TCPA · Retention
How long to keep TCPA consent records
Plan on at least five years from the last call or text that relied on the consent. Here is where that number comes from, a retention calculator that gives you the keep-until date, and why the storage should be yours. This is a summary, not legal advice.
Where the numbers come from
- Four years to sue
- Federal claims under laws like the TCPA can be brought for four years (28 U.S.C. § 1658). The clock generally runs from each call or text, not from the day the lead was captured, so a lead you keep calling keeps the window open.
- Five years of records
- The FTC's Telemarketing Sales Rule asks sellers and telemarketers to keep consent records for five years, which is 60 months (16 CFR 310.5).
- State laws
- None of the state laws we checked asks for consent records longer than five years. What they change is how long someone has to sue: two to six years. State-by-state table →
TCPA consent retention calculator
Enter the date of the last call or text that relied on a consent to get its keep-until date. Nothing is sent anywhere; it runs in your browser.
Four years under 28 U.S.C. § 1658; five years of records under 16 CFR 310.5. State laws may differ (see the table), and this is not legal advice.
State telemarketing laws and how long to keep consent
We read the statute text for the state telemarketing laws most often named in lawsuits. None of them asks you to keep consent records longer than the FTC's five years. Only three set a record-keeping period at all, and each is shorter: Florida and New Jersey two years, New York 24 months.
What a state law changes is how long someone has to sue. Most of these laws don't set their own deadline, so the state's general deadline applies, marked "general" below. The longest we found is Michigan's general six years. If you call into Michigan, ask counsel whether to keep records longer than five years.
| State | Law | Covers | Consumers can sue | Time to sue | Record-keeping rule |
|---|---|---|---|---|---|
| Florida | Telephone Solicitation Act, § 501.059 | Calls, texts | Yes | 4 years (general) | None |
| Florida | Telemarketing Act, § 501.6175 | Calls | Yes | 4 years (general) | 2 years, including requests to be contacted (licensed commercial telephone sellers) |
| Oklahoma | Telephone Solicitation Act, 15 O.S. § 775C | Calls, texts | Yes | Not stated | None |
| Maryland | Stop the Spam Calls Act, Com. Law § 14-4503 | Calls, texts | Yes | 3 years (general) | None |
| Washington | RCW 80.36.390 · RCW 19.190 (texts) | Calls, texts | Yes | 4 years (texts) | None |
| Texas | Bus. & Com. Code ch. 302, 304 · § 305.053 | Calls, texts | Yes | 2 years (ch. 302, 304); 4 years (general, § 305.053) | None |
| Virginia | Telephone Privacy Protection Act, § 59.1-510 | Calls, texts | Yes | 2 years (general) | None for consent. Do-not-call requests are honored 10 years |
| Georgia | O.C.G.A. § 46-5-27 | Calls | Yes | 2 years (in the law) | None |
| Connecticut | Conn. Gen. Stat. § 42-288a | Calls, texts | Yes | 3 years | None |
| Colorado | C.R.S. § 6-1-901 | Calls, texts | Yes | 3 years | None |
| Michigan | MCL 445.111 | Calls | Yes (actual loss needed) | 6 years (general) | None |
| New York | Gen. Bus. Law § 399-z | Calls, texts | No | — | 24 months, all telemarketing records |
| New Jersey | N.J.A.C. 13:45D-3.10 | Calls | No | — | 2 years, including express written permission |
| Arizona | A.R.S. § 44-1278 | Calls | No | — | None for consent. Do-not-call requests kept 10 years for the safe harbor |
"Some states require ten years." You will see this claim on compliance blogs. We found no state that asks for consent records to be kept that long. The two ten-year rules we found are about do-not-call requests: Virginia honors an opt-out for ten years, and Arizona's safe harbor needs do-not-call requests kept for ten years. Keep those opt-outs for ten years if you call into either state. They are a different record from consent.
Statute text checked on 28 September 2026. "General" means the law sets no deadline of its own and the state's general limitations period is cited; no court has confirmed that period for every one of these laws. Laws change, and this is a summary, not legal advice.
Why the storage should be yours
If your proof of consent sits with a vendor, it is kept for the vendor's retention period, on the vendor's terms, and it may not come with you if you switch. When the lawsuit arrives in year four, you want the record in your hands, not behind a support ticket.
That is why Kapture writes every record to your own storage bucket: Cloudflare R2, Amazon S3, Backblaze B2, Wasabi, DigitalOcean Spaces, Telnyx storage or any S3-compatible endpoint. You set the retention. The records stay yours if you ever leave.
One thing to check. Kapture also offers KX21-hosted storage for accounts without a bucket, and hosted records are kept for 90 days. That is fine for a trial. It is not long enough for TCPA. For consent you may need to produce years later, use your own bucket.
Price your recordings → What a consent record has to contain
Questions
- How long should I keep TCPA consent records?
- Plan on at least five years from the last call or text that relied on the consent. Federal TCPA claims can be brought for four years (28 U.S.C. 1658), generally counted from each call, and the FTC's Telemarketing Sales Rule asks for five years of consent records. State laws may add their own rules.
- What is the record-retention period under the Telemarketing Sales Rule?
- Five years, which is 60 months. The FTC's Telemarketing Sales Rule asks sellers and telemarketers to keep consent records for five years (16 CFR 310.5).
- Do state laws require keeping TCPA consent records longer than five years?
- Not in any state law we checked. Florida and New Jersey ask for two years and New York for 24 months, all shorter than the FTC's five. State laws do change how long someone has to sue: from two years in Georgia, Texas and Virginia to a general six years in Michigan. Ten-year rules in Virginia and Arizona cover do-not-call requests, not consent records.
- Does the TCPA statute of limitations start when the lead was captured?
- Generally no. The four years run from each call or text, so a lead you keep calling keeps the window open. Keep the consent record for as long as you rely on it, plus the limitation period.
- How long does Kapture keep consent records?
- With your own storage bucket, as long as you choose: the records are written to your bucket and stay yours if you leave. On KX21-hosted storage, records are kept for 90 days, which is not long enough for TCPA, so use your own bucket for consent you may need to produce years later.