The 31-day rule: how the DNC safe harbor actually works

Most outbound teams can recite the number — scrub every 31 days — without being able to say where it comes from or what it actually buys. It comes from 47 CFR § 64.1200, the FCC rule implementing the TCPA's do-not-call provisions. And what it buys is narrower than most compliance decks suggest: a defense for the call that got through despite a disciplined process. It is not permission to run a loose one.

What the rule actually says

The regulation prohibits telephone solicitations to residential subscribers whose numbers are on the national Do-Not-Call registry. It also recognizes that a careful operation will occasionally dial a registered number anyway — a mistyped digit in the CRM, two lists merged badly, a registration that landed yesterday. The safe harbor holds when the caller can demonstrate that the violation was an error and that, as part of its routine business practice, it meets five conditions:

• Written procedures for honoring do-not-call requests and the national registry.
• Training for the personnel who dial, in those written procedures.
• An internal do-not-call list — a maintained, recorded list of the people who asked you, specifically, to stop calling.
• Fresh registry data — a process to prevent solicitations using registry data obtained no more than 31 days before the date of the call, with records documenting that process.
• Direct registry access — the caller obtains the national registry data from the registry administrator, without arrangements to share the cost of access.

Miss any one of the five and the safe harbor is unavailable. The 31-day scrub alone carries none of the weight; it is one element of a practice you must be able to demonstrate end to end.

What "31 days" means operationally

The clock runs from the date the registry data was obtained to the date of each call — per call, not per calendar month. That distinction breaks real campaigns in two common ways.

First, calendar drift. "We scrub monthly" is not the same practice. A list scrubbed on March 1 and dialed on April 2 is outside the window, because most months are longer than the rule's arithmetic and a standing calendar invite does not know that.

Second, list age. Clearance attaches to the data version, not the file. A list scrubbed once and dialed for six weeks goes stale mid-campaign with no visible change — the file looks exactly as clean on day 40 as it did on day 1. Nothing about a CSV tells you its verdicts have expired.

The operational rule that survives both failure modes: no number gets dialed against registry data older than 31 days, and every scrub gets a timestamp you can produce later.

The part everyone forgets: the records

The safe harbor is an affirmative defense — the caller demonstrates the routine practice, with documentation. That makes record-keeping a condition of the defense, not an accessory to it. A scrub you cannot document is, for defense purposes, a scrub that never happened.

This is why every Bastro job stores its verdicts, scopes, and timestamps with the job itself, retained in job history. The report is not a receipt; it is the record a defense gets built from.

One boundary worth stating plainly: the federal safe harbor addresses the federal registry. Several states maintain their own do-not-call lists with their own cadences and their own causes of action, so a federal-only process is not a complete one. Precision about what a rule covers is most of what compliance is.

This article summarizes 47 CFR § 64.1200 for operators. It is general information about the regulation, not a compliance opinion for your campaign. Bastro provides data services, not legal advice.