The Registry Is Mandatory, But It Is Not Enough

Here's the uncomfortable math: a single call to a number you didn't scrub can cost you $500 to $1,500 under the TCPA, and FTC-enforced fines can reach $43,792 per violation. The National Do Not Call Registry helps you avoid that, but it doesn't protect you by itself.

Start with what the registry actually is. Administered by the FTC and effective since October 1, 2003, it covers almost all telemarketers nationwide and applies to both landlines and mobile phones. Businesses are required to register, obtain a Subscription Account Number, and routinely scrub their call lists against it, at least every 31 days. That part is non-negotiable, and it's legally reliable.

The mistake is treating it as a complete compliance shield. It isn't, and the regulatory guidance is blunt about why. Since 1992, the FDIC's compliance manual notes, telephone solicitors have also been required to maintain their own company-specific do-not-call lists. If a customer asks you to stop calling, that request ends your ability to call them even if they keep doing business with you. The national registry knows nothing about that conversation. Only your internal list does.

Layer on the other requirements the registry doesn't touch:

• Documented consent. Written, specific, and stored. Consent records are widely considered the strongest defense against a TCPA claim.
• Reassigned Numbers Database checks. A number that used to belong to your customer may now belong to a stranger.
• State-level rules. Florida, Texas, Oregon, and others maintain their own lists, calling-hour limits, and fines that can run $500 to $25,000+ per violation.
• Opt-out handling. Best practice is honoring a stop request within 24 hours, not whenever someone gets around to it.

There's a practical wrinkle for service businesses running reactivation campaigns. The established business relationship exception lets you call past customers even if they're on the national registry, but it has a shelf life: 18 months from their last purchase, or 3 months from their last inquiry. A customer list from two years ago may sit outside that window, which is exactly why consent documentation matters so much. This is why we segment every CallMyCustomers list by recency before a single call goes out, and why the owner approves every script and offer before anything runs.

The stakes justify the extra layers. TCPA class action settlements averaged $6.6 million in 2024 and 2025, and serial litigators actively hunt for violations. Scrubbing the registry is the foundation. Building the rest of the structure on top of it is what keeps you standing.

Why Calling Past Customers Is Legally Different

If you've ever hesitated to call a past customer because their number might be on the registry, here's the part of the rules that works in your favor. The National Do Not Call Registry has two major exceptions, and one of them exists specifically for businesses contacting people they already know.

The exception is called the Established Business Relationship (EBR). Under it, you can call a customer who's on the registry, provided the relationship falls inside a defined time window. According to the FDIC's compliance manual, the windows are:

• 18 months from the customer's last purchase or transaction with you
• 3 months from their last inquiry or application

So if an HVAC customer paid you for a tune-up last spring, you can legally follow up this fall, even if their number sits on the registry. If someone requested a quote three weeks ago and never booked, that inquiry keeps the door open for three months.

The 18-month window is why list recency matters legally, not just for response rates. A customer who last bought from you 14 months ago is inside EBR protection. A customer from three years ago generally isn't, unless you have documented consent. As law firm guidance makes clear, the other path to contacting registered numbers is prior express written consent, and that consent needs to be specific and documented.

Two limits are worth knowing before you build a reactivation campaign around EBR. First, the exception covers manually dialed live voice calls; since 2012, autodialed and prerecorded calls to cell phones require prior express written consent regardless of the relationship. Second, a customer's request to your own company ends the relationship exception immediately, even if they keep doing business with you. Companies have been required to maintain their own do-not-call lists since 1992, and honoring opt-outs within 24 hours is standard practice.

This is why CallMyCustomers segments every list by recency before a single call goes out, and works only from lists of real customers. It's also why older, dormant segments get handled differently than recent ones: the compliant move for anyone outside the 18-month window is consent-based outreach, not a cold call.

The short version: past customers are a different legal category than strangers, and the EBR exception is what makes reactivation campaigns possible. Know your dates, keep your records, and respect every opt-out the moment it arrives.

The Hidden Risks of State Laws and Reassigned Numbers

States don't all play by the same rules, and that's where a lot of well-meaning businesses get hurt. Federal law sets a floor, not a ceiling, and roughly a dozen states have layered their own do-not-call statutes on top with different calling windows and different penalties.

The variation is real and specific. Florida allows solicitation calls only between 8 a.m. and 8 p.m., while Oregon's HB 3865, effective September 29, 2025, narrows the window to 9 a.m. to 7 p.m. and caps outreach to the same consumer at three attempts in 24 hours. Pennsylvania prohibits calls on Sundays outright, and Texas runs its own no-call list separate from the national registry. A campaign that's perfectly compliant in Illinois can be a violation in Florida.

The money at stake varies just as widely. State fines run from $500 to more than $25,000 per violation depending on the state, and 2024–2025 TCPA class action settlements averaged $6.6 million. That's before federal exposure, which adds TCPA statutory damages of $500 to $1,500 per call or text.

Then there's the reassigned number problem, which catches even careful callers:

• A number you collected with valid consent can be reassigned to a new person months later.
• Calling that new person can trigger liability even though the original consent was legitimate.
• The FDIC's reassigned-numbers safe harbor only protects callers who previously obtained consent from the original subscriber.
• This is why list recency matters legally, not just for response rates.

For businesses reactivating past customers, the practical takeaway is that state rules and number reassignment both require active management, not a one-time check. CallMyCustomers works only from lists of real customers and honors opt-outs immediately, which addresses part of the risk. The rest comes down to scrubbing lists regularly and knowing which states your customers live in.

Turn past customers, old quotes, and inactive members into booked work, approved by you and run by us.

Building a Defensible Outreach Process

Staying compliant isn't a one-time registration. It's an operating rhythm, and the businesses that get sued are usually the ones that let the rhythm slip.

The core obligation is scrubbing. Federal rules require you to check your call lists against the National Do Not Call Registry at least every 31 days, and many compliance teams scrub every 30 days or even weekly as added protection. Human error is cited as one of the biggest risks to DNC compliance, which is why a documented, repeatable scrubbing schedule matters more than good intentions.

Opt-out handling is the second pillar. When someone says "stop" or asks to be removed, best practice is to update your records within 24 hours. The FCC has identified seven words that count as automatic revocation requests, including "stop," "cancel," "unsubscribe," and "opt out," so your team and any vendor calling on your behalf need to catch all of them. And remember that a customer's do-not-call request binds you even if they keep buying from you, per the FDIC compliance manual.

Beyond the registry, a defensible process layers in:

• An internal do-not-call list, which regulators have required since 1992 and which ActiveProspect calls "just as critical" as registry checks
• Documented consent for every contact, which sources consistently describe as the strongest defense against violations
• Reassigned Numbers Database checks, since a number that changed hands is a common trap
• Calling-hour discipline: 8 a.m. to 9 p.m. federally, but stricter in states like Florida and Oregon

This is where working from real customer lists changes the math. The established-business-relationship exception lets you call past customers for 18 months after their last purchase, even if they're on the registry. CallMyCustomers builds every campaign from those existing customer lists, segments them by recency, collects explicit consent in the booking flow, and honors opt-outs immediately, so the compliance story is documented rather than assumed. The owner approves every script and message before anything goes out, which keeps judgment where it belongs.

One caution: the 18-month EBR window means very old lists may fall outside that protection. If your last transaction with someone was two years ago, documented consent becomes essential, not optional. Getting the process right before you dial is far cheaper than defending a $500 to $1,500 per-call TCPA claim after the fact.