Setting Up a Compliant Outbound Call Strategy for the New Year
A practical compliance blueprint for agent outbound in 2026 — consent, DNC, RND, STIR/SHAKEN, and the operational controls that keep you dialing.
Setting Up a Compliant Outbound Call Strategy for the New Year
A compliant outbound operation in 2026 requires six control layers stacked on top of each other: consent capture that meets 47 CFR 64.1200(f)(9), scrubbing against the National DNC Registry, state DNC lists, and the FCC Reassigned Numbers Database, STIR/SHAKEN attestation through a Robocall Mitigation Database-compliant originator, dialer configuration aligned with the FTC Telemarketing Sales Rule, CNAM and analytics hygiene, and recordkeeping that will survive discovery. Miss one layer and the others do not save you.
TL;DR
- Prior Express Written Consent (PEWC) under 47 CFR 64.1200(f)(9) requires clear and conspicuous disclosure, seller identification, "not a condition of purchase" language, and an E-SIGN Act-compliant signature.
- Federal calling hours are 8 am – 9 pm consumer local time; the FTC TSR caps abandonment at 3% per campaign per 30 days.
- RND safe harbor under 47 CFR 64.1200(m) requires a logged, definitive "no" response.
- The delayed revocation-all rule requires 10-business-day cross-channel propagation of opt-outs.
The Stack, Top to Bottom
- Consent capture — how leads enter your universe.
- List hygiene — DNC, RND, state suppression lists.
- Originating-carrier compliance — STIR/SHAKEN, RMD, attestation level.
- Dialer configuration — hours, frequency caps, abandonment, recording disclosures.
- CNAM and reputation — display and analytics.
- Recordkeeping — everything you'll produce in discovery.
Each layer has non-negotiables. Build them before you dial.
Layer 1: Consent Capture
Prior Express Written Consent is the federal standard for most marketing calls to wireless numbers and for pre-recorded or autodialed calls. 47 CFR 64.1200(f)(9) requires:
- Clear and conspicuous disclosure that the consumer agrees to receive calls, including autodialed and pre-recorded messages.
- Identification of the seller by name.
- That consent is not a condition of purchase.
- An E-SIGN Act-compliant signature.
Even though the FCC one-to-one consent rule was vacated in IMC v. FCC, state mini-TCPAs in Florida, Maryland, and Oklahoma drive most agencies to treat one-to-one as the operational baseline.
Capture for every lead: server-side timestamp, source URL, IP address, user agent, exact disclosure language presented, list of sellers consented to, and signature mechanism.
Layer 2: List Hygiene
Four scrubs, in order:
- Internal DNC. Anyone who has asked you to stop. Required under 47 CFR 64.1200(d).
- National DNC Registry. Scrub every list before every campaign. Narrow EBR exemption.
- State DNC lists. Pennsylvania, Indiana, Tennessee, Wyoming, and others maintain their own.
- FCC Reassigned Numbers Database. Required for the 47 CFR 64.1200(m) safe harbor. Log every query with timestamp, number, consent date, and response.
Layer 3: Originating-Carrier Compliance
STIR/SHAKEN A-level attestation — originating carrier vouches for both caller and number — is what terminating carriers trust. B or C attestation increasingly gets filtered or labeled.
Verify with the origination provider:
- Outbound traffic receives A-level attestation (get it in writing).
- They are current in the FCC Robocall Mitigation Database with a complete filing.
- Upstream peering partners are STIR/SHAKEN compliant.
- Per-call attestation records are retrievable for disputes.
If the carrier hedges on any of these, migrate before Q2.
Layer 4: Dialer Configuration
Federal and state rules impose hard constraints. The commonly overlooked ones:
| Control | Federal (TCPA / TSR) | Stricter State Example |
|---|---|---|
| Calling hours (consumer local) | 8 am – 9 pm | FL FTSA: 8 am – 8 pm; some states exclude Sunday |
| Abandonment rate | ≤3% of answered calls, per campaign per 30 days (TSR) | Same |
| Call frequency cap | Not explicit federal | FL FTSA: 3 calls / 24h / line |
| Recording disclosure | Two-party consent where required | CA, FL, IL, MD, MA, MT, NV, NH, PA, WA |
| Abandoned-call message | Play within 2s, identify seller, provide opt-out (TSR §310.4(b)(4)) | Same |
Configure to the strictest applicable rule per call, not to the federal floor. Modern dialers support per-state policy profiles — use them.
Layer 5: CNAM and Reputation
A technically-compliant call that displays "SCAM LIKELY" does not connect. Reputation is where legal compliance and operational reality meet.
- Register CNAM correctly with the underlying carrier and propagate to major providers.
- Audit every DID before rotation and weekly thereafter.
- Retire flagged numbers rather than rehabilitating dirty ones.
- Register on the Free Caller Registry and directly with Hiya, TNS, and First Orion.
- Enroll in branded calling where volume justifies it.
For the full teardown, see How Carriers Classify Your Business (and Why They Get It Wrong) and The Hidden Cost of Reassigned Phone Numbers.
Layer 6: Recordkeeping
In a TCPA claim, the defense lives or dies on records. Minimum retention:
- Every consent capture: 5 years minimum per FCC guidance; longer where state law requires.
- Every RND query: at least through the TCPA statute of limitations.
- Every DNC-scrub result: campaign-level, timestamped.
- Every Call Detail Record (CDR): 24 months minimum.
- Every recording disclosure and opt-out request: indefinitely.
Store in a system you control, not only in a vendor's environment.
Revocation-All: What to Build Now
The FCC's revocation-all rule — treating an opt-out on any channel as opt-out across all automated marketing — was delayed in certain categories until January 31, 2027, but core "reasonable means to revoke" and 10-business-day propagation obligations under 47 CFR 64.1200(a)(10) remain in force. Build the plumbing now:
- A single revocation record propagates to dialer, CRM, and any outsourced callers.
- Propagation latency is documented and tested.
- Any text reply containing "stop," "quit," "end," "cancel," "unsubscribe," or "revoke" triggers revocation automatically.
First 30 Days of the New Year
- Week 1. Audit every active consent record against the PEWC fields above. Quarantine any incomplete.
- Week 2. Re-scrub every active list against federal DNC, state DNC, and the RND. Log the queries.
- Week 3. Confirm A-level STIR/SHAKEN attestation with the origination carrier in writing.
- Week 4. Run a full CNAM and analytics audit across the DID pool. Retire anything flagged.
What Usually Goes Wrong
From TCPA class action filings tracked by CompliancePoint and Assurance IQ's $21.875M settlement, repeat failure modes:
- Consent captured client-side with no IP, user agent, or server timestamp — treated as no consent in discovery.
- RND scrubbing outsourced to a vendor that does not produce per-query logs.
- CNAM set at the dialer but never propagated to the underlying carrier — terminating carriers see empty CNAM and apply default filtering.
- Recording disclosure language that was compliant in 2019 but no longer matches current two-party consent state requirements.
- Dialer hours configured in agent local time instead of consumer local time.
Agent-community discussion on Insurance Forums consistently identifies the CNAM-at-dialer-only failure as a top source of mystery flag waves.
FAQ
Q: Is prior express written consent required for every call I make? A: Required for autodialed or pre-recorded marketing calls to wireless numbers, and for pre-recorded marketing to residential landlines under 47 CFR 64.1200(f)(9). Manually dialed, non-pre-recorded calls to landlines have different requirements. Treating PEWC as the universal posture is the cleanest operational choice.
Q: Can I rely on a lead-gen vendor's consent records? A: You inherit their risk. Demand direct access to raw consent records (not summary reports), audit them periodically, and make indemnification meaningful. If the vendor refuses any of these, they are not a compliant source.
Q: Does the National DNC Registry cover business-to-business calls? A: No. The DNC protects residential subscribers. B2B calls have separate rules; state laws vary.
Q: How often should I re-scrub a list? A: Federal DNC at least every 31 days under FTC TSR §310.4(b)(3), state DNC per state schedule, and the RND immediately before each dial.
Q: What counts as an established business relationship (EBR)? A: Narrowly — existing customer within 18 months of last transaction, or inquiry within 3 months per FTC TSR §310.2(p). EBR exempts from federal DNC but NOT from state DNC in several states and NOT from PEWC for autodialed calls.
Q: Do I need recording disclosures on every call? A: If you record, yes, to satisfy the strictest applicable state. In two-party consent states, failure to disclose creates both TCPA-adjacent and state privacy law exposure.
Q: What's the single biggest compliance gap agencies actually have? A: Inadequate consent records. More enforcement cases turn on completeness and authenticity of consent records than on any other single factor, per CompliancePoint's Assurance IQ teardown.
Q: How does the revocation-all rule affect my workflow? A: The FCC delayed full effect in some categories to January 31, 2027, but the 10-business-day cross-channel propagation rule under 47 CFR 64.1200(a)(10) is in force. Build opt-out plumbing between dialer, CRM, and vendors now — not on the 2027 deadline.
Stop guessing. Run the audit.
LineAudit checks your first 20 DIDs free. You'll see exactly which numbers are flagged, mis-registered, or at risk — in 30 seconds.