TCPA compliance software and DNC scrubbing tools, with do not call list scrubbing costs

How often do you have to scrub the DNC list?

Every 31 days at the outside. The FTC safe harbor at 16 CFR 310.4(b)(3)(iv) requires that you use "a version of the 'do-not-call' registry obtained from the Commission no more than thirty-one (31) days prior to the date any call is made, and maintains records documenting this process." Miss that window and the safe harbor is gone even if the call was an honest mistake.

Thirty-one days is a legal floor, not an operating target, and the distinction matters more than most vendors admit. Consumers register on the federal list every day. A list scrubbed once when it was uploaded and then dialed for four weeks is compliant on paper and progressively wrong in practice, and the numbers that register during those four weeks are exactly the people most likely to complain. That is the argument for checking at the moment of the dial rather than at import, and it is why our platform applies suppression per call rather than per upload.

The other thing worth reading properly is what the safe harbor actually asks for, because scrubbing is only one of six conditions and they apply together. Written procedures, trained personnel, a maintained internal do-not-call list, the 31-day registry version, active monitoring and enforcement, and the offending call being genuine error. Buy the best scrubber on the market and you have satisfied one of six. The registry mechanics themselves are broken down in our guide to Do Not Call rules for businesses, and how suppression, disclosure and calling windows run on a live call is set out on our TCPA compliant AI calling page.

• Written procedures for honoring do-not-call requests
• Personnel trained in those procedures, including anyone assisting you
• An internal do-not-call list maintained and recorded
• A registry version no more than 31 days old at the time of the call
• Monitoring and enforcement of the procedures you wrote
• The violating call being the result of error, not missing information

Does TCPA compliance software cover the FTC registry fee?

No, and it is one of the few places where the rule explicitly forbids the arrangement buyers assume they are getting. Under 16 CFR 310.8(c) the annual fee is "$82 for each area code of data accessed, up to a maximum of $22,626," with "no charge to any person for accessing the first five area codes of data." The same paragraph then says: "No person may participate in any arrangement to share the cost of accessing the National Do Not Call Registry, including any arrangement with any telemarketer or service provider to divide the costs to access the registry among various clients of that telemarketer or service provider."

Read that twice if you are shopping. Your scrubbing vendor cannot buy registry access once and spread it across its customer base, and a subscription that appears to include registry data is not making the fee disappear. The seller pays it, gets a unique account number, and that account is tied to a twelve month period beginning on the first day of the month the fee was paid.

Adding area codes later is priced by half. Section 310.8(d) sets $82 for each additional area code taken in the first six months of the annual period and $41 for each one taken in the second six months. If your territory is going to expand mid year, the timing is worth a moment of planning rather than a surprise invoice.

There is also a certification requirement people skip. Under 310.8(e) you must certify under penalty of law that you are accessing the registry solely to comply with the rule, and a service provider scrubbing on behalf of sellers has to identify each seller and provide each seller's own account number. If a vendor cannot tell you which account number your scrubs run under, that is a real question, not a technicality.

• $82 per area code per year, up to $22,626 for national coverage
• First five area codes free to every account
• Additional area codes: $82 in the first six months, $41 in the second
• Cost sharing with a vendor or between its clients is prohibited
• Access requires certification under penalty of law, per seller account

What does DNC scrubbing cost?

Published pricing exists at the small end and disappears as you scale. Do Not Call Scrub Lite runs a plain record ladder: free for 25 records a month, $24.99 for 1,000, $39.99 for 5,000, $59.99 for 25,000 and $119.00 for 60,000, with state DNC access an extra $99.00 a month. The DNC Project publishes $449 a month paid annually for unlimited national, state and litigator scrubs with API access, and a pay per scrub option where the first ten numbers are free. Above that, DNCScrub and PossibleNOW both publish nothing and quote against your record volume.

The part that catches people out is that state coverage is frequently a separate product with its own exclusions. Do Not Call Scrub Lite sells state DNC as a $99 monthly add-on and states plainly that Mississippi, Louisiana and Oklahoma are not included. That is not an oversight. Oklahoma runs its own registry through the Attorney General at $150.00 per quarter or $600.00 per year, requires a completed registry access form and an executed confidentiality agreement, updates the list quarterly, and gives you 30 days to remove newly registered consumers. Non-exempt telemarketers there also register with the Attorney General and post a bond.

Mississippi is the useful counter-example, because it went the other way. As of July 1, 2023 the program moved from the Public Service Commission to the Attorney General, Mississippi now uses the federal registry as its list of objecting consumers, and solicitors no longer buy a separate state list. There is one registration and one bond, $75,000 to the Attorney General, and the earlier $50,000 Public Service Commission bond is no longer required. Solicitors calling Mississippi numbers do have to obtain a copy of the federal list monthly and confirm they have done so at registration, which is a tighter cadence than the federal 31 day floor. Anyone still budgeting a separate Mississippi list fee is working from a stale checklist.

So a realistic annual compliance line for a national outbound team is the scrubbing subscription, plus up to $22,626 of federal registry access, plus per-state fees and bonds where you dial, plus whatever your dialer charges for the compliance module. If you are also pricing the dialer itself, the seat costs are laid out on auto dialer pricing and the plan-by-plan feature gates on cold calling software.

• Scrubbing subscription: $25 to $449 a month at published rates
• Federal registry access: $82 per area code, capped at $22,626
• State registries and bonds where you dial, billed by each state
• Litigator list coverage, sometimes bundled and sometimes not
• Dialer compliance modules, often an add-on rather than a plan feature

Do you need DNC scrubbing for B2B calls?

Mostly no, and the exception is bigger than the rule suggests. The federal do-not-call provisions at 47 CFR 64.1200(c) and (d) attach to residential subscribers, and 16 CFR 310.6(b)(7) exempts business to business calls from most of the Telemarketing Sales Rule. That is genuinely why automated outbound sells into B2B first.

Where it breaks down is the phone itself. A prospect's mobile number is frequently their personal line, and once you are dialing cell phones you are inside consent territory regardless of how business the conversation is. The FCC also confirmed in February 2024 that AI-generated voices in calls fall under the TCPA, which means an artificial voice reaching a consumer line generally needs prior express consent. Several states then set a higher floor than the federal one through mini-TCPA statutes, some of which cap daily call attempts per lead rather than just restricting hours.

The practical position for a B2B team is that you still want suppression running, you still want an internal do-not-call list, and you want the calling window applied by the contact time zone. It costs very little and it removes the argument. We work through where the exemption holds and where it does not on the TCPA B2B exemption, and the AI-specific position is in whether AI cold calling is legal. If your outbound uses local area code caller IDs, the separate question of when that is lawful is covered in is local presence dialing legal.

• The registry attaches to residential subscribers, not business lines
• Business mobiles are often personal lines, which pulls consent back in
• AI voices fall under the TCPA per the FCC, February 2024
• State mini-TCPA laws can cap daily attempts per lead

What records do you have to keep, and for how long?

Five years, and the list is longer than most teams have wired up. Section 310.5(a) of the Telemarketing Sales Rule requires a per-call record covering the telemarketer, the seller, the good or service offered, whether the call was to a consumer or a business, that it was outbound, whether it was prerecorded, the calling and called numbers, the date, the time and the duration, the script used, the caller ID number and name transmitted along with proof of authorization to use them, and the disposition.

Read that against what a scrubbing tool produces. A scrubber gives you a timestamped record that a number was checked against a registry version on a date, which is exactly what 310.4(b)(3)(iv) asks for and nothing more. It does not know which version of your script ran, what the agent and the prospect actually said, or how the call was dispositioned. Those come from the dialer, and if the dialer only retains recordings for 30 or 90 days on your plan, your retention posture is set by a storage setting nobody reviewed.

The amended rule also raised the exposure. The civil penalty ceiling under 16 CFR 1.98 is $53,088 per violation as adjusted at 90 FR 5581, January 17, 2025, and the TCPA carries a private right of action at 47 U.S.C. 227(b)(3) worth $500 per call and up to $1,500 where the violation was willful or knowing. Per call, against a campaign of any size, is the number that matters.

One more retention detail that has changed recently: since April 11, 2025 a called party may revoke consent by any reasonable method, you may not designate an exclusive means of doing it, and you have a reasonable time not to exceed ten business days to honor it. Keeping the evidence of when a revocation arrived and when it took effect is now part of the record, not a nicety.

• Five year retention of per-call records under 16 CFR 310.5(a)
• Including the script used and the call disposition
• Including the caller ID transmitted and proof you were authorized to use it
• Civil penalties up to $53,088 per violation under 16 CFR 1.98
• TCPA private right of action at $500 per call, $1,500 if willful

Which outbound platforms include compliance, and which charge extra?

When we opened the pricing and feature pages across this category in August 2026, the pattern was consistent: compliance is priced as a module, and the module is usually not on the plan you were quoted.

Kixie sells do-not-call scrubbing as a compliance add-on rather than a plan feature, and publishes no price for its plans or its add-ons anywhere on the site. PhoneBurner sells ARMOR, its number reputation and spam remediation product, as a paid add-on on all three tiers, which are $140, $165 and $183 per user per month on annual billing. Readymode puts DID reputation monitoring and managed spam remediation behind its iQ tier, at $199 per licence for 1 to 4 licences and $249 at 5 or more. Convoso publishes a genuinely deep compliance stack by name, including StateTracker for state dialing rules, Attempt Control Manager, the Reassigned Numbers Database and STIR/SHAKEN attestation, and no price at all.

None of this is dishonest on their part, but it does mean the number you compare across vendors has to be the compliant configuration rather than the entry seat. A $140 seat with the reputation product added is not a $140 seat. The same trap shows up with CRM connectors, which sit above the entry plan on five of the sixteen platforms we priced, and we go through that comparison on the best dialer for cold calling.

There is a related question about pacing that belongs here rather than in a scrubbing conversation. The abandonment safe harbor at 310.4(b)(4) caps abandoned calls at three percent of calls answered by a person, measured per campaign under 30 days or separately over each successive 30-day period, and requires a 15 second or four ring minimum plus a recorded identification message. Note the denominator: calls answered by a person, not calls placed. Pushing a predictive dialer harder to lift connect rates is precisely how a compliant campaign stops being one, which is the subject of are power dialers illegal.

• Kixie: DNC scrubbing is a compliance add-on, no published price
• PhoneBurner: ARMOR reputation product is an add-on on every tier
• Readymode: reputation monitoring and remediation gated behind iQ
• Convoso: named compliance modules, quote only, annual, no trial
• Compare the compliant configuration, not the advertised entry seat