TCPA compliance software: what it does and what to look for

Last updated 2026-07-10

What does TCPA compliance software actually do?

TCPA compliance software keeps illegal calls from going out and documents that you tried, in case you land in court. The Telephone Consumer Protection Act, 47 U.S.C. § 227, sets liability at $500 per negligent violation and $1,500 per willful one ^[1]. Those numbers stack fast at any real volume.

At the core, the software does a few specific jobs. It scrubs your contact list against the national Do Not Call Registry and any state DNC lists before a call goes out. It checks whether a number got reassigned to a new consumer since you captured consent, because the FCC's Reassigned Numbers Database makes "I didn't know" a weak defense ^[2]. It enforces calling hours (8 a.m. to 9 p.m. local time for the called party under the TCPA ^[1]). And it stores consent records, call logs, and opt-out requests where you can pull them during discovery.

Some platforms go further. They plug into your outbound dialer and block a call if the number fails a compliance check. Others add real-time caller ID reputation monitoring, since a flagged number gets fewer pickups and more complaints even when every call is legal. The better tools handle SMS alongside voice, because the TCPA treats a text to a wireless number the same as a call ^[1].

Here's what no software does. It cannot invent consent that never existed. It cannot turn a prerecorded message sent without prior express written consent into a lawful call. Software enforces your rules and records your actions. It does not fix a bad business practice.

What are the specific TCPA rules that software needs to enforce?

The TCPA and FCC rules ^[1][3] set a short list of hard requirements for outbound calling and texting. Know them before you evaluate any tool, because a vendor demo will not tell you what it quietly skips.

Calls to wireless numbers using an automatic telephone dialing system (ATDS) or an artificial or prerecorded voice need prior express written consent. Not verbal. Not implied. Written, which the FCC reads to include electronic records like a web form submission or a recorded verbal agreement stored properly ^[3].

Calls to residential landlines using a prerecorded message need prior express written consent for commercial calls, or a prior business relationship for non-commercial ones, with narrow exceptions.

The national DNC Registry applies to all outbound solicitation calls regardless of technology. If a consumer sits on the registry and you have no established business relationship (EBR) or express invitation, you cannot call them to sell. The FCC defines an EBR as a relationship based on a purchase or transaction within the prior 18 months, or an application or inquiry within three months ^[3].

Time-of-day rules are simple. No solicitation calls before 8 a.m. or after 9 p.m. local time for the called party ^[1].

Caller ID rules bar misleading or inaccurate caller ID. The STIR/SHAKEN authentication framework, mandated by the TRACED Act, now requires carriers to attest to the legitimacy of the caller ID on calls ^[4].

Any tool you buy should enforce every one of these, and most major platforms do. The gaps hide in the edges: state-specific rules (Florida, Oklahoma, and Washington all run stricter regimes than federal law), the reassigned-number scrub, and real-time ATDS detection on a blended dialer.

What is an abandoned call under the TCPA?

An abandoned call is a connected outbound call where no agent or live voice picks up on your side within two seconds of the called party finishing their greeting ^[3]. This matters a lot for call center TCPA compliance, because predictive dialers routinely abandon calls when the algorithm dials more numbers than the available agents can take.

The FCC's rule at 47 C.F.R. § 64.1200(a)(7) caps abandoned calls at 3% of all answered calls per campaign, per month ^[3]. When a call gets abandoned, the dialer has to play a recorded message with the name and telephone number of the entity the call is placed for, and you have to keep a DNC list for anyone who asks during that message.

Blow past the 3% cap and you have a direct FCC rule violation, not a best-practice miss. FCC forfeitures can reach $23,727 per violation under recent inflation adjustments, on top of any private TCPA lawsuit exposure ^[9].

Good call center compliance software tracks your abandonment rate per campaign in real time and throttles the dialer before you breach the cap. If your dialer doesn't show live abandonment rate by campaign, that's a red flag. You're flying blind on a number the FCC actively enforces.

Which auto dialer software supports TCPA compliance for outbound calls?

Several dialer and contact center platforms build compliance controls straight into the outbound workflow. These are the names compliance teams at outbound call centers keep evaluating. Features and pricing shift, so read this as a starting framework, not a final buy list.

Platform	DNC Scrub	Time-Zone Enforcement	Abandonment Rate Tracking	Consent Management	Reassigned Number Check
Five9	Yes	Yes	Yes	Limited (integration)	Via third-party
NICE CXone	Yes	Yes	Yes	Yes	Via integration
Genesys Cloud	Yes	Yes	Yes	Configurable	Via integration
Convoso	Yes	Yes	Yes	Limited	Via integration
Velocify (Salesforce)	Yes	Yes	Configurable	Yes	Via third-party
PhoneBurner	Manual scrub	Yes	No (not a predictive dialer)	No	No

A few things stand out in that table. No platform runs reassigned-number scrubs natively as of 2025. They all lean on an integration with a third-party data provider that queries the FCC's Reassigned Numbers Database ^[2]. PhoneBurner isn't a predictive dialer, so it doesn't need abandonment tracking, but that also means teams using it carry more manual compliance work. And "consent management" means different things to different vendors. Always ask whether they store the timestamp, IP address, and exact consent language captured, because that's what survives litigation.

Smaller teams on a tighter budget sometimes pair a standalone list-scrubbing service (examples: DNC.com, Gryphon Networks, or the FCC Reassigned Numbers Database API ^[2]) with a simpler power dialer like PhoneBurner or Kixie. That works. It just demands more process discipline, so scrubs actually run before every campaign and not only at setup.

For a structured view of the checks that matter most, the LeadCompliant compliance kit puts the core checklist in one place, so your team has a documented process no matter which dialer you run.

What should call centers specifically look for in TCPA compliance software?

Call center TCPA compliance carries requirements that don't hit a one-person sales team the same way. Scale is the difference. A single misconfiguration can spray thousands of violations before anyone notices.

Here's what to actually evaluate when buying for a call center.

Real-time DNC integration, not batch scrubs. Overnight batch scrubs are almost good enough, and "almost" loses lawsuits. If a consumer registers on the national DNC Registry, you have 31 days to honor it under FTC rules ^[7]. A real-time API tie-in with the registry, refreshed at least daily, is the bar.

Time-zone detection at the number level. Enforcing calling hours by area code isn't enough. Numbers port between states. A 212 number might belong to someone who moved to California. You want detection of the current time zone tied to the number's actual location, which means a real-time lookup, not an area-code map.

Suppression list management. Every DNC request, from an inbound call, an opted-out text, or a written notice, has to land in a suppression list that gets checked before any outbound contact on that number or from that consumer (name plus number). The TCPA requires you to honor internal DNC requests within 30 days ^[3].

Call recording with retrievable timestamps. If you get sued, you produce the call record, the time of the call, the number dialed, and the consent on file at that moment. Platforms that silo these in separate systems become a litigation headache.

Audit trails. Every suppression-list change, every consent record added or edited, every compliance setting touched should log automatically with a timestamp and user ID. That serves internal quality control and regulatory response both.

Insurance call centers raise the stakes on consent documentation. Insurance leads often flow through lead generators and aggregators, and the FCC's 2024 one-to-one consent rule (effective in 2025, though litigation has muddied the implementation) tightened who can rely on consent a third party captured ^[5]. TCPA compliance for insurance call centers means auditing more than your own consent capture. It means auditing the consent chain from every lead source.

How does AI for TCPA compliance in call centers actually work?

AI features in compliance software fall into two buckets right now: predictive risk scoring and conversation analysis. One is often oversold. The other genuinely earns its keep.

Predictive risk scoring runs a phone number against several signals (DNC status, litigation history tied to the number, reassignment probability, complaint rates) and assigns a contact risk score before the dialer touches it. Gryphon Networks and a handful of others have shipped versions of this for years. Honest read: the underlying data quality matters far more than the AI layer. A neural net trained on stale data is still stale data.

Conversation analysis transcribes calls in real time and flags when an agent skips the required disclosure, when a called party says something like "take me off your list" (which triggers a DNC obligation immediately ^[3]), or when a call runs long enough that opt-out procedures need repeating. This is the useful part. An agent who misses a verbal DNC request is the most common source of willful-violation exposure, and real-time flagging stops that from compounding across a hundred calls.

A few vendors now use AI to classify whether a given dialing technology counts as an ATDS. That's ambitious. The Supreme Court's 2021 Facebook v. Duguid decision ^[6] narrowed the ATDS definition sharply, but state laws (Florida and Maryland especially) use different definitions, and the classification question stays unsettled across jurisdictions.

Here's the honest read on AI for TCPA compliance in call centers. It supplements hard rules enforcement. It doesn't replace it. You still need the scrubs, the time-zone checks, the suppression list, and the consent records. AI catches the soft failures that rules alone miss.

Do insurance companies cover TCPA damages?

Maybe, but probably not fully, and not reliably. Small teams keep assuming their general liability or E&O policy will catch a TCPA judgment. It usually won't.

General liability policies typically cover bodily injury, property damage, and sometimes personal and advertising injury. TCPA claims sometimes fit under personal injury coverage when the policy defines it to include invasion of privacy. Many insurers have since bolted explicit TCPA exclusions onto their GL policies after years of expensive class action losses.

Errors and omissions (E&O) or professional liability policies almost never cover TCPA claims, because the violation is usually a deliberate act (you chose to dial the number) even when the illegality was accidental.

A specialty category called Media Liability or Technology E&O sometimes covers TCPA exposure, and a few carriers now write TCPA-specific endorsements. Limits usually run $1 million to $5 million. That sounds like plenty until you do the math: a class of 10,000 called parties at the $500 statutory minimum is a $5 million exposure before any willfulness multiplier.

The honest advice: talk to a licensed insurance broker who specializes in technology or communications liability before you assume you're covered. The policy language on "expected or intended" injury exclusions can gut your coverage at the worst possible moment. Don't run insurance as your primary TCPA risk tool. Prevention is cheaper. For a sense of real settlements, the UnitedHealthcare case and the Credit One settlement show the actual exposure range.

How much does TCPA compliance software cost?

Pricing is all over the map, and vendors stay quiet about it. Here's the honest breakdown based on the market as of mid-2025.

Standalone DNC scrubbing services run roughly $50 to $200 per month for SMB volumes (under 50,000 records scrubbed monthly). Some charge per record past a threshold. DNC.com publishes tiered pricing. Gryphon Networks is enterprise-priced and gates everything behind a sales call.

FCC Reassigned Numbers Database access is a separate federal charge. The FCC sets a subscription that starts around $215 per year for API access ^[2]. That fee is on top of any platform cost.

Full-featured call center compliance platforms (NICE, Genesys, Five9) price by seat and almost always require a negotiated contract. Budget $75 to $200 per agent per month for the compliance-enabled tier, and that often excludes the DNC data subscription.

Mid-market dialers with compliance features (Convoso, Velocify) typically run $100 to $250 per seat per month, with DNC scrub either included or offered as an add-on.

The cheapest credible setup for a small team: a power dialer in the $50 to $100 per seat range, a DNC scrubbing service, a standalone consent tool or a CRM field setup, and FCC Reassigned Numbers Database API access. You can assemble it for $200 to $400 per month total for three to five reps. It takes more manual process than an all-in-one platform. It works.

The cost of getting it wrong is one class action settlement. Cash App paid $15 million. Truist Bank settled for $9 million. Albertsons and Safeway settled for $4 million. None of these are edge cases.

What does a solid TCPA compliance process look like alongside software?

Software is half the answer. Process is the other half, and it's the half most small teams skip.

Before any campaign launches, someone verifies the list was scrubbed within the last 31 days (or less), that time-zone enforcement is on for every number, that the calling line carries a valid caller ID passing STIR/SHAKEN attestation ^[4], that consent records exist for every number you're dialing with an ATDS or prerecorded voice, and that your last campaign's abandonment rate stayed under 3% ^[3].

During a campaign, someone watches the live abandonment rate. Not once a day. Continuously, during active dialing hours. If it's climbing toward 3%, slow the dialer.

After a campaign, export your suppression additions and confirm they load into your master suppression list before the next campaign touches those records. One missed DNC request that resurfaces in the next campaign is exactly how a single violation becomes a class action theory.

Training matters just as much. Agents need to know that any verbal request to stop calling, or to come off the list, creates a DNC obligation immediately, and that they log it in real time, not at end of shift. This is the failure mode that turns $500 violations into willful $1,500 violations, because a plaintiff's attorney will argue a missed verbal request was intentional.

State rules need a human, particularly Florida (the Florida Telephone Solicitation Act), Washington (CEMA), and Oklahoma (which added strict requirements in 2022). Bring in legal counsel who knows those regimes on top of your software. The vendors mostly track federal rules. The state overlay takes judgment. Staying current on tcpa news is genuinely necessary for anyone running outbound at scale.

LeadCompliant's free TCPA checkers and compliance kit give you a reasonable place to document your process before you layer in a paid platform.

What are the biggest TCPA compliance mistakes outbound teams make?

Read enough class action filings and FCC enforcement actions and the same failure patterns show up again and again. Five of them do most of the damage.

Running a predictive dialer without knowing whether it qualifies as an ATDS. After Facebook v. Duguid ^[6], the federal ATDS definition narrowed, but state definitions in California, Florida, and Maryland stayed broader. Teams assume they're clear under federal law and get hit under state law.

Buying lead lists without checking the consent chain. A vendor who calls the leads "TCPA compliant" is making a claim you cannot verify without documentation. Get the consent language, the date of capture, the source URL, and the IP address. If the vendor can't hand that over, the leads aren't safe to call with an ATDS.

Skipping internal DNC requests in the national list check. Your internal suppression list is not the same as national DNC scrubbing. Both matter. A consumer on your internal DNC who also sits on the national registry needs to be caught by both layers.

Assuming an established business relationship covers everything. The EBR exemption applies to the national DNC Registry, not to the prior express written consent requirement for wireless numbers called with an ATDS. Two different rules. Confusing them is common and expensive.

Never testing the opt-out in SMS campaigns. The TCPA requires any automated text campaign to honor STOP commands immediately and without condition. A marketing follow-up text after a STOP reply is a clean violation, and plaintiffs' attorneys test for it. Text message marketing carries the same statutory damages as voice: $500 to $1,500 per text.

How do you evaluate whether a TCPA compliance software vendor is credible?

The vendor landscape runs heavy on marketing and light on standardized certification. Here's what to actually ask, in order.

Ask for their data source for DNC scrubbing. They should pull straight from the FTC's national DNC Registry through official API or licensed data feed, not a cached copy of uncertain age ^[7]. Ask how often the data refreshes.

Ask about their Reassigned Numbers Database integration specifically ^[2]. It's a federally operated database. If they can't tell you clearly how they access it and how often they query it, that's a gap.

Ask about consent record retention. TCPA consent records should be kept at least four years, matching the longest applicable statute of limitations (some states run longer). Ask where records live, whether they're tamper-evident, and whether you can export them in a discovery-ready format.

Ask what happens if their data error causes a violation. Their contract almost certainly caps liability at the fees you paid them, which is not much. That's the whole point: software is risk reduction, not risk transfer. You remain the responsible party under the TCPA.

Ask for customer references at companies close to yours in volume and industry. A vendor who has never supported an insurance call center brings different implementation experience than one who has. TCPA compliance for insurance call centers carries lead-source consent chain issues that not every vendor has worked through.

Want to see what happens when these checks fail? The Kaiser TCPA settlement and the Truist Bank case both show how fast a compliance gap turns into eight- and nine-figure exposure.

Frequently asked questions

Do insurance companies cover TCPA damages?

Sometimes partially, but not reliably. General liability policies may cover TCPA claims under personal injury definitions, but many GL policies now include explicit TCPA exclusions. E&O policies almost never cover TCPA. Specialty media liability or TCPA-specific endorsements exist but stay limited. Before assuming coverage, review your policy language with a broker who specializes in communications liability. A class of 10,000 calls at $500 minimum is $5 million before any willfulness multiplier.

What is an abandoned call under the TCPA?

An abandoned call is a connected outbound call where no live agent picks up within two seconds of the called party finishing their greeting. FCC rules cap abandoned calls at 3% of all answered calls per campaign per month under 47 C.F.R. § 64.1200(a)(7). Predictive dialers generate abandoned calls when they over-dial relative to available agents. Exceeding 3% is a direct regulatory violation, separate from private TCPA lawsuit exposure.

Which auto dialer software supports TCPA compliance for outbound calls?

Five9, NICE CXone, Genesys Cloud, and Convoso all carry built-in TCPA compliance controls including DNC scrubbing, time-zone enforcement, and abandonment rate tracking. None of them natively check the FCC Reassigned Numbers Database; that takes a third-party integration. Smaller teams sometimes pair a power dialer like PhoneBurner or Kixie with standalone DNC and consent tools to keep costs lower.

What is the FCC Reassigned Numbers Database and why does it matter?

The FCC Reassigned Numbers Database is a federally operated registry that tracks when a phone number has been disconnected and reassigned to a new consumer. Calling a reassigned number with an ATDS without new consent is a TCPA violation even if you had valid consent from the prior owner. The FCC charges a subscription starting around $215 per year for API access. Ignorance of reassignment is no longer a complete defense since the database launched.

How often should I scrub my call list against the DNC Registry?

At minimum, scrub within 31 days before any campaign call, the maximum window the FTC allows under DNC rules. In practice, most compliance teams scrub within 24 to 72 hours of dialing. For high-volume campaigns running over multiple weeks, re-scrub weekly. The FTC processes new registrations within 31 days of submission, so a fresher scrub gives you more protection.

Does the TCPA apply to B2B calls?

The national DNC Registry applies to residential numbers, not business lines, so B2B calls to a true business line dodge that specific rule. But if you're calling a mobile number belonging to a business person, it's still a wireless number and ATDS rules apply when you use an auto dialer. The TCPA doesn't cleanly exempt all B2B calling, and plaintiffs have successfully argued mobile numbers used for business are still covered.

What is prior express written consent under the TCPA?

Prior express written consent is a signed, written agreement (including electronic signatures) in which the consumer authorizes calls to a specific number using an ATDS or prerecorded voice, for a specific purpose. The agreement must be unambiguous, cannot be a condition of purchase, and must include the phone number consented to. The FCC's one-to-one consent rule tightened this further, requiring consent to name a specific seller rather than a broad category.

How does the TCPA apply to text message marketing?

The TCPA treats SMS messages to wireless numbers the same as calls. Sending a marketing text using an ATDS without prior express written consent carries the same $500 to $1,500 per message statutory damages as a voice call violation. Opt-out via STOP must be honored immediately. A single confirmation text after a STOP reply is permitted; any further marketing texts after STOP are violations.

What does the Supreme Court's Facebook v. Duguid decision mean for call centers?

Facebook v. Duguid (2021) narrowed the federal ATDS definition to systems that use a random or sequential number generator to store or produce numbers to be called. This means predictive dialers that only dial from a pre-set list may not qualify as an ATDS under federal law. Several state laws use broader definitions, though, so the ruling does not eliminate ATDS risk for all call center operations, particularly in Florida, California, and Maryland.

What records do I need to keep for TCPA compliance?

Keep consent records with timestamp, IP address, exact consent language, and phone number consented for a minimum of four years. Retain call logs including the number dialed, time, and agent ID for at least four years. Maintain your internal DNC/suppression list indefinitely. Store DNC scrub logs showing the date of each scrub, the source, and the results. These records are what you produce in discovery if you're sued.

Can I call someone back who called me first?

Yes, with limits. An inbound call from a consumer generally creates an established business relationship that allows a follow-up solicitation call within three months under FCC rules. This EBR does not override a prior DNC registration for calls using an ATDS to wireless numbers without written consent. The EBR exemption is narrower than most sales teams assume, particularly for insurance and financial services where regulatory interpretations have been strict.

What TCPA penalties has the FCC imposed in recent enforcement actions?

FCC forfeiture orders in recent years have ranged from hundreds of thousands to tens of millions of dollars. The commission's per-violation cap for robocall violations under the TRACED Act is $23,727, adjusted for inflation. Private class action settlements are often larger: examples include a $15 million settlement involving Cash App and a $9 million settlement involving Truist Bank. The FCC focuses enforcement on high-volume violators; private lawsuits hit everyone.

Is TCPA compliance software different for insurance call centers?

The core software requirements are the same, but insurance call centers face extra consent chain pressure. Insurance leads often come from aggregators, and the FCC's one-to-one consent rule (implementation status varies due to litigation) requires consent to name the specific insurer, not a lead category. Insurance call centers need to audit consent capture at the lead source level, beyond their own forms, which requires contractual documentation from every lead vendor.

What is the three-percent abandoned call rule and how do I track it?

The FCC's rule under 47 C.F.R. § 64.1200(a)(7) caps abandoned outbound calls at 3% of all answered calls per campaign per month. An abandoned call is any answered call where no agent connects within two seconds of the called party's greeting. Most enterprise predictive dialer platforms (NICE, Five9, Genesys) report abandonment rate per campaign in their dashboards. If yours does not, build the calculation from your call log exports and check it daily.

Sources

1. Cornell Legal Information Institute, 47 U.S.C. § 227 (TCPA statute text): TCPA statutory damages are $500 per violation and $1,500 for willful violations; calling hours are restricted to 8 a.m. to 9 p.m. local time for the called party
2. FCC Reassigned Numbers Database (reassigned.us): The FCC operates a Reassigned Numbers Database to track numbers disconnected and reassigned to new consumers; API access subscription starts around $215 per year
3. Cornell Legal Information Institute, 47 C.F.R. § 64.1200 (FCC TCPA rules): FCC rules cap abandoned calls at 3% per campaign per month; internal DNC requests must be honored within 30 days; EBR defined as 18-month purchase relationship or 3-month inquiry relationship
4. FCC Report and Order FCC 23-107 on lead generator consent: FCC's one-to-one consent rule requires TCPA consent to name a specific seller, closing the lead generator loophole for aggregated consent
5. U.S. Supreme Court, Facebook, Inc. v. Duguid, 592 U.S. 395 (2021): The Supreme Court narrowed the ATDS definition under the TCPA to systems that use a random or sequential number generator to store or produce numbers dialed
6. FTC, National Do Not Call Registry: The FTC operates the national Do Not Call Registry; telemarketers must scrub against it within 31 days before calling; new registrations are processed within 31 days
7. FTC, Telemarketing Sales Rule, 16 C.F.R. Part 310: The Telemarketing Sales Rule governs DNC compliance requirements for telemarketers including scrubbing timelines and EBR exemptions
8. Cornell Legal Information Institute, 47 U.S.C. § 227(b)(4) and TRACED Act penalties: The TRACED Act increased FCC forfeiture penalties for illegal robocalls; per-violation cap is $23,727 adjusted for inflation
9. FTC, Consumer Advice on unwanted calls: The FTC provides consumer guidance on stopping unwanted robocalls and telemarketing, and enforces DNC and telemarketing rules
10. Cornell Legal Information Institute, 47 U.S.C. § 227(c) (private right of action and DNC provisions): The TCPA grants consumers a private right of action for DNC and consent violations, the basis for the class actions cited