Call Center Compliance Checklist 2026: TCPA, TSR & State Law
Knowing the rules is the easy part. Proving you followed them on a specific call is where centers get caught.
TL;DR
- Four layers of law apply, not one. The TCPA governs consent and calling hours. The FTC's Telemarketing Sales Rule governs records. State mini-TCPAs override both with stricter limits. Sector rules (Medicare, ACA) add their own retention clocks on top.
- The recordkeeping rule changed and most checklists never caught up. Under the amended TSR, telemarketers must keep records for five years, not two, and must keep a record of each individual call including the script used and the disposition.
- The proof is the pivot. Most operations get caught not because they broke a rule, but because they could not prove they followed it on the one call that got disputed.
- Legal disclaimer: this is operational guidance, not legal advice. Verify against current law with your own counsel.
Most outbound litigation does not target operators who ignore compliance. It targets operators who followed their protocols perfectly and could not prove it when the demand letter arrived.
Call center compliance in 2026 is the operational framework for dialing consumers lawfully: getting valid consent, honoring opt-outs, staying inside the legal window, and keeping records that survive scrutiny. What has changed is the last part. The FTC quietly rewrote the recordkeeping half of the job in 2024, and a lot of published checklists still describe the old rule.
This checklist covers all four layers, in the order your floor actually encounters them.
Disclaimer: operational best practices, not legal advice. This area moves fast. Consult your own counsel for your specific campaigns and states.
The compliance checklist at a glance
| Layer | What it governs | Key requirement |
|---|---|---|
| TCPA (47 U.S.C. § 227) | Consent, calling hours, revocation | Prior express written consent for autodialed or prerecorded telemarketing; 8 a.m.–9 p.m. local |
| TSR (16 CFR Part 310) | Records and disclosures | A record of each call, kept 5 years, including the script used and the disposition |
| DNC | Who you may call | National registry scrub plus a maintained internal suppression list |
| State mini-TCPAs | Stricter local limits | Florida and Oklahoma: 8 a.m.–8 p.m., max 3 calls per 24 hours on the same subject |
| Sector rules | Retention by vertical | Medicare marketing calls 6 years; ACA consent documentation 10 years |
Before you dial
1. Secure prior express written consent for marketing
If you run autodialers or prerecorded marketing messages, you need prior express written consent: a written agreement, signed by the consumer, with clear disclosures showing they agreed to receive your calls.
The standard moved recently. The FCC's one-to-one consent rule was vacated by the Eleventh Circuit in January 2025 (Insurance Marketing Coalition v. FCC), returning the standard to prior express written consent. You do not need consent scoped to a single seller under federal law. You do still need a signed, documented agreement for every lead you dial, and you need to be able to produce it on demand.
2. Scrub the National DNC, and maintain your internal list
Scrub lead sheets against the National Do Not Call Registry, and maintain a company-wide internal suppression list. When a consumer tells an agent to stop calling, that number goes on the internal list and stays there. Plaintiffs' attorneys routinely test whether an internal opt-out on one campaign actually suppressed the number across all of them. Frequently it did not.
3. Treat wireless numbers as the high-exposure path
Autodialed or prerecorded telemarketing to a mobile number without documented prior express written consent is a violation. Most modern lead files are majority wireless. Treat every mobile number on the list as the one most likely to become a claim.
On the call
4. Identify yourself accurately
Agents must state the name of the business responsible for the call at the start. If you are a BPO dialing for a client, disclose who you represent. Caller ID must be accurate and non-deceptive.
5. Deliver disclosures up front, and give recording notice where required
Required disclosures belong at the top of the pitch, not buried after it. Where the consumer sits in an all-party-consent state, agents must say the call is being recorded. One missed disclosure on one call is enough to anchor a dispute.
6. Respect the calling window — and know that federal is not the strictest
The TCPA restricts telemarketing to 8 a.m. to 9 p.m. in the called party's local time. A dialer running on your office clock will call someone two time zones away too early, which is a violation regardless of intent.
But federal is the floor, not the ceiling. See the state section below: if you dial nationally, the practical window is narrower than the TCPA's.
7. Honor a verbal opt-out immediately
"Stop calling," "take me off your list," or any equivalent ends the call and puts the number on internal DNC. Training agents to talk past a clear opt-out to save a pitch is the fastest way to earn a claim, and the easiest thing in the world for a plaintiff to prove from the audio.
8. Keep agents on the approved script
Off-script promises and unapproved claims are their own exposure category, and under the TSR the script itself is now a record you have to keep. A compliance framework protects you only to the extent agents actually follow it on live calls.
After the call
9. Process revocation by any reasonable means
Under the FCC's revocation rule, consumers may revoke consent by any reasonable method, at any time: a verbal statement mid-call, a "STOP" reply, an email, a letter. You cannot compel them to use a specific form or portal. Your systems have to capture that and suppress the number across the whole database, promptly.
10. Keep the records the TSR actually asks for
This is the item most checklists get wrong, so it gets its own section.
The TSR recordkeeping rule that changed in 2024
The FTC amended the Telemarketing Sales Rule at 89 FR 26784, effective May 16, 2024, with compliance on the new recordkeeping provision required from October 15, 2024 after a 180-day grace period.
Two things changed, and both matter operationally.
First, the retention period doubled and then some. Records must now be kept five years, not two. If your document-retention policy still says 24 months, it was written against a rule that no longer exists.
Second — and this is the part almost nobody has absorbed — the TSR now requires a record of each individual call. Under 16 CFR § 310.5(a)(2), a seller or telemarketer must keep, for every telemarketing call:
- the telemarketer that placed or received it, and the seller it was placed for
- the good, service, or charitable purpose that was the subject of the call
- whether it went to an individual or a business consumer
- whether it was an outbound call
- whether the call used a prerecorded message
- the calling number, called number, date, time, and duration
- the telemarketing script(s) and prerecorded message, if any, used during the call
- the caller ID number and name transmitted, plus authorization to use them
- the disposition of the call — answered, connected, dropped, or transferred, including the number or IP address it was transferred to
Read that list as an operator rather than a lawyer. The federal government now requires you to be able to say, for a specific call on a specific date, which script was running and how the call ended. Not for a sample. For each call. For five years.
Most floors can produce a CDR that covers the numbers, date, time and duration. Far fewer can produce the script version that was actually in the agent's hands on that call, and fewer still can show that the record has not been edited since.
State mini-TCPAs: the strictest rule wins
Federal law is the floor. Several states have passed their own telemarketing statutes — "mini-TCPAs" — that bind harder, and they apply based on where the consumer is, not where you are.
Two of the strictest:
Florida (FTSA). Calls and texts only between 8 a.m. and 8 p.m. in the recipient's time zone, and no more than three commercial calls per 24 hours on the same subject. Florida also uses one of the broadest autodialer definitions in the country.
Oklahoma (OTSA, Okla. Stat. tit. 15 § 775C.1 et seq.). Mirrors Florida closely: 8 a.m. to 8 p.m. in the called party's time zone, a three-call limit per 24 hours, prior express written consent bearing the consumer's signature, and a private right of action.
Texas and Maryland have moved in the same direction, and more states are following.
The operational consequence is simple and worth writing into your dialer config rather than your training deck: if you dial nationally, your real calling window is 8 a.m. to 8 p.m. local, not 8 to 9. The last hour is only safe if you are certain no one in the list sits in a stricter state. Most operators are not certain, and a pacing algorithm does not know the difference.
Sector rules stack on top
If you dial a regulated vertical, retention obligations arrive from that regulator too, and they do not replace the TSR — they sit alongside it.
- Medicare. Marketing and sales calls must be recorded and retained in their entirety for 6 years under 42 CFR § 422.2274(g)(2)(ii), audio for the first three. The enrollment portion of the same call is governed separately and carries a far longer tail — one recording, two retention clocks, divided at a sentence spoken mid-call. We covered what changes for Medicare TPMOs and how those calls reach a plan's Star Ratings in detail.
- ACA Marketplace. Agents and brokers must document consumer consent and retain that documentation for 10 years under 45 CFR § 155.220.
A single floor running Medicare and ACA campaigns under a TSR obligation is therefore holding three different clocks against the same week of calls.
Where operations actually get caught
Read the checklist again. Almost every item is something you can perform correctly every day and still lose a dispute over, because executing a protocol and proving you executed it are different problems.
A demand letter names a specific call on a specific date. To defend it you have to show what was said on that call. Most operations cannot, because human QA samples about 2% of calls and the disputed one is essentially never in the sample. The rules were followed. The proof is missing.
TCPA statutory damages start at $500 per call and rise to $1,500 where a court finds the violation willful. Those are per-call numbers, which is what makes them dangerous on a dialer.
Do the arithmetic once. A floor placing 2,000 marketing calls a day runs one campaign for a week: 10,000 calls. If the disclosure was misconfigured for that campaign, the theoretical exposure is $5 million before anyone argues willfulness. Nobody collects the theoretical maximum, but that is the number printed in the demand letter, and it is the number your buyer's counsel sees when they decide whether to keep the contract.
And note what the TSR did to this problem. The obligation is no longer just "keep your consent records." It is a per-call record including the script and the disposition, held for five years. The regulation moved toward exactly the thing operators find hardest to produce.
Closing the proof gap
Klariqo scores 100% of calls — not a 2% sample — against the rulebook you write: was the disclosure read, was identification stated, was the script followed, was a verbal opt-out honored.
Each call is then sealed into a Klariqo Call Record: the audio, the transcript and the score bound into a signed, tamper-evident file built on the open vCon standard, witnessed on JLINC and carrying an independent RFC 3161 trusted timestamp (DigiCert), the standard behind legal e-signatures. Change one byte and the signature breaks. Anyone can check a record at verify.klariqo.com with no account, or run the open-source verifier offline.
To be precise about the boundary, because it matters: this is audit-ready evidence of on-call behavior. It does not validate the upstream written consent — that stays with you and your lead source — and it does not make your company compliant or substitute for counsel. What it removes is the blind spot: the moment a call is disputed and you have no way to show what was actually said.
FAQ
What does a call center compliance checklist need to cover in 2026? Four layers: TCPA consent and calling hours, FTC Telemarketing Sales Rule recordkeeping, National and internal DNC scrubbing, and state mini-TCPAs that impose stricter limits. Regulated verticals like Medicare and ACA add their own retention rules on top.
How long must telemarketers keep call records? Five years under the amended Telemarketing Sales Rule (16 CFR § 310.5), up from two. Compliance with the per-call recordkeeping provision has been required since October 15, 2024.
Does the TSR require a record of every individual call? Yes. 16 CFR § 310.5(a)(2) requires a record of each telemarketing call including the calling and called numbers, date, time and duration, whether a prerecorded message was used, the script used during the call, and the disposition including any transfer destination.
Is the one-to-one consent rule still in effect? No. The Eleventh Circuit vacated it in January 2025 (Insurance Marketing Coalition v. FCC) and the standard returned to prior express written consent. You still need valid, documented written consent before dialing.
What are the TCPA calling hours, and do states differ? Federal law allows 8 a.m. to 9 p.m. in the called party's local time. Florida and Oklahoma narrow it to 8 a.m. to 8 p.m. and cap solicitation calls at three per 24 hours on the same subject, so national dialers should run to the stricter window.
What are the penalties for a TCPA violation? $500 per violating call, rising to $1,500 per call where a court finds the violation willful or knowing.
How do I prove compliance on a specific disputed call? You need a record of that call showing what was said, plus a way to demonstrate the file has not been altered since. That means scoring the call against your rules and sealing it into a signed, independently timestamped record a third party can verify.
Score every call against this checklist
Klariqo scores 100% of your calls against the rules you set and returns a signed record of each one. Upload one of your own calls and verify it yourself in the browser, no account required.
Last updated 2026-08-03 by Ansh Deb, Founder & CEO of Klariqo. Sources: 16 CFR § 310.5 · 89 FR 26784 · 42 CFR § 422.2274 · 45 CFR § 155.220 · Okla. Stat. tit. 15 § 775C.1
Prove what was said on every call.
Turn one of your own calls into a signed, tamper-evident record you can verify yourself.