DNC Scrubbing on a Budget: Free vs. Paid (And What You Give Up Going Free)

Walk into any forum where agents talk about working purchased leads and you will find the same question over and over: what is the cheapest, easiest way to scrub a list against the Do-Not-Call registry? It is a fair question, and the answers floating around are usually either a vendor pitch or a half-right tip from someone who got lucky.

Here is the straight version — what you can do for free, what that free path actually covers, and the part almost every budget guide gets wrong: the scrub by itself does not protect you.

Operational guidance, not legal advice — liability for every call sits with you, the caller. Confirm specifics with a TCPA attorney; Henson Legal is the firm we point people to.

The scrub is one of six conditions, not the rule

Most agents believe the requirement is "scrub every 31 days." That is where the trouble starts, because the 31 days is not a standalone rule. It is one item in a six-part safe harbor written into the FTC's Telemarketing Sales Rule at 16 CFR 310.4(b)(3).

A safe harbor is a defense. It says that if a call slips through to someone on the registry, you are not liable provided you can demonstrate all of the following as part of your routine business practice:

1. Written procedures. You have established and implemented written procedures to comply with the do-not-call rules. Written. Not "we know what we're doing."
2. Training. You have trained your personnel — and anyone assisting in your compliance — in those procedures.
3. An internal do-not-call list. You maintain and record a list of numbers you may not contact, because someone told you to stop.
4. A scrub no older than 31 days, with records. You use a process that employs a version of the registry obtained from the Commission no more than thirty-one days before the call, and you maintain records documenting that process.
5. Monitoring and enforcement. You monitor and enforce compliance with your own procedures.
6. The call was an error. The call that got through was a genuine mistake, not a failure to collect the information you needed.

Read condition four again. The scrub is half of it — the other half is the documentation. A clean file with no dated record of how it got clean is a scrub you cannot prove. And conditions one, two, three, five and six do not involve scrubbing at all.

This is why "I scrub every month" is not a compliance program. An agent who does only the scrub believes they are protected and is not, and they will not discover the gap until someone is asking questions.

Three lists, not one

Scrubbing against "the DNC list" is already a simplification. There are three, and they fail in different ways:

The federal registry. The national list the Commission maintains, covered at 16 CFR 310.4(b)(1)(iii)(B). This is the one everybody means.

State registries. Several states run their own, with their own rules and their own currency requirements. If you dial into multiple states, the federal scrub alone leaves gaps.

Your own internal list. Required by 16 CFR 310.4(b)(1)(iii)(A), and it is the one agents skip most often, because it is the one nobody sells you. When a person tells you to stop calling, that request binds you regardless of what any registry says, and it binds you forever. It costs nothing to honor and it is pure discipline.

Of those three, the internal list is the cheapest to maintain and the most expensive to neglect. A complaint from someone who already told you to stop is the hardest kind to defend, because the record of the request is usually sitting in your own CRM.

The clock applies to aged lists twice over

Aged data is exactly the case the 31-day rule was written for. People register on the Do-Not-Call list every single day, so a list you cleaned six weeks ago is no longer clean — and a 90-day-old lead file has had three months of registrations land on it since the day it was generated.

So the rule for aged leads is: re-scrub before you work the batch, and re-scrub again every thirty-one days for as long as you keep working it. Not once at purchase.

Looking for leads? Compare top providers for your vertical — independent ratings across 15+ verticals.

Calling hours are a separate rule, and people forget them

While you are building the process, note that the registry has nothing to do with when you may dial. 16 CFR 310.4(c) restricts calls to a residence to the hours between 8:00 a.m. and 9:00 p.m. local time at the called person's location — not yours. Several states are stricter.

That is a trap built into aged data specifically, because aged lists are almost always multi-state. A perfectly scrubbed file dialed at 7:45 a.m. in a time zone you did not check is still a violation.

A word on which law you are reading

The Telemarketing Sales Rule cited throughout this piece is the FTC's. The TCPA is a different statute with its own implementing rules at the FCC (47 CFR 64.1200), and the TSR's own footnotes say so: complying with one does not discharge your obligations under the other.

It matters here because the two regimes have different consent standards and different enforcement. A vendor telling you a product makes you "DNC compliant" is describing one half of one regime. Ask which.

The free path

You can genuinely scrub on a budget. Here is what is available at no cost and what each option is good for.

Register directly with the federal registry. Sellers and telemarketers access the national Do-Not-Call data through the FTC's telemarketer portal. You will need a Subscription Account Number, and access to a limited number of area codes is free, with broader access carrying an annual fee that scales with how many area codes you pull. This is the official route. It is built for compliance teams rather than for an agent who wants a clean file this afternoon, but it is the authoritative source and it generates the record condition four asks for.

Free scrub tools. A handful of services offer no-cost list scrubbing against the federal registry. They are a legitimate starting point for a solo agent on a tight budget. The trade-offs are consistent: slower, lighter on state registry coverage, and thinner on the documentation that makes your process defensible.

Your internal opt-out list is always free. It is your own data and it is the condition nobody can sell you.

The free path works. What you give up is speed, comprehensive state coverage, and the clean audit trail.

The paid path

Paid scrubbing is not expensive, which is the part that surprises people. Bulk commercial scrubbing runs in the range of a fraction of a cent per record — roughly sixty dollars to clean a hundred thousand numbers at the low end. For that you typically get federal and state coverage in one pass instead of stitching registries together yourself, upload-or-API speed that makes the 31-day re-run trivial, and dated scrub records you can keep as evidence of a consistent process.

That last one is the real purchase. You are not buying a cleaner file; the free tools also produce a cleaner file. You are buying condition four's second half.

So which should you use?

Start free if you are a solo agent, working modest volume, dialing in one or two states, and watching every dollar. The free federal scrub plus a disciplined internal opt-out list covers the most common risk — provided you also write the procedures down, keep the dated records, and hold yourself to the 31-day clock.

Pay if you dial into multiple states, you are working real volume, or you want documentation that stands up without you having to reconstruct it. At a fraction of a cent per record, the cost of cleaning a list is rounding error next to the cost of one complaint.

Either way, the budget decision is the smaller half of this. The free-versus-paid question is about scrubbing. The safe harbor is about process, and the process is free.

Where litigator scrubbing fits — and where it does not

Litigator scrubbing is a different product aimed at a different problem, and the distinction is worth being precise about.

A litigator scrub checks your file against lists of known serial TCPA plaintiffs and the attorneys who work with them — people who answer calls in order to generate claims. It is not a legal requirement. It appears nowhere in the safe harbor above. No regulation obliges you to run one.

What it is, is risk management against a specific and real phenomenon. A small number of people file a disproportionate share of TCPA claims, and a scrub against those lists removes a tail risk the DNC registry does not address at all, because a serial plaintiff's number is frequently not on the registry — being reachable is the point.

So the honest sequencing is: get the six safe-harbor conditions in place first, because that is the defense the regulation actually gives you. Add a litigator scrub when your volume makes the tail risk worth paying to remove. Doing it in the other order — buying the specialist product while your written procedures do not exist — buys the rarer protection and skips the one that covers the common case.

What should you pay? Check our Lead Price Index — fair market benchmarks updated monthly.

The practical version

The regulation is six conditions. Most of them cost nothing and take an afternoon. The one that costs money is the one most agents are already doing.

We put the six conditions into a worksheet you can work through in a sitting — what each one requires, what "documented" actually means for a one-person operation, and the 31-day re-scrub schedule laid out so you are not tracking it in your head. It is free to read, in full, with no email required: the DNC Safe Harbor Worksheet.

DNC scrubbing is one layer. For the complete routine — how it sits alongside validation and your internal list — see the Lead-Data Hygiene Checklist, and for the deeper mechanics on aged data specifically, DNC Compliance for Aged Leads.