What Is TCPA Safe Harbor? Practices That Support a Defense

2 minutes ago

12 min read

A safe harbor is a defense, not blanket permission to call. If you’re asking “what is TCPA safe harbor?”, it’s a limited defense for certain Do Not Call violations when a business can show reasonable prevention practices and due care. According to the Federal Communications Commission, telemarketers must check the National Do Not Call Registry and scrub registered numbers at least once every 31 days.

That distinction matters: a well-maintained compliance process may support a defense when a number is contacted by mistake, but it does not protect against every TCPA claim. Businesses need more than a written policy. They need practices staff follow and records showing how those practices work.

This article explains which policies, training, internal do-not-call procedures, and timing may support a safe harbor defense. It also explains where that defense ends, including the difference between Do Not Call violations and claims involving autodialed or prerecorded calls. You’ll learn which safeguards can help organizations communicate responsibly and document their efforts.

Reasonable practices and procedures for preventing telephone solicitations

A TCPA safe harbor defense depends on reasonable prevention procedures and due care, not just a policy on paper. Written rules, trained staff, current suppression lists, and records help show how a business prevents and addresses mistakes.

For practical guidance, watch this overview of written policies and internal procedures:

Reasonable Prevention Procedures

Reasonable prevention procedures are written, implemented processes designed to prevent telephone solicitations that violate do-not-call rules. Under 47 U.S.C. § 227(c)(5), a business may assert a defense by establishing and implementing reasonable practices with due care. The safe harbor provision matters because it can address an erroneous call within routine business practice, if the required standards are met.

Make the policy operational. Assign responsibility for checking lists, training callers, and reviewing compliance; document each activity. The Federal Communications Commission requires telemarketing lists to be scrubbed against the National Do Not Call Registry at least once every 31 days. Keep dated records of each scrub so the business can show when the process occurred.

Training should show staff how to identify restricted numbers, record consumer preferences, and pause outreach when list status is unclear. Provide onboarding instruction, annual refreshers, and additional training when rules or internal procedures change. A test before an employee makes calls can also document understanding. Keep training logs, policy versions, audit findings, and corrective actions together.

Handling Opt-Out Requests

Processing an opt-out means capturing a consumer’s request, adding the number to the relevant internal do-not-call list, and suppressing it from future covered solicitations. The Federal Communications Commission says companies must honor subscribers’ do-not-call requests within a reasonable time, not exceeding 30 days. Prompt, consistent handling reduces the risk of another call becoming a fresh mistake.

Requests can arrive through different channels, use unclear wording, or get delayed between teams. A single intake process helps: record the number and request, route it to the person responsible for suppression, update the list, and retain a timestamped record. Train telephone and messaging staff to recognize opt-outs and escalate them without disputing the consumer’s intent.

Keep internal do-not-call numbers for at least five years, and review suppression controls before launching a campaign. Sync internal lists with registry updates, then test that excluded numbers stay out of calling files. If an audit finds a number was contacted after an opt-out, stop further outreach, investigate the cause, correct the list or workflow, and document the response. These records help show whether written procedures worked in practice.

TCPA restrictions on autodialed and prerecorded calls

The Do Not Call safe harbor addresses mistaken solicitations, not every TCPA claim; it does not protect against alleged autodialer, artificial-voice, or prerecorded-call violations. Unlike that specific safe harbor, a bona fide error argument focuses on whether an unintentional mistake occurred despite reasonable procedures; neither label automatically defeats a claim. Without a defense, TCPA damages may range from $500 to $1,500 per violation, depending on severity and intent.

Mistaken-Call Safe Harbor and Bona Fide Error Defense

The Do Not Call safe harbor is a defense for certain erroneous calls when a business establishes and implements reasonable procedures with due care. A written process and records can help show that the error occurred despite routine compliance, rather than because the business failed to prevent violations.

A bona fide error is an inadvertent mistake, but it does not replace the safe-harbor requirements. In Johansen v. eFinancial, LLC, the court found that compliance materials provided significant evidence of routine TCPA procedures. If a consumer says they never requested contact, preserve the relevant lead record, consent evidence, and call history to show what the business understood when it called.

Reassigned-Number Safe Harbor Rules

A reassigned-number safe harbor concerns calls to a number that has moved to a new subscriber after the caller obtained consent from its prior user. The FCC’s reassigned-number database became available in November 2021, giving callers a means to check reassignment information before relying on outdated consent records.

Keep the number checked, query result, and date associated with the relevant campaign record. Do not confuse it with the former one-call safe harbor: the FCC established that protection in 2015, and the D.C. Circuit struck it down in 2018.

Safe Harbor Limits and Exceptions

Safe-harbor protection is limited to the violation and compliance process it addresses. It does not erase separate consent requirements. For example, a business may have Do Not Call procedures yet still face a claim about an autodialed or prerecorded call to a wireless number.

For calls to numbers on the National Do Not Call Registry, prior express written consent can provide an exception under 47 C.F.R. § 64.1200(c)(2)(ii). Keep the consent record tied to the called party and the specific outreach. A registry scrub or database check cannot replace consent where a separate TCPA rule requires it.

Penalties and Damages Outside the Safe Harbor

When a business does not qualify for a defense, alleged TCPA violations can expose it to statutory damages ranging from $500 to $1,500 per violation, depending on severity and intent. Each challenged call or text may matter, so a documented review of the campaign, recipient records, and contact method is important.

Investigate promptly: preserve call logs, list versions, consent records, and training materials; identify how the number entered the campaign; then correct the process that allowed contact. For teams planning telephone outreach, review communication options alongside a separate compliance review.

Current 30-day safe-harbor period

The 30-day period concerns how quickly businesses must honor subscribers’ do-not-call requests. It is separate from the National Do Not Call Registry scrubbing schedule, which governs list freshness before telemarketing. Treating these as two distinct controls helps prevent an outdated list or delayed opt-out from reaching a calling campaign.

According to the Federal Communications Commission, companies must honor subscribers’ do-not-call requests within a reasonable time, not exceeding 30 days. That limit sets an outside boundary, not a recommended waiting period. A business should process a request promptly, then confirm the affected number no longer appears in calling files. The request’s arrival date, processing timestamp, and suppression result help document the timeline.

Registry screening follows a different clock. According to the Federal Communications Commission, businesses seeking the DNC safe harbor must scrub telemarketing call lists against the National Do Not Call Registry at least once every 31 days. The FCC rule also requires access to the registry and removal of registered numbers no more than 31 days before a telemarketing call. A recent scrub does not excuse ignoring a direct opt-out received afterward.

Build policies around both timelines. If a consumer opts out after a list has been screened, for example, route the request to the suppression process immediately. Don’t wait for the next registry refresh. Before calling, use a list version reflecting the latest internal do-not-call records and a sufficiently recent registry check. Keep dated copies or logs showing which numbers were removed and when.

Requests may arrive by telephone, text, email, or through another team, creating operational delays. A shared intake process helps each channel reach the people who update suppression records. Record the consumer’s number, request date, source, and action taken. If the number is already in a campaign file, stop further calling and remove it from queued outreach before the next call attempt.

The 30-day rule should not become a routine processing target. A prompt workflow lowers the chance that a request sits unaddressed while another campaign begins. Assign ownership, monitor unresolved requests, and escalate records approaching the federal limit. During an audit, compare request logs with campaign files to identify processing gaps and correct them. Document the correction and the process change, such as improving routing between intake staff and list managers.

These periods address different compliance questions: whether a registered number was screened recently, and whether a direct request was honored within the required time. Tracking both dates helps a business explain its calling decisions with records, rather than relying on memory or a general policy statement.

How do FCC rules define a reassigned phone number for TCPA safe harbor purposes?

A phone number can change hands while a business still has consent from its former user. A later call or text may then reach a new subscriber who never agreed to receive it. The FCC’s Reassigned Numbers Database helps callers check whether numbers have been reassigned before relying on older contact records.

Consent applies to the called party, not the phone number alone. A business cannot assume that permission from a former subscriber automatically covers whoever later receives that number. For example, if a customer disconnects a mobile number and another person receives it, the old consent record may not establish permission from the new recipient.

The FCC established a one-call safe harbor for reassigned numbers in 2015. In 2018, the D.C. Circuit struck down that former protection. Its removal matters: callers should not treat a single mistaken call as a general allowance to contact numbers that may have changed subscribers.

The Reassigned Numbers Database safe harbor became valid with the database’s implementation in November 2021. Callers can claim this safe harbor if they scrub their number lists against the FCC database within 30 days. This gives businesses a way to check for reassignment before calling, rather than relying only on the age or apparent accuracy of a consent record.

A defensible process links the database check to the actual calling list. Keep records identifying the numbers checked, the check date, the result, and the campaign using those numbers. If a number appears in several campaigns, link the result to each relevant list version. This helps show which information informed the decision to call.

For example, a business preparing a campaign may compare its contact file with the FCC database, remove numbers identified as reassigned, and preserve the screening record. If a consumer later reports receiving a call intended for a prior subscriber, the business can review the list, consent record, and database result together. This may show whether the issue arose from reassignment, outdated data, or a missed screening step.

The database check addresses reassignment risk. It does not create consent or replace other TCPA requirements. Treat the result as one part of the caller’s compliance record, alongside the source and scope of permission and any later opt-out. Keeping these records separate helps distinguish a number-change issue from a separate consent or do-not-call concern.

Assign responsibility for screening numbers, retain dated results, and refresh checks before relying on older records for campaigns. These steps make reassignment reviews traceable and help explain why a number remained on a calling list.

What are the limits and exceptions to the TCPA safe harbor?

A Do Not Call safe harbor is narrow, not blanket immunity from TCPA claims. It concerns certain violations involving telephone solicitations and does not resolve separate questions about consent, calling technology, or the recipient’s request. A business may, for example, maintain strong registry-screening procedures yet still face a claim about an autodialed or prerecorded call.

The distinction matters because each claim depends on the conduct and rule at issue. The Do Not Call safe harbor does not protect businesses against claims based on alleged autodialer, prerecorded, or artificial-voice violations. A registry scrub cannot replace consent required for a different type of call, and a consent record does not excuse ignoring a direct do-not-call request.

For calls to a number on the National Do Not Call Registry, 47 C.F.R. § 64.1200(c)(2)(ii) provides an exception where the business obtains prior express written consent signed by the recipient. Keep the record connected to the person and the specific outreach. Under the E-SIGN Act, 15 U.S.C. § 7001(c)(1), consent must clearly disclose the right to withdraw, the transaction’s scope, and withdrawal procedures.

Electronic records can qualify. The E-SIGN Act, 15 U.S.C. § 7001(a), says a signature, contract, or record cannot be denied legal effect solely because it is electronic. The FCC’s 2012 Report and Order recognized methods such as website forms, email, text messages, telephone key presses, and voice recordings when they comply with the E-SIGN Act. Preserve the exact consent language and the record showing how the consumer agreed.

Separate restrictions apply to technology and call content. TCPA rules require prior express written consent for calls to mobile phones using an Automatic Telephone Dialing System, according to the listed research facts. FCC regulations prohibit telemarketing calls using an artificial or prerecorded voice without the recipient’s consent. A defense based on do-not-call procedures does not establish whether these separate requirements were met.

Some rules include defined exceptions, but they do not make all outreach permissible. A business relationship may provide an exception to a consent requirement described in the TCPA rules, but the scope and type of call still matter. Review the recipient’s status, consent language, calling method, and purpose before applying an exception. Keep separate records for registry screening and consent so one does not stand in for the other.

For organizations coordinating telephone outreach, plan your calling outreach alongside clear consent and suppression controls. Matching the communication method to the applicable requirements helps teams avoid treating one safe harbor as a defense to every TCPA issue.

Calls-Are-Us: Voice Broadcast

Calls-Are-Us offers Voice Broadcast for organizations planning telephone outreach. Clear communication workflows can help teams coordinate messages, while TCPA compliance still depends on consent, do-not-call controls, and the nature of each call.

For campaigns that need individual interaction, Peer-to-peer texting and a Live Calling Center offer additional communication options. Mass Texting can support broader message distribution. Each approach requires its own audience permissions and suppression processes, so align the channel with your outreach goals and compliance procedures.

Calls-Are-Us supports communication operations, but no outreach service replaces legal review or creates a safe-harbor defense on its own. Contact Calls-Are-Us to discuss the communication approach that fits your organization’s needs.

Make your next outreach plan more intentional

Understanding what TCPA safe harbor means is a starting point, not a complete compliance strategy. Build communication processes that make responsible contact part of campaign planning, rather than a last-minute review. Assign clear ownership, keep decisions traceable, and match each outreach channel to its purpose and audience.

Calls-Are-Us offers Voice Broadcast, Peer-to-peer texting, and Mass Texting for different outreach needs. Choose a channel alongside a review of audience permissions and internal contact controls. These options support outreach operations, but they do not replace your organization’s compliance policies or legal guidance.

As you prepare a campaign, consider where clearer workflows could help your team communicate with greater care and consistency. Contact Calls-Are-Us about your communication needs and explore an approach that fits your organization. Thoughtful planning can help you build stronger, more respectful connections with the people you want to reach.

Frequently Asked Questions

What can businesses do to demonstrate a viable safe harbor defense?

Show that compliance procedures worked in practice, not merely that a policy existed. For example, connect a campaign’s calling file to its screening record, employee training materials, and documented response to any complaint. A dated audit can explain how a number entered the file and what the business changed after finding an error. This evidence helps establish whether reasonable prevention efforts were part of routine operations.

What is the TCPA safe harbor?

The TCPA safe harbor is a limited defense for certain mistaken telephone solicitations that violate Do Not Call rules. Under 47 U.S.C. § 227(c)(5), a business may rely on it by establishing and implementing reasonable procedures with due care to prevent violations. It does not create blanket protection from TCPA liability. The specific conduct, the applicable rule, and the business’s actual compliance practices all matter.

What are the requirements for the TCPA safe harbor defense?

Under 47 C.F.R. § 64.1200(c)(2)(i)(A)-(E), businesses need reasonable prevention procedures and due care. Practical measures include written do-not-call policies, employee instruction, an internal suppression list, and procedures that prevent contact with restricted numbers. Keep evidence showing how these controls work, such as training records, list-screening logs, and reviews of calling activity. A written policy alone does not show that staff followed it.

Does the TCPA safe harbor apply to autodialed calls, texts, or prerecorded messages?

No. The Do Not Call safe harbor does not defend claims alleging unlawful autodialed, artificial-voice, or prerecorded calls. Separate consent requirements may apply, including prior express written consent for calls to mobile phones using an Automatic Telephone Dialing System. Telemarketing texts can also raise Do Not Call concerns. Assess the contact method and alleged violation separately, rather than treating one safe-harbor defense as protection for every call or message.

What records should businesses keep to document TCPA consent and compliance?

Keep consent records showing the recipient, the language presented, the signature or electronic method, and the outreach covered. Preserve dated registry-screening results, campaign list versions, opt-out records, employee training logs, written policy updates, and audit findings. These materials can help reconstruct why a number was contacted and whether a mistake was corrected. Telemarketing businesses must retain numbers on internal Do Not Call lists for at least five years.