to it.

The short version: federal law requires an internal suppression list, you must scrub against the National DNC Registry if you telemarket, and you have to honor channel-specific opt-outs (STOP, unsubscribe, verbal request) as fast as your systems allow.

What are the real penalties for suppression list failures?

The TCPA sets statutory damages at $500 per violation, trebled to $1,500 per violation if a court finds the violation was willful or knowing ^[1]. Class actions are where the numbers get frightening.

The Cash App TCPA class action, for example, produced a multi-million dollar fund for consumers who alleged they got unwanted texts and calls after opting out ^[6]. The Credit One TCPA settlement is another where the failure to honor opt-outs across channels drove a nine-figure result. These are not freak events. The plaintiff's bar hunts for companies running multi-channel outreach without unified suppression.

The FTC can also bring TSR actions for National DNC violations, with civil penalties up to $51,744 per violation as of 2024 ^[3]. State attorneys general pile on from there.

Do the math on a real campaign. Send 10,000 messages to a list where 2% are bad numbers (people who opted out on another channel) and you have 200 potential violations at $500 each. That is $100,000 in exposure before anyone files suit. At $1,500 per willful violation, the same slip is $300,000. Courts have found willfulness when a company had the technical ability to suppress and chose not to.

How does the National Do Not Call Registry fit into suppression list management?

The National DNC Registry, maintained by the FTC, holds the phone numbers of consumers who have asked not to receive telemarketing calls ^[8]. Any company making telemarketing calls has to scrub its lists against the registry at least every 31 days. Registration is free for consumers. Telemarketers pay an annual fee to access the data.

The registry covers voice calls. The FCC has also held that autodialed or prerecorded calls to wireless numbers need prior express consent regardless of registry status, because the wireless-number protections in 47 USC 227(b) run stricter than the DNC rules in 47 USC 227(c) ^[1]. A mobile number on your list gets two layers of protection: the DNC rules and the autodialer/prerecorded consent rules.

For cross-channel suppression, DNC registry status should flow into your master list automatically. Every number you load into a dialer campaign gets pre-scrubbed, and the scrub result gets stored so your SMS and email tools can read it too. If a number is on the DNC registry, you probably should not text it either, even though the text rules are technically separate. The same person is telling you they want to be left alone.

You can learn more about accessing registry data and what counts as a telemarketing call in our articles on the do not call list and how do i get the do not call list.

What channels need to feed into one suppression list?

Here is the full map of opt-out sources that should flow into a single master suppression record for each contact:

Opt-out source	Signal to capture	Required response time
National DNC Registry	Phone number flagged	Scrub before each campaign (31-day max)
STOP / STOPALL / QUIT (SMS)	Mobile number + keyword	Immediate (carrier-enforced)
Email unsubscribe (CAN-SPAM)	Email address	Within 10 business days [4]
Verbal opt-out on call	Phone number + date	Internal list: within 30 days [1]
Written request (email, letter)	Phone/email per request	As soon as practical
State DNC list (e.g., Indiana, Texas)	Phone number	Before campaign in that state
Internal "do not contact" CRM flag	Contact record	Real-time

Every one of these has to write to the same master record. The biggest failure point is the verbal opt-out on a call. Reps either forget to log it or log it only in the dialer, and the SMS tool never sees it. Build a workflow where logging a DNC in the dialer also flags the CRM contact record, which then suppresses that record from every export list. It is not glamorous work. It is the work that keeps you out of court.

How should you actually build a cross-channel suppression system?

No single tool does all of this perfectly out of the box for a small team. You are going to patch something together, and that is fine as long as the architecture holds.

The core principle is a single source of truth. Your CRM is usually the best candidate because it touches every campaign. Each contact record needs a suppression field (a checkbox or a status value) that, once set, keeps that record out of any export, any campaign sync, or any API call to a dialer or SMS platform.

Here is a practical build for a small team:

1. Create a "Suppressed" boolean field on every contact record in your CRM. Set it to true whenever any opt-out arrives from any channel.

2. For SMS, configure your provider's webhook to POST the STOP event to your CRM via API. Twilio, Bandwidth, and MessageBird all support outbound webhooks on opt-out events. The webhook should fire within seconds of the STOP keyword landing.

3. For your dialer, build a suppression export that pulls all suppressed contacts from the CRM daily, or in real time if your dialer supports API-based suppression. Do not rely on manual CSV exports. Manual processes fail.

4. For email, sync your ESP's unsubscribe list back to the CRM through the ESP's native integration or a Zapier/Make workflow. Every unsubscribe sets the suppression flag.

5. For DNC registry scrubbing, use a scrubbing service that returns a file you can import and flag. Set a calendar reminder to re-scrub every 30 days at minimum.

6. Document the whole flow. When a regulator or a plaintiff's attorney asks for your suppression process, you need a written procedure and logs that prove it ran. "We had a process" is not enough. "Here is the audit log showing the STOP event at 2:14 PM on March 3 and the suppression flag set at 2:14 PM on March 3" is.

LeadCompliant's free compliance kit includes a suppression workflow template and a pre-scrub checklist you can adapt to your stack without starting from scratch.

If you run cold calling alongside SMS, watch step 3 closely. Dialers are the most common place suppression breaks, because they tend to run on their own contact databases that drift out of sync with the CRM.

How often do you need to scrub your list, and against what?

The TSR requires scrubbing against the National DNC Registry no more than 31 days before a call is made ^[3]. The FTC has been clear that scrubbing once "before a campaign" fails if the campaign runs longer than 31 days. You need rolling scrubs.

Your internal suppression list should be continuous, not periodic. Every time you build a campaign audience, the query itself should exclude suppressed contacts by definition, not through a separate cleanup step. Export a CSV and manually delete rows and you are one human error from a violation.

State lists vary. Some states require scrubbing inside a specific window before calls go out. Indiana, for example, maintains its own DNC list separate from the federal registry. Call Indiana numbers and you scrub both.

SMS has no traditional scrub. Your platform should automatically block messages to any number that sent a STOP keyword, and that block should be permanent unless the consumer texts START or YES to re-subscribe. What you do need to verify is that your platform's internal suppression flows back to your CRM. Send a test STOP from a test number and confirm within five minutes that the CRM record is flagged.

The honest floor: for any active outbound program, run daily automated scrubs against your internal suppression list and monthly scrubs against the DNC registry. That is the minimum defensible standard.

What records do you need to keep, and for how long?

Record-keeping is where small teams cut corners, and it is also where they lose lawsuits they could have won.

The TSR requires telemarketers to keep records of their DNC compliance for 24 months ^[3]. The FTC reads that to include the actual suppression lists used, the dates of DNC scrubs, and records of every opt-out request received. The TCPA does not name a retention period, but case law strongly suggests keeping records far enough back to cover the statute of limitations, which is four years for TCPA claims under 28 USC 1658 ^[7].

For practical purposes, keep the following for at least four years:

• Timestamped logs of every opt-out event, including the channel, the number or email address, the date and time, and who or what processed it.
• Records of every DNC scrub, including the date, the vendor, and the file or confirmation number.
• Consent records for every contact you reached, including the original source, the date, and the exact language the consumer agreed to.
• Campaign audience lists as they existed at send time, so you can prove who was suppressed.

Cloud storage is cheap. Store everything. A TCPA plaintiff's attorney will ask for these records in discovery, and the inability to produce them often reads to a court as proof the suppression process never existed.

For contacts on the mobile phone do not call list or the federal registry, store the scrub confirmation showing the number was checked and cleared before the call went out.

What are the most common suppression list mistakes that lead to lawsuits?

Read enough TCPA complaints and the same failure modes keep surfacing.

The biggest is siloed opt-out processing. The SMS team honors STOP, the phone team honors verbal DNC requests, and the email team processes unsubscribes, but none of them talk. The consumer who opted out on SMS gets a call three days later. Textbook cross-channel violation.

Second is stale suppression data. A company scrubs its list on January 1 and runs a campaign through March without scrubbing again. Consumers who registered on the DNC Registry in February never get suppressed. The TSR's 31-day rule exists for exactly this reason ^[3].

Third is the re-import problem. A rep downloads a contact list, cleans it in Excel, drops some columns, and re-imports it. The suppression flags that lived in the CRM are gone, because they were never in the Excel file. Suppressed contacts go live again.

Fourth is the acquisition problem. A company buys a third-party lead list and calls it without scrubbing against its own internal DNC list or the federal registry. The bought list might hold contacts who already opted out directly with the company.

Fifth is the subsidiary or brand problem. A company runs three brands from one legal entity. A consumer opts out of Brand A's texts. Brand B's team never knows, because Brand B keeps its own list. Same company, same TCPA liability.

The cash app tcpa class action settlement and cases like it usually trace back to one of these exact gaps, not to malice but to process holes nobody caught until a class got certified.

How do consent and suppression interact, and can someone un-suppress themselves?

Suppression and consent are two sides of one ledger. Consent is the legal basis for outreach. Suppression is the record that consent was withdrawn, or never existed at all.

Under the FCC's framework, a consumer can revoke consent at any time by any reasonable means ^[2]. The FCC's 2024 order said it plainly: "consumers may revoke prior express consent... through any reasonable means." A consumer who calls your inbound line and says "take me off your list" has validly revoked consent for all automated outreach, more than calls.

A suppressed contact can re-subscribe. If they text START to your SMS number, that is a new consent event. Log it with a timestamp and treat it as fresh consent, the same way you would treat any other opt-in. The bar is higher now because you are starting over: the new consent has to meet whatever standard applies at that moment (prior express written consent for autodialed texts to mobile numbers, per 47 USC 227(b)) ^[1].

Do not auto-re-subscribe people. Do not run win-back campaigns to suppressed contacts without explicit new consent. Some platforms have re-engagement features that can trip this by accident. Turn them off.

For more on how consent works across channels, the text message marketing article covers the SMS consent standards in detail.

What tools can help you manage cross-channel suppression?

The honest answer: no single tool solves this completely for a small team. You are stitching together a CRM, an SMS platform, a dialer, and maybe an email service provider, and the suppression logic has to hold across all of them.

Here is how to judge any tool for suppression capability.

Can it receive opt-out events from outside sources via webhook or API? If you have to import opt-outs by hand, the tool is a liability.

Does it expose a suppression status that other systems can read? Your CRM needs to be queryable by your dialer and SMS platform so they check suppression at send time, more than at list-build time.

Does it log opt-out events with timestamps? You need the full history, not only the current status, so you can answer "was this number suppressed on March 3 at 2 PM?" four years from now.

Does it handle STOP keywords automatically and permanently, or does re-importing a contact override the STOP? This is a known trap with some SMS platforms.

A few tools worth knowing. Twilio has built-in, carrier-compliant opt-out management for SMS. HubSpot's CRM syncs email unsubscribes natively. For DNC scrubbing, vendors like Gryphon Networks and Contact Center Compliance offer real-time and batch scrubbing APIs. For a small team, a well-configured HubSpot or Salesforce instance plus a few Zapier automations handles cross-channel suppression reasonably well without enterprise spend.

LeadCompliant's free tools include a suppression audit checklist that maps each failure point above to a specific process control, so you can see exactly where your current stack leaks.

What should a suppression list policy document actually say?

A written suppression policy is more than paperwork for regulators. It is the document you hand a new sales manager so they do not undo your compliance architecture on day one.

At minimum, the policy should cover:

Scope: which channels are covered (phone, SMS, email, anything else), which brands or subsidiaries are covered, and which geographic markets, since state rules differ.

Opt-out signal types: exactly what counts as an opt-out on each channel. Verbal request on a call, STOP keyword, email unsubscribe, written request, DNC Registry presence, internal flag.

Processing time: how fast each opt-out type must hit the master suppression list. SMS should be immediate. Verbal requests, same day. Email within 10 business days per CAN-SPAM ^[4], though faster is better.

Data retention: how long suppression records are kept and where they live.

Scrub schedule: when and how the team scrubs against the National DNC Registry and any state lists, which vendor is used, and who owns it.

Audit cadence: who reviews suppression logs, how often, and what triggers a manual review (any opt-out not processed inside its required window, for instance).

Enforcement: what happens when a rep calls or messages a suppressed contact. A coaching event? An HR issue? How is it documented?

One page is enough for a small team. What matters is that the policy exists, it is dated, it is signed by someone with authority, and it is actually followed. A policy buried in a Google Drive folder nobody opens is not a defense.

Frequently asked questions

What is a suppression list in the context of TCPA compliance?

A suppression list is a database of phone numbers, email addresses, or contact records your team cannot reach, either because the person opted out, registered on the National Do Not Call Registry, or was flagged internally. Under 47 USC 227 and the TSR, keeping and honoring this list is a legal obligation for telemarketers, more than a best practice.

Does a STOP text opt someone out of calls too?

Technically the STOP keyword revokes consent for SMS. But the FCC has said consumers can revoke consent by any reasonable means, so a documented STOP is strong evidence the person does not want contact. Best practice is to treat any opt-out on any channel as a reason to suppress across all channels, especially for the same legal entity.

How long do you have to honor a Do Not Call request?

The FCC requires adding a number to your internal Do Not Call list within 30 days of a request. The TSR requires company-specific DNC requests be honored immediately. SMS opt-outs are carrier-enforced and must process essentially in real time. CAN-SPAM gives 10 business days for email unsubscribes, but faster is always safer.

Can you call someone who is on the National DNC Registry if they gave you consent?

Yes, with caveats. Prior express written consent can override the DNC Registry for calls to wireless numbers. But the consent has to be real, documented, and meet the FCC's standards under 47 USC 227(b). If the consent is questionable, the DNC registration is a serious red flag and calling is high risk.

What happens if you accidentally call a suppressed number?

Each call or text to a suppressed number is a potential $500 statutory violation under the TCPA, trebled to $1,500 if a court finds it willful. If enough contacts are involved, it can support a class action. Documenting that the violation was a one-time system error, and fixing the process fast, matters for damages but does not erase liability.

Do you need to scrub against state DNC lists separately from the federal registry?

Yes. Some states, including Indiana and Texas, maintain their own DNC lists separate from the federal registry. If you call numbers in those states, you scrub both. State penalties often run alongside federal TCPA exposure. Check each state's attorney general website for whether an independent list exists.

How do you handle suppression when you buy a third-party lead list?

Scrub every purchased list against your internal suppression list and the National DNC Registry before your first contact attempt. The law does not care that the opt-out came before you owned the lead. If that number was on your internal DNC list or the registry, calling it is a violation regardless of how you acquired it.

What is the statute of limitations for a TCPA claim?

Four years under 28 USC 1658, the general federal statute of limitations for statutes that do not set their own. That is why compliance attorneys recommend keeping suppression records, consent records, and campaign logs for at least four years. Evidence you cannot produce in discovery tends to hurt your case.

Does CAN-SPAM require cross-channel suppression?

CAN-SPAM covers commercial email and requires you to honor email unsubscribe requests within 10 business days. It does not explicitly require cross-channel suppression, but the FTC's guidance and general best practice push toward it. An email unsubscribe should at minimum flag the contact record so phone and SMS teams know.

How often do you need to re-scrub against the National DNC Registry?

The Telemarketing Sales Rule requires scrubbing no more than 31 days before a call is made. If your campaign runs longer than 31 days, you need rolling re-scrubs. Monthly scrubs on a fixed calendar date, with records of each scrub stored for 24 months per the TSR, is the minimum defensible practice for an active outbound program.

What is the difference between an internal DNC list and the National DNC Registry?

The National DNC Registry is a federal database maintained by the FTC that consumers opt into voluntarily. Your internal DNC list is your own company's database of people who asked you specifically not to call them. Both must be kept and honored. A number does not have to be on the federal registry to belong on your internal list.

Can a suppressed contact re-subscribe and become reachable again?

Yes, if they provide fresh, documented consent that meets current legal standards. For autodialed texts, that means prior express written consent under 47 USC 227(b). Log the new consent with a timestamp and source. Never auto-re-subscribe people through re-engagement features in your platforms. The new consent has to be affirmative and voluntary.

Do small businesses with fewer than 50 employees still have to comply with TCPA suppression rules?

Yes. The TCPA applies to any person or entity making calls or sending texts, regardless of company size. The statute has no small-business exemption. Small teams are actually common TCPA targets, because their suppression infrastructure tends to be informal and their documentation thin, both of which make defending a suit harder.

What records should you keep to prove suppression compliance if you get sued?

Timestamped logs of every opt-out event and its channel, records of every DNC Registry scrub with the date and vendor, consent records for every contact you reached, and campaign audience snapshots as they existed at send time. Store all of it for at least four years. Without this evidence, courts often treat the absence of records as proof the process never existed.

Sources

1. U.S. Code, 47 USC 227, Telephone Consumer Protection Act: The TCPA sets statutory damages at $500 per violation, trebled to $1,500 for willful violations, and requires companies to maintain an internal Do Not Call list and honor requests within 30 days
2. FCC, Report and Order on One-to-One Consent (2024): The FCC's 2024 one-to-one consent rule reinforced that opt-outs must be honored promptly and that consumers can revoke prior express consent through any reasonable means
3. FTC, Telemarketing Sales Rule, 16 CFR Part 310: The TSR requires scrubbing against the National DNC Registry no more than 31 days before a call, honoring company-specific DNC requests immediately, and keeping DNC compliance records for 24 months; civil penalties up to $51,744 per violation
4. FTC, CAN-SPAM Act compliance guide for business: CAN-SPAM requires email opt-out requests to be honored within 10 business days
5. Florida Legislature, Florida Telephone Solicitation Act (FTSA), Section 501.059: Florida's Mini-TCPA allows a private right of action for calls or texts to Florida numbers without consent, with statutory damages of $500 per violation
6. PACER / public court records, Cash App TCPA class action settlement: The Cash App TCPA class action resulted in a multi-million dollar settlement fund for consumers who alleged they received unwanted texts and calls after opting out
7. U.S. Code, 28 USC 1658, statute of limitations for federal civil actions: The general federal statute of limitations under 28 USC 1658 is four years, which courts have applied to TCPA claims
8. FTC, National Do Not Call Registry: The National DNC Registry is maintained by the FTC; consumers register for free and telemarketers pay an annual fee to access the data for scrubbing