Compliance Self-Audit

1. Do you capture prior express written consent before making marketing calls or texts?

2. Does your opt-in clearly and conspicuously disclose who may contact the consumer?

3. Do you capture and store reproducible proof of consent (e.g., TrustedForm or Jornaya)?

4. Do you scrub against the national and applicable state Do-Not-Call lists before dialing?

5. Do you honor opt-out/STOP requests promptly and maintain an internal do-not-call list?

6. If you buy leads, do you verify the consent actually authorizes calls by your company?

7. Do you know whether you must register as a data broker (California Delete Act and similar)?

8. Do you account for stricter state mini-TCPA rules in the states you call into?

9. If you use mortgage trigger leads, do you qualify under one of the HPPA exceptions now in force?

10. If you use an AI-generated or cloned voice on outbound calls, do you get prior express written consent first?

11. Are your application-to-person text campaigns registered with the carriers (10DLC) with required opt-out language?

12. Do you disclose and get consent for the tracking pixels, session-replay, and chat tools running on your lead forms?

13. If you generate health, medical, or insurance leads, do you know whether what you collect is protected health information?

14. Do you restrict outbound calling to permitted hours in the consumer's local time zone?

15. If you use a predictive dialer, do you measure and cap your abandoned-call rate?

16. Do you maintain a written do-not-call policy, train staff on it, and keep the required records?