A 2026 TCPA compliance checklist covers seven controls: written consent you can prove, DNC scrubbing at least every 31 days, opt-outs honored within 10 business days, recipient-local calling hours, state-law overlays, text-message rules, and five-year records. This year’s update adds a pending federal opt-out rewrite, a court split over texts, and new Pennsylvania and Texas laws.
In This Article
Teams open this checklist for two reasons. Either a campaign is already live and someone needs to know whether it would survive a demand letter, or a new program launches next month and every control has to exist before the first dial. Both readers need the same map. This one lists each rule, what it asks of your dialer and your records, and where 2026 changed the answer. Terms that need a definition are in the TCPA glossary.
The TCPA compliance consulting service page lays out what a campaign audit examines: scripts, consent records, DNC procedures, recording practices, and training files. It also shows how the 5–10 business day review runs, for teams that want an outside read on their own program. Everything below works without it.
What changed in TCPA compliance for 2026?
Four developments changed TCPA compliance for 2026: courts stopped deferring to FCC interpretations, a federal appeals court held texts are not calls under the DNC private right of action, the FCC moved to rewrite revocation rules, and states expanded coverage.
None arrived as a single rulebook update. Each one shifts where your exposure sits, so each one belongs in this year’s audit, including one correction to checklists written in 2024.
- Courts stopped deferring to the FCC. The Supreme Court held on June 20, 2025 that district courts hearing private TCPA suits are not bound by FCC interpretations; the Supreme Court’s docket for McLaughlin v. McKesson holds the briefs, argument record, and disposition. An FCC order your team relied on is now an argument in court, not a shield. The answer can differ by circuit.
- One-to-one consent never took effect. The Eleventh Circuit vacated the FCC’s one-seller-at-a-time consent rule on January 24, 2025, three days before its compliance date. Remove it from any checklist that still lists it as a current requirement.
- Texts split the appeals courts. The Seventh Circuit held in July 2026 that texts are not “telephone calls” under the federal DNC private right of action. The texting section below covers what that ruling does and does not change.
- The FCC moved to rewrite opt-out rules. A draft order released September 9, 2026 narrows the delayed “revoke all” provision and lets callers designate an exclusive opt-out method. The Commission votes on it September 30.
- States widened their reach. Texas brought marketing texts under its telemarketing law, with a private right of action, on September 1, 2025. Pennsylvania’s rewrite of its Telemarketer Registration Act takes effect in October 2026.
2,810 TCPA lawsuits were filed in U.S. federal district courts in 2025.
Volume matters less than shape. When 68% of a month’s new TCPA filings seek class status, one control gap is multiplied by every record on the list that shares it.
What do TCPA compliance requirements say about consent?
Telemarketing calls and texts sent with an autodialer or prerecorded voice need prior express written consent: a signed agreement naming the seller, the number, and a disclosure that consent is not a condition of purchase.
The definition sits in 47 CFR § 64.1200(f)(9), the FCC rule that also sets the calling-hour, DNC, and opt-out requirements covered below. Electronic signatures valid under the E-SIGN Act count.
Agreement is not the audit question. Proof is: the record for one specific number, produced on request, in a form a court will read. For a web opt-in, that record holds the timestamp, IP address, page URL, and the exact disclosure text shown. It also names the seller and the number entered. For verbal consent, the record is the recording itself, retrievable by number and date.
Consider a purchased lead. A comparison-shopping form collects a phone number, its disclosure points to a hyperlinked list of “marketing partners,” and your company is entry 140 on that list. The Eleventh Circuit’s vacatur means the form is not automatically void under federal law. It still has to show the person clearly authorized calls from your company, and Pennsylvania’s new consent definition applies its own test to Pennsylvania recipients.
The engagement walkthrough on the TCPA compliance consulting service page shows where this review sits in a full audit. It starts with a campaign inventory, moves through scripts, consent, DNC, recording, and training records, and ends in a gap report ranked by risk and financial exposure.
How often should DNC lists be scrubbed under TCPA compliance guidelines?
Scrub against the National Do Not Call Registry at least every 31 days, add every applicable state list, and honor internal do-not-call requests within 10 business days, honoring each one for five years.
The 31-day ceiling appears in the FTC’s Telemarketing Sales Rule at 16 CFR § 310.4, which lists the abusive telemarketing practices the rule prohibits, and again in the FCC’s DNC provisions at § 64.1200(c). Two deadlines get confused. Thirty-one days is how old your registry data can be at the moment of dialing. Ten business days is the deadline for honoring someone’s own request to stop, and that request stays honored for five years.
Thirty-one days is a ceiling. Scrubbing at list load and again before each dialing session catches state-list changes and your own opt-outs, which run on a shorter clock. A defensible scrub runs in this order before any list reaches the dialer:
- National DNC Registry, using data downloaded within the past 31 days.
- State DNC lists for every state the list touches, including Texas, Pennsylvania, and Florida.
- Your internal do-not-call file, merged across voice and text.
- The FCC Reassigned Numbers Database, which reports whether a number was permanently disconnected after a given date. Querying it before dialing an aged consent record earns the safe harbor in § 64.1200(m).
- A litigator suppression list, if your risk policy uses one. This is an industry practice, not a legal requirement.
Budget for registry access before launch. Consumer campaigns need their own subscription account: the first five area codes are free, each additional one costs $82, and nationwide access costs $22,626.
State regulators enforce this without waiting for class counsel. In 2022, Pennsylvania’s attorney general settled with an energy company over more than 355,000 calls to consumers on the Do Not Call list, a case now cited in the record behind the state’s 2026 rewrite.
Dispositions are the other half. In legal-services outreach we run, agents log DNC, wrong-number, and disconnected dispositions on each contact, so the number leaves the active dialer queue immediately.
Which calling hours belong on a multi-state TCPA compliance checklist?
Federal rules allow telemarketing calls between 8 a.m. and 9 p.m. in the recipient’s local time; the strictest state rule reachable by your list replaces that window for recipients in that state.
State law is where 2026 moved fastest. The Pennsylvania General Assembly’s page for Senate Bill 992 carries the enacted text of Act 47 of 2026 and its full vote history. The table below sets the four windows a typical multi-state list touches side by side.
Jurisdiction | Calling window | What else changes for your list |
|---|---|---|
Federal (TCPA and TSR) | 8 a.m.–9 p.m., recipient’s local time | Baseline for every telemarketing call |
Florida (FTSA) | 8 a.m.–8 p.m. | Applies to Florida area codes; three calls per 24 hours on the same subject; text plaintiffs must reply STOP and allow 15 days before suing |
Texas (SB 140, effective Sept. 1, 2025) | 9 a.m.–9 p.m. Monday to Saturday; noon–9 p.m. Sunday | Marketing texts covered; private right of action through the Texas DTPA; consent-based text programs exempt from registration |
Pennsylvania (SB 992, effective Oct. 2026) | 9 a.m.–7 p.m.; no Sunday solicitations | Texts, voicemail, and ringless voicemail covered; contacts based on written consent or a 12-month business relationship fall outside “telephone solicitation”; up to $1,000 per violation, $3,000 for recipients 60 and older |
Size your compliance exposure before the next dial
A campaign compliance audit maps every active program against the controls above and ranks each gap by risk and financial exposure. The gap report is yours whether or not you engage further.
Area code is not location. Take a number with a Florida area code whose owner now lives in Oregon. The FTSA reaches it through the area code, the federal window follows the owner’s location, and the dialer has to satisfy both. Build the rule into the dialer. The safe configuration computes each window from the best-known address, falls back to area code, and applies the stricter result when the two disagree.
Multi-state lists multiply this. Insurance programs we run across California, Connecticut, Maryland, and Ohio carry four state rulebooks on one list.
Does the TCPA compliance checklist change for SMS and texting?
Yes. Texts sent with an autodialer need the same consent as calls, carriers require 10DLC registration for business texting, and the federal DNC question for texts now depends on which circuit the recipient lives in.
The appellate split is new this year. On July 14, 2026, the Seventh Circuit held in Steidinger v. Blackstone Medical Services that marketing texts are not “telephone calls” under the DNC private right of action in § 227(c)(5), reading the 1991 term as voice communication. In January, the Ninth Circuit called texts “calls” in Howard v. Republican National Committee, under a different subsection.
Keep scrubbing text lists nationwide. The ruling binds federal courts in Illinois, Indiana, and Wisconsin only, it leaves FCC and state enforcement intact, and Texas, Pennsylvania, and Florida name texts in their own statutes. Skadden’s summary of the Steidinger decision walks through the court’s statutory reading and the claims it leaves open.
Carrier rules run on a separate track. Business texting over standard 10-digit numbers requires brand and campaign registration through The Campaign Registry. Carriers filter or block unregistered traffic, however clean your consent records are. The opt-in language you register has to match what your forms show.
How should opt-outs flow through your TCPA compliance policy?
Every opt-out must stop the covered calls and texts within 10 business days, across every channel and campaign it applies to; a pending FCC order lets callers designate an exclusive opt-out method if disclosed clearly.
The rules in force today took effect April 11, 2025, under the FCC’s 2024 consent revocation order, which sets out the reasonable-means standard and the 10-business-day deadline. A reply of stop, quit, end, revoke, opt out, cancel, or unsubscribe counts as a revocation. So does any wording a reasonable person would read the same way.
One provision never started. The “revoke all” rule, where a single opt-out ends every consented call and text from your company, was pushed to January 31, 2027 by FCC bureau order DA 26-12, the January 2026 order extending its effective date.
The September 9 draft changes the picture again. For informational calls, callers can treat an opt-out as covering only the category it answered. For telemarketing, one revocation still ends all future telemarketing from that caller. Callers can also designate an exclusive opt-out channel (a keypress mechanism, a standard text keyword, or a designated website or phone number), provided every call or text discloses it clearly. The rules take effect 30 days after Federal Register publication, and a companion proposal would cut the processing deadline to seven business days. Troutman Pepper Locke’s analysis of the draft order lists each change against the prior rule.
The Steidinger plaintiffs alleged that marketing texts kept arriving after they replied STOP. Whatever a court decides about the legal theory, that fact pattern is the operational failure. An opt-out captured in one system never reached the system doing the sending.
The control is one suppression file shared by voice and text. Measure the opt-out-to-suppression time instead of assuming it. Across programs we run, opt-outs reach the shared suppression file within [X hours] of capture.
Does TCPA compliance apply to B2B outbound campaigns?
Yes for the TCPA’s consent rules, which contain no business-to-business exemption, so wireless numbers on B2B lists still need consent handling. The Telemarketing Sales Rule exempts most B2B calls, except its misrepresentation bans.
Our Telemarketing Sales Rule explainer walks through where the B2B exemption at § 310.6(b)(7) begins and ends, including the 2024 amendments that pulled misrepresentation claims back into scope. The practical trap is list drift. Sole proprietors on personal mobiles and business contacts pitched consumer products fall outside the exemption without anyone deciding to leave it.
The full 2026 TCPA compliance checklist, by control
Use this table as the audit worksheet: each row pairs one control with the rule that requires it, the evidence an auditor asks for, and the team that owns it.
Control | Rule | Evidence to verify | Owner |
|---|---|---|---|
Consent capture | e 47 CFR § 64.1200(a)(2)–(3), (f)(9) | Retrievable record per number: timestamp, disclosure text, seller named, number, signature | Compliance |
National DNC scrub | 16 CFR § 310.4(b)(1)(iii), (b)(3)(iv); 47 CFR § 64.1200(c)(2) | Registry data no older than 31 days at dial time; scrub logs retained | Campaign Ops |
State DNC lists | State statutes (TX, PA, FL, others) | Every state on the list mapped to its registry and download date | Compliance |
Internal DNC | 47 CFR § 64.1200(d) | Written policy; requests honored within 10 business days and for five years | Campaign Ops |
Reassigned numbers | 47 CFR § 64.1200(m) | RND query logged before dialing aged consent records | Campaign Ops |
Calling hours | 47 CFR § 64.1200(c)(1); state law | Window computed from recipient location; stricter state rule applied | Campaign Ops |
Opt-out handling | 47 CFR § 64.1200(a)(10)–(11) | Standard keywords honored; one suppression file across voice and text | Campaign Ops |
Text programs | 10DLC carrier registration; state text laws | Brand and campaign registered; registered opt-in language matches live forms | Compliance |
Script disclosures | 16 CFR § 310.4(d); 47 CFR § 64.1200(d)(4) | Seller, caller, and purpose identified; deviations scored in QA | Training |
Agent training | 47 CFR § 64.1200(d)(2) | Training dated before each agent’s first call and after each rule change | Training |
Recordkeeping | 16 CFR § 310.5 | Call records, consent, and scripts retained five years | Compliance |
Owners matter as much as rules. A control without a named owner drifts the first week that person is out, and the gap surfaces in discovery instead of review.
Built this way, the checklist stops being an annual scramble. It becomes a set of dialer settings, suppression rules, and logs that let you add states, channels, and volume without rebuilding the basics each time.
Frequently asked questions
What should a TCPA compliance checklist include in 2026?
A 2026 TCPA compliance checklist should include provable prior express written consent for autodialed or prerecorded marketing calls and texts, National DNC scrubbing at least every 31 days, state DNC lists, and an internal do-not-call list honored within 10 business days. It should also cover recipient-local calling hours, state mini-TCPA rules, 10DLC registration for business texting, opt-out handling across voice and text, and five-year recordkeeping.
How often do you need to scrub call lists against the Do Not Call registry?
Federal rules require registry data no more than 31 days old at the time of each call. Scrubbing at list load and again before each dialing session also catches state-list changes and internal opt-outs. Internal do-not-call requests run on a separate clock: they must be honored within 10 business days and kept for five years.
How fast does a business have to honor a TCPA opt-out request?
Within a reasonable time, not to exceed 10 business days from receipt, under FCC rules in effect since April 11, 2025. Consumers can revoke by any reasonable means, including replying stop, quit, end, revoke, opt out, cancel, or unsubscribe to a text. A draft FCC order released September 9, 2026 would let callers designate an exclusive opt-out method, and a companion proposal would shorten the deadline to seven business days.
Do TCPA rules apply to text messages in 2026?
Yes. Marketing texts sent with an autodialer require the same prior express written consent as calls, and the FCC treats texts as calls. Whether consumers can sue over texts under the federal DNC provision now depends on the circuit: the Seventh Circuit said no in July 2026, while state laws in Texas, Pennsylvania, and Florida cover texts directly.
Does the FCC's one-to-one consent rule apply in 2026?
What are the penalties for violating the TCPA?
The TCPA allows $500 in statutory damages per violation, rising to $1,500 per call or text when the violation is willful or knowing. The FTC can seek civil penalties of up to $53,088 per Telemarketing Sales Rule violation. State laws add their own, such as Pennsylvania’s $1,000 per violation, or $3,000 when the recipient is 60 or older.
Assess your campaign risk posture
Unsure if your current outbound scripts, consent storage systems, or DNC scrubbing workflows meet current regulatory enforcement standards?
