TCPA compliance checklist for small businesses: how to stop the next demand letter

Updated 2026-11-03. 6 minute read. Cites 47 U.S.C. § 227 and 47 C.F.R. § 64.1200 and Fla. Stat. § 501.059.

The campaign that produced the letter you are holding has produced others. Fixing the campaign is cheaper than resolving the next letter. These are the controls, in the order a regulator or a plaintiff would check them: written consent capture, a Do Not Call scrub every 31 days, an internal do-not-call list, opt-outs honoured within ten business days, calling hours, reassigned-number checks, vendor contracts and four-year record retention.

Consent

  1. Capture prior express written consent in the form 47 C.F.R. § 64.1200(f) requires: signature, clear disclosure of automated marketing calls and texts from your named business, the number, and a statement that consent is not a condition of purchase. See consent explained.
  2. Store the record: number, timestamp, the page or script as presented, IP and user agent. Keep it for at least four years after the last call, matching the federal limitation period.
  3. Never buy or accept a lead without the consent record attached. A vendor's assurance is not a record.

Do Not Call

  1. Subscribe to the National Do Not Call Registry for every area code you call and scrub every 31 days. § 64.1200(c)(2)(i)(D).
  2. Maintain an internal do-not-call list and add every person who asks not to be called, within the ten business days the 2024 rules allow and in practice the same day. § 64.1200(d).
  3. Write the do-not-call policy down, train staff on it, and keep the training records. § 64.1200(d)(1) and (2). The written policy is also the first thing a plaintiff asks for in discovery.

Dialing

  1. Honour every opt-out by any reasonable means. STOP, verbal, email, form. Automate it in the messaging platform.
  2. Check the FCC Reassigned Numbers Database before dialing numbers from older consent. It is the only safe harbour for a wrong-number call.
  3. Calling hours: 8 a.m. to 9 p.m. recipient local time federally; 8 a.m. to 8 p.m. in Florida with a limit of three calls on the same subject in 24 hours under Fla. Stat. § 501.059. Set the dialer to the recipient's time zone, not yours.
  4. Identify yourself. Name of the business, purpose of the call, and a number or address at which the business can be reached, at the start of every telemarketing call. § 64.1200(d)(4).

Vendors and records

  1. Vendor contracts that require all of the above, give you audit rights, require monthly delivery of consent and scrub records, and carry an indemnity. Then actually audit. See vendor liability.
  2. Retain everything for four years: dialer logs, consent, scrub reports, opt-outs, policies, training records, vendor reports. The business that can produce its records resolves demands on the evidence. The business that cannot pays the full count.
Twelve controls, none of them expensive. The cost of all of them for a year is usually less than one demand letter.

Quick answers

How often do I have to scrub against the Do Not Call Registry?

At least every 31 days under 47 C.F.R. § 64.1200(c)(2)(i)(D). A business that makes telemarketing calls must also hold a subscription to the registry for the area codes it calls.

What hours can a business make telemarketing calls?

Federal rules: 8 a.m. to 9 p.m. in the recipient's local time. Florida's Telephone Solicitation Act narrows that to 8 a.m. to 8 p.m. and limits calls on the same subject to three in a 24-hour period.

How quickly must I honour a STOP request?

Within ten business days under the FCC's 2024 rules, by any reasonable means of revocation. Florida requires a sender of texts to stop within 15 days of a STOP reply before a claim can be brought for later messages. Good practice is immediately and automatically.

Related