How Long Do You Have to Keep Your DNC and Consent Records?

Scrubbing protects you twice: once by keeping bad numbers off the dialer, and once by letting you prove you kept them off. The second protection only exists if you kept the paperwork. Plenty of teams do the work properly and then can't demonstrate it eighteen months later, which in practice is close to not having done it.

What you should be keeping

• Scrub reports. What list was checked, when, against what, and what came back flagged.
• Consent records. Who consented, to what, when, and through what mechanism — including the actual wording they agreed to.
• Your internal do-not-call list, with the date each request was received.
• Call detail records. Numbers dialled, timestamps, outcomes, and which campaign they belonged to.
• Registry access records. Evidence that you obtained and applied current registry data.
• Your written compliance procedures, and evidence staff were trained on them.

How long

Different obligations point at different periods, so the practical approach is to take the longest one that applies to you rather than tracking each separately.

Telemarketing record-keeping obligations under FTC rules run to a couple of years for several categories of record. Internal do-not-call requests have to be honoured for substantially longer — in the region of five years — which means the record supporting them needs to outlive the request itself.

Then there's litigation exposure, which is usually the real driver. TCPA claims have a limitation period measured in years, and the evidence you need is the evidence of what you did at the time of the call. If your records expire before your exposure does, you have a gap precisely where it hurts.

Most teams land on five years as a default retention period, longer for consent records tied to relationships that are still active. Confirm the right number for your business with counsel — this is one of the places where the correct answer genuinely depends on what you sell and where.

What makes a record actually useful

There's a difference between having data and having evidence. A useful compliance record:

• Is timestamped and hard to alter after the fact. A spreadsheet anyone can edit is worth much less than a generated report with a fixed date.
• Ties to a specific campaign and list, so you can connect a particular call to the scrub that preceded it.
• Shows what was excluded and why, not just the final clean list. The flagged numbers are the proof the process worked.
• Can be produced quickly. Evidence you can't locate in a reasonable time functions as evidence you don't have.

The failure mode

The usual way this goes wrong is quiet. Reports get downloaded to somebody's laptop instead of a shared archive. A tool gets swapped out and the old history doesn't migrate. A campaign runs from an export that nobody kept. Nothing feels broken until a demand letter arrives naming a call from fourteen months ago and the honest answer is that the list probably was scrubbed but nobody can show it.

Archiving the report with the campaign, at the time, is a small habit that removes that whole category of problem.

Carrier Fence keeps your scrub history on the account, so each run stays retrievable rather than depending on whoever downloaded it. Start with 500 free coins, and see how to read a scrub report for what those records contain.

General information, not legal advice. Retention requirements vary by business and jurisdiction — confirm yours with counsel.