What Is DNC Scrubbing? Do-Not-Call List Compliance Explained

A home services call center in Tampa ran a plumbing campaign last March. Sixty-five thousand numbers. Standard Tuesday. Except 847 of those numbers were on the National Do Not Call Registry — and 23 of the owners filed complaints with the FTC within 72 hours.

Statutory damages start at $500 per violation. Willful violations can hit $51,997 per call. The math got ugly fast.

Their compliance vendor had let the scrub subscription lapse. Nobody noticed for six weeks. I wish I could say this was rare. It's not. I've seen variations of this story play out at agencies that should know better — and honestly, the only reason some of them got away with it was luck, not process.

DNC scrubbing is the process of checking your call lists against Do-Not-Call registries before you dial. Federal registry. State lists. Internal suppression. Three layers, each with its own rules and refresh requirements. Get it right, and it's invisible infrastructure. Get it wrong, and you're writing six-figure checks to the FTC — or settling class actions that make those fines look cheap. For a broader overview of telemarketing compliance, see our TCPA compliance fundamentals guide.

This is the complete breakdown: what DNC scrubbing actually is, how the federal and state registries work, the 31-day refresh rule, when EBR exemptions apply (and when they don't), and how to build a compliant scrub process that doesn't crater your dial rates.

What DNC Scrubbing Actually Does

At its core, DNC scrubbing is a comparison operation. You take a list of phone numbers you want to call. You compare each number against registries of people who've said "don't call me." Numbers that match get suppressed. Numbers that pass get dialed.

The catch: there are multiple registries. And each has different rules.

The National Do Not Call Registry. Operated by the FTC. Over 246 million phone numbers as of 2026. Consumers register online or by calling from the number they want protected. Registration never expires — once a number is on, it stays on until the consumer removes it or the number gets reassigned.

State DNC lists. 12 states maintain their own registries, separate from federal. Some require separate registration and fees. Some have stricter rules than federal. Pennsylvania's state list, for example, requires annual registration fees and quarterly scrubs against their specific database.

Internal suppression lists. Your own list of people who've told you directly to stop calling. An opt-out request made to your company. A complaint. A legal demand letter. These take precedence over everything — even if someone isn't on any registry, if they've told you to stop, you stop.

DNC scrubbing checks your dial list against all three layers. Federal match? Suppress. State match? Suppress. Internal suppression match? Suppress. What's left is your compliant dial queue.

For a deeper dive on the distinction between DNC scrubbing and litigator scrubbing (professional plaintiffs who bait calls to sue), see our TCPA litigator scrub guide. Different problem, different database, both required.

Core Concepts Before You Start

The 31-day rule. This is the one that catches people. The FTC requires that any number you call must have been scrubbed against the National DNC Registry within the previous 31 days. Not "scrubbed once and you're good." Scrubbed within the last 31 calendar days.

If you scrubbed a list on June 1st and dial it on July 3rd, you're non-compliant. Even if every number was clean on June 1st. Even if no new registrations happened. The 31-day window is absolute.

Most operations scrub weekly to stay well inside the buffer. Some scrub before every campaign. Either way, you need a process that tracks when each list was last verified — and blocks dialing when it's stale.

Safe Harbor documentation. The FTC provides a "safe harbor" defense against DNC violations if you can demonstrate three things: (1) you have written policies and procedures for DNC compliance, (2) you train personnel on those procedures, and (3) your DNC violation was an error — not a policy failure.

Safe harbor doesn't prevent lawsuits. But it can cap damages at the minimum $500 per call instead of the willful $51,997. Documentation matters. Keep your scrub logs, training records, and policy docs indefinitely. If you're building compliance documentation from scratch, our call center compliance checklist covers the full audit trail requirements.

EBR exemptions (and their limits). An Established Business Relationship exempts you from federal DNC restrictions for certain customers. If someone bought from you, you can call them for 18 months from the transaction date. If someone inquired (filled a form, called your sales line), you can call them for 3 months from the inquiry.

But — and this is the part people miss — EBR doesn't override a direct opt-out request. If a customer says "stop calling me," the EBR exemption evaporates immediately. And in many states with their own DNC lists, EBR doesn't apply at all to the state registry. Indiana's state DNC list has no EBR exemption. Pennsylvania requires explicit consent even for existing customers.

Reassigned number risk. Phone numbers get recycled. A number that was clean when you scrubbed might now belong to someone on the registry. The new owner registered it. Your scrub showed it clean because you scrubbed before the reassignment. You call. They complain.

This one genuinely frustrates me. You can do everything right — scrub on time, document meticulously, follow every rule — and still catch a violation because AT&T recycled a number between your scrub date and your dial date. There's no grace period, no "but I checked" defense that automatically works.

The FCC maintains a Reassigned Numbers Database (RND) specifically for this. Checking the RND shows whether a number has been disconnected and reassigned since your last contact. It's an extra layer — not a replacement for DNC scrubbing, but a supplement that catches reassignment gaps.

The Complete Process: Setting Up DNC Scrubbing

Step 1: Access the National Registry

You need a Subscription Account Number (SAN) from the FTC to access the National DNC Registry. Registration is free for the first five area codes. Beyond that, fees range from $72 per area code to $20,988 for nationwide access (as of 2026).

Go to telemarketing.donotcall.gov. Register your organization. Get your SAN. This is your key to download current registry data or run API lookups.

Data delivery options:

• Flat file download. You download the entire registry (or your subscribed area codes) as a data file. Then you run comparisons locally. Updated weekly.
• API access. Real-time lookups against the FTC's servers. Slower but always current. Better for smaller operations or real-time verification.

Most high-volume call centers use flat file downloads for pre-campaign batch scrubbing, then supplement with API checks for same-day verification. Is this overkill? Probably not, given the penalty math. Is it annoying? Absolutely.

Step 2: Identify Your State Requirements

Here's the current list of states with separate DNC registries:

If you're calling into any of these states, you need to subscribe to their lists separately and scrub on their cadence — not just the federal 31-day rule.

For operations running pay-per-call campaigns across multiple states, this adds operational overhead. But the alternative is state-level enforcement actions on top of federal penalties. Our TCPA compliance FAQ covers state-specific nuances for the major pay-per-call verticals.

Step 3: Build Your Internal Suppression List

Your internal list is every number that has asked you specifically to stop calling. Sources include:

• Phone requests during calls ("take me off your list")
• Written requests (emails, letters, form submissions)
• Legal demand letters
• Complaint filings forwarded to you
• CRM opt-out flags from any channel

Internal suppression is absolute. A number on your internal list gets suppressed even if it passes federal and state checks. Someone can have an EBR with you and still opt out — the opt-out wins.

Critical: internal suppression must be honored within 30 days of the request. If someone opts out on June 1st, they cannot receive a call from your organization after July 1st. Many operations process opt-outs same-day to avoid any risk of timing errors. (If you're still doing batch opt-out processing weekly, I'd strongly recommend fixing that. The 30-day window sounds generous until a Friday opt-out hits your Monday batch process with a holiday weekend in between.)

Step 4: Integrate Scrubbing Into Your Workflow

For batch operations (most call centers):

1. Export your dial list as CSV
2. Run against federal registry (flat file comparison or API batch)
3. Run against applicable state registries
4. Run against internal suppression list
5. Flag and remove matches
6. Log the scrub with timestamp, data sources, and results
7. Import clean list to dialer
8. Track the 31-day expiration date for re-scrubbing

For real-time operations (immediate follow-up calls, inbound callbacks):

1. Receive lead with phone number
2. Before any dial, run API check against federal registry
3. Run API check against applicable state registries
4. Check internal suppression
5. If clean, allow dial
6. Log the pre-dial check with timestamp

VeloCalls ships with DNC scrubbing at the routing layer — calls get checked before transfer to buyers. For publishers and buyers running their own outbound follow-up, the VeloCalls webhook integration can trigger pre-dial verification in your CRM.

Step 5: Document Everything

You need an audit trail. For every scrub:

• Timestamp of the scrub
• Data sources used (federal registry version, state list date, internal list version)
• Number of records checked
• Number of matches suppressed
• Which area codes were covered

If a complaint comes in, you need to prove that the number was scrubbed within 31 days of the call date, that your scrub process used current data, and that the number didn't match at the time. Without documentation, you have no safe harbor.

Advanced: EBR Exemptions in Practice

The Established Business Relationship exemption is narrower than most people think.

Transaction-based EBR (18 months). If a customer purchased from you, you can call them for 18 months from the transaction date. The clock starts at purchase, payment, or delivery — whichever is last. After 18 months, the exemption expires and they're back to registry rules.

Inquiry-based EBR (3 months). If a prospect inquired — filled out your form, called your sales line, requested a quote — you have 3 months to call them. After that, you need explicit consent or they're protected by their DNC registration.

Immediate opt-out override. Here's the part people mess up. If a customer or prospect says "don't call me," the EBR exemption ends immediately. Doesn't matter if the 18-month or 3-month window is still open. An opt-out cancels the exemption on the spot. You must honor the opt-out within 30 days.

State limitations. EBR is a federal exemption. Some states don't recognize it for their state DNC lists. Indiana has no EBR exemption — if someone's on Indiana's state list, your business relationship doesn't matter. Check each state's rules before assuming EBR covers you.

For pay-per-call operations, EBR tracking gets complicated. If a caller reaches your buyer through a pay-per-call campaign, the inquiry-based EBR accrues to the buyer — not the publisher or network. The buyer has 3 months to follow up. But that EBR doesn't transfer back upstream. Our one-to-one consent guide covers how consent and EBR interact in multi-party call flows.

Common Mistakes

Scrubbing once and forgetting. The 31-day rule is ongoing. A list that was clean a month ago needs re-scrubbing before you dial it again. I've watched call centers reuse "verified" lists for 90 days. That's 60 days of non-compliance.

Ignoring state lists. Federal scrubbing isn't enough. If you're calling Florida numbers, you need Florida's state list too. The state enforcement actions are separate from federal — you can be compliant federally and still face state penalties.

Treating EBR as a blanket exemption. EBR lets you call existing customers and recent inquiries. It doesn't let you ignore opt-out requests. It doesn't cover state lists in many states. It expires. Operators who lean too hard on EBR eventually lean into a lawsuit.

Here's my honest take: EBR is the compliance loophole that gets more operations in trouble than any other. People read "you can call existing customers" and hear "you can call anyone who ever touched your funnel." That's not what it says. That's not how it works. But I get why the confusion happens — the rules are written by lawyers for lawyers, and the plain-English version sounds more permissive than the actual regulation.

Not documenting scrub logs. When the FTC asks for proof of your DNC compliance process, "we definitely scrubbed that" is not evidence. Timestamped logs showing what data you checked, when you checked it, and what you suppressed — that's evidence.

Calling reassigned numbers. The number was clean when you scrubbed. But it's been disconnected and given to someone new. The new owner is on the registry. You call anyway because your old scrub didn't catch the reassignment. Check the FCC's Reassigned Numbers Database if you're calling numbers older than 90 days.

Skipping wireless numbers. The National DNC Registry includes both landlines and wireless numbers. Some operators still believe the old myth that wireless numbers aren't covered. They are. Have been since 2003. Every year I encounter at least one person convinced wireless is exempt. Every year I have to pull up the same FTC FAQ page. It's a myth that won't die. For the full rundown on wireless-specific regulations, see our wireless number compliance guide.

For click fraud detection on the paid media side of your lead campaigns — the traffic source problems that happen before a number even enters your dial list — ClickzProtect handles detection before fake leads become wasted dials.

Frequently Asked Questions

What is DNC scrubbing?

DNC scrubbing is the process of checking your call lists against Do-Not-Call registries before dialing. You compare phone numbers against the federal National Do Not Call Registry, applicable state DNC lists, and your company's internal suppression list. Numbers that match get removed from your dial queue. The process prevents you from calling consumers who've opted out of telemarketing calls — and prevents the $500-$51,997 per-call penalties that come with violations.

How often do I need to scrub against the National DNC Registry?

Every 31 days, minimum. The FTC requires that any number you call must have been checked against the federal registry within the previous 31 days. If you last scrubbed 32 days ago, you're non-compliant — even if the number was clean then. Most compliant operations scrub weekly or before each campaign to stay well inside the window.

What is an Established Business Relationship (EBR) exemption?

An EBR exemption allows you to call someone on the DNC registry if you have an existing customer relationship. For transactions, the exemption lasts 18 months from the last purchase, payment, or delivery. For inquiries (they filled out a form, called you, etc.), it lasts 3 months from the inquiry date. The exemption ends immediately if the consumer asks you to stop calling — and you must honor that request within 30 days. EBR doesn't exempt you from state DNC lists in many states, so check your state requirements.

Do I need to scrub against state DNC lists separately?

Yes, in most states. 12 states maintain their own DNC registries with separate registration and scrubbing requirements. Indiana, Pennsylvania, Texas, Colorado, Florida, Louisiana, Massachusetts, Missouri, Oklahoma, Tennessee, Wisconsin, and Wyoming all have state-level lists. Some states (like Pennsylvania) require registration fees and periodic re-scrubbing on their specific cadence. Federal DNC scrubbing alone doesn't cover you in these states.

Try VeloCalls for Your Vertical

Pay-per-call routing platform built for HVAC, plumbing, roofing, PI lawyers, Medicare brokers, and insurance. Smart routing, real-time bidding, visual IVR builder, AI conversation intelligence — and yes, DNC scrubbing baked into the routing layer. Per-minute pricing: Managed starts at 4¢/min, BYOC at 2¢/min, both drop as you scale.

See pricing → · Book a demo