Telemarketing Sales Rule Compliance: The 2026 Checklist

Ask most floor managers what the Telemarketing Sales Rule says and you'll hear "calling hours and Do Not Call." That was a fair summary until 2024, when the FTC rewrote the recordkeeping section and turned the rule into something closer to an audit trail requirement.

The Telemarketing Sales Rule (TSR) is the Federal Trade Commission's rule for telemarketing calls, published at 16 CFR Part 310. It sets when you can call, who you can't call, what you must say up front, how many calls you can drop, and which records you must keep and for how long. It runs alongside the TCPA, which the FCC enforces, and you need both. Our TCPA compliance checklist covers the FCC side and state laws.

This one is the FTC side, read straight from the rule text as it stands in 2026.

The TSR checklist at a glance

What changed in 2024

The FTC published the amendments on April 16, 2024 at 89 FR 26784. They took effect on May 16, 2024, and the FTC gave call centers until October 15, 2024 to comply with the new per-call record, because most dialers weren't logging everything it asks for.

Three things matter for an outbound floor. Retention went from 24 months to five years. Section 310.5(a)(2) added a record of each telemarketing call, which didn't exist before. And business-to-business calls, which used to be almost entirely exempt, are now covered by the TSR's ban on misrepresentation, so a B2B floor that overstates what it's selling is inside the rule now (310.6(b)(7)).

The record of every call, field by field

This is the part of the rule most floors haven't caught up with. Under 310.5(a)(2), each telemarketing call needs a record showing:

1. The telemarketer that placed or received the call, and the seller it was for.
2. The product or service, and whether the person called was a consumer or a business.
3. Whether the call was outbound, and whether it used a prerecorded message.
4. The calling number, called number, date, time and duration.
5. The telemarketing script and any prerecorded message used during the call.
6. The caller ID number and name you transmitted, plus proof you're authorized to use them.
7. The disposition: answered, connected, dropped or transferred. For a transfer, the number or IP address it went to, and the company name if it's someone other than you or the seller.

The format rules are strict. Times and durations go to the closest second, and the time has to be in Coordinated Universal Time (UTC). Phone numbers follow the North American Numbering Plan, or E.164 for international numbers.

There's one carve-out. If an agent dials a single number by typing it in by hand, you don't need the numbers, time, duration or disposition for that call. A predictive or power dialer gets no such break.

Where VICIdial already helps

If you run VICIdial, most of the call record already exists in your database. The vicidial_log and vicidial_closer_log tables hold the numbers, timestamps, length and status for each call, and the closer and user call logs show where transfers went. Two gaps catch people. VICIdial stores server time, so someone has to convert it to UTC when you produce records. And "the script used during the call" isn't a field anywhere, because the script assigned to a campaign and the words an agent actually said are different things.

That second gap is the one a regulator or a buyer will push on. The rule asks for the script used during the call. A transcript of the call shows what was used.

The other records you must keep for five years

The per-call record gets the attention, but section 310.5(a) lists ten more. For a typical outbound floor, these are the ones that bite:

• Every script and prerecorded message you've used, kept for five years after you stop using it. Old campaign scripts you deleted in 2023 may already be a gap.
• Consent records, with a copy of the consent request exactly as the person saw or heard it, the purpose, the date, and a copy of the consent given. A checkbox log without the page it sat on doesn't meet this.
• Established business relationship records for anyone you call on that basis: name, number, the date they inquired, and what they asked about. An inquiry gives you 90 days; a purchase gives you 540.
• Each company-specific do-not-call request, with the date, the telemarketer that called, and what was being sold.
• Which version of the national registry you used, with the account number, the date you accessed it and the campaign it was for.
• Every service provider that delivered your outbound calls, with the contract and its dates, kept five years after the contract ends.
• Every employee on the phones, including any fake name they use, and each fake name must trace back to one real person.

Who keeps the records: seller or call center?

Both, by default. Under 310.5(e), the seller and the telemarketer can split recordkeeping in a written agreement. Without one, or if the agreement is vague, both are on the hook for all of it.

When the call center takes on the records, the seller still has to make sure it's actually keeping them, and has to keep access to them. That's a big reason sellers have started putting recordkeeping clauses in vendor contracts. If you sell transfers or run campaigns for a brand, expect the question. Having an answer ready before a buyer asks is how you keep the account.

The safe harbor for gaps in your call records

Nobody's records are perfect, and the FTC knows it. Section 310.5(d) says you won't be liable for gaps in the per-call record if you can show, with documents, that:

1. You have written procedures to keep the records complete and accurate.
2. You've trained your staff, and anyone helping you comply, on those procedures.
3. You monitor and enforce the procedures, and keep records of that monitoring.
4. Any failure was temporary, an honest error, and fixed within 30 days of finding it.

Item 3 is where floors that sample 2 calls in 100 come up short. Monitoring that leaves no record doesn't count, and a QA sheet covering a handful of calls a week is thin evidence that you monitor anything. Scoring every call against your own checks produces a monitoring record for each one. Our free QA scorecard template is a starting point if you don't have written checks yet.

Calling rules that still trip up floors

The 3% abandonment rule is measured per campaign if it runs under 30 days, or separately over each 30-day period if it runs longer. A dialer averaging 2% over a quarter can still break the rule in one bad month. When nobody is free to take a call, the safe harbor requires you to promptly play a recorded message with the seller's name and phone number. You must also keep records showing you met these conditions.

The 2-second clock starts at the end of the person's greeting, not when the line picks up. Watch long AMD settings in VICIdial: a detection delay of several seconds on a human answer can push you past it.

The disclosures come first. Under 310.4(d), the seller's identity, the fact that it's a sales call and the nature of the product have to come "promptly." An agent who opens with a survey question and gets to the pitch two minutes later is the classic violation, and it's also the one a call recording proves or disproves.

Debt relief has its own rule. A seller can't take a fee until at least one debt is settled or changed under an agreement the customer signed, and the customer has made at least one payment under it. If you run debt campaigns, your opener can't suggest otherwise.

What a violation costs

The FTC can seek civil penalties of up to $53,088 per violation. That figure was set in January 2025, and the FTC left it unchanged for 2026. Every call can count as a separate violation, and so can every missing record. State attorneys general can also enforce the TSR in federal court.

The field your dialer can't fill

Your dialer can produce most of the 310.5(a)(2) record: who called whom, when, for how long and where it went. What was said is the piece it can't give you, and it's the piece the safe harbor, a buyer's audit and every dispute come back to.

A Klariqo Call Record is a signed record of one recorded call: the transcript, a fingerprint of the audio and a digital signature, with an independent RFC 3161 timestamp from DigiCert. Change one byte and the signature breaks, and anyone can check one at verify.klariqo.com with no account. Try changing a word on a sample call and watch the check fail.

Klariqo connects to VICIdial with read-only access in about 10 minutes and seals every recorded call in the background. Your first 10,000 recorded calls get their record free, and Call QA can score each one against your own checks, including the TSR disclosures.

This article is general information, not legal advice. Check with your own counsel before relying on it.

Questions people ask