TCPA Recordkeeping Requirements: What to Retain

Written by: Matt Beucler, CEO, Plura AI

Key Takeaways

• TCPA and TSR rules require operators to retain records on prior express written consent, internal DNC logs, call and text disposition, promotional materials, and revocation handling for at least five years.
• Consent records must capture the consumer’s name, phone number, consent language, opt-in date and time, source channel, brand, and verification details such as IP address.
• Internal DNC lists must be updated against the National Registry at least every 31 days, and scrub receipts should be retained as part of the audit trail.
• Call and text logs must document every contact attempt with timestamps, duration, and time-zone validation to show compliance with quiet-hours restrictions.
• Plura AI automates these requirements through real-time DNC scrubbing, an immutable consent ledger, and one-click audit exports, and you can see this workflow in a live demo.

TCPA Record Retention Timelines for Telemarketers

16 CFR § 310.5 establishes a five-year retention floor for telemarketing records.² The FTC’s compliance guidance for the TSR confirms that this framework covers consent records, DNC logs, advertising materials, and call detail records.

Some states require retention periods of up to 2 years, and many high-volume operators keep records longer as a risk-management practice. The four-year federal statute of limitations under the TCPA can create disputes about when the clock starts. Operators running multi-state campaigns should work with qualified counsel to identify any state-specific retention obligations that exceed the federal floor.

Five Record Categories That Matter for TCPA and TSR

TCPA and TSR frameworks focus on five core record categories. Each category has its own required elements and audit expectations.

1. Prior express written consent. A complete consent record includes the consumer’s name and phone number, a copy of the consent language as presented, the purpose for which consent was given, the date and time of opt-in, and the source or channel, such as web form URL, IVR path, or keyword reply. The record should also identify the specific brand named in the consent language and include verification details such as IP address or device identifier. The E-SIGN Act permits consent agreements and consumer signatures to be collected digitally.
2. Internal DNC logs. Every outbound-calling organization maintains an internal DNC list with numbers from consumers who requested not to be called, opt-out requests from any channel, and timestamped records showing when each request was received. Contact lists must be updated against the National Do Not Call Registry at least every 31 days, and scrub receipts should be retained as part of required DNC recordkeeping.
3. Call and text disposition logs. Call detail records capture the number dialed, date, time, and duration of each contact attempt. Logs must also be detailed enough to show compliance with time-of-day restrictions, such as 8:00 a.m. to 9:00 p.m. in the consumer’s time zone, and to validate dialing-system time-zone logic. For SMS campaigns, operators should retain message content sent to each subscriber, delivery timestamps, campaign identifiers, and phone number delivery logs for at least two to three years.
4. Promotional materials and scripts. Under the TSR as amended in 2024, sellers and telemarketers must retain telemarketing scripts, prerecorded messages, and promotional materials for five years after they are no longer used.
5. Revocation handling records. TCPA regulations describe how businesses should process SMS opt-out requests, such as replies containing “STOP,” within defined timeframes and restrict further promotional messages after an opt-out is received. Opt-out records should include the timestamp of any STOP message or opt-out request, the processing timestamp when the number was removed from the active list, suppression list entry confirmation, any re-opt-in requests with new consent documentation, and complaint records tied to post-opt-out messages.

See how Plura handles these five record categories in a live campaign environment.

How Plura Compliance Engine Supports Recordkeeping

Plura AI’s compliance engine operates as a core layer of the platform, not a bolt-on feature. Every outbound contact is checked against federal and state DNC registries in real time before dial, using integration with The Blacklist Alliance’s TCPA Litigation Firewall for real-time DNC scrubbing and litigation protection.⁴ The platform blocks non-compliant numbers before the first attempt. Consent records are timestamped, stored in an immutable ledger, and retrievable on demand. Quiet-hours rules apply automatically through time-zone detection, using state and federal calling-window restrictions on every campaign.

The platform’s compliance framework starts with SOC 2 compliant infrastructure that establishes baseline security controls.¹ On that foundation, TCPA compliance and SHAKEN/STIR caller ID verification enforcement help outbound contacts align with federal calling standards, while DNC compliance screening and Number Verifier protect caller ID reputation.¹ For operators handling protected health information, HIPAA-aligned encryption, access controls, and audit logging extend these protections across all channels.¹ ISO certification and GDPR coverage further extend the framework for operators with European operations.¹

Three Plura channels generate the records that TCPA and TSR frameworks address:

• The AI Predictive Dialer logs every call attempt with number, date, time, and disposition, and enforces time-zone-based quiet-hours restrictions on every outbound dial.
• AI SMS captures consent at opt-in, processes STOP requests within required windows, and maintains suppression list history with timestamps.
• AI Voice records call detail data and routes sensitive disclosures through HIPAA-aligned channels with field-level redaction.

The compliance dashboard exports audit-ready reports in one click for legal review, carrier requirements, or regulatory inquiries. Customers are responsible for their own regulatory obligations, and Plura provides the infrastructure that supports the recordkeeping process.

Manual versus Automated Recordkeeping

Record Type	Manual Process	Automated Process	Audit Risk
Prior express written consent	Spreadsheet or CRM field entry, prone to missing IP, timestamp, or consent-language version	Immutable ledger captures timestamp, IP, consent language version, channel source, and phone number at opt-in	TCPA violations carry statutory damages of $500 to $1,500 per unsolicited call or text, with class action settlements averaging $6.6M in 20233
Internal DNC logs	Manual list updates, scrub receipts stored in separate files, 31-day re-scrub often missed	Real-time DNC scrubbing before every dial, scrub receipts auto-generated with date and registry version	Missed scrub cycles expose every contact made after the 31-day window to per-call liability
Call/text disposition logs	Agent-entered notes, incomplete time-zone data, no automated quiet-hours enforcement	System-generated logs with number, date, time, duration, and time-zone validation on every contact	Incomplete logs cannot demonstrate compliance with time-of-day restrictions in a regulator review
Promotional materials and scripts	Stored in shared drives, version control inconsistent, retrieval slow under audit timelines	Scripts versioned and timestamped within the platform, retrievable on demand with last-use date	TSR requires retention from date of production or five years from last use, missing versions create gaps

Walk through the audit-export workflow with a platform specialist.

Regulatory Updates and Primary Sources

The regulatory framework governing TCPA recordkeeping continues to evolve through FCC and FTC rulemaking. The following primary sources reflect the current state of the rules as of July 2026:

• 16 CFR § 310.5 (eCFR) – TSR Recordkeeping Requirements
• FTC.gov – Complying with the Telemarketing Sales Rule
• Federal Register – Telemarketing Sales Rule Updates

The FCC clarified in 2023 that National Do Not Call Registry protections apply to SMS marketing messages, which extends DNC scrubbing and audit-record expectations to text campaigns.² The TSR was amended in March 2024, with updated recordkeeping provisions for scripts, prerecorded messages, and call detail records. Operators running AI-assisted dialing or SMS campaigns should verify their record categories against the current rule text and consult qualified counsel for any state-specific obligations.

Regulatory Disclaimer

This article describes the TCPA and TSR recordkeeping framework for informational purposes only. It does not constitute legal advice and does not interpret what any specific law requires of any specific operator. Regulatory obligations vary by state, campaign type, and contact method. Operators should consult the current text of 16 CFR § 310.5, FTC guidance, and qualified legal counsel to determine their specific recordkeeping obligations. Plura provides infrastructure that supports the recordkeeping process, and customers are responsible for their own compliance posture and regulatory obligations.

See the consent ledger and audit exports at campaign scale.

Frequently Asked Questions

What is the difference between the TCPA retention period and the TSR retention period?

The TCPA is a federal statute enforced by the FCC that governs automated calls, prerecorded messages, and text messages to consumers. The TSR is an FTC regulation that governs telemarketing practices broadly, including recordkeeping. The TSR sets an explicit five-year retention floor for consent records, scripts, promotional materials, and DNC documentation under 16 CFR § 310.5. The TCPA’s four-year federal statute of limitations creates a practical minimum for consent records, and many compliance programs align to the TSR’s five-year standard as the operative floor. Some states impose longer periods, up to 10 years in certain jurisdictions. Operators running multi-state campaigns often identify the longest applicable retention period across all states where they contact consumers and apply that period uniformly to reduce audit risk.

Do TCPA recordkeeping requirements apply to AI-assisted dialing and SMS campaigns?

TCPA and TSR obligations apply based on the nature of the communication and the technology used, not the label applied to the platform. AI-assisted dialers that use automated dialing technology, prerecorded messages, or artificial voice fall within the same prior express written consent, DNC scrubbing, and call detail logging expectations as traditional dialers. AI SMS campaigns that send marketing messages to consumers require the same consent documentation, opt-out processing, and suppression list maintenance as manual SMS programs. The FCC’s 2023 clarification that National Do Not Call Registry protections apply to SMS marketing messages extended DNC audit-record expectations explicitly to text campaigns. Operators using AI-assisted tools should confirm that their platform generates and retains the required record elements for every contact, including timestamp, channel source, consent language version, and disposition.

What elements must a TCPA-compliant consent record contain?

The consent record elements listed in the main article, including name, phone number, consent language, opt-in timestamp, channel source, brand, and verification details, form a minimum defensible set. For web-based opt-ins, operators should also retain the URL and consent language version. Oral consent typically involves a contemporaneous written record or call recording. The E-SIGN Act permits consent agreements and consumer signatures to be collected digitally. Both lead sellers and advertisers should maintain independent records of each consent transaction.

How does Plura support TCPA recordkeeping for high-volume operators?

Plura’s compliance engine, described in detail above, automates the five core record categories through real-time enforcement rather than post-hoc documentation. The platform generates audit-ready exports that map directly to TSR and TCPA requirements, with each record element captured at the point of contact instead of reconstructed later. This approach gives contact center leaders and executives a consistent data trail across voice, SMS, and AI-assisted channels.

What happens if a consumer revokes consent, and how should that be documented?

Consent revocation creates its own documentation requirement. When a consumer opts out, the opt-out event should be recorded with a timestamp, the method of revocation, such as a STOP reply, verbal request during a call, or written request, and confirmation that the number was added to the internal DNC list. The processing timestamp, when the number was removed from the active contact list, should also be captured. Any subsequent re-opt-in requests require new consent documentation that meets the same standard as the original consent record. Suppression list history, including dates of addition and any changes, should be retained alongside the original consent record. For SMS campaigns, opt-out requests such as STOP replies should be processed within the timeframe specified by applicable regulations, and promotional messages should not continue after an opt-out is received. Plura processes opt-out requests and updates suppression lists automatically, with timestamped records generated for each event.

---