# Litigator Scrub vs DNC Registry vs Internal Opt-Out: Why You Need All Three > Each suppression layer blocks a different risk. Learn how to stack federal DNC, internal opt-outs, and a TCPA litigator scrub in your outbound pipeline. Published 2026-05-22, updated 2026-10-03 by Marcus Whelan. Canonical: https://checkthatphone.com/blog/litigator-scrub-vs-dnc-registry-vs-internal-opt-out-why-you-need-all-three ## The three-layer problem most teams get wrong Most compliance checklists collapse suppression into one question: are we honoring opt-outs? That feels thorough. It isn't. There are three separate failure modes here, each caught by a different mechanism, and each one completely invisible to the other two. Skip any layer and you leave a gap. Skip the litigator scrub in particular and you leave the kind of gap that turns into coordinated TCPA litigation, because some of the people on your list are not there by accident. They put themselves there on purpose, and they are waiting for you to call. Here is how each layer works, what it misses, and how to wire all three into a real pipeline. --- ## Layer 1: the federal Do-Not-Call Registry The [National Do-Not-Call Registry](https://www.donotcall.gov/), run by the FTC, lets consumers register their numbers to opt out of unsolicited telemarketing. If you make outbound marketing calls, you have to scrub against a version of the registry no more than 31 days old ([16 CFR 310.4(b)(3)(iv)](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-310/section-310.4)). It isn't calls-only: the FCC's December 2023 order (FCC 23-107) codified that the registry's protections extend to marketing text messages too ([Federal Register, Jan. 26, 2024](https://www.govinfo.gov/content/pkg/FR-2024-01-26/html/2023-28832.htm)). What it catches: consumers who proactively told the government they don't want telemarketing calls or texts. What it misses: numbers registered after your last scrub window. Numbers that were never registered at all. Numbers belonging to serial litigants who registered specifically to collect evidence, since registration alone tells you nothing about intent. The practical point is that DNC registration is a floor, not a ceiling. A clean DNC scrub says nothing about whether you have consent, whether the line was reassigned, or whether the person on the other end sues for a living, and TCPA claims get built on all three. --- ## Layer 2: your internal opt-out list Every outbound program should keep its own suppression list of numbers where a contact asked you, specifically, to stop. This list is yours to build and yours to honor, regardless of DNC status. What it catches: prior customers or leads who revoked consent, numbers that generated complaints internally, and anyone who used your opt-out mechanism, whether that was a STOP reply, a verbal request, or a web form. What it misses: people who never contacted you in the first place. Reassigned numbers, where a number that opted out two years ago may belong to a stranger today. And litigants who haven't touched your brand yet. Before you dial a number that's been sitting in your CRM for months, it's worth confirming it's still active and still belongs to the same person. CheckThatPhone returns a `deactivationDate` while a number is recently deactivated, and the `deliverable` flag tells you whether the number is reachable at all. Our lookup can't tell you who holds a number today, but your own history can: a suppressed number you once saw deactivated that is now active again may belong to someone new, which flips the risk. Now you might be calling a stranger who never opted out of anything. For a definitive answer, the FCC's [Reassigned Numbers Database](https://www.reassigned.us/) tells you whether a number was permanently disconnected after a given date. [Opt-out hygiene](/blog/opt-out-hygiene-keeping-your-internal-suppression-list-tight-enough-to-defend) covers how to keep this layer defensible. The `/v1/lookup` endpoint also returns `blackList`, `action`, and `reason`. If `blackList` is `"true"`, the number is on CheckThatPhone's internal blacklist (a litigator match also sets it), and `action` comes back `"unsubscribe"`, with `reason` saying why. --- ## Layer 3: the TCPA litigator scrub This is the layer most teams skip, and it carries the most asymmetric downside. A small, well-documented group of people, sometimes called serial TCPA plaintiffs or professional litigants, deliberately hand their numbers to businesses, wait for contact, then file or threaten TCPA suits. They are not on the DNC registry by accident, and they are not on your internal opt-out list at all. In your data they look exactly like any other lead. The litigator scrub is a lookup against a database of numbers tied to known TCPA litigants, refreshed daily. It won't stop every claim, but it clears the low-hanging fruit: numbers with a documented history of litigation activity. With CheckThatPhone you enable it by adding `litigatorFilter: true` to your lookup request: ```http POST https://api.checkthatphone.com/v1/lookup Authorization: Bearer Content-Type: application/json { "phone": "2025550178", "litigatorFilter": true } ``` The response includes three fields: - `litigator`: the string `"true"` if the number is flagged, `"false"` if not - `litigator_type`: how the match is classified: `"litigator"`, `"plaintiff"`, or `"agitator"` - `litigator_name`: the name on the record where available If `litigator` comes back `"true"`, suppress the number before it ever reaches your dialer queue. Don't call it. Don't text it. The cost of a single TCPA claim, where statutory damages run $500 per violation and up to $1,500 if willful ([47 U.S.C. § 227(b)(3)](https://www.law.cornell.edu/uscode/text/47/227)) and each message can count as a violation, dwarfs the value of any one contact. For how this fits a broader TCPA risk strategy, see our [TCPA litigator scrub use case](/use-cases/tcpa-litigator-scrub), and for whether the add-on pays for itself, [the ROI math of running a litigator filter on every SMS send](/blog/the-roi-math-of-running-a-litigator-filter-on-every-sms-send). --- ## Layering all three in a real campaign pipeline Here is the sequence I'd run for an outbound SMS or calling campaign. Step 1: line type and carrier validation. Before anything else, know what you're dialing. CheckThatPhone returns `nanpType` (mobile, landline, not-mobile) and carrier details via `dipCarrier`, `dipCarrierType`, `dipCarrierSubType`, and `dipPorted`. A number that has ported from a landline carrier to a mobile carrier now falls under the TCPA's stricter rules for autodialed and prerecorded calls to cell phones ([47 U.S.C. § 227(b)(1)(A)(iii)](https://www.law.cornell.edu/uscode/text/47/227)), even if you originally captured it as a landline. Missing that shift is an easy way to end up without the consent you need. If you need to reach landline numbers via SMS through registered messaging services, add `landlineSmsLookup: true` to the request. The response then includes the `dipMessaging*` fields (`dipMessagingEnabled` is the one to route on) to tell you whether that specific landline can receive messages. Step 2: deliverability and blacklist check. Look at `deliverable`, `blackList`, `action`, and `reason`. Drop numbers that aren't deliverable or are flagged. If `deactivationDate` is present, the number was deactivated in the last 45 days and hasn't been reactivated since; record it, and if a later lookup shows the number active again, treat it as potentially reassigned and don't lean on historical consent. Step 3: litigator scrub. Run `litigatorFilter: true`. If `litigator` returns `"true"`, suppress immediately and log `litigator_type` and `litigator_name` for your compliance records. Add `dncState: true` and `dncComplainer: true` to the same call (both free) and you also get [state do-not-call registry and complainer-list results](/use-cases/state-dnc-scrub) back. The state check reports whether it ran, so the 12 states whose registries aren't in the data are flagged rather than read as clear. Step 4: DNC registry scrub. For the federal registry, apply your most recent scrub file from your own registry subscription — at least monthly, more often if your list turns over fast. The 38 states plus DC that the state check covers are already handled from step 3; for the 12 uncovered states (no `dncStateChecked` in the response), fall back to your own per-state files. Step 5: internal opt-out suppression. Cross-reference your internal list last, since it's the most current signal about your specific relationship with that contact. Only numbers that clear all five checks should enter the active campaign. --- ## Running this at scale For real-time lead qualification, like a web form submission, an inbound call, or a new CRM record, the single-number endpoint at `POST https://api.checkthatphone.com/v1/lookup` handles per-request checks in real time. For existing lists of thousands or hundreds of thousands of numbers, use the [Bulk CSV feature](/bulk-phone-validation) in the dashboard (Dashboard, then Bulk CSV). Upload your file, select the add-ons you need (including litigator filter and landline SMS lookup), and download the enriched results. The service deduplicates rows, validates carrier and line type, and runs every add-on you have enabled against each number. The upload and the result file are deleted within 24 hours. That is the right path for pre-campaign list hygiene. Looping the single-lookup endpoint once per number at scale is not. See [/pricing](/pricing) for add-on costs and volume tiers, and [/docs](/docs) for the full field reference and request schema. --- ## The bottom line Each layer catches a specific failure mode. The DNC registries — federal via your own scrub file, state-level via the free `dncState` check — catch consumers who opted out of telemarketing calls and texts. None of them replaces consent; [prior express written consent under the TCPA](/blog/prior-express-written-consent-under-the-tcpa-what-survives-the-2024-fcc-changes) covers that side. Your internal list catches people who opted out of your program. The litigator scrub catches people who never intended to opt out at all, because they want you to call. Running one or two of these layers does not buy you partial protection. It leaves a gap, and the parties most motivated to find it already know exactly where to look. If your pipeline doesn't include all three today, [contact list hygiene](/use-cases/contact-list-hygiene) and [sales lead validation](/use-cases/sales-lead-validation) are good starting points for seeing where these checks fit in practice. --- CheckThatPhone is a phone validation API for US and Canada numbers: https://checkthatphone.com (docs: https://checkthatphone.com/docs.md, pricing: https://checkthatphone.com/pricing.md).