The TCPA Vendor Audit Checklist: What to Ask Any Calling or Texting Vendor After the 2026 FCC Order

Start With the Dates Your Vendor Should Be Able to Name

Open the audit with the calendar, because every other answer hangs on it. The FCC adopted its Report and Order on September 30, 2026, amending paragraphs (a)(9)(iii)(A), (a)(10), (a)(11), and (a)(12) of 47 CFR 64.1200. The revised revocation rules take effect 30 days after the order is published in the Federal Register, and that date supersedes January 31, 2027, which had been the pending date for the 2024 “revoke-all by any reasonable means” framework. Check the Federal Register for the publication date yourself; the effective date follows from it.

That gives you the first two questions. Which rule set is the vendor operating under today, and what exactly changes inside their program on the effective date? A vendor that has read the order answers in a few sentences and mentions that the date depends on publication. A vendor still quoting January 2027 is working from a calendar the order replaced. Ask for the answer by email, put a name on it, and keep the date you asked, because you will want to compare it with what the program does later.

Question Set One: Which Opt-Out Methods Does the Vendor Designate?

The order sets out exclusive opt-out methods: a voice or key-press response, a standardized text keyword, or a designated website or phone number, with the method disclosed in each message. Ask the vendor to name, channel by channel, which of these they have designated. Then ask to see the exact line in a text template and in a call script where the method is disclosed. Find out whether the choice was made on purpose or inherited from a platform default, and who signed off on it.

Then test it yourself. Have someone on your team receive the vendor’s outreach on a test number or inbox, use each designated method, and note how long the stop takes to land and what the confirmation looks like. Also ask what happens when a person says stop some other way, such as a free-text reply or a remark to a live rep. Some programs honor those requests anyway, and others do not. Either way it is a decision, so ask to see it written down with the name of whoever made it. A vendor that has designated nothing and honors every plain-language stop is making a conservative choice, and the audit then shifts to proof that a free-text stop actually reaches the list.

Question Set Two: Does One Opt-Out Reach Everything?

Scope is where programs leak. A marketing opt-out still revokes consent to all marketing from the caller, affiliates included, so ask where the vendor’s suppression list lives and whether it is one list or one per campaign, brand, or affiliate. Ask how an opt-out captured on a phone call reaches the texting platform, and how one captured on a web form reaches both. The answer you want describes a single store that every channel writes to and every send reads from. An answer that involves a weekly spreadsheet merge is a finding.

Next come partial requests. The order limits category-specific revocation to informational messages, so a prospect who says stop the reminders but keep sending the details is raising a question the vendor has to handle on purpose. Ask how the log captures the exact words, who reviews them, and what happens next. Ask who classifies each message type as informational or marketing and where that classification is documented. Meeting confirmations and reminders are the usual gray area, so ask about them by name.

Question Set Three: How Fast, and Can They Prove It?

Speed is a number you can ask for. The further notice of proposed rulemaking that came with the order asks whether the window for honoring a revocation should shrink from 10 business days to 7, and whether two-way texting should be required. Both are under comment, so treat them as signals and not as rules. Ask the vendor for their measured time from opt-out to suppression across every channel, the median and the slowest case from the last quarter, and whether the process would clear 7 business days without heroics.

A vendor who measures from the log instead of from memory is showing you the right habit. Ask about the slow paths too: opt-outs received by phone, relayed by a rep, or arriving as an inbound text overnight or on a weekend. If they text, ask whether replies are read by a person or only by a keyword filter, since two-way texting is on the table. A text program that cannot read replies will struggle to hear the most natural way anyone says stop.

Question Set Four: What Records Prove the Answers?

Everything above is a claim until it becomes a record. For each opt-out, the vendor should keep when it arrived, which method delivered it, the message or call that prompted it, who or what processed it, and when suppression took effect. For each outbound template, they should keep every dated version, because a disclosure line that existed last month and vanished in an edit is a line nobody can show. For the rule changes themselves, they should keep a short decision log: which methods were designated, who approved, and when the cutover happened.

Ask for a redacted sample of each before you sign, not after a complaint lands. A vendor who produces one the same day is running a system. A vendor who needs a week is building the record while you wait. If confidentiality is the objection, ask for a screen-share walkthrough with names masked, and write down what you saw and when.

Scoring the Answers and Writing Them Into the Contract

Score each answer plain, partial, or deflected. Plain means a specific answer, a named owner, and a log or document on request. Partial means the answer is right in principle and nothing backs it. Deflected means a pointer to a sales deck, a general statement that the vendor is compliant, or a follow-up that never arrives. Two deflections on scope or speed should end the evaluation. Then write the answers into the contract: the designated methods, the single suppression list, the turnaround standard, a duty to tell you before any method or window changes, and access to the logs on request. The commercial terms that sit around them are covered in our guide to questions before signing and in replacement policies, decoded, which is why this page stays on the compliance layer.

Re-run the audit on the effective date and every quarter after it, and again whenever the vendor adds a channel or an affiliate, because the further notice may move the numbers. The order itself is explained in plain terms in our post on the FCC’s 2026 TCPA order, and the broader case for putting compliance at the top of a vendor screen is in compliance as a vendor selection criterion. If you would rather buy booked meetings than audit opt-out plumbing, VA Horizon runs human-dialed outreach as a managed service and hands the meetings to your calendar.

Sources

The external data in this guide draws on the sources below. Figures described in the text as estimates or industry triangulations are directional and are not attributed to a single dataset.

• Crowell & Moring, "FCC Adopts TCPA Rule Amendments October 2026"
• Day Pitney, "The FCC Changes Certain Consent Revocation Rules"
• Troutman Pepper Locke, "FCC Revises TCPA Revocation of Consent Rules That Were Set to Go Into Effect in January"

FAQ