TCPA compliance checklist for sales floors

Download the free TCPA checklist (PDF)

Rules checked November 4, 2026. No email needed. This is our plain-English reading of the rules, not legal advice, so have a TCPA lawyer review your program. Items marked (practice) are habits we recommend, not law. More on sales dialers and how each kind works.

No dialer ticks these boxes for you. It can enforce some settings, but consent, disclosures and records are your process (what TCPA compliance software can and can't do).

TCPA compliance requirements: what the law actually requires

TCPA compliance requirements come from four places: the TCPA statute, the FCC's rules under it, the FTC's Telemarketing Sales Rule (TSR) and state telemarketing laws. A sales floor has to meet all four at once, and the strictest rule that applies to a given call wins.

The TSR exempts most business-to-business calls (16 CFR 310.6(b)(7)), but the FCC's text doesn't say whether a business cell phone is covered, so don't assume a B2B list is exempt. Our TCPA rules guide explains each rule in depth.

Consent

Consent for sales calls depends on how you dial and why you call. Autodialed, prerecorded or artificial-voice marketing calls and texts to a cell phone need prior express written consent. A live rep dialing by hand doesn't trigger the consent rule, but hours and do-not-call rules still apply.

• Hold prior express written consent before any autodialed or prerecorded marketing call or text to a cell phone, and before any prerecorded or artificial-voice marketing call to a home landline. 47 CFR 64.1200(a)(2), (a)(3)
• For autodialed calls or texts that don't sell anything, such as reminders, hold prior express consent, oral or written. 64.1200(a)(1)
• Make each written consent a signed agreement that names the phone number, authorizes marketing calls by autodialer or prerecorded voice from your company, and says plainly that signing isn't a condition of buying. 64.1200(f)(9)
• Accept e-signatures (a web form, a text reply, a key press, a recorded "yes") only if they're valid under the E-SIGN Act or state contract law. 64.1200(f)(9)(ii); FCC 12-21 para 34
• Keep a full record of each consent: name, number, a copy of the request as the person saw it, the purpose, a copy of the consent and the date. Keep it 5 years. 16 CFR 310.5(a)(8)
• If you use the Reassigned Numbers Database, query each number with its consent date, call only on a "no" and keep the query record. It's optional and paid, from $8 a month for 1,000 queries. 64.1200(m); reassigned.us

You may see "one-to-one consent" on other checklists. A federal appeals court vacated that rule on January 24, 2025, and the FCC took it out of the rule text (90 FR 42137). It isn't on this list.

Lists and do-not-call

Do-not-call compliance means two lists: the National Do Not Call Registry, which you scrub against at least every 31 days, and your own internal list of people who asked you to stop. Both need written proof of when and how you checked.

• Subscribe to the National Do Not Call Registry and give each telemarketer your Subscription Account Number. The first five area codes are free; each extra one is $85 a year, up to $23,425, from October 1, 2026. 16 CFR 310.8; 91 FR 54947
• Scrub every list against a registry copy no more than 31 days old, and write down which copy you used. This keeps the safe harbor. 16 CFR 310.4(b)(3)(iv); 64.1200(c)(2)(i)(D)
• Keep a written do-not-call policy you can hand over on request. 64.1200(d)(1)
• Log every do-not-call request when it's made, honor it within 10 business days and keep it 5 years. 64.1200(d)(3), (d)(6)
• Give the rep's name, your company's name and a phone number or address on every call. 64.1200(d)(4)
• Before calling a registry number on an existing relationship, check for a purchase in the last 18 months or an inquiry in the last 3 months, and no opt-out since. The TSR counts it as 540 and 90 days. 64.1200(f)(5); 16 CFR 310.2(q)
• Scrub the state do-not-call lists for the states you call, such as Florida's, and check each state's registration rules. Fla. Stat. 501.059(4)

Calling hours and frequency

Federal TCPA calling hours are 8 a.m. to 9 p.m. in the called person's local time. Several states set a tighter window or cap how many times you can call one person in a day, and the stricter rule applies.

• Call consumers only between 8 a.m. and 9 p.m. at the called person's location, or the tighter state window in the table below. 64.1200(c)(1); 16 CFR 310.4(c)
• Set each lead's clock to where the lead is, not where the rep or the dialer is. The rules say "called party's location" and don't name area code as the test. (practice) When you have both an area code and an address, use the stricter of the two.
• In Florida, Oklahoma and Maryland, make no more than 3 sales calls to one person in 24 hours on the same subject, from any number. Federally there's no number cap, but repeated calls meant to annoy or harass are banned. 16 CFR 310.4(b)(1)(i)
• Before dialing into a state, check whether you must register or post a bond. Florida requires a license and at least $50,000 in security; New Jersey requires yearly registration, out-of-state callers included. Fla. Stat. 501.605, 501.611; N.J.S.A. 56:8-121

Other states have their own windows and holiday rules, so check each one before you load the list.

Dialer settings

The dialer settings that matter most for TCPA compliance are the abandon rate (3% or less of answered calls per campaign over 30 days), ring time, the message played when no rep is free and caller ID. These are settings you choose, so write them down and check them.

• Keep abandoned calls at or under 3% of calls a live person answers, per campaign, per 30-day period. A call is abandoned if no rep is on the line within 2 seconds of the greeting. 64.1200(a)(7); 16 CFR 310.4(b)(4)
• (practice) Set the dialer's abandon cap at or below 3% and know what it does at the limit. Defaults differ: ReadyMode's help center shows a 2.5% default you can change.
• Let unanswered calls ring at least 15 seconds or four rings before hanging up. 64.1200(a)(6)
• When no rep is free, play a recorded message that names the seller, says the call was for telemarketing, gives a number that takes do-not-call requests in business hours and offers a key-press opt-out. 64.1200(a)(7)(i)
• Show a real caller ID number (or your name and a customer-service number) that someone answers in business hours, keep proof you're allowed to use it, and never block or spoof it. Use a phone provider that signs calls under STIR/SHAKEN. 47 CFR 64.1601(e), 64.6301; 16 CFR 310.4(a)(8), 310.5(a)(2)(ix); 47 U.S.C. 227(e)
• Don't lean on "we're not an autodialer." Hours, registry, do-not-call, abandonment and caller ID rules apply to sales calls whatever dialer you use, and Florida's and Oklahoma's laws use wording about automated dialing that's broader than the federal test. Facebook v. Duguid; Fla. Stat. 501.059(8)(a)
• For AI-voice and prerecorded calls, get consent first (written, for sales calls), name the business at the start, give a callback number and offer a key-press opt-out within 2 seconds of that identification. FCC 24-17; 64.1200(b)
• (practice) Write down every setting above with a date. Check it again after any dialer, carrier or number change.

How the 3% math works on a real campaign is in our predictive dialer software guide.

Call recording

Call recording consent is set by state wiretap law, not the TCPA. Federal law needs only one party's consent, but at least nine states need every party's, so the safe default on a multi-state floor is to announce the recording at the start of every call.

• Know the federal floor: one party's consent is enough under federal wiretap law, and neither the TCPA nor the TSR sets a recording-notice rule. 18 U.S.C. 2511(2)(d)
• Go by the lead's state. All parties must consent in California, Florida, Maryland, Massachusetts, Pennsylvania, Washington, Montana and New Hampshire, and Connecticut's civil rule says the same. Check Illinois, Michigan, Delaware and Nevada with counsel. Cal. Penal Code 632; Fla. Stat. 934.03
• Announce the recording at the start of every call, and make sure the announcement is on the recording. Washington and Connecticut write this into law; elsewhere it's the safe habit. RCW 9.73.030(3); Conn. Gen. Stat. 52-570d
• (practice) When the rep and the lead are in different states, follow the stricter state. California's Supreme Court applied California law to calls recorded from Georgia in Kearney v. Salomon Smith Barney (2006).
• (practice) Write down how long you keep ordinary recordings. No federal rule sets a period, but recordings that prove consent fall under the 5-year consent record rule. 16 CFR 310.5(a)(8)

TCPA compliance checklist for texting (SMS)

A TCPA compliance checklist for texting starts with one fact: under the FCC's rules a text is a call. Marketing texts need the same written consent, do-not-call scrubs, calling hours and opt-out handling as autodialed calls, plus carrier registration so the texts get delivered at all.

• Treat every marketing text as a call: the same consent, do-not-call, hours and opt-out rules apply. 64.1200(a)(9), (e); Campbell-Ewald v. Gomez
• Get signed written consent before any autodialed marketing text (see the consent items), and scrub text lists against the registry and your internal list. 64.1200(c)(2), (e); FCC 23-107
• Treat stop, quit, end, revoke, opt out, cancel and unsubscribe, or any other clear request, as an opt-out, and stop within 10 business days. Any confirmation text carries no marketing. 64.1200(a)(10), (a)(12)
• From November 25, 2026: you may name one opt-out method (a reply word, a key press, a website or a number) only if you say so clearly in each text or call. Name none and any reasonable request counts. A stop to a marketing text ends all marketing texts from you. FCC 26-67, 91 FR 67214
• Text only between 8 a.m. and 9 p.m. in the lead's time, or the tighter state window. The FCC hasn't ruled on whether consent lifts that window for texts, so obey it. 64.1200(c)(1); DA 25-216
• Check state text laws where you send. Florida, Oklahoma, Maryland and Washington have their own, and in Washington damages for suits filed on or after June 11, 2026 are $100 a text. Wash. Laws 2026, ch. 135
• Carrier rules (not law, but unregistered texts get blocked): register your brand and campaign for 10DLC with The Campaign Registry, and follow the opt-in and opt-out guidance in the CTIA Messaging Principles.

Records and audits: your TCPA audit checklist

A TCPA audit checklist is mostly a records check: proof of consent, the registry scrub, the abandon rate and every opt-out, kept for 5 years. The FTC's Telemarketing Sales Rule sets 5 years for most records; the FCC rule names no period for most of its own.

• Keep every record in the table above for the period shown. 16 CFR 310.5
• Monitor and enforce your own procedures, and keep records showing you did. 16 CFR 310.4(b)(3)(v), 310.5(d)
• (practice) Run a dated internal audit every quarter: sample calls and consents, check calling hours, the scrub date, the abandon rate and opt-out turnaround, and file the result. No regulator sets a frequency or sample size. The do-not-call defense in 47 U.S.C. 227(c)(5) turns on "reasonable practices and procedures" kept with due care.
• Check that vendors and lead sources log and honor consent and opt-outs. You answer for their misses. 64.1200(d)(3); FCC 13-54

TCPA compliance training for reps

TCPA compliance training is required, but no rule sets the curriculum. The FCC requires that everyone involved in your telemarketing is trained on your do-not-call list, and the FTC's safe harbor expects training on your written procedures too. Hours, frequency and content are up to you, so write them down and keep sign-offs.

• Train every rep, and any vendor that calls for you, on your do-not-call list and written procedures before they dial. 64.1200(d)(2); 16 CFR 310.4(b)(3)(ii)
• Never let a rep argue with or keep pitching someone who asks to be put on your do-not-call list. 16 CFR 310.4(b)(1)(ii)
• (practice) Cover the calling window and the lead's location, which consent each call type needs, how to log a stop request on the call, the recording announcement and how to identify yourself.
• (practice) Re-train when the rules change (next: November 25, 2026) and keep dated sign-offs for every rep.

What changes on November 25, 2026

FCC order 26-67 changes the TCPA opt-out rules on November 25, 2026. Callers may name one exclusive way to opt out if they disclose it clearly on each call or text. If they name none, any reasonable request still counts. From that date, a stop to a marketing call or text ends all marketing calls and texts from that caller.

The 10-business-day limit doesn't change. A shorter limit is only a proposal, with comments due November 25, 2026. The eCFR still showed the old text on November 4, 2026.

Can a dialer tick these boxes for you?

A dialer can enforce part of this TCPA compliance checklist: the calling window, the abandon cap, do-not-call blocks on upload and a recording prompt. It can't capture the right consent, prove the disclosure was said on every call or run your audit. That part is process.

In my experience running outbound floors, a lot of dialers position themselves as TCPA compliant, and that may be true, but a lot of it comes down to the way you configure it. The other gap is scale. With 100 reps dialing, it's impossible for a manager to confirm the recording disclosure was given on every call and that text-message consent was captured. Our TCPA compliance software comparison shows what each vendor's docs say its dialer enforces.

When owning the system makes sense

Owning your dialer makes sense when the checks above need to run on every call and your software bill is already a few thousand dollars a month. We build systems that check every call for the recording disclosure and the text-message consent, and send you a report card every week showing which reps follow the rules and which don't.

These are tools that help you follow the rules. They aren't legal advice, and you're still responsible for your own compliance. If your dialer, CRM and texting tools cost roughly $2,000 a month or more, a free audit will show what one owned system would replace, typically for less than you spend today (how pricing works). Under $1,000 a month, keep what you have.

The SaaS cost calculator adds up your stack in about two minutes. Then book a free audit.

Download the TCPA checklist (PDF)

Sources

Rules checked November 2 and 4, 2026. Not legal advice. Laws change, so check the source before you rely on it.

• 47 U.S.C. 227 and 18 U.S.C. 2511
• FCC: 47 CFR 64.1200, 64.1601, 64.6301, FCC 26-67 final rule, FCC 24-17, FCC 23-107, FCC 13-54, FCC 12-21, DA 25-216
• FTC: 16 CFR 310, 310.4, 310.5, 310.6, registry fees, 91 FR 54947, 16 CFR 1.98
• States: Florida 501.059, 501.616 and 934.03; Oklahoma HB 3168; Maryland 14-4502; Washington 80.36.390, 9.73.030 and ch. 135, Laws of 2026; Connecticut 42-288a and 52-570d; Texas 301.051; New Jersey P.L.2003, c.76; California Penal Code 632
• Cases: Facebook v. Duguid, Campbell-Ewald v. Gomez, Kearney v. Salomon Smith Barney
• Other: Reassigned Numbers Database and pricing, The Campaign Registry, CTIA Messaging Principles, ReadyMode dialing speed help