Why DNC Scrubbing Is Not Optional: The Real Cost of a Dirty List

One dialed number you shouldn't have called can cost more than the entire list you bought it from. That's not an exaggeration — it's the arithmetic of telemarketing compliance, and it gets worse every year.

The exposure numbers are hard. FTC penalties now reach up to $53,088 per violation, effective January 2025, according to compliance analysis. Under the TCPA, statutory damages run $500 per call and treble to $1,500 for willful violations — with no cap on total damages.

The lawsuit trend points one direction. TCPA class actions rose 23% year over year, with 856 filed through April 2026 compared to 691 the year before. And the stakes aren't theoretical: in Wakefield v. ViSalus, 1.85 million prerecorded calls produced a $925 million award at the $500 statutory minimum.

• FTC penalties: up to $53,088 per violation (January 2025)
• TCPA damages: $500–$1,500 per call, no cap
• State penalties: $100 to $25,000 per call
• TCPA class actions: up 23% year over year

Here's the part many callers miss: scrubbing is not a one-time cleanup. The registry changes constantly — it held over 258 million numbers by the end of FY 2025, growing by 4.8 million in a single year. The standard is to re-scrub every 31 days minimum, and again immediately before each campaign launch, logging every scrub with a timestamp and the file it produced. A scrub you cannot date is a scrub you cannot defend.

There's also a trap hiding in a clean result. A registry scrub satisfies the TSR, but it's no defense to a TCPA consent claim — the two regimes are enforced by different parties, and you can win one while losing the other. Serial litigators often aren't on the registry at all, so a list that passes a DNC scrub can still hold the numbers most likely to sue.

Now the good news: the fix is cheap. Paid bulk scrubbing runs roughly $60 per 100,000 records at the low end, according to cost research — a fraction of a cent per record, and rounding error next to the cost of a single DNC complaint. It's one of the cheapest forms of insurance in outbound calling.

This is why list discipline sits at the front of every campaign we run at My AI Call Center. List source and consent records are reviewed before anything launches, and bought lists without clear permission records are flagged — usually declined. We tell you plainly if the list won't support the campaign, before you spend anything.

Multiply your worst uncorrected list error by your dial volume, and you have your actual exposure number.

The Three-List Framework: Federal, State, and Internal Opt-Outs

Most operators assume "DNC scrubbed" means one check against one list. It doesn't. A compliant scrub covers three separate lists, and missing any one of them leaves you exposed to penalties that can reach $53,088 per violation at the federal level.

List one: the federal National Do Not Call Registry. Access runs exclusively through the automated secure site at telemarketing.donotcall.gov, and you will need a Subscription Account Number (SAN) to get in. First-time users create a company profile, and telemarketers must identify their seller-clients along with those clients' SANs. The registry itself holds more than 258 million phone numbers, so a manual approach is not realistic.

The fee structure is manageable. Your first five area codes are free, and after that you pay per area code — $82 each in FY 2026, capped at $22,626 nationwide. Once you have completed your first download, subsequent downloads only need to include the changes since your last access, which is called incremental scrubbing.

List two: the state registries. Eleven states maintain their own DNC registries — Colorado, Florida, Indiana, Louisiana, Massachusetts, Missouri, Oklahoma, Pennsylvania, Tennessee, Texas, and Wyoming — and you must scrub against every registry for each state you dial. State penalties range from $100 to $25,000 per call, so a missed state list is not a small oversight.

List three: your internal opt-out list. This one is fed by every channel — calls, texts, emails, web forms, and verbal requests — and it must be centralized. Suppress at the contact level, not the phone-number level, because an opt-out belongs to the person, not the handset. A suppressed number that survives contact deletion, re-import, or CRM sync failures creates violations identical to deliberate ones.

Cadence matters as much as coverage:

• Re-scrub against the federal registry at least every 31 days
• Run a second re-scrub immediately before each campaign launch
• Log every scrub with a timestamp and the file it produced
• Process internal opt-outs within 10 business days, the window in force since April 11, 2025

That last logging habit is what makes the whole process defensible. As one compliance guide puts it, "a scrub you cannot date is a scrub you cannot defend."

One final warning: a clean registry scrub satisfies the TSR but not the TCPA. Consent requirements are a separate regime enforced by different parties, and cell numbers are doubly prohibited — the TCPA requires prior express written consent for telemarketing calls to mobile numbers. This is why list source and consent records get reviewed before any campaign launches at My AI Call Center, and why a registry scrub alone is never treated as full clearance.

Suppress the Contact, Not the Number: Building a Defensible Scrub Process

The most common scrub failure isn't a missed registry check — it's an opt-out recorded against a phone number instead of the person who made it. When that contact gets deleted, re-imported, or synced from your CRM, the number quietly becomes dialable again, and the resulting violation looks identical to a deliberate one.

The fix is architectural. As Aloware's compliance guide puts it: "Wrong: suppress the number. Right: suppress the contact, then every number attached to it." An opt-out belongs to the person, not the handset, so suppression must live at the contact level and survive deletion, re-import, and CRM sync.

A defensible process also captures opt-outs from every channel, not just phone calls. Consumers revoke consent through texts, emails, web forms, and verbal requests, and your internal DNC list must be centralized enough to catch all of them. Since April 11, 2025, you have just 10 business days to process an opt-out — down from 30 — so scattered records are a liability, not an inconvenience.

A defensible scrub process includes:

• Contact-level suppression that applies across every number attached to a contact and persists through re-imports and CRM syncs
• Centralized opt-out capture across calls, texts, emails, and web forms, honored within the 10-business-day window
• EBR tracking with hard expiration dates — 18 months from a transaction, 3 months from an inquiry, per FTC guidance
• Dated, logged scrub records showing when each scrub ran and what file it produced
• Re-scrubbing every 31 days minimum, plus again immediately before each campaign launch

The EBR clock deserves special attention: it runs shorter than most CRMs' definition of an "active contact," so a number your system treats as current may have lost its exemption months ago. And remember — entering an EBR number into your internal DNC list negates the exemption entirely, per DNC.com's scrubbing documentation.

Finally, documentation is what separates a process from a claim. A scrub you cannot date is a scrub you cannot defend — and with TCPA class actions up 23% year over year, according to recent filing data, investigators will treat any control you can't produce an artifact for as a control you don't have.

This is why My AI Call Center reviews list source and consent records before any campaign launches, and delivers opt-out and DNC logs as a named campaign deliverable. Suppression decisions made before launch are cheap; suppression failures discovered after 10,000 dials are not.

Beyond the Registry: Litigator Screening and Reassigned Numbers

A clean federal DNC scrub is the floor, not the ceiling. The registry captures consumers who opted out, but it misses the two profiles that drive the costliest TCPA litigation: serial litigators who rarely register their numbers, and wireless lines that have been reassigned to new subscribers without the caller's knowledge. Aloware notes that a clean registry scrub is no defense to a TCPA consent claim because the two regimes are enforced by different parties. NumberBroom confirms that most callers run both DNC and litigator scrubs for this reason.

The layered standard has become the practical minimum for defensible outbound programs. Start with the federal and applicable state DNC registries plus your internal opt-out list, then add a custom suppression list for known litigators and professional plaintiffs, and run every wireless number through the FCC's Reassigned Numbers Database (RND) before dialing. ActiveProspect frames this as a combination of tools that work together to manage consent, prevent risky outreach, and document every step. Ignoring opt-outs and contacting reassigned numbers remain the two most common TCPA lawsuit triggers, and the RND check directly addresses the latter.

• Federal + state DNC registries (11 states maintain their own lists)
• Internal opt-out list, centralized and surviving contact deletion or re-import
• Custom litigator/professional-plaintiff suppression list
• FCC Reassigned Numbers Database checks for every wireless number

Pricing for the added layers is modest. Per-record batch scrubbing across vendors typically ranges from $0.002–$0.01 per record, and RND lookups are often bundled or available via API for roughly $30–$100 per month for a few thousand queries. NumberBroom's vendor comparison highlights practical due diligence: compare the total cost for the list in front of you, check whether unused credits expire, and confirm what each price actually includes before comparing rates. Landline Remover, for example, offers 10,000 scrubs including DNC and litigator checks for $20, while the TCPA Litigator List starts at $199 per month for 200,000 scrub coins that expire on cancellation.

At My AI Call Center, every campaign review includes a list and consent audit before a single call is placed. We verify list source, consent records, and calling windows, then apply the layered scrub — federal, state, internal, litigator, and RND — so the numbers we dial are approved, permissioned, and reviewed. The managed-service model means the scrub logic, documentation, and opt-out handling are baked into the campaign workflow, not left to a separate tool stack you have to stitch together.

Your Step-by-Step Scrub Checklist Before Every Campaign

A compliant scrub is a repeatable sequence, not a one-time cleanup. Run these steps in order before every campaign, and you build both a cleaner list and a defensible paper trail.

1. Obtain a SAN and registry access. Access to the National DNC Registry runs only through the automated secure site at telemarketing.donotcall.gov. According to the FTC's official guidance, first-time users create a company profile, service providers must identify their seller-clients and provide their SANs, and the first five area codes are free.

2. Map every state you dial. Eleven states — including Florida, Texas, Pennsylvania, and Indiana — maintain their own DNC registries, and some add stricter rules on top. Florida, for example, enforces quiet hours of 8 a.m. to 8 p.m. versus the federal 8 a.m. to 9 p.m. window, per state-level dialing research. Your scrub must cover each state's registry and calling windows.

3. Run the three-list scrub. Every pass must check the federal registry, every applicable state registry, and your internal opt-out list. Liability stays with the caller regardless of who performs the scrub, according to list-scrubbing guidance. Remember: a clean registry scrub is no defense to a TCPA consent claim — consent status is a separate obligation.

4. Layer in litigator and RND checks. Serial filers often never appear on the registry, so a list that passes a DNC scrub can still hold the numbers most likely to sue, as scrubbing cost analyses note. Adding Reassigned Numbers Database checks addresses the two most common TCPA lawsuit triggers: ignoring opt-outs and calling reassigned numbers, per TCPA compliance tooling research.

5. Apply contact-level suppression. Suppress the contact, then every number attached to it — an opt-out belongs to the person, not the handset. Your suppression records must survive contact deletion, re-import, and CRM sync, or a deleted-and-reimported contact becomes dialable again.

6. Log the scrub. Record the timestamp and the output file every scrub produced. As compliance practitioners put it, a scrub you cannot date is a scrub you cannot defend — and FTC penalties now reach $53,088 per violation.

7. Re-scrub on schedule. Refresh against the registry at least every 31 days, then scrub again immediately before launch. Registry data changes constantly — it held over 258 million numbers by end of FY 2025.

Your pre-launch checklist in short form:

• SAN active, registry access confirmed, state rules mapped
• Federal, state, and internal lists scrubbed; litigator and RND layers applied
• Contact-level suppression verified across all numbers
• Scrub logged with timestamp and output file; re-scrub scheduled

This is the same discipline My AI Call Center applies to its list and consent review before any campaign launches. Bought lists without clear permission records get flagged — and in most cases declined — and opt-out and DNC logs ship as standard campaign deliverables alongside dispositioned contact lists and outcome counts. Paid scrubbing at roughly $60 per 100,000 records is, as one industry analysis puts it, one of the cheapest forms of insurance in the business.