TCPA Safe Harbor: What It Covers and What It Doesn't

"We have a safe harbor for this" is one of the more dangerous half-truths in TCPA compliance. A safe harbor does exist — but it's narrow, conditional, and covers far less than most teams assume.

What the safe harbor actually covers

The relevant safe harbor provides a defense against liability for calling a number on the National DNC Registry, if the caller can show the call was the result of an error and, as part of routine business practice, the caller maintains and follows written procedures for complying with DNC rules, trains staff on those procedures, and uses a process to prevent calls to registered numbers — including checking the registry no more than 31 days before the call was placed.

Why "it was just a mistake" isn't enough on its own

The safe harbor isn't a general good-faith defense — it's conditioned on having documented, followed procedures in place before the error happened. A caller with no written compliance process can't retroactively claim safe harbor just because a violation was unintentional. The documentation requirement is the whole point: it exists to distinguish a real, systemic compliance effort from an after-the-fact excuse.

What it doesn't cover

This is the longer list, and it's where most exposure actually sits:

• It's specific to DNC registry errors — it doesn't extend to consent violations.
• It doesn't cover calls to honeypot numbers or numbers associated with documented litigator activity — those aren't DNC registry matches to begin with.
• It doesn't cover calling-time violations.
• It doesn't cover a failure to honor a direct opt-out request.
• It doesn't automatically extend to state-level mini-TCPA claims, which may have their own (different, or absent) safe harbor provisions.

What "maintaining procedures" actually looks like

In practice, this means: a written scrubbing process, evidence you actually run it before campaigns (not just that a policy document exists), a habit of re-checking within the required window before dialing, and records you can produce showing all of the above happened. A policy that exists on paper but isn't actually followed doesn't satisfy the standard.

The practical takeaway

Safe harbor is a reason to have a documented, consistently-followed scrubbing process — not a reason to assume errors are automatically forgiven. Scrubbing every list, keeping the reports, and re-scrubbing on a regular cadence is what actually builds toward safe harbor eligibility, not just having a compliance policy in a drawer. Try Carrier Fence free to build that record.