Internal Do-Not-Call List: TSR Rules, Safe Harbor, and Penalties

The internal do-not-call list requirements under the FTC’s Telemarketing Sales Rule apply to every seller and telemarketer placing outbound sales calls: when a consumer asks a specific company to stop calling, that company must record the request, add the number to its own suppression list, and stop calling that consumer about that seller’s offerings. The obligation exists the moment the consumer speaks the request, applies indefinitely, and carries penalties up to $53,088 per violating call.

Who Has to Keep an Internal List

Two groups carry the obligation independently: the sellers of goods or services and the telemarketers who call on their behalf. If a company hires an outside call center, the vendor must follow the same rules, and the seller cannot shift the blame entirely onto the vendor when something goes wrong.¹

Charities that use telemarketers to solicit donations face the same internal list requirements. They are exempt from the national Do Not Call Registry, but not from honoring entity-specific requests.² Purely political calls fall outside the TSR entirely and carry no federal internal-list obligation under this rule.³

What Counts as a Valid Do-Not-Call Request

A consumer needs no magic words. “Stop calling me,” “take me off your list,” and “don’t call again” all trigger the obligation. The TSR describes the trigger as a person stating they do not wish to receive calls from or on behalf of that seller. The burden falls on the company to recognize the request and act on it.⁴

The rule also forbids common evasions. A telemarketer cannot require the consumer to sit through the pitch first, charge a fee for suppression, redirect the caller to another number, demand the consumer identify which seller prompted the call, or hang up and pressure the consumer to reconsider. Each of these is its own violation, independent of any later call placed to a suppressed number.⁴

What You Must Record for Each Request

Logging a phone number is not enough. For each do-not-call request, 16 CFR 310.5 requires you to capture:

The consumer’s name
The telephone number or numbers associated with the request
The specific seller or charitable organization the consumer wants to stop hearing from
The telemarketer that placed the call
The date the consumer made the request
The goods, services, or charitable purpose being promoted at the time of the call

The seller-specific detail matters because the request applies only to that seller. If a telemarketing firm represents multiple clients, a stop-calling request about Product A from Company X does not block calls about Product B from Company Y. Tying the suppressed number to the correct entity prevents both over-blocking and under-blocking.⁵

Records should live in a centralized system available to everyone involved in lead generation and campaign execution. Before any outbound campaign runs, lead lists need to be scrubbed against that internal suppression database, including lists imported from third-party providers. Manual dialing gets no exemption.

How Fast You Have to Stop Calling

The TSR’s prohibition is immediate. Once the consumer says stop, the legal obligation exists that instant, and the rule builds in no grace period on its face.⁴

Databases take some time to update in practice, and the safe harbor recognizes that by protecting companies from liability when a violation results from genuine error despite proper procedures. But the safe harbor has teeth: the error cannot stem from a failure to collect or process the information needed to comply. A company that failed to record the number, or waited weeks to sync its suppression file, will not qualify.¹

Separately, the FCC’s Telephone Consumer Protection Act rules impose a firm outer deadline: honor do-not-call and consent-revocation requests within 10 business days. Most telemarketing operations are subject to both regimes, so the 10-business-day limit is the practical standard.⁶

The Request Overrides Any Existing Business Relationship

Having a customer relationship does not create a permanent right to call. The TSR lets sellers with an established business relationship call consumers on the national registry for up to 18 months after the last transaction, and inquiry-based relationships open a three-month window. Both exemptions vanish the moment the consumer asks that company to stop calling. The entity-specific request wins every time.³

Written Procedures, Training, and the Safe Harbor

Honoring requests is not enough on its own. The TSR requires written procedures explaining how your organization identifies, records, and acts on those requests. That written policy is one of six conditions for the safe harbor defense if an accidental call slips through.¹

Everyone involved in outbound calling must be trained on those procedures, and the requirement extends to outside entities that help with compliance, such as dialing platform vendors or lead providers. The TSR does not prescribe a format for training records, but you will need documentation of dates, attendees, and material covered if you ever invoke the safe harbor.¹

All six safe harbor conditions must be part of routine business practice:

Written procedures established and implemented before any violation
Personnel training for all callers and any entity assisting with compliance
A maintained internal suppression list
National registry scrubbing using a version obtained no more than 31 days before any call
Active monitoring and enforcement of the procedures
A violation that resulted from genuine error, not from a failure to collect or process required information

Miss any single element and the defense collapses. The FTC treats these as cumulative, not a menu.¹

How Long You Keep the Records

Internal do-not-call records must be kept for at least five years from the date they were produced, consistent with the general recordkeeping rule in 16 CFR 310.5.⁷

The suppression itself does not expire after five years. The retention period governs the documentation. The obligation to stop calling continues indefinitely for that seller unless the consumer affirmatively revokes the request. FTC guidance provides no mechanism for requests to lapse over time, and companies that purge suppression entries after five years are creating liability, not reducing it.³

Federal investigators can demand access to these records at any point during the retention window. Without a complete log showing when a request came in, who the caller was, and which seller was involved, the safe harbor defense is unavailable.

What Noncompliance Costs

The FTC can impose civil penalties of up to $53,088 for each individual call that violates the do-not-call provisions. That figure reflects the 2025 inflation adjustment and remains in effect for 2026 because no new cost-of-living adjustment was published for the current year.⁸

The per-call calculation is what makes noncompliance dangerous. A company running an outbound campaign with a corrupted suppression file can accumulate hundreds or thousands of violations in a single day. There is no cap of one fine per complaint or per consumer. Every prohibited dial is its own violation, and when incomplete records also disqualify the safe harbor, financial exposure from a single failure can dwarf the revenue of the campaign that caused it.

1
eCFR. 16 CFR Part 310 – Telemarketing Sales Rule
2
eCFR. 16 CFR 310.6 – Exemptions
3
Federal Trade Commission. Q&A for Telemarketers and Sellers About DNC Provisions in TSR
4
eCFR. 16 CFR 310.4 – Abusive Telemarketing Acts or Practices
5
eCFR. 16 CFR 310.5 – Recordkeeping Requirements
6
Federal Communications Commission. Rules and Regulations Implementing the Telephone Consumer Protection Act of 1991
7
eCFR. 16 CFR 310.5 – Recordkeeping Requirements
8
Federal Trade Commission. FTC Publishes Inflation-Adjusted Civil Penalty Amounts for 2025