Your Internal Do-Not-Call Policy: What the Law Actually Requires Beyond the National Registry

If you make calls to consumers, here's a trap I've watched good operators fall into: they scrub the National Do-Not-Call Registry religiously, pat themselves on the back, and assume they're covered. They aren't. The National Registry is a separate obligation from your own internal, company-specific do-not-call list. You need both. And the internal one is the piece that most teams either skip entirely or fake with a spreadsheet nobody trained anyone to use.

The internal do-not-call rule is where a lot of TCPA lawsuits actually land, because it's easy to prove you didn't have the paperwork. This is a walk through what the federal rules literally require, and how I'd build a policy that survives a plaintiff's attorney reading it back to you in a deposition.

The rule most people never read: 47 CFR 64.1200(d)

The FCC's TCPA regulations flatly prohibit telephone solicitations unless you've first put internal procedures in place. The regulation lists six specific components, and they are not suggestions.

Here are the six components, straight from the current regulation:

• (d)(1) Written policy. You must have a written do-not-call policy, and it has to be "available upon demand." Not a policy in your head. Not tribal knowledge. A document.
• (d)(2) Training of personnel. Anyone "engaged in any aspect of telemarketing must be informed and trained in the existence and use of the do-not-call list." Training the closer isn't enough if the appointment-setter never heard of it.
• (d)(3) Recording and honoring requests. When someone asks not to be called, you must "record the request and place the subscriber's name, if provided, and telephone number on the do-not-call list at the time the request is made," and honor it "within a reasonable time... This period may not exceed ten (10) business days from the receipt of such request."
• (d)(4) Identifying the caller. On the call, you must provide "the name of the individual caller, the name of the person or entity on whose behalf the call is being made, and a telephone number or address at which the person or entity may be contacted."
• (d)(5) The affiliated-persons rule. Absent a specific request otherwise, a do-not-call request "shall apply to the particular entity making the call... and will not apply to affiliated entities unless the consumer reasonably would expect them to be included given the identification of the caller and the product being advertised."
• (d)(6) Record retention. You "must maintain a record of a consumer's request not to receive further calls," and "a do-not-call request must be honored for 5 years from the time the request is made."

The 5-year record you'll wish you had

Subpart (d)(6) is the one that quietly wins or loses cases. It's not enough to stop calling someone. You have to keep the record that they asked, and honor it for five years. When a plaintiff claims they told you to stop, your defense is a dated, timestamped log entry showing exactly when the request came in and when it was honored. No record, no defense.

Treat that five-year clock as a floor for the request itself. In practice, I keep the surrounding evidence, call recordings, agent notes, the CRM event, for as long as I hold the internal list, because the request record is only as credible as the trail around it.

The FTC's parallel rule: the Telemarketing Sales Rule

If the FCC's rule were the only one, life would be simpler. It isn't. The FTC enforces the Telemarketing Sales Rule (TSR), and it has its own entity-specific do-not-call obligation plus the National Registry scrub cadence.

• Entity-specific DNC, 16 CFR 310.4(b)(1)(iii)(A). It's an abusive practice to call a person after that person "previously has stated that he or she does not wish to receive an outbound telephone call made by or on behalf of the seller whose goods or services are being offered." That's the TSR's version of your internal list.
• National Registry scrub, 16 CFR 310.4(b)(3)(iv). To claim the safe harbor, you must employ "a version of the 'do-not-call' registry obtained from the Commission no more than thirty-one (31) days prior to the date any call is made," and maintain records documenting that process.

The TSR safe harbor in 16 CFR 310.4(b)(3) also expects you to have "established and implemented written procedures" and to have "trained its personnel... in the procedures established." Notice the pattern: written procedures plus training show up in both the FCC and FTC rules. That overlap is your blueprint.

Why a national scrub isn't enough: the state layer

Here's where operators get blindsided. Federal law sets a floor, not a ceiling. A number of states run their own do-not-call regimes and mini-TCPA statutes with tighter rules, their own state registries, narrower calling windows, and in several states, private rights of action with statutory damages that stack on top of the federal exposure.

A once-a-month National Registry scrub does nothing for a state-specific list you never pulled, and it does nothing for a caller-specific request logged under a state statute with a shorter honor window than ten days. Your internal policy has to be the layer that absorbs all of it: federal, state registry, and the individual "stop calling me" your rep heard on Tuesday.

Building a policy that actually holds up

The regulation tells you the components. Here's how I'd operationalize them so the paperwork matches reality:

• Write the actual policy document. Name who owns the internal DNC list, how a request gets captured, the honor window (I use "same business day, never exceeding the federal ten-business-day ceiling"), the retention period (minimum five years), and who can access and edit the list. Keep it "available upon demand" per (d)(1), a shared, versioned doc, not a file on one person's laptop.
• Train everyone who touches a phone, and log the training. Appointment-setters, closers, retention, vendors calling on your behalf. Date every training session and keep sign-offs. The record of training is itself evidence for the safe harbor.
• Log requests at the moment they happen. The rule says "at the time the request is made." Give reps a one-click way to flag a number in the CRM the instant they hear "don't call me," capturing timestamp, the number, name if given, channel, and who took the request.
• Honor across channels and across systems. A do-not-call request should propagate to every dialer, list, and campaign, not just the one that made the call. If your SMS and email suppression live in different systems, make sure a phone opt-out that also signals other channels is respected everywhere it legally should be.
• Keep an audit trail you can hand to a lawyer. Immutable, timestamped log entries; regular exports; documented proof of your National Registry pulls dated within 31 days. The goal is that when someone claims you called after they opted out, you can produce the record faster than they can finish the sentence.

None of this is exotic. It's a document, a training log, a suppression workflow, and disciplined record-keeping. The reason it matters is that every one of the six components is independently provable, which means it's independently disprovable when you skip it. Build the boring version well and it quietly protects you for years.