As you read this blog post, you may be facing one of two situations: either you are being sued for violating do-not-call compliance and want to know how to avoid penalties, or you want to learn more about DNC safe harbor. Whatever your objective is, this guide will help you achieve it.
We have discussed a practical solution to the problem you are facing by explaining how you can use TCPA safe harbor as an affirmative defense, along with the rules every calling team must follow.
TL;DR
- The DNC safe harbor is a legal defense.
- It may protect your business if you accidentally violated do-not-call compliance by calling a number registered on the DNC registry.
- It is a defense, not an exemption. The call is still a violation.
- To qualify, you need written procedures, trained staff, an internal DNC list, DNC scrubbing against the registry within 31 days, and a complete log to prove it all.
What is DNC Safe Harbor?
The DNC safe harbor is an affirmative defense. It does not make the call legal, and nobody grants or certifies it. It is a set of facts you prove about your own routine business practice after you have already been accused. If any one element is missing, the defense fails and you are left with the violation. However, this TCPA safe harbor defense won’t apply to every claim. If you have followed certain guidelines and demonstrated consistent DNC and TCPA compliance , you may avoid penalties for an honest mistake.
For example, auto-dialers and prerecorded or AI voice violations are excluded from the DNC safe harbor claim. However, in the case of an honest do-not-call allegation, it may provide a valuable affirmative defense. The key is you need to demonstrate that your business has established and implemented necessary practices and procedures for DNC compliance.
The two rules create a DNC safe harbor.
|
| FTC | FCC |
| Citation | ||
| Rule | Telemarketing Sales Rule | TCPA implementing rules |
| Who comes after you? | FTC and state AGs | Private plaintiffs, class actions, FCC |
| Exposure | The FTC can fine up to $53,088 per violation. | $500 per call and up to $1,500 if the violation was willful or knowing |
| Registry data age | No more than 31 days before the call | No more than 31 days before the call |
| Covers texts | No, calls only | Yes, since March 26, 2024 |
Most DNC lawsuits against businesses come from private individuals suing under the TCPA, not from the FTC. That means the FCC's safe harbor is the one that protects you in a private lawsuit. It has the same 31-day rule as the FTC version. So one documented scrubbing process supports your defense under both rules.
In the next section, let's look at which practices and elements you need to follow.
The Six Elements of the Defense
The FTC rule lists six elements, and the FCC rule lists five. The FTC says all of these must be part of your routine business practice, not something you do once. Let’s look at how they translate into daily practice. If you have missed any one of them, the DNC safe harbor (defense) can fail.
1. Write a DNC Policy
As a general rule of thumb, every business that promotes its products or services through telemarketing should have a written DNC policy. This policy should clearly outline:
- How you scrub your contact list against the National DNC Registry.
- How your internal DNC list is maintained.
- How your business receives, processes, and respects DNC requests.
This is an important document that your team can use as a compliance roadmap. It can also serve as evidence that your business has established and implemented reasonable practices, should you need to raise safe harbor as a defense.
2. Train Your Employees
What is the meaning of a written DNC policy if employees are not following it? If your employees are not following it, the policy won’t help. Therefore, training is non-negotiable and directly linked to the statute’s “due care” requirement.
You should train your employees when you hire them and arrange refresher training for all employees involved in telemarketing at least once a year. You should also train your staff whenever any policy or regulations change.
When your staff is well-trained, there are far fewer chances of making mistakes. Regular training gives you an edge and a strong position to argue that a DNC violation was a true accident, not a compliance failure.
3. Maintain an Internal DNC List
Every business involved in telemarketing is required to maintain its own internal DNC list . Follow these best practices:
- Keep numbers on the list for at least five years, as required by the TCPA.
- Consider keeping them indefinitely to avoid confusion or complaints.
- Implement DNC scrubbing on your internal list before making any telemarketing call or text. Here is our detailed blog on the Do Not Call List Scrub Workflow .
Maintain this list carefully, because it is one of the core elements that a court or regulatory agency examines to determine whether your business has reasonable procedures in place.
4. Scrub Your Contact List Against the National Registry
Businesses are required to scrub their contact list against the national DNC registry at least once every 31 days. This prevents them from mistakenly contacting individuals who have opted out of unsolicited calls. Keep proof of every scrub, such as the date and the list you used. A one-time scrub is valid for 31 days. After that, it expires.
"The seller or a telemarketer uses a process to prevent telemarketing to any telephone number on any list established pursuant to § 310.4(b)(3)(iii) or 310.4(b)(1)(iii)(B), employing a version of the 'do-not-call' registry obtained from the Commission no more than thirty-one (31) days prior to the date any call is made, and maintains records documenting this process." - Source: 16 CFR 310.4(b)(3)(iv)
Keep in mind that access to the registry is not free for most businesses. As of October 1, 2026 (FY2027), the fee is $85 per area code, or $23,425 for all area codes . Your first five area codes are free.
5. Monitor Your Team and Keep Proof
Rules must be followed. Monitor your team and ensure they are following your company’s written DNC policies and procedures. Check scrub logs, training records, and opt-out logs on a regular schedule. This is important because documentation is how you can prove your defense. Without it, a court may treat your compliance efforts as if they never happened. Keep dated records for five years; the TSR now requires this, up from two. A scrub you performed in March 2026 must still be provable in 2031.
6. The Call Was a Genuine Error
The call must have happened by mistake. It cannot be the result of your business failing to obtain the information it needed to follow the rules. For example, if you never downloaded the registry, or you ignored a customer who asked you to stop calling, that is not an error. In that case, the defense fails, even if every other element is in place.
Use the National Registry Data Only for Compliance
FCC adds one more requirement: the national DNC registry is not a marketing tool. Use the registry to remove numbers that have registered for DNC from your list, and nothing else. The FCC rule makes this clear.
Why is Regular DNC Scrubbing Important?
The scale of the National Do Not Call Registry shows why regular DNC scrubbing should be part of an ongoing calling-list process.
- The registry changes all the time. The FTC reports that more than 4.8 million numbers were added in fiscal 2025. This clearly means that a list that was clean last quarter may now include numbers that are off-limits.
- The 31-day rule is part of your defense. If businesses fail to fulfill any of the rules discussed above, they won’t qualify for safe harbor.
- Marketers often obtain lists from third parties, so skipping the DNC check on these lists is one of the most common compliance mistakes businesses make.
- TCPA violation penalties can be costly, running from $500 to $1,500 per violation.
According to the FTC’s 2025 National Do Not Call Registry Book , more than 258.5 million phone numbers were actively registered on the National Registry as of September 30, 2025.
Image Source: Link
The FTC also received more than 2.6 million DNC complaints during fiscal year 2025, including about 1.6 million involving robocalls and more than 800,000 involving live callers.
Image Source: Link
So, for businesses that make outbound telemarketing calls, checking a list once is not enough. They need to scrub their list against the National DNC Registry every 31 days and have written DNC policies, employee training, record-keeping, and ongoing monitoring in place to qualify for safe harbor.
DNC scrubbing can help businesses identify numbers on this registry and remove them before a calling campaign begins.
If you are still not convinced, the next section provides some real-world examples. Read on.
Real-World Examples of Why Lead Verification and DNC Scrubbing are Important
Buying a lead list does not free you from your compliance responsibility.
Example - 1
A Reddit discussion involving a Florida real estate agent demonstrates how a single DNC-related call can create legal trouble. The agent received leads from a provider that claimed the numbers had been scrubbed against the Do Not Call Registry. One of the numbers was still registered on the list, and the resulting call led to a TCPA dispute. You can read what happened in detail here .
Of course, this Reddit post isn't a legal authority, but it highlights a practical lesson: businesses should have their own process for checking numbers before making outbound calls.
This is where DNC and phone number verification tools can help. Before a sales team contacts a lead, businesses can check whether the number is associated with the National DNC registry, a company-specific do-not-call list, or other compliance flags.
Example - 2
Buying a lead does not mean a number is safe to call. A Reddit discussion in the insurance-agent community describes a case involving a $25,000 settlement demand after an agent received a lead from a third-party provider.
This Reddit discussion highlights a few risks that businesses can miss when they rely entirely on third-party lead providers. A lead may have been generated without the consent the seller claims, the number may sit on the federal or a state DNC list, or it may belong to someone who has previously pursued TCPA claims.
Businesses must check leads against multiple sources before making a call, which includes:
- Do Not Call Records
- Litigator Lists
Businesses need to check the following before making even a single outbound call.
- Is it a mobile, landline, or VoIP number?
- Is it on a Do Not Call list?
- Is it associated with a known TCPA litigator?
- Are there other compliance flags that should be reviewed?
Tools like Landline Remover can help you check a number's carrier and line type, its federal and state DNC status, and whether it belongs to a known TCPA litigator, all before your team calls.
Also Read: DNC Scrubbing for Insurance Agents: Federal, State, and Internal Lists
What Does TCPA’s Safe Harbor Not Cover?
The TCPA safe harbor defense is useful, but it has limits.
- It does not apply to autodialer or prerecorded and artificial voice claims.
- The DNC safe harbor won’t help if you ignored the rules or never built a real system.
- It only works if all the steps were in place before you were sued.
In Johansen v. eFinancial , a federal court dismissed DNC claims at summary judgment because the company's procedures met the safe harbor.
What If My Business Fails to Qualify for TCPA Safe Harbor
If your business fails to qualify for TCPA safe harbor, it can expose you to significant legal and financial risks. If your company has violated DNC compliance rules without adhering to safe harbor, you may face steep fines and legal action.
TCPA penalties can run from $500 to $1,500 per violation, depending on whether the violation was willful or knowing. For large-scale violations, penalties can quickly add up, leading to substantial financial losses and reputational damage.
What’s New in 2026: Consent Revocation Rules
On September 30, 2026 , the FCC adopted new rules on how people can withdraw their consent to calls and texts. If someone opts out of one type of informational message, such as a payment reminder, that opt-out may apply only to that type. Opting out of marketing messages, however, must stop all marketing messages. Businesses can choose one method for people to opt out, such as a key press or a text keyword, and they should disclose it clearly. If they don’t, they must honor opt-outs made in any reasonable way.
These new rules are not in effect yet. They will take effect 30 days after they are published in the Federal Register.
Respect DNC Requests Promptly
Since April 11, 2025, businesses must honor DNC requests or consent revocations within a reasonable time, and no later than 10 business days.
Conclusion: DNC Safe Harbor
Follow the six elements above to build your defense. If you run a business in which you and your teams deal with lead lists all the time, the manual version will break down. That is the specific problem Landline Remover was built to solve. It helps you verify your lead lists by checking the line type of each number: mobile, landline, or VoIP, so your team can apply the right rules before dialing.
Book a demo to see how it works in action.