There is no such thing as a TCPA-compliant list. There are compliant campaigns, and a list is one input to one. A vendor who prints the phrase on a rate card is making a claim about the file — usually that it was scrubbed and that wireless numbers are flagged — and a floor that reads it as a claim about the calls has just bought a false sense of safety at a fraction of a cent per record.
This page is a plain-language account of what the federal rules actually require, what a purchased list can and cannot do about each requirement, and what stays yours no matter who sold you the file. It cites the statute and the rules so you can read them yourself. It is not legal advice, it does not cover every state, and it is not a substitute for putting your specific dialer, states and scripts in front of counsel — do that, and treat their answer as authoritative over anything here.
Disclosure: Scout Data is our product and we sell homeowner phone data. We do not sell compliance tooling, and nothing we ship removes an obligation described below.
What the rules actually say
Three bodies of federal rules apply to outbound calling, and they overlap. The Telephone Consumer Protection Act of 1991 is the statute, at 47 U.S.C. § 227. The FCC’s implementing rules are at 47 C.F.R. § 64.1200. The FTC’s Telemarketing Sales Rule, at 16 C.F.R. Part 310, covers much of the same ground for sellers and telemarketers. In plain language, the requirements a homeowner campaign runs into:
| Requirement | In plain language | Where it lives |
|---|---|---|
| Consent for automated calls to mobiles | A telemarketing call or text to a wireless number using an autodialer or an artificial or prerecorded voice needs prior express written consent | 47 U.S.C. § 227(b); 47 C.F.R. § 64.1200(a)(2)–(3) |
| National Do Not Call Registry | Do not make telemarketing calls to numbers on the registry; the version you scrub against must be no more than 31 days old | 47 C.F.R. § 64.1200(c)(2); 16 C.F.R. § 310.4(b)(3) |
| Calling hours | No telemarketing calls before 8 a.m. or after 9 p.m. in the called party’s local time | 47 C.F.R. § 64.1200(c)(1); 16 C.F.R. § 310.4(c) |
| Internal do-not-call list | Record and honour a request not to be called again, for five years from the request | 47 C.F.R. § 64.1200(d)(3), (d)(6) |
| Identification | Give the caller’s name, the company’s name, and a phone number or address at which the company can be reached | 47 C.F.R. § 64.1200(d)(4) |
| Abandoned calls | A predictive dialer may abandon no more than 3% of answered calls, measured per campaign over 30 days | 47 C.F.R. § 64.1200(a)(7); 16 C.F.R. § 310.4(b)(4) |
| Private right of action | $500 per violation, up to $1,500 where the violation was wilful or knowing; for registry violations, after more than one call in twelve months | 47 U.S.C. § 227(b)(3), (c)(5) |
Two things about that table before anything else. Every row is about a call, and the last row is why the phrase “TCPA compliant” sells: at $500 to $1,500 per call, a campaign of a few thousand dials can be priced in seven figures by a plaintiff. And the rules move. Check the current text of each section before relying on it, because the FCC has amended § 64.1200 repeatedly and courts have narrowed and widened pieces of it.
Consent-based versus cold: what a vendor’s consent can transfer
A “consent-based” lead is a person who filled out a form that included consent language: the seller, or sellers, who may contact them, by what means, including automated ones. The consent is to the parties named. It is not a property of the person that travels with the record — a homeowner who agreed to be called by three named companies did not agree to be called by you, and a form whose consent language points to a hyperlinked list of hundreds of “marketing partners” is the kind of consent that gets argued about in court.
The rule on this has moved recently, in both directions. In December 2023 the FCC adopted a “one-to-one” consent rule requiring that written consent name a single seller at a time; it was due to take effect in January 2025 and was vacated by the Eleventh Circuit in Insurance Marketing Coalition v. FCC that month, before it applied. What remains is the pre-existing standard — consent that clearly authorises the seller — and a separate 2024 FCC order on revocation, in effect from April 2025, under which a consumer may revoke consent by any reasonable means and the caller must honour it within ten business days. Confirm the current status of both with counsel; this paragraph describes where things stood at the time of writing.
A cold list carries no consent at all, and that is not a defect — it is a description. A cold homeowner file is lawful to buy and to dial as long as nothing that requires consent is done with it: no autodialed or prerecorded telemarketing to the wireless numbers on it, registry and internal scrubs applied, hours respected. The vendor who calls a cold file “TCPA compliant” is telling you the scrub ran and the wireless flag is on; the vendor who calls a form-fill file “TCPA compliant” is telling you a consent record exists for someone. Neither has said the calls you make with it will comply.
Wireless rules: why the flag is on the row
The consent requirement in the first row of the table attaches to wireless numbers dialed with an autodialer or a prerecorded voice, which is why the line-type column on a homeowner file is a compliance field before it is a performance one. Two developments shape how floors treat it. The Supreme Court’s 2021 decision in Facebook v. Duguid held that an autodialer under the statute must have the capacity to use a random or sequential number generator, which narrowed the definition — and floors have since split between treating their dialers as outside it and continuing to manually dial mobiles as if it still applied broadly, because state law and litigation risk did not narrow with it. And the FCC’s Reassigned Numbers Database, operating since 2021, lets a caller check whether a number has changed hands since a date of consent, with a safe harbour for callers who query it and rely on the result.
For the list, that means two columns: line type on every number, with its source, and — where consent is being relied on — a reassigned check against the date the consent was given. A file with a blank line-type column has handed you the classification problem; a file whose flag is wrong on a quarter of rows is worse, because the floor will trust it.
Do-not-call scrubbing
Three lists, not one: the national registry, the state registries that several states maintain with their own rules, and your own internal list of everyone who has asked you to stop. The purchased file can be scrubbed against the first two before delivery, and the date has to be on the file, because the 31-day rule runs from the registry version, not from delivery. The third is yours alone, it never shrinks, and no vendor can apply it unless you send it to them before the file is built. The ordering — scrub after the phones exist, not before — and the routines that survive a storm week are in DNC scrubbing for roofing and HVAC and DNC compliance for outbound solar; this page does not repeat them.
Litigator lists
Not a legal requirement and not a defence — a commercial file of numbers linked to repeat claimants, bought as a probability filter and applied as one more suppression pass. The single most predictive signal that a household will cause trouble is that it has already complained to you, which is a list only you can keep. What a litigator list is, where the names come from, and why over-suppression is the error to prefer are in what is a litigator list.
Record-keeping: the part that decides a claim
Under scrutiny, what matters is whether you can show the process ran. A campaign that did everything right and kept nothing looks the same as one that did nothing. The minimum:
- Scrub records. For each file: the date it was scrubbed, the registry version used, and which state lists were applied.
- The internal do-not-call list, with the date and source of every entry, retained and honoured for five years from the request.
- Consent, where you rely on it. What the person saw, what they agreed to, when, and the identifying details of the submission — not a checkbox state in a CRM. And the revocation record when it comes.
- Line-type source and date for every number, and reassigned-number query records where consent is being relied on.
- Dialer history sufficient to reconstruct when a number was called, by whom, in what mode, and what happened.
The Telemarketing Sales Rule’s five-year record-keeping requirement at 16 C.F.R. § 310.5 is the usual floor; state rules may set longer ones. Where the internal list lives matters as much as what is on it — inside a dialer you may replace is inside a dialer you will lose it with, and building a suppression list covers keeping it as one file that outlives every platform.
Six questions for a vendor who says “TCPA compliant”
- Scrubbed against what — national, which states, your litigator source — and on what date, printed on the file?
- Where does the line-type flag come from, and how old is it?
- If the file is consent-based: consent for whom, by name? Show me the form and the language the homeowner saw.
- Has the file been checked against the Reassigned Numbers Database as of the consent date?
- Will you apply my internal do-not-call list and suppression file before the file is built?
- What does the contract say about who bears a claim arising from a record you supplied?
A vendor with good answers to all six is selling a well-prepared file. That is a real thing worth paying for. It is still not a compliant campaign.
What stays yours
Whatever the file promised: the calling window on the homeowner’s clock, the internal do-not-call list and the same-day handling of every request to stop, the dialing mode used on wireless numbers, the consent you rely on and the records that prove it, the abandonment rate on the predictive dialer, and the identification the rep gives at the top of every call. None of it can be purchased with a list and all of it is where the claims come from. A well-matched file helps in one specific way — a number that reaches the owner named on the row is a call to someone who has a reason to hear it, and wrong-party calls to strangers are where complaints start — but that is a reduction in exposure, not a discharge of the obligation.
Again: this page is operational practice, written by a data vendor, and not legal advice. Put your dialer, your states and your scripts in front of compliance counsel before the first campaign, and treat their answer as authoritative over anything here.
Frequently asked questions
Can a purchased lead list be TCPA compliant?
Not on its own. The Telephone Consumer Protection Act regulates calls, not files: who may be called, how, when, and with what consent. A list can be scrubbed against the do-not-call registry, can flag wireless numbers, and can carry documented consent for named sellers — each of which removes one way a campaign can violate the rules — but the obligations belong to the caller, and no file discharges them. “TCPA compliant” on a rate card means, at best, “scrubbed and flagged”; ask which.
Do I need consent to cold call homeowners?
It depends on how the call is placed and where. Under the federal rules, prior express written consent is required for telemarketing calls or texts to a mobile number made with an autodialer or a prerecorded or artificial voice. A live, manually dialed marketing call to a number that is not on the national or your internal do-not-call list, inside permitted hours, does not require consent under the TCPA — but several states impose stricter rules, and what counts as an autodialer is litigated. This is not legal advice; ask counsel about your dialer and your states.
How often must a lead list be scrubbed against the Do Not Call registry?
The federal rules require that the version of the registry used was obtained no more than 31 days before the call. In practice that means a scrub date on every file and a re-scrub of anything held longer than a month — and the scrub has to run after the phone numbers exist, because a scrub of an address file checks nothing.
What records should a call center keep for TCPA compliance?
The date each list was scrubbed and against which registry version; your internal do-not-call list with the date and source of every entry, honoured for five years; any consent you are relying on, in a form you can produce — what the person saw and when; the source of each number’s line-type flag; and enough dialer history to reconstruct when a number was called, by whom, and how. The Telemarketing Sales Rule’s five-year retention requirement is the usual floor.