Internal Do Not Call List Requirements: The 2026 Rules

Scrubbing against the National Do Not Call Registry is the part every floor gets right, because the dialer does it for you. The internal list is different. It's built by your own agents, one "please stop calling me" at a time, and it fails in quiet ways: a request an agent didn't disposition, a campaign that wasn't checking the list, a vendor that kept its own copy.

An internal Do Not Call list, sometimes called a company-specific or entity-specific DNC list, is the list of people who have told your company not to call them again. Federal law makes you keep one if you make telemarketing calls, and it sets the rules for what goes on it, how fast you act, and how long you honor it.

Two sets of rules apply, and they overlap. The FCC's TCPA rules at 47 CFR 64.1200(d) set the procedures. The FTC's Telemarketing Sales Rule at 16 CFR 310.5 sets what the record must say. Both are quoted below as they read in 2026.

The six FCC requirements, in order

Section 64.1200(d) says no one may make a telemarketing call to a residential subscriber unless they've set up procedures that meet these minimum standards:

"Available on demand" means someone can ask for your policy and you hand it over. In practice the person asking is usually a plaintiff's lawyer in a TCPA suit, and a policy someone wrote the day the demand letter arrived reads exactly like one.

The contact number in the identification rule can't be a 900 number or any number that charges more than normal calling rates.

What to record for each request

This is one of the most searched questions about internal lists, and the answer comes from both rules. The FCC asks for the name, if provided, and the number. The TSR asks for more. Under 310.5(a)(10), the record of each request must include:

1. The person's name.
2. Every phone number associated with the request.
3. The seller they don't want to hear from.
4. The telemarketer that called them.
5. The date they asked.
6. The goods or services being offered.

Keep all of it for five years. If you only store a phone number with a DNC flag, you're short on four of the six. The TSR also wants times and phone numbers kept in specific formats: times to the second in UTC, and numbers in North American Numbering Plan format. Our TSR compliance checklist covers the rest of the rule.

The 10 business day deadline

The FCC says "a reasonable time," capped at 10 business days. That cap isn't a grace period to use up. If your dialer can add a number the moment an agent clicks a disposition, nine days is a hard delay to call reasonable.

A separate FCC rule, 64.1200(a)(10), covers people revoking consent to autodialed or prerecorded calls and texts. It also sets a 10 business day limit and lists methods that count automatically, such as replying "stop" to a text. The FCC adopted changes to the revocation rules on September 30, 2026, taking effect November 25, 2026. Our TCPA checklist tracks those dates.

Who the request covers: affiliates and vendors

Affiliates. A request covers the company that made the call, or the one the call was made for. It doesn't extend to affiliated companies, unless the consumer would reasonably expect them to be included given how the caller identified itself and what was being sold. If your agents say "calling from the Smith family of companies," expect the whole family to be covered.

Vendors. This is the line in 64.1200(d)(3) that brands tend to miss: if someone other than the seller records or keeps the requests, the seller "will be liable for any failures to honor the do-not-call request." A brand buying calls from three call centers needs all three lists to reach it, and needs every request honored across every vendor calling for that brand.

Sharing. You also need the consumer's prior express permission to share their request with a company other than the seller or an affiliate. Passing requests to the seller is fine. Passing them along to other clients of your call center isn't.

What a violation costs

The TCPA gives consumers their own right to sue. Anyone who gets more than one call within 12 months from or on behalf of the same company, in violation of these rules, can sue for up to $500 per violation, and a court can triple that to $1,500 if the violation was willful or knowing (47 U.S.C. 227(c)(5)). Class actions multiply it by every person on the list.

There's a defense built into the same section: a company that shows it set up and followed reasonable practices and procedures to prevent these calls. The written policy, the training records and the dated request log are that defense. FTC penalties under the TSR come on top, at up to $53,088 per violation.

Setting up internal DNC in VICIdial

VICIdial has the pieces, but they're off or scattered by default.

• The system DNC list (vicidial_dnc) applies to every campaign on the server. Use it for requests that should cover every client you dial for.
• Campaign DNC lists (vicidial_campaign_dnc) apply to one campaign. Use them for client-specific requests, since a request to one seller doesn't cover another.
• Campaign settings decide whether a campaign checks either list. Look at "Use Internal DNC List" and "Use Campaign DNC List" on every active campaign. A new campaign cloned from an old one inherits whatever the old one had.
• A DNC disposition adds the number when the agent selects it. Make it one click, train agents to use it the moment someone asks, and audit how often each agent uses it. An agent who never dispositions DNC on hundreds of calls a week isn't hearing zero requests.

VICIdial stores the number and the date it was added. The rest of the TSR record (the seller, the telemarketer and the product) has to come from the campaign and the call log, so make sure you can join them before someone asks.

Proving the request was honored

A TCPA suit over internal DNC usually turns on one question: when did this person ask you to stop? The plaintiff says the first call. Your log says the fourth. Whoever has the better evidence of that call wins the argument, and a log entry an agent may or may not have clicked isn't strong evidence.

A Klariqo Call Record is a signed record of one recorded call: the transcript, a fingerprint of the audio and a digital signature, with an independent RFC 3161 timestamp from DigiCert. Change one byte and the signature breaks, so anyone can check it at verify.klariqo.com without trusting you. Change a word on a sample call to see the check fail.

Klariqo connects to VICIdial with read-only access in about 10 minutes and seals every recorded call in the background. Your first 10,000 recorded calls get their record free. Add "caller asked not to be called, and the agent dispositioned DNC" as a check in Call QA, and you'll see which agents miss requests before a demand letter does.

This article is general information, not legal advice. Check with your own counsel before relying on it.

Questions people ask