Why 'Just Check the National List' Gets Businesses Sued

Most businesses assume the federal National Do Not Call Registry is the only list that matters. That assumption is exactly what's fueling a wave of litigation that shows no sign of slowing down.

TCPA litigation has hit historic highs. According to industry tracking, 507 TCPA class actions were filed in Q1 2025 alone — a 112% jump over the same quarter the year before. Nearly 80% of all TCPA lawsuits now proceed as class actions, where a single bad calling practice can multiply across thousands of claims.

The stakes per violation are steep. Legal analysis of the statute puts statutory damages at $500 per call or text for negligent violations and $1,500 for willful ones — with no aggregate cap, because each call counts as a separate violation.

And here's the part that catches most businesses off guard: buying leads doesn't shield you from liability. In Ward v. Liberty Mutual, courts certified classes of more than 20,000 prerecorded-voice recipients and 7,000 do-not-call claimants against an insurance agency that simply purchased internet leads — 24,587 of them from a single website. The case analysis is blunt: the more an agency shapes the script, targeting, or cadence, the more it looks like a principal making the calls itself.

A single-list scrub leaves three major blind spots:

• State registries — Florida, Colorado, Massachusetts, Oklahoma, and Washington maintain separate DNC lists, some with harsher penalties than federal law (Massachusetts allows double or treble damages plus mandatory attorneys' fees).
• Your internal DNC list — consumers who previously asked you not to call them, which every telemarketing entity is required to maintain in writing.
• Wireless and VoIP numbers, which need prior express written consent regardless of registry status — making cell numbers on the DNC list "doubly prohibited".

The FTC received over 2 million do-not-call complaints in FY 2024 and actively uses that complaint data to drive enforcement, according to the agency's own Data Book. Regulators aren't waiting for businesses to figure this out on their own.

For companies that respond to inbound leads at speed — like the home services and dental practices CallMyLeads serves — the lesson is simple: fast follow-up only counts when it's compliant follow-up. Scrubbing against one list isn't a safety net. It's a single thread in a net you actually need.

The Three Lists Every Scrub Must Cover (Plus Two Worth Adding)

Stop assuming one list is enough. The research is clear: compliant lead scrubbing requires checking against multiple registries simultaneously, and skipping any layer exposes your business to escalating risk.

The mandatory baseline is the federal National Do Not Call Registry, operated by the FTC with over 253 million active registrations as of FY 2024. Under the Telemarketing Sales Rule, you must scrub against this list within 31 days of every call. Access requires a Subscription Account Number (SAN) — the first five area codes are free, then $72 per additional area code per year.

But federal compliance alone leaves dangerous gaps. States including Florida, Colorado, Massachusetts, Oklahoma, and Washington maintain separate DNC registries with their own penalties. Massachusetts, for example, allows double or treble damages plus mandatory attorneys' fees — penalties the federal TCPA doesn't include. Florida restricts calling hours to 8 a.m.–8 p.m., tighter than the federal 8 a.m.–9 p.m. window. If your leads come from multiple states, the strictest standard applies to each consumer's state of residence.

The third required layer is your internal DNC list — every person who has explicitly asked your business not to call. Federal law requires every entity engaged in telesales to maintain a written DNC policy and honor opt-outs immediately.

For deeper protection, two additional lists are worth adding:

• TCPA wireless lists — cell numbers on the DNC registry are "doubly prohibited" without prior express written consent, and implied consent is insufficient
• Litigant lists — known serial plaintiffs who file TCPA class actions, which hit a record 507 filings in Q1 2025 alone, a 112% increase over the prior year

VoIP numbers should be treated the same as wireless under TCPA rules. For CallMyLeads, which responds to inbound leads across home services, dental, legal, and insurance nationwide, this multi-list approach isn't optional — it's built into every campaign we run. Aged leads must be re-scrubbed before dialing since numbers are added daily and get reassigned or ported. The cost of scrubbing is negligible compared to the $500–$1,500 per violation statutory damages, or the average class action settlement exceeding $6.6 million.

State Rules That Are Stricter Than Federal Law

Scrubbing against the federal National Do Not Call Registry is the baseline — but if that's all you do, you're exposed in some of the largest states in the country. A growing number of states run their own do-not-call regimes with penalties and consent standards that exceed federal law, and courts apply them per the consumer's state of residence.

The practical rule is simple: if your leads come from multiple states, assume the strictest standard applies to each consumer's state of residence, as compliance guidance for lead buyers puts it. A federal-only scrub can't protect you from a statute you've never checked.

Massachusetts is the clearest example. The state maintains its own do-not-call regime under M.G.L. c. 159C and 201 CMR 12.00, and violations can trigger double or treble damages plus mandatory attorneys' fees under Chapter 93A — penalties the federal TCPA simply doesn't have. According to legal analysis of recent TCPA class actions, agencies operating in Massachusetts must scrub against both the federal and state registries, and "Was the number scrubbed against the federal and Massachusetts do-not-call registries?" is now a standard due-diligence question for any purchased lead list.

Florida tightens the clock. The federal calling window runs 8 a.m. to 9 p.m. recipient's local time, but Florida cuts it to 8 a.m.–8 p.m., and its FTSA adds $500 per call — $1,500 if willful — according to industry compliance research. A call that's perfectly legal at 8:30 p.m. in most states is a violation in Florida.

Other states are following the same pattern:

• Texas's TDPSA, effective July 1, 2024, allows penalties up to $7,500 per violation.
• Oklahoma's 2022 telemarketing law sets its own do-not-call and consent standards for automated contacts.
• Washington's telemarketing rules exceed federal standards as well.
• Established Business Relationship exemptions vary by state and vertical, so an exemption that saves a call in one state may not exist in another.

The stakes of missing one of these traps are not theoretical. TCPA statutory damages run $500 per negligent violation and $1,500 per willful one, with no aggregate cap and each call counted separately — and litigation data shows 507 TCPA class actions were filed in Q1 2025 alone, a 112% jump over the prior year. Layer state damages on top, and a single unscubbed list can compound fast.

For a nationwide operation, this is why scrubbing has to happen at the state level, not just the federal one. At CallMyLeads, every lead response follows consent and telemarketing quiet-hours rules, with opt-outs honored immediately and automatically — because when you respond to leads across all 50 states, the strictest rule in the room is the one that governs.

Timing, Aged Leads, and the 31-Day Scrub Cycle

The federal Telemarketing Sales Rule gives you a hard deadline: scrub against the National Do Not Call Registry within 31 days of every call. That clock resets with each dial, and the registry itself grows daily — the FTC logged over 253 million active registrations in FY 2024 alone. A lead that was clean last month may not be clean today. Numbers get added, disconnected, reassigned, or ported. If you're working aged lists without a fresh scrub, you're guessing.

• New numbers hit the federal registry every day — last month's scrub is stale
• Disconnected or reassigned numbers turn a valid lead into a violation
• State registries (Florida, Massachusetts, Colorado, Oklahoma, Washington) update on their own schedules
• EBR exemptions expire on state-specific timelines and vanish the moment a consumer asks you to stop

The Established Business Relationship exemption looks like a safe harbor until it isn't. Federal rules allow calls to DNC-registered consumers with an EBR, but the exemption ends 18 months after the last transaction — or immediately if the person tells you not to call. Adding that number to your internal suppression list voids the EBR exemption entirely. Massachusetts goes further: its law demands dual scrubbing against both federal and state registries and attaches double or treble damages plus mandatory attorneys' fees for violations. Florida narrows the calling window to 8 a.m.–8 p.m., an hour tighter than the federal standard.

The FCC's April 2025 revocation rules added another layer: consent withdrawal must be honored within 10 business days through any reasonable method. Keywords like "stop," "quit," "revoke," "opt out," "cancel," "unsubscribe," and "end" trigger immediate revocation. For a service like CallMyLeads that responds to inbound leads across home services, dental, legal, and insurance verticals nationwide, that means every text-back, every callback, and every AI-driven follow-up needs a documented consent trail and a scrub timestamp.

Courts presume non-compliance when you can't produce records. The statute of limitations runs four years; industry best practice says keep consent documentation, disclosure language, form URLs, and scrubbing evidence for five years or more. With 507 TCPA class actions filed in Q1 2025 — a 112% jump over the prior year — the cost of missing paperwork far exceeds the cost of keeping it.

A Practical Scrubbing Workflow for Fast Lead Response

Fast lead response and compliance are not enemies. With the right workflow, scrubbing happens in seconds — before the first call or text ever goes out — so speed never becomes exposure.

Here's the workflow that keeps fast-moving businesses on the right side of the rules:

• Register for a SAN first. Access to the National Do Not Call Registry requires a Subscription Account Number from the FTC. The first five area codes are free; additional area codes run $72 each per year as of 2024, according to compliance guidance for lead generators.
• Scrub every list layer before first outreach. Check each lead against the federal registry, applicable state registries, and your internal do-not-call list. The federal registry alone holds over 253 million active registrations, per the FTC's FY 2024 data book — and states like Florida, Massachusetts, and Oklahoma maintain separate lists on top of it.
• Re-scrub aged leads. The Telemarketing Sales Rule requires scrubbing within 31 days of each call, and numbers get added, disconnected, and reassigned daily. A lead that was clean in January may not be clean in March.
• Flag wireless and VoIP numbers. Mobile numbers without prior express written consent are effectively off-limits for telemarketing — scrubbing specialists recommend treating VoIP numbers the same way. Route these to written-consent-only handling.
• Honor opt-outs instantly and document everything. FCC rules effective April 2025 require honoring consent withdrawal within 10 business days through any reasonable method, and keywords like "stop" and "unsubscribe" trigger immediate revocation, per the lead generation compliance guide. Keep consent and scrubbing records at least four to five years — courts presume non-compliance if you can't prove consent existed at call time.

The documentation step deserves extra weight. The burden of proof rests with the caller, and the Ward v. Liberty Mutual case shows lead buyers can face class-action liability even when vendors made the calls. "My vendor handled it" is not a defense.

This is where built-in compliance beats bolted-on compliance. CallMyLeads collects explicit consent at booking, honors opt-outs immediately and automatically, and enforces quiet-hours rules on every outreach — so a lead answered in under ten seconds is also a lead answered lawfully. When the workflow handles suppression, consent, and timing by default, your team never has to choose between responding fast and responding safely.

The bottom line: build the scrub into the system, not into someone's to-do list. Speed wins jobs, but only documented, consent-based speed survives a lawsuit.