TCPA compliance management system: what it is and how to build one

Last updated 2026-07-09

What is a TCPA compliance management system?

A TCPA compliance management system is not a single piece of software. It's the combination of written policy, consent collection and storage, list scrubbing, calling-hour controls, opt-out processing, and documentation that together let you prove you followed the Telephone Consumer Protection Act before a plaintiff's attorney ever sends a demand letter.

The Telephone Consumer Protection Act, codified at 47 U.S.C. § 227, restricts automated calls and texts to cell phones, prerecorded messages to any phone, and calls to numbers on the National Do Not Call Registry ^[1]. Penalties run from $500 per violation for negligent violations up to $1,500 per violation for willful ones, and courts have repeatedly allowed class certification, meaning one bad practice can multiply a five-figure mistake into eight figures fast ^[1].

The word "system" carries the weight here. A spreadsheet of opt-outs is not a system. A DNC scrubbing vendor you call once a quarter is not a system. A system has interconnected parts that run automatically, produce records, and catch problems before a call goes out rather than after. Most small teams build one in layers: start with consent and documentation, add scrubbing, then add monitoring and audit.

Think of it the way you'd think of a building's fire suppression setup. Nobody hopes the sprinklers go off. The whole point is that they're ready if something goes wrong, and the inspector wants to see the maintenance log, more than your word that the pipes are charged.

What does the TCPA actually require for outbound calling and texting?

The statute draws three main lines that affect outbound sales teams ^[1].

First, you need prior express written consent before making an autodialed or prerecorded call or text to a cell phone for marketing purposes. The FCC's 2012 rules tightened the consent standard: oral consent is no longer enough for marketing calls, and the written consent must include a clear disclosure that the person is agreeing to receive autodialed or prerecorded calls from a specific company ^[2]. The FCC's 2024 one-to-one consent rule, which took effect in January 2025, went further and said a single consent form cannot grant consent to multiple, unrelated sellers ^[2].

Second, you cannot call numbers on the National DNC Registry without either prior express invitation or an established business relationship (EBR). The EBR window is 18 months from a purchase and 3 months from an inquiry ^[3].

Third, calling hours are fixed by federal rule: no calls before 8 a.m. or after 9 p.m. in the called party's local time zone ^[10]. Many states set tighter windows. Florida's Mini-TCPA, for example, restricts some calls to 8 a.m. to 8 p.m. ^[4].

The FCC also requires that automated systems honor do-not-call requests within a reasonable time, which the agency has interpreted as a matter of days, and that companies maintain an internal do-not-call list separate from the National Registry ^[3].

Nobody has perfectly clean data on how often violations happen by accident versus on purpose, but the class action dockets make the pattern clear: wrong-number calls to reassigned numbers and calls after opt-out are the two most common triggers. A compliance system addresses both directly.

What are the core components of a TCPA compliance management system?

There are six components every defensible system needs. Miss one and you have a gap a plaintiff can drive through.

1. Consent capture and storage Every lead entering your pipeline needs a consent record: what disclosure the person saw, when they clicked or signed, the IP address or call recording, and which company they consented to. The FCC's 2012 order requires consent to be in writing and to explicitly authorize autodialed or prerecorded calls ^[2]. Store these records for at least four years, which is the TCPA's statute of limitations under most circuits.

2. National DNC Registry scrubbing You must subscribe to the National DNC Registry, pay the access fee (free for up to five area codes, $75 per area code per year beyond that, capped around $18,375 for full national access as of the FTC's current fee schedule) ^[3][11], and scrub your calling lists within 31 days of those records being generated. Once a scrub passes 31 days, the safe harbor that protects against innocent violations disappears.

3. Internal DNC list This is separate from the Registry. Anyone who asks not to be called by your company goes on your internal list, and that request has to be honored by the next calling day at minimum. The FCC rule says you must maintain this list and honor it for five years ^[3].

4. Reassigned number scrubbing The FCC's Reassigned Numbers Database (RND) launched in 2021 ^[5]. If you call a number that was reassigned to a new subscriber after your consent was collected, you can still be liable, because the person you reach never consented. Checking the RND before each campaign is the single fastest way to cut wrong-number exposure.

5. Time-zone and calling-hour enforcement Your dialer or CRM needs to know each contact's local time zone and block calls outside the permitted window. Hard-coding this in the system beats trusting reps to check manually. State law adds complexity: some states run narrower windows or extra restrictions on Sundays and holidays.

6. Opt-out processing and documentation Every opt-out channel (call, text, email, web form) needs to funnel into the same internal DNC list within a defined SLA. Write that SLA down. If a plaintiff's attorney shows that a contact asked to stop and then got two more calls a week later, your written policy and the record of the miss become exhibit A against you.

How much does TCPA non-compliance actually cost?

The statutory range is $500 to $1,500 per violation, where each individual call or text counts as a separate violation ^[1]. Courts have allowed class certification in TCPA cases repeatedly, so the math compounds fast.

Real settlements give you a better feel for the actual risk than the statute alone. UnitedHealthcare paid $2.5 million to resolve alleged TCPA violations around automated calls [see /articles/tcpa-basics/unitedhealthcare-to-pay-2-5m-for-alleged-tcpa-violations]. Credit One Bank reached a TCPA settlement that drew national attention [see /articles/tcpa-basics/credit-one-tcpa-settlement]. Truist Bank settled a class action over similar automated-call allegations [see /articles/tcpa-basics/truist-bank-tcpa-class-action-settlement]. Cash App faced a TCPA class action as well [see /articles/tcpa-basics/cash-app-tcpa-class-action-settlement].

Small teams often assume these cases only hit big companies with deep pockets. That's wrong. Plaintiff attorneys work on contingency, so even a 50-person sales floor with sloppy consent practices is a viable target if the call volume is high enough. A team making 1,000 calls a day at a 0.1% non-compliant rate is generating one potentially actionable call every day.

Compliance costs money too. A mid-market team typically spends $5,000 to $30,000 a year on DNC scrubbing software, consent management tools, and staff time. That's real. But it sits against a potential eight-figure class action, and framed that way it stops looking expensive.

Risk factor	Estimated exposure
Single negligent violation	$500
Single willful violation	$1,500
10,000-call class, negligent	$5,000,000
10,000-call class, willful	$15,000,000
Typical mid-market settlement (public cases)	$1M, $15M
Annual compliance system cost (small team)	$5,000, $30,000

How do you build a TCPA compliance management system from scratch?

Start with an inventory before you buy anything. List every channel you use to collect leads, every system that stores contact records, every tool that makes outbound calls or sends texts. You cannot build a compliance layer over a process you haven't mapped.

Step 1: Audit your current consent language. Pull every web form, landing page, and paper form where you collect phone numbers. Check whether each one carries an explicit TCPA disclosure naming your company, describing the use of autodialed or prerecorded calls or texts, and stating that consent is not a condition of purchase. If that language is missing or vague, fix it before your next campaign. The 2024 FCC one-to-one consent rule means you also need to verify that each form is specific to your company and not a shared lead-gen form that bundles multiple sellers ^[2].

Step 2: Set up consent storage. You need a record of the consent event: timestamp, the exact disclosure text the person saw (store it by version, because forms change), the confirmation token or signature, and the phone number. A database table works. A consent management platform works better because it timestamps automatically and makes records easier to produce in litigation.

Step 3: Subscribe to and scrub against the National DNC Registry. Go to donotcall.gov to access the Registry ^[3]. Subscribe at the area-code level you need. Build the scrub step into your campaign launch checklist so it's impossible to skip. Many CRMs have native or third-party integrations that automate this.

Step 4: Build your internal DNC list and connect every opt-out channel to it. This is the part most small teams get wrong. Text opt-outs go into one tool, call opt-outs land in a spreadsheet, web form opt-outs sit in the CRM, and none of them talk to each other. Connect all three to a single suppression list that every dialer and messaging platform checks before any send.

Step 5: Configure calling-hour blocks. Your dialer should know the time zone of the called number and refuse to connect before 8 a.m. or after 9 p.m. local time. If you call into multiple states with stricter rules, layer in those restrictions. This is a one-time configuration, not ongoing work.

Step 6: Add reassigned-number scrubbing. Query the FCC's Reassigned Numbers Database via API or a vendor before each campaign batch. The database updates monthly ^[5]. This step alone catches a real slice of wrong-number liability.

Step 7: Write it all down. A compliance management system that exists only in practice and not in policy is a problem in court. Write a TCPA compliance policy that covers consent requirements, DNC procedures, opt-out handling, record retention, and the person responsible for each process. Review and update it at least once a year, or whenever the FCC issues new rules.

What technology tools does a TCPA compliance system need?

You don't need a single monolithic platform. Most teams assemble a stack from four categories.

Consent management. Tools like Jornaya (now part of ActiveProspect) and TrustedForm capture the lead-gen event and produce a certificate with timestamp, IP, and the exact page content the consumer saw. These certificates are the gold standard for defending a TCPA lawsuit because they're third-party records, not self-generated ones.

DNC scrubbing. Vendors like DataValidation, Gryphon Networks, and Contact Center Compliance (CompliancePoint) connect to the National DNC Registry, state DNC lists, and your internal list in one query. Some integrate directly into Salesforce, HubSpot, or common dialers so every call is scrubbed in real time.

Reassigned number database access. The FCC built and operates the RND directly ^[5]. Several vendors wrap the FCC's API into a simpler interface. Query costs are minimal per lookup.

Policy and audit documentation. Some teams use purpose-built compliance platforms (like Convoso or CallTrackingMetrics for call-side compliance, or a simple shared document system for policy). What matters is that records are timestamped, searchable, and can be exported fast if you get a litigation hold notice.

For teams building or auditing their stack, LeadCompliant offers free DNC and consent checkers that let you verify individual numbers and consent records against the Registry and the RND before you commit to a full vendor relationship.

One honest opinion: do not buy an expensive all-in-one "compliance platform" before you understand your own workflows. Spend the first 60 days mapping your process and patching the obvious gaps with low-cost or free tools. Then buy the expensive thing, because you'll know what you actually need.

How do consent requirements differ for calls versus texts?

The consent standard for texts is effectively the same as for autodialed calls to cell phones: prior express written consent for marketing messages ^[2]. The FCC has confirmed repeatedly that SMS marketing sent via an autodialer or automated system falls under the same TCPA restrictions as calls.

Text workflows carry a few specific wrinkles worth knowing.

Double opt-in, where you send a confirmation text asking the person to reply YES before adding them to your list, is not required by federal law but is strongly recommended, because it generates an on-device record of affirmative consent. The Cellular Telecommunications Industry Association (CTIA) guidelines call for it on most commercial messaging programs, and mobile carriers increasingly enforce those guidelines by blocking traffic from senders who skip it ^[6].

Opt-out has to work via text reply. If someone texts STOP, QUIT, CANCEL, END, or UNSUBSCRIBE, your system must process that as an opt-out immediately and send a confirmation message ^[6]. If your texting platform needs a human to process STOP replies by hand, that's a workflow gap that will eventually produce a violation.

For more on what's allowed in text marketing, the text message marketing and text messaging marketing guides on this site go deeper into campaign-level requirements.

The FCC's 2024 one-to-one consent rule hits text campaigns especially hard, because many lead-gen operations historically used a single web form to collect consent for dozens of SMS marketers at once. That practice is now clearly prohibited ^[2].

What records do you need to keep, and for how long?

The TCPA's statute of limitations is four years under 28 U.S.C. § 1658 (the catch-all federal limitations period), though some courts have applied shorter periods depending on the theory pled. The safest practice is to retain every consent record, DNC scrub result, and opt-out log for at least four years from the date of the call or text ^[7].

Keep, specifically:

• The consent record for each contacted number: what they consented to, when, and through which form version.
• The DNC scrub results for each campaign, dated, so you can show the scrub landed within 31 days of the call.
• Your internal DNC list with timestamps showing when each number was added and why.
• RND query results by campaign.
• Call recordings or text logs good enough to reconstruct what was said and when.
• Your written TCPA compliance policy, every version of it, with effective dates.

The most dangerous gap in small-team practice is consent record retention. Teams store leads in a CRM that later gets migrated or purged, and two years on, when a lawsuit arrives, they cannot produce the consent certificate for the plaintiff's number. A third-party consent certificate from a vendor like TrustedForm solves this because the record lives outside your infrastructure.

For ongoing monitoring, watch for complaints filed against your phone number. The FTC and FCC both accept consumer complaints, and a pattern of complaints on one number can prompt an investigation even without a private lawsuit ^[3][8].

How do state TCPA-equivalent laws complicate your compliance system?

Federal TCPA sets the floor. A growing list of states have layered extra requirements on top, and your compliance system needs to account for them separately.

Florida's Telephone Solicitation Act (FTSA), sometimes called the "Mini-TCPA," restricts calls and texts to 8 a.m. to 8 p.m. and created a private right of action that has generated a wave of class actions since its 2021 amendments ^[4]. Florida plaintiffs file TCPA-style suits in state court under FTSA, which matters because state courts sometimes apply different class certification standards.

California's consumer protection framework, including the California Consumer Privacy Act (CCPA), adds consent and data handling requirements that interact with TCPA compliance ^[9]. If you market to California residents, you need to think about opt-out honoring for data use more broadly, not only for calls and texts.

Oklahoma, Washington, Indiana, and several other states run their own DNC lists or telemarketing statutes with independent requirements. Most compliance scrubbing vendors include multi-state DNC lists in their service, but you should verify which states are covered and whether the vendor's list updates on the required schedule.

For state-specific questions, especially if you're facing a potential suit, local counsel matters. A practitioner who focuses on TCPA defense in a specific jurisdiction (such as a tcpa lawyer kentucky) knows the local court's class certification tendencies and settlement norms in ways national generalist advice cannot cover.

The honest summary: if your calling volume is high and your footprint spans multiple states, get a legal review of your compliance system against the specific states you call into. A one-size federal policy is not enough.

How do you audit an existing TCPA compliance system for gaps?

An audit does not require outside counsel, though counsel can be useful for privilege protection if you're nervous about what you'll find. At a minimum, run these six checks.

Check 1: Pull 20 random consent records from the last six months. Can you retrieve the full consent certificate (disclosure text, timestamp, IP, phone number) for each? If it takes more than five minutes per record, your consent storage has a gap.

Check 2: Review your last three campaign lists. When were they scrubbed against the National DNC Registry? Is the scrub date within 31 days of the first call? Any gap over 31 days eliminates the safe harbor.

Check 3: Test your opt-out processing. Have someone submit an opt-out through each channel: reply STOP to a text, ask to be removed on a call, submit a web form. Then check whether that number lands on the internal DNC list within your documented SLA. More than 24 to 48 hours is a gap.

Check 4: Check your calling-hour controls. Review your dialer configuration and look for any calls made before 8 a.m. or after 9 p.m. in the recipient's time zone in the last 30 days. Your dialer's call logs should make this queryable. Even one call outside hours is a violation.

Check 5: Review your written policy. Is it current? Does it name the person responsible for each process? Has it been updated for the FCC's 2024 one-to-one consent rule?

Check 6: Verify RND queries. Are you checking the Reassigned Numbers Database before campaigns? If not, add that step.

For a structured version of this audit, the LeadCompliant compliance kit includes a checklist that covers each of these areas with specific documentation prompts.

Nobody passes a first audit clean. The point is to find the gaps before a plaintiff does. Document what you find and document the corrective steps you take, because showing a good-faith remediation effort helps in settlement negotiations.

What happens when you get a TCPA demand letter or lawsuit?

A TCPA demand letter arrives. Your first move is to preserve everything: do not delete call logs, consent records, or opt-out data. Send a litigation hold notice to anyone who touches your calling or texting systems right away. This sounds obvious, but teams under pressure have made deletions that turned a defensible case into an indefensible one.

The second move is to pull the specific records for the plaintiff's number. What consent do you have? When was it last scrubbed? Was it on your internal DNC list? Did the plaintiff ever opt out before the call? Those answers tell you and your counsel whether you have a defense or whether you need to settle fast.

The statutory cap of $1,500 per willful violation is a ceiling, not a floor. Named plaintiffs often demand far more for nuisance value, knowing litigation costs make it rational to settle even a weak claim. A full record set for the plaintiff's number shifts that calculus in your favor.

Most TCPA cases settle. Real public settlements range from thousands of dollars for single-plaintiff suits to tens of millions for class actions. The Albertsons/Safeway TCPA settlement and the Kaiser TCPA settlement (with its notable claim deadline) show how even large, sophisticated organizations end up in class-wide exposure [see /articles/tcpa-basics/albertsons-safeway-tcpa-settlement] [see /articles/tcpa-basics/kaiser-tcpa-settlement-claim-deadline].

If you are in active litigation, stop reading this article and hire a TCPA defense attorney. This is a reference, not legal advice. Compliance systems reduce the probability and cost of suits. They do not remove the need for counsel once a suit lands.

How do you keep a TCPA compliance system current as the rules change?

The FCC issues new rules, courts hand down conflicting circuit opinions, and states pass new statutes every year. A compliance system built for 2022 rules may have gaps under 2025 rules. Staying current takes a process, not good intentions.

Subscribe to FCC rulemaking proceedings that affect TCPA. The FCC's public comment dockets are searchable at fcc.gov and free to monitor ^[8]. Every major TCPA rulemaking runs through a comment period before taking effect, which gives you advance notice.

Designate someone, even part-time, to read TCPA-related news monthly. The plaintiff's bar is sophisticated and publishes detailed analysis of new rulings fast. Monitoring a source like the tcpa news feed is a practical way to stay ahead of rule changes that force system updates.

Review your written compliance policy at least once a year, and again every time a court or agency issues a change that touches your calling or texting practices. Update consent language, DNC procedures, and staff training to match.

Plan for the FCC's one-to-one consent rule to be the template for future consent tightening, not a one-time change. Since 2012, the direction of federal regulation has run consistently toward stricter consent requirements and stronger opt-out rights. Build your system assuming further tightening, not rollback.

Once a year, redo the six-point audit from the previous section. The gaps shift as your team grows and your tooling changes. What passed last year may not pass next year.

Frequently asked questions

What is a TCPA compliance management system?

It's the documented combination of written policy, consent storage, DNC list scrubbing, opt-out processing, calling-hour controls, and audit records that together let a company prove it followed the Telephone Consumer Protection Act. No single tool covers all of it. The system works only when the components connect so a bad number cannot be called without triggering a block.

How much does it cost to build a TCPA compliance system?

A basic system for a small team runs $5,000 to $15,000 per year, covering National DNC Registry access, a consent management tool, and a DNC scrubbing vendor. Mid-market teams with higher volume typically spend $15,000 to $30,000 annually. Legal review and staff training add to that. The FTC's DNC Registry charges $75 per area code per year beyond the first five, capped at roughly $18,375 for full national access.

What is the difference between the National DNC Registry and an internal DNC list?

The National DNC Registry is the federal database maintained by the FTC that consumers register with to block most unsolicited sales calls. Your internal DNC list is your company's own suppression list of people who asked specifically not to be called by you. Both are required. The FCC mandates that companies maintain an internal list and honor requests on it for five years, separate from whatever Registry scrubbing you do.

How often do you need to scrub your calling list against the DNC Registry?

You must scrub within 31 days of generating or acquiring the list you plan to call. A scrub older than 31 days removes the safe harbor protection that shields you from liability for innocent violations. Most compliance teams set up automated scrubbing that runs every list before any campaign launches, so the 31-day question never comes up.

Does TCPA apply to text messages?

Yes. Text messages sent via an autodialer or automated system to cell phones are covered by the TCPA the same way autodialed calls are. You need prior express written consent for marketing texts. Opt-out must be honored immediately when someone replies STOP. The FCC's 2024 one-to-one consent rule also applies to text campaigns, prohibiting shared consent forms that simultaneously authorize multiple unrelated companies to text a consumer.

What is the FCC's Reassigned Numbers Database and why does it matter?

The FCC's Reassigned Numbers Database, launched in 2021, tracks phone numbers that have been disconnected and reassigned to a new subscriber. If you call a number using old consent from the previous subscriber, you can still face TCPA liability because the current subscriber never consented. Querying the RND before each campaign identifies numbers reassigned since your consent was collected, letting you remove them before the call.

How long do you need to keep TCPA consent records?

The safest practice is four years from the date of the call or text, matching the TCPA's statute of limitations under the catch-all federal period in 28 U.S.C. § 1658. Some circuits have applied shorter periods, but building your retention policy around the longer window protects against any theory a plaintiff's attorney might use. Third-party consent certificates from vendors like TrustedForm store records outside your own infrastructure, cutting the risk of loss during system migrations.

What is the FCC's 2024 one-to-one consent rule?

The FCC's 2024 order, effective January 2025, requires that TCPA consent be given specifically to one company at a time, not bundled across multiple sellers on a shared lead-gen form. A consumer clicking a form that says 'I consent to be contacted by our marketing partners' no longer provides valid TCPA consent to any of those partners. Each seller must be named, and consent must be logically and topically related to the website where it's collected.

Can you call someone with an established business relationship even if they're on the DNC Registry?

Federal rules allow EBR as a basis for calling DNC-registered numbers, but the window is limited: 18 months from the most recent purchase, payment, or transaction, or 3 months from an inquiry or application. Once that window closes, the EBR no longer protects the call. State laws may set shorter or different EBR windows, so check the specific state if you're relying on EBR.

What is the TCPA calling hours rule?

Under 47 C.F.R. § 64.1200(c)(1), no telemarketing calls may be made before 8 a.m. or after 9 p.m. in the called party's local time zone. That's the federal floor. Florida restricts certain calls to 8 a.m. to 8 p.m. Other states have similar or stricter limits. Your dialer should enforce time-zone-based blocks automatically, because one call outside hours is a chargeable violation.

What should a TCPA compliance policy document include?

At minimum: the consent standard your company requires before any autodialed call or marketing text, how consent is captured and stored, the DNC scrubbing schedule and vendor used, how the internal DNC list is maintained and updated, the opt-out processing SLA for each channel, calling-hour restrictions by state, record retention periods, the person responsible for each process, and the review and update schedule for the policy itself.

How do state mini-TCPA laws affect a compliance system?

State laws like Florida's FTSA create independent private rights of action with their own consent and calling-hour rules. A company fully compliant with federal TCPA can still violate Florida, California, or Oklahoma law. Your compliance system needs to flag contacts in high-restriction states and apply the stricter state rules to those records. DNC scrubbing vendors typically include state list access, but verify which states are covered.

Does a TCPA compliance system protect you completely from lawsuits?

No. It significantly reduces exposure and gives you a documented defense if a suit is filed, but it does not make you lawsuit-proof. Plaintiffs' attorneys can still file suits based on alleged gaps or disputes about consent validity. A well-run system changes the economics: a company with clean records typically settles fast and cheap; a company with no records faces the full class-wide statutory exposure. The system is risk reduction, not immunity.

What happens if you receive a TCPA demand letter?

Immediately issue a litigation hold to preserve all call logs, consent records, and opt-out data. Pull the full compliance record for the plaintiff's number: consent certificate, DNC scrub date, opt-out history. Share those records with TCPA defense counsel before responding to the letter. Do not delete anything. Whether you have a strong defense or need to settle depends entirely on what those records show, so producing them quickly is your first priority.

Sources

1. U.S. Congress, 47 U.S.C. § 227 (Telephone Consumer Protection Act): TCPA penalties range from $500 per violation for negligent violations to $1,500 per willful violation; statute restricts autodialed calls and texts to cell phones and calls to DNC-registered numbers
2. FTC, National Do Not Call Registry: DNC Registry access is free for up to five area codes; scrubbing must occur within 31 days; companies must maintain a separate internal DNC list honored for five years; EBR window is 18 months from purchase, 3 months from inquiry
3. Florida Legislature, Florida Telephone Solicitation Act (FTSA), F.S. § 501.059: Florida's FTSA restricts telemarketing calls and texts to 8 a.m. to 8 p.m. and creates a private right of action for violations
4. FCC, Reassigned Numbers Database: FCC's Reassigned Numbers Database launched in 2021 and is updated monthly; allows callers to check whether a number has been reassigned to a new subscriber since consent was collected
5. U.S. Congress, 28 U.S.C. § 1658 (catch-all federal statute of limitations): General federal statute of limitations is four years; applied by most courts to TCPA claims, setting the minimum record retention period
6. California Attorney General, California Consumer Privacy Act (CCPA): CCPA adds data handling and opt-out requirements for California residents that interact with TCPA consent practices for marketers operating in California
7. FCC, 47 C.F.R. § 64.1200 (TCPA implementing regulations): Federal regulations prohibit telemarketing calls before 8 a.m. or after 9 p.m. in the called party's local time zone under 47 C.F.R. § 64.1200(c)(1)
8. FTC, Complying with the Telemarketing Sales Rule (DNC Registry fees and access): DNC Registry access costs $75 per area code per year beyond the first five free area codes, with a national access cap of approximately $18,375