Scrubbing a calling list against the US National Do Not Call Registry means dialling only from a registry snapshot obtained no more than 31 days before each call — the safe harbour in 16 CFR §310.4(b)(3)(iv). From 1 October 2026 the FTC charges US$85 per area code, US$23,425 for all of them, first five free.
That 31-day number is the whole problem. It was written for call centres that run discrete campaigns, download a list on Monday and burn it by Friday. An autonomous AI agent does not work that way: it dials continuously, across months, against a database that keeps growing as your CRM does. The Federal Trade Commission’s Telemarketing Sales Rule and the Federal Communications Commission’s rules at 47 CFR 64.1200 both turn on the age of the registry version at the moment of each individual call, which converts an annual procurement task into a scheduler invariant. This page is the US setup sequence. The Australian equivalent — a 30-day wash under the Do Not Call Register Act 2006, policed by the ACMA — is a different regime with different numbers, and we cover it separately in our guide to the Do Not Call Register and AI voice agents under ACMA enforcement.
One clarification before the fees: every dollar figure on this page is a US government access fee payable to the FTC’s registry operator. None of it is what any AI calling platform costs.
The seven-step setup, and what to do on day one
The finish state is specific, so work backwards from it: you are set up when a call physically cannot be placed unless three checks pass at dial time — the number is absent from a federal registry snapshot under 25 days old for that area code, absent from your own entity-specific do-not-call list, and inside the permitted calling window for the called party’s location — and when a query against your call logs can return, for any single call you made, the subscription account number and the download date of the registry version that cleared it. That last clause is the one teams skip, and it is the one §310.5(a)(11) makes a record-keeping obligation.
- Day one, before anything else: decide who the seller is. This determines everything downstream. The FTC’s own Q&A for telemarketers states that “a Telemarketer may not use Registry data to place calls on behalf of more than one Seller unless each Seller has its own subscription and a SAN”. If you are an agency, a reseller, or a platform dialling for several clients, you cannot buy the national list once and point every client’s agent at it. Each seller subscribes in its own name and gets its own Subscription Account Number; you may then access the registry using that seller’s SAN, and use the data only for that seller.
- Create the profile at telemarketing.donotcall.gov. You receive an Organization ID and two separate passwords: an Authorized Representative password with full access, and a Downloader password limited to downloading numbers and contacting the help desk. Give the automation the Downloader credential. Only one person can be logged in with either password at a time, which is itself a design constraint if you were planning parallel jobs.
- Subscribe to the exact area codes the agent will dial. Five or fewer are free, but processing is not instant and no SAN issues until it finishes. The FTC’s Q&A gives two figures: an order of five or fewer area codes takes up to one business day to process, and a first order of five or fewer takes up to three business days. Plan day one against the three. Payment method decides your start date: pay by credit card and the SAN issues immediately; pay by direct debit or electronic funds transfer and the FTC’s guidance sets a wait of up to three to five full business days before the SAN issues and downloads begin.
- Take the first full download, then switch to deltas. After the first access, the registry offers the option of downloading only the changes since your last access. Load the result as a dial-time blocklist, not as a one-off filter applied to a source list — the distinction matters because your source list keeps changing and the registry keeps changing independently of it.
- Stand up the entity-specific list before the first call, not after the first complaint. This is your own internal do-not-call list, and it is a separate legal object from the federal registry. For an AI agent it is also an intent-detection requirement: a caller saying “take me off your list” mid-sentence has to write a suppression record, which is why we treat mid-conversation opt-out handling in an AI agent as a platform feature rather than a script.
- Add the lists that are not the federal registry. State registries, wireless numbers, and any suppression your client hands you. See the four-list table below.
- Set the scheduler, then prove it. Weekly download, 25-day dial block, and a log line per call carrying the SAN and the snapshot date. The arithmetic behind those two numbers is in the next section but one.
FY 2027 registry fees and the 1 October 2026 change
The FTC announced the new schedule on 26 August 2026. In its words: “The new fees will go into effect on October 1, 2026.” The Commission vote authorising publication of the Federal Register notice was 2–0. Note the structure — there is no fee to check a handful of area codes, and the cost curve only bites when an agent dials nationally.
| Access tier | FY 2027 fee (from 1 Oct 2026) | FTC’s stated change from FY 2026 | Operational note |
|---|---|---|---|
| First five area codes in a subscription | US$0 | Unchanged — “The first five area codes are free to download” | Still requires a subscription, a certification and a SAN |
| Each area code beyond the first five, full year | US$85 | “an increase of $3 from FY 2026” | Priced per area code, not per number or per call |
| All area codes nationwide (maximum charge to any single entity) | US$23,425 | Up from US$22,626 | The realistic figure for a national outbound agent |
| Additional area code added during the second six months | US$43 | Up from US$41 | Does not extend the annual subscription period |
| Exempt organisations (the FTC names “some charities and political callers”) | US$0 for the entire list | — | A three-day waiting period before the SAN issues, beginning the next business day after the profile is created |
| Interactive look-up, “10 or less” numbers at a time | Included once subscribed and any fee paid | — | Built for low-volume callers; useless for an autonomous dialler |
| Renewal cadence | Annual | — | “Telemarketers must subscribe each year for access to the Registry numbers” |
Coverage is wider than the fifty states: the FTC states the registry’s area codes cover the 50 states, the District of Columbia, Puerto Rico, the US Virgin Islands, Guam, the Northern Mariana Islands, American Samoa, and toll-free numbers in 500, 800, 866, 877, 880, 881, 882 and 888. If your agent dials toll-free numbers as part of a campaign, those are in scope.
Two traps sit inside the fee structure. The first is area-code splits: when a densely populated area code splits, you must subscribe to the new one, and pay for it if it takes you past your five no-cost area codes — unless you already hold the global list, in which case the FTC states there is no charge for it. The second is more expensive. The FTC’s guidance is explicit that it is against the law for a seller to call any person whose number is within a given area code “unless the seller first has subscribed to and accessed the portion of the registry that includes numbers within that area code, and paid the annual fee, if required” — and that is true even for numbers that are not on the registry. An agent that dials a number nobody ever registered, in an area code you never subscribed to, is still in breach.
The 7/25/31 rule: safe-harbour arithmetic for an agent that never stops dialling
The safe harbour at 16 CFR §310.4(b)(3) is what stands between an inadvertent call and a penalty. Six conditions have to hold as part of a routine business practice, and the fourth is the one with a clock in it. It requires the seller or telemarketer to use a process to prevent telemarketing to any listed number, employing a version of the registry “obtained from the Commission no more than thirty-one (31) days prior to the date any call is made”, and to maintain “records documenting this process”. The FCC imposes the same 31-day condition in its own safe harbour at 47 CFR 64.1200(c)(2)(i)(D), and the FTC restates it plainly for operators: “If you are required to use the registry, you must synchronize your lists with an updated version of the registry at least every 31 days.”
Now the arithmetic, worked. Take an agent dialling area code 312 continuously. You download on 1 March. That snapshot protects calls made through 1 April — 31 days later — and not one call after it. A tidy monthly cadence pinned to the first of the month therefore lands exactly on the cliff edge in the seven months that have 31 days (March, May, July, August, October, December, January), clears it by a single day in April, June, September and November, and by three days in a 28-day February (two in a leap year). Steady state, that schedule has zero days of failure budget for more than half the year.
Then add the download cap. The registry permits a download “only once in any 24-hour period”, so a failed run costs a full calendar day and there is no same-day retry. Lock the account — five failed logins in a 15-minute window does it — and recovery runs through an email to the help desk, at human speed. Budget five days for retries and lockout recovery, plus one day for ingest and propagation into suppression, and the working ceiling is 31 − 6 = 25 days. Download weekly and steady-state snapshot age never exceeds 7 days, which absorbs three consecutive failed weekly runs (21 days) before the block trips on the fourth.
That is the rule, and it is worth naming because it is the thing to hand an engineer: scrub every 7 days, block dialling on any area code whose snapshot exceeds 25 days, because the statute dies at 31.
Be clear about which part of that is law. Only the 31 is a regulatory limit. The 7 and the 25 are ours — an operational margin we derived from the FTC’s own published constraints (one download per 24 hours, lockout recovery by help-desk email) and nothing more. No regulator requires a weekly scrub or a 25-day hard block, and an operator who downloads on day 30 every month and never misses a run is inside §310.4(b)(3)(iv) without any of this. The margin exists because scheduled jobs fail, and because the penalty for discovering that on day 32 is the loss of the safe harbour for every call in between.
| Age of the registry snapshot for an area code | What the scheduler does | Why |
|---|---|---|
| 0–6 days | Dial normally | Steady state under a weekly cadence |
| 7 days | Delta download runs; snapshot replaced; SAN and access date written to the log | §310.5(a)(11) requires the entity name, access date, SAN and campaign to be recorded |
| 14 days | Alert — two cycles missed | Half the failure budget consumed |
| 21 days | Page the on-call engineer; stop adding new numbers to the dialling queue | The 25-day block trips on day 26, before the next weekly cycle would run |
| Over 25 days | Hard-block outbound dialling for that area code | Reserves 5 retry days plus 1 ingest day against the 31-day limit |
| Over 31 days | Safe harbour under §310.4(b)(3)(iv) is unavailable for every call made | The regulation’s own ceiling |
Two things this table deliberately does not do. It does not treat the scrub as a property of a list — it is a property of an area code snapshot, because that is the unit the registry is sold and downloaded in. And it does not let a stale area code block the whole campaign; the agent keeps dialling everywhere its data is fresh. Continuous dialling is the reason both distinctions matter, and it is the reason a compliance model designed around campaign start dates quietly stops working.
The retention periods are longer than the scrub window, and they are separate
The 31-day clock governs freshness. Three other clocks govern memory, and they run far longer. Conflating them is the most common way an otherwise well-run agent creates liability.
- Federal registry entries never expire. 47 CFR 64.1200(c)(2) states that “Such do-not-call registrations must be honored indefinitely, or until the registration is cancelled by the consumer or the telephone number is removed by the database administrator.” A number cleared in 2011 is not cleared today.
- An entity-specific request must be recorded at the time it is made, and honoured within ten business days. Under 47 CFR 64.1200(d)(3), the request must be recorded when made and honoured within a reasonable time, and “This period may not exceed ten (10) business days from the receipt of such request.” For an AI agent that captures the request in a transcript, ten business days is generous; the practical target is the next dial cycle.
- An entity-specific request runs five years. 47 CFR 64.1200(d)(6) is unambiguous: “A do-not-call request must be honored for 5 years from the time the request is made.” Note that the TSR’s own prohibition at §310.4(b)(1)(iii)(A) states no expiry on its face, so five years is a floor rather than a licence to resume dialling in year six. Treat internal suppression as permanent and you never have to argue the point.
- The records themselves run five years. §310.5(a) requires sellers and telemarketers to keep the listed records “for a period of 5 years from the date the record is produced unless specified otherwise”. Two entries matter here: §310.5(a)(10), the record of each person who asked not to be called — name, telephone numbers, which seller, which telemarketer called, the date of the request and what was being sold — and §310.5(a)(11), the record of which version of the registry was used, including the entity that accessed it, the access date, the SAN and the campaign.
Read §310.5(a)(11) alongside §310.4(b)(3)(iv) and the design consequence is unavoidable: the safe harbour is not a fact about your data, it is a fact you have to be able to evidence for an individual call placed on an individual day. If your call detail records cannot join to a registry access record, you have a compliant process and no defence. That is the same evidentiary logic we set out in our note on compliance architecture for AI sales agents in regulated industries: the log is the control.
The exemptions, and the four things they do not cover
The exemptions are real, and they are narrower than the summaries suggest. 16 CFR §310.6(b)(7) exempts telephone calls between a telemarketer and a business to induce the business to buy goods or services — but that exemption expressly does not reach §310.3(a)(2) and (4), the misrepresentation prohibitions, and does not reach calls inducing the retail sale of nondurable office or cleaning supplies. Charitable solicitations by outbound call are carved out of the registry prohibition specifically, by §310.6(a). And there are two routes past the registry itself, in §310.4(b)(1)(iii)(B): an express written agreement that names the party permitted to call, includes the telephone number and carries the person’s signature; or an established business relationship where that person has not separately asked you to stop.
The FCC defines that relationship with two clocks in 47 CFR 64.1200(f)(5): eighteen months from the subscriber’s purchase or transaction, or three months from an inquiry or application. Both expire silently. If your agent is dialling bought data rather than your own relationships, none of this helps you — see our analysis of purchased lead lists, AI voice agents and TCPA consent.
Here is what an exemption or a consent never buys you:
- Not the internal list. An established business relationship is defeated by an entity-specific request. Consent to the registry rule is not consent to be called after saying stop.
- Not the calling hours. §310.4(c) prohibits outbound calls to a residence “at any time other than between 8:00 a.m. and 9:00 p.m. local time at the called person’s location” without prior consent. Local time at their location, not your data centre’s.
- Not the abandonment rule. A call is abandoned if a person answers and the telemarketer does not connect it to a sales representative “within two (2) seconds of the person’s completed greeting”. The corresponding safe harbour at §310.4(b)(4)(i) permits abandonment of “no more than three (3) percent of all calls answered by a person, measured over the duration of a single calling campaign, if less than 30 days, or separately over each successive 30-day period or portion thereof that the campaign continues”. For an always-on agent, read that as a rolling 30-day measurement window — the same shape of problem as the 31-day scrub.
- Not the subscription. As above: the seller must have subscribed to and accessed the area code before any call into it, registered number or not.
Worth stating plainly: the Telemarketing Sales Rule applies to calls made as part of “a plan, program, or campaign which is conducted to induce the purchase of goods or services”. The test is the purpose of the call. Nothing in it turns on whether a human or a model is speaking, which is why an autonomous agent inherits the entire rule set unchanged.
Federal DNC is one of at least four lists
Clearing the national registry clears one list. An operator dialling US numbers has to clear several, and they refresh on different clocks.
| List | Who maintains it | The clock that governs it | Where to get it |
|---|---|---|---|
| National Do Not Call Registry | FTC | Snapshot no older than 31 days at the time of each call; registrations honoured indefinitely | telemarketing.donotcall.gov, per area code |
| Entity-specific (internal) do-not-call list | You | Recorded when made, honoured within 10 business days, honoured 5 years, records kept 5 years | Your own systems — it is built from your own calls, not bought in |
| State registries | Individual state agencies | Varies by state; several use fixed quarterly effective dates rather than a rolling window | The state agency — e.g. FDACS in Florida, the Public Utility Commission’s lists in Texas |
| Wireless numbers | FCC rules, not a list | 47 CFR 64.1200(a)(1)(iii) and (a)(2) restrict autodialled and artificial or prerecorded telemarketing to wireless numbers; 64.1200(e) applies the paragraph (c) and (d) rules to wireless numbers to the extent described in the Commission’s Report and Order in CG Docket No. 02-278 | Carrier/line-type lookup at dial time |
We are not going to publish a fifty-state table, because a stale one is worse than none — verify the states you actually dial, at the state’s own agency, before you dial them. Two verified examples show how differently they behave. Florida runs its list through the Department of Agriculture and Consumer Services under section 501.059 of the Florida Statutes; FDACS states it is free to subscribe and “the number remains on the list indefinitely”. Texas runs two Public Utility Commission–sponsored lists: a statewide Do Not Call list open to residential and wireless numbers but not business numbers, and a separate Electric No Call list for business numbers, which applies to retail electric providers. Texas also publishes fixed compliance dates rather than a rolling window — a number registered between 1 January and 31 March must stop receiving calls by 1 June, with equivalent quarterly cut-offs through the year. A scheduler built purely around a 31-day rolling scrub will satisfy the federal rule and miss the Texas cut-over entirely.
The design principle Zian builds its outbound agents around is that suppression state and the calling-window check belong in the platform layer, evaluated at dial time, rather than in a script an author can forget to update. If you are assessing any AI calling vendor — us included — the useful question is not whether they “support DNC”. It is to ask them to walk you through each row of the threshold table above, and to show you the log line that an individual call record joins to.
Zian AI is in a partnership-application beta.
FAQ
How often does an AI dialler have to re-scrub against the National Do Not Call Registry?
Every 31 days at the absolute latest, measured against each individual call rather than against a campaign. 16 CFR §310.4(b)(3)(iv) conditions the safe harbour on employing a version of the registry obtained from the Commission no more than thirty-one (31) days prior to the date any call is made, and on maintaining records documenting the process. Because an agent dialling continuously has no campaign boundary to hang a scrub on, we run it weekly and hard-block any area code whose snapshot passes 25 days.
How much does access to the National Do Not Call Registry cost in FY 2027?
US$85 per area code, US$23,425 as the maximum charge to any single entity for all area codes nationwide, and US$43 to add an area code during the second six months of a subscription. The first five area codes in a subscription are free. The FTC announced the schedule on 26 August 2026 and stated that the new fees go into effect on October 1, 2026. These are government access fees, not the cost of a calling platform.
Do I need to subscribe if I am only calling numbers that are not on the registry?
Yes. The FTC’s guidance for telemarketers and sellers states that a seller may not call any person whose number is within a given area code unless the seller first has subscribed to and accessed the portion of the registry covering that area code and paid the annual fee, if required. That applies to unregistered numbers too. Penalties are assessed per violation, and each call may count as a separate violation; the current maximum civil penalty amount under section 5(m)(1)(A) of the FTC Act is US$53,088 at 16 CFR §1.98, applying to penalties assessed after 17 January 2025.
How long do I have to keep an internal do-not-call request?
The request must be honoured for five years from the time it is made under 47 CFR 64.1200(d)(6), and must be recorded when made and honoured within a period that may not exceed ten business days under 64.1200(d)(3). Separately, 16 CFR §310.5(a) requires the underlying records to be kept for five years from the date the record is produced unless specified otherwise. The TSR’s own prohibition on calling someone who has asked you to stop states no expiry, so five years is a floor.
Does the business-to-business exemption mean an AI agent can skip the scrub for business numbers?
Not safely. 16 CFR §310.6(b)(7) exempts calls between a telemarketer and a business to induce a purchase by that business, but it does not reach the misrepresentation prohibitions in §310.3(a)(2) and (4), and it does not reach calls inducing the retail sale of nondurable office or cleaning supplies. It also does nothing about state law or line type: Texas, for instance, runs a separate Electric No Call list specifically for business numbers, and sole traders routinely register the mobile they answer for work.
Is the US 31-day rule the same as Australia’s 30-day wash?
No, and running one process for both will fail. The Australian safe harbour under the Do Not Call Register Act 2006 runs on a 30-day window ending on the day of the call, express consent that is not expressed to be for a specified or an indefinite period is taken to be withdrawn after three months under Schedule 2, clause 3, and the permitted calling hours and identification duties come from a separate ACMA industry standard. The US regime has a 31-day window, an 8:00 a.m. to 9:00 p.m. local-time restriction, an eighteen-month established business relationship, and a per-area-code subscription that has to be held in the seller’s own name.
Sources and verification
| Claim | Owner | Verified at |
|---|---|---|
| FY 2027 fees: US$85 per area code, US$23,425 maximum, US$43 half-year additional, first five free, exempt organisations free; effective 1 October 2026; Commission vote 2–0 | Federal Trade Commission | FTC press release, 26 August 2026; corroborated at telemarketing.donotcall.gov |
| 31-day safe-harbour condition; abandonment at two seconds; 3% abandonment safe harbour; 8:00 a.m.–9:00 p.m. calling hours; express written agreement and established business relationship exceptions | FTC, Telemarketing Sales Rule | 16 CFR §310.4 (eCFR, title 16 current to 3 September 2026) |
| Five-year record retention; the entity-specific request record; the record of which registry version was used, with entity, date, SAN and campaign | FTC, Telemarketing Sales Rule | 16 CFR §310.5 |
| B2B exemption and its carve-outs; charitable solicitation carve-out | FTC, Telemarketing Sales Rule | 16 CFR §310.6 |
| Registrations honoured indefinitely; FCC 31-day safe harbour; ten-business-day honouring period; five-year entity-specific period; 18-month/3-month established business relationship; wireless application | Federal Communications Commission | 47 CFR 64.1200 |
| Synchronise at least every 31 days; download once per 24 hours; one SAN per seller; area-code coverage including toll-free; credit card versus EFT access timing; interactive look-up of 10 or fewer numbers; subscription and access required before calling into an area code; US$53,088 per violation | FTC business guidance | Q&A for Telemarketers & Sellers About DNC Provisions in TSR |
| Current maximum civil penalty amount of US$53,088 | FTC | 16 CFR §1.98 |
| Florida list free and indefinite, under Fla. Stat. §501.059 | Florida Department of Agriculture and Consumer Services | FDACS Florida Do Not Call |
| Texas statewide Do Not Call list covers residential and wireless but not business numbers; separate Electric No Call list for business numbers; quarterly compliance dates | Texas Public Utility Commission | texasnocall.com |
All sources opened and checked on 8 September 2026.