The Short Answer: The FTC Administers the National Do Not Call Registry

If you've ever wondered who's actually behind that list you added your number to, the answer is simpler than the alphabet soup of federal agencies suggests: the Federal Trade Commission (FTC) administers the National Do Not Call Registry. This isn't guesswork — the FTC states it plainly on its own Do Not Call Registry topic page, and the agency confirms it in the biennial report to Congress it's required to file, handled by its Bureau of Consumer Protection.

The Registry has operated since 2003 and remains massive in scale. As of the end of FY 2025, it held more than 258 million registered phone numbers — an increase of over 4.8 million from the prior fiscal year — and the FTC received more than 2.6 million Do Not Call complaints in FY 2025, up from the year before.

Here's where most people get confused, and understandably so. The Federal Communications Commission (FCC) says it developed the national Registry working with the FTC, covering both interstate and intrastate telemarketing calls. So the FCC deserves real credit as a co-developer.

The division of labor looks like this:

• The FTC administers the Registry and enforces Do Not Call rules under the Telemarketing Sales Rule.
• The FCC enforces robocall, spoofing, and robotext rules under the TCPA — and calls stopping illegal robocalls its top consumer protection priority.
• When consumers want to report a Do Not Call violation, the FCC's own consumer guidance directs them to the FTC.

In short: two agencies, two enforcement lanes, one Registry — and the FTC is the one running it. The FTC also coordinates with the FCC, state attorneys general, and telecom providers, using complaint data to prioritize enforcement, and it releases a daily list of DNC and robocall complaints that analytics firms use to flag abusive calling patterns.

If your business runs outreach to past customers, knowing who enforces what is practical knowledge, not trivia. The stakes are real: the FTC has filed 173 lawsuits against 570 companies and 449 individuals since 2003, collecting nearly $400 million. Telemarketers must scrub their lists against the Registry every 31 days, and calls are restricted to 8 a.m.–9 p.m. local time under FCC guidelines.

At CallMyCustomers, we build every reactivation campaign around these rules — working only from lists of real customers, honoring opt-outs immediately, and getting every message approved by the business owner before it goes out. Knowing the FTC runs the Registry is step one; running compliant outreach is the rest.

What the Registry Covers — and the Exemptions That Matter to Your Business

Here's a detail that surprises most business owners: the National Do Not Call Registry contains phone numbers and nothing else. No names, no addresses, no record of whether a number is a landline or a mobile — just numbers, according to the FTC's own Registry topic page.

That simplicity matters for two reasons. First, the FTC frames the Registry as helpful to telemarketers too, since it screens out consumers who don't want contact. Second, being on the list doesn't mean a number is untouchable — several exemptions carve out legal room to call.

The Registry doesn't apply to every type of call. Political calls, legitimate survey calls, and charitable calls fall outside its scope — though telemarketers calling on behalf of charities are covered, a distinction worth remembering if you ever hire a fundraising vendor.

The exemption that matters most to service businesses is the established business relationship (EBR). Under FTC rules, a company may call a customer for up to 18 months after their last transaction, even if that customer's number sits on the Registry.

This is the rule that makes customer reactivation legal. If a past customer had their HVAC serviced, visited your clinic, or got their car repaired within the last 18 months, you can call them — registration on the DNC list doesn't block it. It's the foundation of permissioned reactivation, and it's exactly why CallMyCustomers works only from lists of real, past customers rather than cold data.

The EBR is not a blank check. A few obligations still apply in full:

• Internal opt-out requests must be honored indefinitely — one "don't call me" ends the exemption for that customer.
• Calling hours stay restricted to 8 a.m.–9 p.m. local time under FCC guidelines on telemarketing conduct.
• Telemarketers must scrub calling lists against the Registry every 31 days for any numbers without an exemption.
• State rules run in parallel — many states maintain their own DNC lists with stricter hours and separate penalties.

Pure business-to-business calls to clearly identified business lines are generally exempt from the Registry. But the exemption has real limits: personal mobile phones, home-based businesses, and mixed-use lines can all fall back under DNC protection, according to SalesHive's compliance glossary. If your "business contact" works from a home office on a personal cell, treat the call as covered.

The stakes for getting this wrong are steep. Violating calls can carry civil penalties up to $53,088 per call under the Telemarketing Sales Rule, and the FTC has collected nearly $400 million across 173 lawsuits since 2003, per its biennial report to Congress.

The practical takeaway: the Registry isn't a wall between you and your past customers — it's a set of rules that reward businesses calling people they actually know. Segment your list by recency, honor every opt-out immediately, and the 18-month window does the rest.

The Compliance Rules Every Outreach Campaign Must Follow

Knowing the FTC runs the National Do Not Call Registry is only half the picture — the other half is what the law actually requires of any business that picks up the phone to reach customers.

Under the FTC's Telemarketing Sales Rule and the TCPA, outreach campaigns carry a set of non-negotiable operational duties. The most fundamental is the 31-day scrubbing requirement: telemarketers must check their call lists against the Registry every 31 days and remove any registered numbers before dialing. Skipping even one scrub cycle can put a campaign out of compliance without anyone noticing until a complaint lands.

Beyond list hygiene, the rules cover how and when you call:

• Scrub every 31 days against the National Do Not Call Registry, which held more than 258 million phone numbers as of the end of FY 2025.
• Honor internal opt-out requests indefinitely — once a customer says "don't call me," that request never expires, even if they later fall off the federal list.
• Restrict calls to 8 a.m.–9 p.m. local time under FCC guidelines.
• Access the Registry and pay required fees for each area code you call, as the Telemarketing Sales Rule directs covered sellers to do.

The stakes are real. Under the TSR, a single violating call can carry a maximum civil penalty of $53,088, while TCPA violations run $500 to $1,500 each — higher if the conduct is deemed willful. Since 2003, the FTC has filed 173 lawsuits against 570 companies and 449 individuals, collecting nearly $400 million in penalties. As compliance research from ActiveProspect notes, even a handful of unresolved opt-out requests can snowball into costly legal exposure given that TCPA class action settlements averaged $6.6 million in 2024–2025.

There's also a state-level patchwork layered on top of federal rules. Many states maintain their own Do Not Call lists with separate registration requirements, and some impose stricter call windows — Florida, for example, restricts telemarketing calls to 8 a.m.–8 p.m. rather than the federal 9 p.m. cutoff. Penalties vary just as widely, from $500 per violation in Colorado to more than $25,000 in some states, with New York allowing fines up to $20,000 and Florida up to $10,000. Any business running outreach across state lines needs to check both the federal Registry and the rules in each state it dials.

The good news: the FTC itself frames the Registry as beneficial to legitimate businesses too, because it screens out consumers who don't want contact. That's the philosophy behind how CallMyCustomers runs reactivation campaigns — working only from lists of real customers, honoring opt-outs immediately, and following all calling and texting regulations. Compliance isn't a hurdle to reactivation; done right, it's what keeps the outreach welcome.

The Real Cost of Getting It Wrong: Penalties and Enforcement Trends

The numbers don't lie, and they're sobering. Since 2003, the FTC has filed 173 lawsuits against 570 companies and 449 individuals, collecting nearly $400 million in penalties. For businesses running outreach campaigns, the per-violation exposure is staggering: up to $53,088 per TSR-violating call, $500 to $1,500 per TCPA violation (higher if willful), and state fines that can reach $25,000 or more per incident. Class action settlements have averaged $6.6 million in recent years — a figure that turns a handful of unresolved opt-out requests into existential risk.

The enforcement landscape has shifted decisively toward the technology supply chain. The FTC's biennial report highlights that robocalls now dominate DNC complaints, surpassing live telemarketing, and the agency pursues VoIP providers, dialing platforms, and soundboard technology vendors alongside the callers themselves. To identify abusive patterns, the FTC releases a daily list of DNC and robocall complaints that analytics firms use to flag problematic traffic in real time. This means compliance isn't just about your own calls — it's about the platforms and partners you trust to deliver them.

• $53,088 maximum civil penalty per TSR-violating call
• $500–$1,500 per TCPA violation, trebled for willful conduct
• $25,000+ per violation in states like New Jersey and New York
• $6.6M average class action settlement (2024–2025)
• $400M+ collected by the FTC across 173 lawsuits since 2003

For service businesses reactivating past customers, the stakes are personal. CallMyCustomers works exclusively from lists of real customers with established business relationships — the very exemption the FTC recognizes for up to 18 months after the last transaction. But that exemption only holds when every other rule is followed: 31-day registry scrubs, immediate opt-out honoring, proper call hours, and consent-backed texting under A2P 10DLC. The FTC's own guidance notes the Registry helps legitimate businesses by screening out consumers who don't want contact. The flip side? Getting it wrong doesn't just risk fines — it erodes the trust that makes reactivation work in the first place.

How to Reconnect With Past Customers Without Touching a DNC Violation

The FTC has collected nearly $400 million from DNC violators since 2003 — a sobering number for any business owner who thinks "it's just a few calls to old customers." The good news? Reconnecting with past customers is one of the most compliant forms of outreach that exists, provided you follow a handful of clear rules.

The foundation is the established business relationship exemption. Under FTC rules, a company may call a customer for up to 18 months after their last transaction — meaning your HVAC client from last spring, the dental patient due for a cleaning, or the homeowner with an unaccepted quote are all fair game. That 18-month window is exactly why reactivation campaigns work: they target people who already know and trusted your business.

Compliance itself comes down to four practices:

• Work only from real customer lists — people you've actually transacted with, not purchased or scraped data.
• Capture explicit consent at booking, so every outreach has a permission trail behind it.
• Scrub your lists against the Registry every 31 days, as telemarketers are required to do.
• Honor opt-outs immediately — and keep honoring them indefinitely, since internal do-not-call requests never expire.

The stakes justify the discipline. Under the Telemarketing Sales Rule, penalties can reach $53,088 per violating call, and TCPA violations run $500 to $1,500 each — with class action settlements averaging $6.6 million in 2024–2025. As one compliance vendor puts it, even a handful of unresolved opt-out requests can snowball into costly legal exposure.

This is where a done-for-you approach earns its keep. CallMyCustomers runs reactivation campaigns only from a business's actual customer lists — CRM exports, spreadsheets, point-of-sale exports, exactly as they exist — and the owner approves every script, offer, and message before anything goes out. Opt-outs are honored immediately, and all calling and texting regulations are followed as standard practice, not as an afterthought.

Before any fee changes hands, a free list review shows the business what its list can actually produce: which customers fall inside the 18-month window, which old quotes deserve a fresh follow-up, and which memberships are about to lapse. Segmented outreach — by recency, by reason to reconnect — makes the message feel useful rather than pushy.

The FTC itself frames the Registry as a benefit to legitimate telemarketers: it screens out people who don't want contact, leaving a more receptive audience. For service businesses, the compliant path is also the profitable one. Your next booked customer already knows your business — reach them the right way, and one call is often all it takes.