Quality assurance checklist for TCPA compliant calls

Last updated 2026-07-11

What does a TCPA compliant call actually require?

A TCPA-compliant call needs three things lined up before you dial: the right consent for that number, a number that isn't on any do-not-call list, and a dialing setup that stays inside the rules for technology, hours, and disclosures. Miss one and every call can cost you.

The Telephone Consumer Protection Act, codified at 47 U.S.C. § 227, sets the floor for every outbound call or text a business makes to a consumer ^[1]. The statute says callers may not use an automatic telephone dialing system or a prerecorded voice to call any cellular number without the "prior express consent of the called party" ^[1]. That one sentence drives most of the compliance machinery your QA process has to check.

Start with the technology. Whether you used an ATDS or a prerecorded voice matters, because those trigger the statute's sharpest teeth. Then consent. You need the right type of consent for the type of call, because the FCC's 2012 TCPA Order built a two-tier system: prior express consent for informational calls to wireless numbers, and prior express written consent for telemarketing calls to wireless and residential lines ^[2]. Last, the number itself. Was it on the National DNC Registry or on the called party's own company-specific opt-out list?

A QA checklist is how you prove, on paper, that your team checked all three before every campaign. Skip the documentation and you're relying on memory. Memory loses in court.

For background on the tcpa itself, including how the statute is structured, that primer is a good place to start before you build your QA workflow.

What are the six categories every TCPA call checklist must cover?

Every TCPA call checklist splits into six buckets: consent verification, DNC scrubbing, calling hours, caller ID and disclosures, ATDS and prerecorded controls, and recordkeeping. Each one maps to a separate legal requirement. Miss any single bucket and you've created exposure, no matter how clean the other five are.

1. Consent verification Before a call goes out, your system should confirm four things: consent exists for this specific phone number (more than the contact record), the consent matches the call type (written for telemarketing, express for informational), the consent wasn't revoked, and the consent is dated and retained. The FCC's 2012 Order requires that consent be obtained "clearly and conspicuously" and that callers keep proof ^[2].

2. DNC scrubbing Scrub the FTC's National Do Not Call Registry at least every 31 days ^[3]. Keep an internal DNC list too, and honor opt-outs within 30 days of getting them. Scrub both lists before each campaign, not once at list import.

3. Calling hours Calls to residential and wireless numbers are limited to 8 a.m. to 9 p.m. in the called party's local time zone, not yours ^[1]. This is a per-call check, not a campaign-level one, because a contact's time zone can differ from the area code on file.

4. Caller ID and required disclosures Every call must transmit the caller's telephone number and, if available, name to caller ID systems ^[1]. Prerecorded messages have to state the business name and a phone number at the start of the message.

5. ATDS and prerecorded voice controls Write down whether your dialer qualifies as an ATDS under the current standard. After the Supreme Court's 2021 decision in Facebook v. Duguid, the ATDS definition turns on whether the system stores or produces numbers using a random or sequential number generator ^[4]. If your dialer doesn't, that matters. Document it. If it does, you need prior express consent for every wireless number.

6. Recordkeeping The FTC's Telemarketing Sales Rule requires sellers to keep records for 24 months ^[3]. Your QA log should capture the scrub date, the consent record ID, the agent who placed the call, and the call outcome. Store recordings where state law requires them.

Here's how those six categories map to the failure points that show up in real litigation:

Checklist Category	Common Failure Mode	Statutory Risk
Consent verification	Consent not tied to specific number	$500, $1,500 per call [1]
DNC scrubbing	Scrub older than 31 days	FTC civil penalty up to $51,744 per violation [3]
Calling hours	Dialer uses originating time zone	$500+ per out-of-window call [1]
Caller ID disclosure	Spoofed or blocked number	Truth in Caller ID Act penalties [5]
ATDS documentation	No record of dialer technology	Undermines ATDS defense in litigation
Recordkeeping	No retained consent proof	Plaintiff wins on burden-shifting

How do you verify consent before each call goes out?

Verify consent at the moment of dial, not at list import, and confirm three things: the consent is tied to that exact phone number, it matches the call type, and it hasn't been revoked. Consent verification is the hardest part of the checklist to run at scale, because it has to happen without slowing your dialer to a crawl.

Here's what a working process looks like. Your CRM or lead management system should store, for every phone number, the consent timestamp, the method (web form, verbal, signed document), and the exact language the consumer saw or heard. The FCC's 2012 Order says written consent for telemarketing must include a clear disclosure that the consumer authorizes contact by autodialer or prerecorded voice, and it can't be a condition of purchase ^[2]. If your consent record is missing those fields, it won't survive scrutiny.

Pull the consent record at the time of dial attempt. People revoke consent, and they do it constantly. The FCC confirmed in its 2015 Declaratory Ruling that consumers can revoke consent at any time and through any reasonable means ^[2]. If someone texted STOP three weeks ago and your list wasn't updated, that call is a violation.

Run a consent-age audit too. The FCC has signaled, and several district courts have held, that consent captured years ago for one product may not cover a different product or a new company that bought the lead. The 2023 FCC One-to-One Consent Rule required each seller to get its own prior express written consent rather than lean on a single bundled consent covering multiple sellers, and it was set to take effect in January 2025 ^[6]. The Eleventh Circuit vacated that rule in January 2025 on procedural grounds ^[6]. The underlying principle held, though: broad blanket consent is legally fragile. Design your consent capture to be seller-specific anyway.

For agents making live, manually dialed calls to wireless numbers with no prerecorded component, the ATDS requirement may not apply. The DNC rules still do. Don't let that distinction lull anyone into a false sense of safety.

How often do you need to scrub against the National DNC Registry?

Scrub your call lists against the National Do Not Call Registry no more than 31 days before calling any number on it. The FTC's Telemarketing Sales Rule sets that hard deadline ^[3]. A scrub from 32 days ago is legally the same as no scrub at all.

Most teams calling more than a few hundred numbers a week should set their scrub cycle to every 14 to 21 days for a buffer. The Registry takes new registrations all the time, and numbers can land on it any day.

You access the Registry through the FTC at donotcall.gov. Sellers with more than 5 unique area codes of data pay an annual fee, which was $81 per area code as of 2024 (the fee schedule changes every year, so check the current rate) ^[10]. For how to access the registry, including the process for small teams, the how do i get the do not call list guide walks through the steps.

Beyond the federal registry, roughly 13 states run their own DNC lists, including Florida, Texas, Indiana, and others ^[7]. Call into any of those states and your QA checklist needs a state-specific DNC scrub line item. The do not call list article covers the federal registry basics, and the mobile phone do not call list article handles the wireless-specific questions.

One thing teams miss: the company-specific internal DNC list. If a consumer asks not to be called, you have to honor that within 30 days and keep the suppression for at least five years ^[3]. Scrubbing the federal registry does not replace maintaining your own internal list.

What calling hours are legally allowed under TCPA?

TCPA calling hours run from 8 a.m. to 9 p.m. in the called party's local time zone. The FCC's regulations at 47 C.F.R. § 64.1200 restrict calls to residential and wireless numbers to that window ^[11]. The operative phrase is "called party's location." A contact in Miami has a local time. Your dialer in Phoenix runs on a different clock. Your QA process has to resolve the gap.

The safest approach: have your dialer derive time zone from the contact's zip code or area code, then apply a conservative buffer. Don't start dialing at exactly 8:00 a.m. System latency can push the actual connect time outside the window. Plenty of teams set their start at 8:05 a.m. and stop at 8:45 p.m. to dodge any late-connection trouble.

Some states are stricter. Florida's Mini-TCPA (Florida Telephone Solicitation Act, § 501.059) restricts calls to 8 a.m. to 8 p.m. and applies to any technology that dials automatically, which is broader than the federal ATDS definition ^[8]. Call Florida numbers and you need the tighter window in your checklist. State law can add restrictions on top of the federal floor. It can't remove them.

Calls to business numbers generally fall outside the 8-to-9 residential restriction, but dialing a business line at 6 a.m. creates its own problems and may trip state laws. Your checklist should carry a "consumer vs. business" flag that applies the right ruleset.

What disclosures must a caller make at the start of every call?

At the start of a live call, the agent must state their name, the company they're calling for, and a phone number or address where that company can be reached. The FCC's regulations at 47 C.F.R. § 64.1200(d)(4) require it ^[11]. This isn't a best practice. It's a rule.

Prerecorded messages carry the same obligation with higher stakes, because every person who gets a noncompliant prerecorded message is a potential plaintiff. The message has to identify the business and give a callback number during or after the recording.

Caller ID transmission is a separate obligation. Under 47 U.S.C. § 227(e) and the Truth in Caller ID Act, transmitting misleading or inaccurate caller ID information with intent to defraud or harm is illegal ^[5]. That covers outright spoofing and displaying a number that doesn't connect back to your business. Your QA checklist should confirm the outbound caller ID is a working number your team actually answers.

For cold calling teams, agent monitoring is the most practical control for disclosure compliance. Review a sample of every agent's calls each week against a scored rubric that includes a disclosure check at the opening. Skip that review and you won't know whether your agents follow the script until a complaint lands on your desk.

How do you document and store TCPA compliance records?

Keep, for every campaign, the consent record, the DNC scrub log, the calling-hours configuration, call recordings or disposition logs, and every opt-out request with the date it was honored. Recordkeeping isn't glamorous. It's the difference between winning and losing a TCPA lawsuit.

The burden of proof in a TCPA case effectively shifts to the caller once a plaintiff shows they got an unwanted call. At that point your only defense is your documentation. Retain these at a minimum:

• The consent record, including timestamp, IP address if web-based, the exact disclosure language shown, and the number consent was granted for.
• The DNC scrub log, showing the scrub date, the registry version used, and who ran it.
• The calling-hours configuration in your dialer at the time of the campaign.
• Call recordings or, where recordings aren't kept, call disposition logs.
• Any opt-out or revocation requests received, and the date they were honored.

The FTC's Telemarketing Sales Rule sets a 24-month retention minimum for outbound telemarketing records ^[3]. Several states require longer. California's CCPA adds documentation requirements for businesses handling California consumer data.

Link each consent record to the specific phone number, more than the contact or account. People change numbers. A consent record tied only to a name is nearly worthless once a carrier reassigns that number to someone else. Reassignment is a real problem. The FCC launched the Reassigned Numbers Database in 2021 to help callers avoid reaching people who never consented because the number changed hands ^[9]. Your QA checklist should include a reassigned-numbers check for any number you haven't contacted in 90 days or more.

LeadCompliant's one-time compliance kit includes editable templates for consent documentation and DNC scrub logs if you want a starting structure instead of building from scratch.

How do you build a pre-call QA gate into your dialer workflow?

Build the QA gate so compliance happens automatically, before an agent ever hears a ring. The goal is to take the decision out of the agent's hands. Here's a workflow that works for most small outbound teams.

Step one: list hygiene before upload. Before any list enters your dialer, run it through DNC scrubbing (federal and applicable state lists), consent verification, and a time-zone flag. Reject any record that fails.

Step two: dialer-level controls. Configure your dialer to enforce calling hours by time zone, block numbers with an active internal DNC flag, and require a consent record ID field before a number can be dialed. Most modern predictive dialers have these controls. Plenty of teams just never turn them on.

Step three: agent-level script controls. The opening disclosure should be the first line of every script, not buried in paragraph three. Put it in a locked script field agents can't skip. If your dialer supports dynamic scripting, have it show the consent record and last-contact date to the agent before the call connects.

Step four: post-call disposition capture. Agents log opt-outs immediately at call end. The disposition field needs a "DNC requested" option that automatically pushes the number to your internal suppression list. Relying on agents to hand-update a spreadsheet will fail. Make the update a required step in the call-close workflow.

Step five: weekly QA audit. Pull a random sample of 5 to 10 percent of calls. Score them against your disclosure checklist. Hunt for calls placed outside permitted hours and any call with no consent record ID. Track the score weekly and fix drops the moment they show up.

For teams doing any form of cold call outreach, the weekly audit is the single highest-leverage compliance investment you can make. One agent making the same mistake 200 times a week is a class action waiting to happen.

What are the penalties if your QA process fails?

The TCPA provides statutory damages of $500 per violation, and up to $1,500 per violation if a court finds the violation was willful or knowing ^[1]. Each call or text is a separate violation. A campaign of 10,000 calls with a technical consent defect carries potential exposure of $5 million to $15 million before any attorney fee multiplier.

The class action mechanism is what makes the TCPA the statute it is. Unlike most consumer protection laws, TCPA plaintiffs don't need to prove actual harm. Receiving the call is the harm. That makes certification relatively easy for a plaintiff's lawyer and pushes settlement pressure sky high.

The credit one tcpa settlement is a useful case study: the company faced allegations of calling consumers after they revoked consent and settled for $75 million in 2022. The cash app tcpa class action settlement is another example of how even well-funded companies take on real exposure from systematic compliance failures.

FTC civil penalties under the Telemarketing Sales Rule are separate from TCPA damages. The FTC can seek up to $51,744 per violation (2024 rate, adjusted annually for inflation) for TSR violations, including calling numbers on the DNC Registry ^[3].

A well-run QA program doesn't erase risk. It does two things that matter: it cuts the frequency of violations, and it builds a documented record of good-faith effort that can move settlement outcomes and, in some cases, the willfulness finding that decides whether you pay $500 or $1,500 per call.

Are there additional QA requirements for texts and SMS campaigns?

Yes. The TCPA treats text messages the same as calls for the ATDS and prior express written consent requirements ^[1]. Send a marketing text to a wireless number using any automated platform and you need prior express written consent for that specific number and that specific sender.

The SMS checklist adds a few items on top of the voice list. Every marketing text needs a clear opt-out mechanism, usually STOP, and you must honor opt-outs within a reasonable time (the industry standard and most carrier guidelines say within 10 business days, though faster is better). Texts must identify the sender. High-volume SMS campaigns run on short codes or 10DLC registered numbers, and using an unregistered number can violate carrier terms and pile on more exposure.

For a broader look at text message marketing compliance, that article covers the SMS-specific consent and opt-out rules in more depth.

Here's what surprises teams: forwarding a marketing text, or dropping a consumer's number into a promotional campaign when they gave that number to a third party, isn't TCPA-compliant without independent consent. The do not call telemarketer list article explains how the DNC rules interact with SMS and text outreach specifically.

How do state TCPA-equivalent laws change your checklist?

State laws can add checklist items the federal TCPA never mentions, and several states have gone materially further. Federal TCPA sets a floor. States build on top of it, so your checklist needs a state-of-the-called-party flag and a rules lookup that applies stricter state requirements when they exist.

Florida's Telephone Solicitation Act (§ 501.059) is the most aggressive active state law right now. It applies to calls made using any technology that dials automatically, which is broader than the federal ATDS definition ^[8]. It restricts calls to 8 a.m. to 8 p.m., requires written consent for automated calls and texts regardless of the telemarketing/informational distinction, and creates a private right of action of up to $500 per call or $1,500 for willful violations, with no arbitration clauses allowed in consent agreements for Florida calls.

California has its own automatic dialing restrictions under the California Public Utilities Code § 2872 and broader consumer protections under the CCPA and CPRA. Texas, Oklahoma, and Indiana each run separate state DNC lists that require separate subscriptions and scrubbing.

If you call into Florida regularly, make Florida's rules your default standard for those records. It's easier to run everyone through the tighter ruleset than to sort exceptions on the fly.

Nobody keeps a clean, regularly-updated public map of every state's telemarketing laws in one place. The closest authoritative source is the National Conference of State Legislatures ^[7], and even that needs cross-referencing against individual state statutes. Build your state-specific rules from the actual statute text, not from a summary.

What should your QA scorecard look like?

A good TCPA QA scorecard is specific enough to catch real violations and simple enough that reviewers use it the same way every time. Keep it short. Here's a working structure:

QA Item	Pass Criteria	Weight
Consent on file for dialed number	Yes, with timestamp and method	Critical (auto-fail)
Number not on federal DNC (scrub within 31 days)	Yes	Critical (auto-fail)
Number not on internal DNC	Yes	Critical (auto-fail)
Call placed within permitted hours (8 a.m. to 9 p.m. local)	Yes	Critical (auto-fail)
Agent stated name and company name at call open	Yes, within first 30 seconds	Major
Caller ID number is working and correct	Yes	Major
Opt-out honored and logged same day (if applicable)	Yes	Major
Call recording retained (where required by state)	Yes	Major
Consent record linked to specific phone number, more than contact	Yes	Major
DNC scrub log retained	Yes	Minor

The "Critical" items are auto-fail. One miss on any of them means the call was noncompliant, full stop, regardless of everything else. Score the rest on a 100-point scale and set a minimum passing score. For a team calling at volume, 90 is a reasonable threshold.

Run the scorecard weekly on a random sample. Share results with agents by name. If one agent fails the disclosure check over and over, that's a training problem. If a whole campaign fails the consent check, that's a list or CRM problem. The scorecard tells you which one you've got.

LeadCompliant offers a free call compliance checker and a downloadable QA template as part of its compliance kit, if you want a pre-built starting point for the scorecard format.

Frequently asked questions

How often should I scrub my call list against the National DNC Registry?

The FTC's Telemarketing Sales Rule requires scrubbing no more than 31 days before calling any number. In practice, scrub every 14 to 21 days for a buffer. The Registry updates continuously, and stale scrubs are one of the most common triggers for DNC violation claims. Maintain and scrub your internal company-specific DNC list separately, before every campaign run.

What counts as prior express written consent under TCPA for telemarketing calls?

The FCC's 2012 TCPA Order requires a written agreement, including electronic, that clearly discloses the consumer authorizes the seller to contact them using an autodialer or prerecorded voice for telemarketing. The consent can't be a condition of purchase, and the consumer must sign or electronically confirm. A pre-checked checkbox or authorization buried in a long terms-of-service document is unlikely to survive a legal challenge.

Can I call a cell phone number if I have the person's contact info from a third-party lead?

Only if that third party got TCPA-compliant written consent specifically naming your company as the potential caller, and that consent wasn't bundled with consent for a dozen other sellers. The FCC's one-to-one consent principle (even after the 2025 Eleventh Circuit vacatur of the specific rule) means broad lead-gen consent covering many sellers is legally fragile. Verify the consent was specific to your business before dialing.

What time zone do I use for the 8 a.m. to 9 p.m. TCPA calling window?

The called party's local time zone, not yours. FCC regulations at 47 C.F.R. § 64.1200 are explicit. Use the contact's zip code or area code to determine local time, and apply a small buffer so system latency doesn't push the actual connect time outside the window. Florida restricts calls to 8 a.m. to 8 p.m. local time, so check state law for every state you call.

Do TCPA rules apply to business-to-business calls?

The TCPA's autodialer and prerecorded voice restrictions apply to calls to cellular numbers whether the purpose is B2B or B2C. Calls to traditional business landlines carry more limited TCPA exposure, but the FTC's Telemarketing Sales Rule and state laws can still apply. The DNC Registry has a business exemption, yet a person using a cell phone for business still has TCPA protections for that number.

How long do I need to keep TCPA consent records?

The FTC's Telemarketing Sales Rule requires a minimum of 24 months for telemarketing records. Many compliance attorneys recommend keeping consent records as long as you might face suit, which under the TCPA's four-year statute of limitations means at least four years from the last call. State laws may require longer. Store records in a system that links consent to the specific phone number, more than the account.

What happens if a number gets reassigned to a different person after I collected consent?

The TCPA has no safe harbor for calling a reassigned number, even if you had valid consent from the previous holder. One call to a new owner who never consented is a violation. The FCC's Reassigned Numbers Database, launched in 2021, lets callers check whether a number has changed hands since consent was collected. Add a reassigned-number check to your QA process for any number not called in 90 or more days.

Does TCPA apply to text message marketing the same way it applies to calls?

Yes. The FCC and courts have consistently held that text messages sent using an automated platform fall under the TCPA's ATDS and prior express written consent requirements. Marketing texts need the same prior express written consent as autodialed telemarketing calls. You also need a clear opt-out mechanism in every message and must honor STOP requests promptly.

What is the penalty for calling a number on the Do Not Call Registry?

The FTC can seek civil penalties of up to $51,744 per violation (2024 rate, adjusted annually) under the Telemarketing Sales Rule. Separately, private plaintiffs can sue under the TCPA for $500 per call, or $1,500 per call for willful violations. Both penalties can apply independently, and class action suits aggregate individual violations into multi-million-dollar exposure fast.

What disclosures does an agent have to make at the start of a TCPA-regulated call?

Under 47 C.F.R. § 64.1200(d)(4), the agent must state their name and the name of the company they're calling for at the start of the call, and provide a telephone number or address where the company can be reached. For prerecorded messages, the business name and a callback number must appear at the start of the recording. A failure on either point is a per-call violation.

How do I know if my dialer qualifies as an ATDS under the current legal standard?

After the Supreme Court's 2021 ruling in Facebook v. Duguid, an ATDS is a system that uses a random or sequential number generator to store or produce numbers to be called. Systems dialing from a fixed uploaded list without random or sequential number generation likely don't qualify under the federal standard. Document your dialer's technical architecture specifically, because that documentation becomes your defense if you're sued.

What should I do when a consumer requests to be placed on a Do Not Call list during a call?

Honor the request immediately. Under the TCPA and FTC rules, you must add the number to your internal company-specific DNC list within 30 days and keep that suppression for at least five years. Train agents to log DNC requests as a required call disposition in your dialer. Don't rely on agents to hand-update a spreadsheet after the call ends; that process fails consistently.

Are there QA differences for prerecorded voice calls versus live agent calls?

Yes. Prerecorded voice calls require prior express written consent for any call to a wireless number and for any telemarketing call to a residential line, regardless of whether you think the dialer is an ATDS. Live manually dialed calls to wireless numbers with no prerecorded component aren't subject to the ATDS consent requirement, though DNC rules, calling hours, and disclosure requirements still apply fully. Document the call type in your QA log.

Do Florida's Mini-TCPA rules change my QA checklist if I call into Florida?

Yes, materially. Florida's Telephone Solicitation Act applies to any technology that dials automatically, broader than the federal ATDS definition, restricts calls to 8 a.m. to 8 p.m. local time (vs. 9 p.m. federally), and requires prior written consent for automated calls and texts. It also creates a private right of action with the same $500 to $1,500 per-violation damages as the TCPA. Treat Florida records with the tighter ruleset as your default.

Sources

1. Cornell LII, 47 U.S.C. § 227 (TCPA statute text): TCPA restricts ATDS and prerecorded calls to wireless numbers without prior express consent; prohibits calls outside 8 a.m. to 9 p.m. local time; requires caller ID and identity disclosures; statutory damages of $500 to $1,500 per violation
2. FTC, Telemarketing Sales Rule (16 C.F.R. Part 310): TSR requires DNC scrubbing at least every 31 days; civil penalties up to $51,744 per violation (2024 rate); records must be retained for 24 months; internal DNC requests must be honored within 30 days and maintained for five years
3. Cornell LII, Facebook, Inc. v. Duguid, 592 U.S. 395 (2021): ATDS under TCPA requires use of random or sequential number generator to store or produce numbers; systems dialing from fixed uploaded lists likely do not qualify
4. Cornell LII, 47 U.S.C. § 227 (TCPA consent provisions); FCC One-to-One Consent Rule and Eleventh Circuit vacatur (2025): FCC's 2023 One-to-One Consent Rule required each seller to obtain its own prior express written consent; rule was vacated by the Eleventh Circuit in January 2025 on procedural grounds; bundled consent remains legally fragile
5. National Conference of State Legislatures, State Telemarketing Laws: Approximately 13 states maintain their own Do Not Call lists including Florida, Texas, California, Indiana, and others requiring separate scrubbing by sellers
6. Florida Legislature, Florida Telephone Solicitation Act (§ 501.059, Fla. Stat.): Florida's Mini-TCPA restricts calls to 8 a.m. to 8 p.m. local time, applies to any auto-dialing technology (broader than federal ATDS), requires prior written consent, and creates private right of action for $500 to $1,500 per violation
7. FTC, National Do Not Call Registry: Sellers with more than 5 area codes of data pay per-area-code annual fees (approximately $81 per area code in 2024) to access the National DNC Registry for scrubbing
8. FCC, 47 C.F.R. § 64.1200 (TCPA Implementing Regulations): FCC regulations require callers to state their name and company name at the beginning of each call and provide a contact telephone number or address; calls restricted to 8 a.m. to 9 p.m. called party's local time