
DNC Scrubbing Practices · September 28, 2026 · GrowthPros
How to tell if someone is on the DNC list?
Learn how to check if someone is on the DNC list with compliant verification steps, exemptions, and safe harbor rules to avoid $50k+ fines.

Key Facts
- The National Do Not Call Registry held over 258.5 million active registrations as of September 2025, according to the FTC's annual data book.
- 4.7 million new numbers were added to the Registry in FY 2025 alone, per the FTC's biennial report to Congress.
- Violating the Telemarketing Sales Rule can trigger civil penalties of up to $50,120 per call, per FTC guidance.
- TCPA violations add statutory damages of $500 to $1,500 per contact, rising for willful violations, according to penalty analyses.
- Telemarketers must refresh DNC lists at least every 31 days and retain compliance records for 24 months, per the TSR safe harbor requirements.
- Companies can legally call DNC-listed numbers for up to 18 months after a consumer's last transaction or inquiry, under the FTC's established business relationship exemption.
- The FTC received more than 2.6 million unwanted telemarketing complaints in FY 2025, according to its biennial report.
Why DNC Verification Can't Be a Guess: The Registry Is Massive and the Fines Are Real
The scale of the Do Not Call Registry makes guessing a contact’s status a dangerous gamble. With over 258.5 million active registrations as of September 2025 and another 4.7 million numbers added in FY 2025 alone, the list represents a vast and growing portion of the U.S. phone-using population. This isn’t a niche concern—it’s a systemic compliance challenge for any business making outbound calls.
The financial stakes are equally severe. Violating the Telemarketing Sales Rule can trigger civil penalties of up to $50,120 per call, while TCPA violations carry statutory damages of $500 to $1,500 per contact—especially impactful for high-volume outreach. Beyond fines, even inadvertent calls erode consumer trust and invite regulatory scrutiny, damaging brand reputation in ways that are harder to quantify but no less costly.
For a lead generation company like GrowthPros, which delivers time-sensitive, consent-recorded leads with AI-powered follow-up inside a five-minute window, DNC verification isn’t optional—it’s foundational. Every lead must be scrubbed against the National Do Not Call Registry before contact, not just to avoid penalties, but to honor the consent and preferences embedded in our process. This includes checking against state-specific lists and internal suppression files, updating scrubbed lists at least every 31 days, and retaining compliance records for 24 months to qualify for the TSR’s safe harbor protection.
- Verify numbers against the National Do Not Call Registry before any outbound call
- Check applicable state-specific DNC lists (e.g., Florida, New York, California)
- Maintain and update internal suppression files with every campaign
- Refresh DNC lists at least every 31 days using official Registry updates
- Document all verification steps and retain records for 24 months
Skipping these steps isn’t just non-compliant—it undermines the very trust that makes lead conversion possible. When consumers opt out, they’re signaling a boundary. Respecting that boundary isn’t only legally required; it’s the first step in building a relationship worth pursuing.
The Multi-Layer Check: How to Actually Verify DNC Status
Verifying a contact's DNC status isn't a single lookup — it's a layered process that most teams underestimate. The National Do Not Call Registry alone holds over 258.5 million active registrations as of September 2025, with 4.7 million new numbers added in the last fiscal year alone, making it the baseline rather than the finish line.
The federal Registry contains only phone numbers — no names, no addresses, no line-type indicators — and it covers only federal registrations. That means a compliant scrub must also hit state-specific lists in Florida, New York, and California, where telemarketing laws impose additional restrictions and separate registries. On top of that, every business needs its own internal suppression file to honor entity-specific opt-out requests that the national and state lists never capture.
- Scrub against the National Do Not Call Registry (first five area codes free; paid access per additional area code)
- Check state-specific do-not-call lists for Florida, New York, and California
- Cross-reference your internal suppression file for entity-specific opt-outs
- Verify no established business relationship exemption applies (valid up to 18 months after last interaction)
- Confirm the number isn't flagged for political, charitable, or survey exemptions that don't cover your outreach
The Telemarketing Sales Rule requires you to update your DNC lists at least every 31 days using the current Registry data, and you must retain all compliance records — including consumer do-not-call requests — for 24 months. These aren't suggestions; they're the conditions for qualifying for the TSR's safe harbor protection, which shields you from liability for inadvertent violations only if you can demonstrate written procedures, employee training, active monitoring, and use of an updated Registry list.
GrowthPros builds this multi-layer scrub into every lead delivery — fresh or reactivated — so the contactable pool is pre-filtered before an AI voice, SMS, or email ever goes out. The result: leads that are qualified, consent-recorded, and compliant by design.
Exemptions and Safe Harbor: When You Can Call a DNC-Listed Number Legally
Being on the DNC list doesn't make a number untouchable — but the exemptions are narrower than most sales teams assume, and one overlooked rule can override all of them. Here's where the FTC actually allows calls to registered numbers, and how the TSR's safe harbor protects you when mistakes happen anyway.
The most widely used exemption is the established business relationship. According to the FTC's official guidance, companies may call consumers for up to 18 months after their last transaction or inquiry. If someone requested a quote from your dealership or filled out a mortgage form last spring, that history — not the Registry — governs whether you can call.
Prior express consent works similarly: when a consumer knowingly agrees to be contacted, that permission carries the call. This is why consent-recorded leads matter so much in practice. At GrowthPros, every lead ships with a consent trail — disclosure text, timestamp, IP address, and the named contacting party — so the exemption can actually be proven if a regulator ever asks.
Other exemptions exist, but they're narrow:
- Charity calls — though telemarketers calling on a charity's behalf must still comply with entity-specific DNC rules, per FTC TSR guidance
- Legitimate survey calls, provided nothing is being sold
- Political calls, which fall outside DNC rules entirely
The trap is the entity-specific DNC rule, which overrides every exemption above. If a consumer directly asks your company — or a specific telemarketer — to stop calling, that request stands regardless of Registry status or business relationship. Compliance practitioners recommend confirming no entity-specific requests exist before invoking any exemption, and documenting that check.
If a violation slips through anyway, the TSR's safe harbor can shield you from penalties that reach $50,120 per violation. To qualify, you must demonstrate four things: written DNC procedures, employee training, active monitoring and enforcement, and use of an updated Registry list — which must be refreshed at least every 31 days, with compliance records retained for 24 months.
In practice, safe harbor is earned through process, not promises. Teams that scrub lists automatically before every campaign, log consent at capture, and honor opt-outs immediately and permanently are the ones that can prove good faith when it counts.
Build a Repeatable DNC Scrubbing Workflow (Before Every Campaign)
Knowing a contact's DNC status once isn't enough — the Registry grows constantly, so a number that was safe last month may be off-limits today. The only way to stay compliant at campaign speed is a scrubbing workflow that runs the same way, every time, before a single dial goes out.
Start with automation. According to compliance guidance from PossibleNOW, best practice is checking lists in real time against the National Registry, relevant state lists, and your internal suppression files before a campaign launches. With over 258.5 million active registrations as of September 2025 — and 4.7 million more added in FY 2025 alone — manual spot-checks simply can't keep pace.
Next, put your procedures in writing. The FTC's Telemarketing Sales Rule guidance makes written procedures a condition of the safe harbor that protects against inadvertent violations — but only if you can also demonstrate training, monitoring, and use of an updated Registry list. Remember, telemarketers must refresh their DNC lists at least every 31 days, and compliance records must be retained for 24 months.
A repeatable pre-launch workflow should cover:
- Automated scrub against the National Registry, state-specific lists (Florida, New York, and California apply stricter rules), and your internal opt-out file
- Exemption verification — confirm established business relationships are under 18 months old and no entity-specific opt-out exists
- Consent capture at every journey point, synced across systems, with disclosure text, timestamp, IP address, and the named contacting party recorded
- Team training on honoring opt-outs immediately and permanently across SMS, voice, and email
Consent capture deserves special attention. The stakes are real: TSR violations carry civil penalties up to $50,120 per violation, and TCPA violations add $500–$1,500 per contact, rising for willful violations, per penalty analyses. A documented consent trail is your best defense when a complaint surfaces.
This is the standard GrowthPros applies to every lead before delivery — DNC-scrubbed and consent-recorded so clients inherit a defensible trail, not just a phone number. The same logic governs reactivation: only pre-existing, opted-in relationships are ever contacted, never cold lists.
Build the workflow once, run it before every campaign, and document everything. Compliance isn't a checkbox — it's the process that keeps your outbound engine running.
Skip the Guesswork: Buy Leads That Arrive Pre-Scrubbed and Consent-Recorded
Skip the Guesswork: Buy Leads That Arrive Pre-Scrubbed and Consent-Recorded
Compliance isn’t just a box to check — it’s a competitive advantage when buying leads. With over 258.5 million active registrations on the National Do Not Call Registry as of September 2025, and more than 2.6 million unwanted telemarketing complaints filed in FY 2025, the risk of calling a number on the DNC list is real and costly. Violations can trigger civil penalties up to $50,120 per call under the Telemarketing Sales Rule, not to mention reputational damage and lost trust.
Instead of gambling on whether a lead has been properly scrubbed, businesses can eliminate guesswork by sourcing leads that arrive pre-verified, consent-recorded, and ready for immediate, compliant outreach. GrowthPros delivers leads by niche — exclusive or capped-shared — each one time-stamped, qualified, and backed by a full consent trail including disclosure text, timestamp, IP address, and the named contacting party. Every list is DNC-scrubbed before delivery, and opt-outs are honored permanently across all channels.
For companies with dormant CRM lists, dead lead reactivation offers a lower-risk path: re-engaging only pre-existing, opted-in contacts through a multi-channel AI sequence (SMS first, then voice, then email). Typically, 8–15% of a dormant database re-engages this way, turning old data into warm opportunities without violating consent rules.
By choosing compliant digital lead sources with valid permissions, businesses reduce legal exposure while improving conversion — leads contacted within five minutes are roughly 100x more likely to connect than those contacted after thirty minutes, and 78% of buyers choose the first responder.
Stop scrubbing in the dark. Submit the get-started funnel or book a 15-minute qualification call to see how GrowthPros’ compliant, consent-recorded leads by niche — or reactivation of your existing opted-in list — can power your outreach with confidence.
Frequently Asked Questions
How often do I need to check the Do Not Call Registry to stay compliant?
You must update your DNC lists at least every 31 days using the current National Do Not Call Registry data to maintain compliance and qualify for the Telemarketing Sales Rule's safe harbor protection. This is a specific TSR requirement for avoiding liability for inadvertent violations.
Can I call someone on the DNC list if they previously did business with my company?
Yes, you may call a consumer for up to 18 months after their last transaction or inquiry under the established business relationship exemption, but you must still verify no entity-specific opt-out request exists and honor any direct 'do not call' requests immediately. This exemption is valid for up to 18 months after last interaction per FTC guidance.
What are the financial risks of calling a number on the DNC list by mistake?
Violating the Telemarketing Sales Rule can result in civil penalties of up to $50,120 per call, while TCPA violations carry statutory damages of $500 to $1,500 per contact, especially for willful violations. These fines can accumulate quickly in high-volume outreach, making compliance critical. TCPA penalties range from $500–$1,500 per violation depending on intent.
Do I need to check state-specific Do Not Call lists in addition to the federal Registry?
Yes, compliant scrubbing requires checking state-specific DNC lists in Florida, New York, and California, as these states impose additional telemarketing restrictions and maintain separate registries that must be honored alongside the federal Registry. Multi-layered scrubbing including state lists is essential for full compliance given varying state laws.
What records do I need to keep to prove DNC compliance if audited?
You must retain all compliance records—including consumer do-not-call requests, verification steps, and consent trails—for 24 months to qualify for the TSR's safe harbor protection. This documentation should include written procedures, training logs, monitoring evidence, and proof of updated list usage. Record retention for 24 months is a specific TSR requirement for safe harbor eligibility.
How can I be sure the leads I buy are already DNC-scrubbed and safe to call?
Choose a lead provider that scrubs every lead against the National Do Not Call Registry, state-specific lists, and internal suppression files before delivery, and provides a documented consent trail with disclosure text, timestamp, IP address, and contacting party. GrowthPros delivers leads that are pre-scrubbed, consent-recorded, and ready for immediate, compliant outreach within a five-minute window. With over 258.5 million active DNC registrations, pre-verification eliminates guesswork and risk.
Compliance Is the Strategy, Not the Fine Print
Verifying DNC status isn't a single lookup — it's a layered discipline: scrub against the National Registry and state-specific lists, maintain internal suppression files, refresh every 31 days, verify exemptions, and document everything for 24 months to earn safe harbor protection. With 258.5 million active registrations and 4.7 million numbers added in FY 2025, guessing is a gamble with penalties up to $50,120 per call. But compliance done well isn't just risk management — it's a conversion advantage. Leads that arrive pre-scrubbed and consent-recorded mean your team spends its five-minute response window selling, not second-guessing. That's exactly how GrowthPros delivers: every lead DNC-scrubbed before delivery, backed by a full consent trail, and followed up by AI voice, SMS, and email inside minutes. Ready to stop scrubbing in the dark? Submit the get-started funnel or book a 15-minute qualification call — free, honest about fit, and it commits you to nothing.
This article is general information, not legal or financial advice. Benchmark figures are directional industry data, not guarantees of results.