How to Run a Privileged TCPA Compliance Audit

A TCPA compliance audit can protect a company or hand a plaintiff’s lawyer the best exhibit in the case, and that’s usually decided before anyone pulls a call log. When a lawyer directs the review to give legal advice, the communications and the lawyer’s analysis can stay privileged. The underlying facts never do, and a review run as routine business often isn’t protected. Built right, an audit leaves a company with a record of good-faith fixes, not a roadmap to a willfulness finding.

Is a TCPA compliance audit privileged?

Parts of it can be, if a lawyer runs it to give legal advice.

The attorney-client privilege covers confidential communications made to get legal advice. In a company, that can reach lower-level employees who, at a superior’s direction and in confidence, give counsel information about matters within their duties, when they know it’s being gathered so the company can get legal advice, as the Supreme Court held in Upjohn Co. v. United States. Upjohn also sets the limit every audit has to live with: “The privilege only protects disclosure of communications; it does not protect disclosure of the underlying facts by those who communicated with the attorney.” If a dialer kept calling numbers on the Registry, that fact is discoverable no matter who found it.

For communications with mixed legal and business purposes, the Ninth Circuit asks which purpose predominates. In re Grand Jury (9th Cir. 2021) holds “that the primary-purpose test applies to attorney-client privilege claims for dual-purpose communications.” It left open the broader D.C. Circuit approach in Kellogg Brown & Root, which asks whether legal advice was a main purpose even if not the only one: “We see the merits of the reasoning in Kellogg. But we see no need to adopt that reasoning in this case.” The Supreme Court took the case and then disposed of it in one line, “The writ of certiorari is dismissed as improvidently granted,” according to its January 2023 per curiam opinion. A TCPA audit looks more like the internal investigation in Kellogg than the tax work in the Ninth Circuit’s case, but I wouldn’t build an audit around a test the court hasn’t adopted. Plan for the stricter one.

Work product is the second protection. Under Federal Rule of Civil Procedure 26(b)(3), it covers “documents and tangible things that are prepared in anticipation of litigation or for trial by or for another party or its representative,” though an opponent can still get them by showing it “has substantial need for the materials to prepare its case” and can’t get their equivalent without undue hardship, and even then Rule 26(b)(3)(B) requires the court to protect the lawyer’s “mental impressions, conclusions, opinions, or legal theories.” In the Ninth Circuit, a document with two purposes qualifies if it was created because of anticipated litigation and “would not have been created in substantially similar form but for the prospect of that litigation,” under In re Grand Jury Subpoena (Torf).

A TCPA audit often looks like ordinary compliance work. A federal magistrate judge in the Northern District of California rejected work-product protection for documents from wage-and-hour classification audits that a bank’s law department said it had initiated and supervised, reasoning that “A generalized fear of litigation does not turn a compliance audit into attorney work product,” in Lewis v. Wells Fargo & Co. (N.D. Cal. 2010). The court noted that the audits began at least a year before the lawsuit the bank pointed to, and that they led to reclassifications.

How should counsel bring in consultants and data vendors?

Through counsel, by an engagement that says the vendor is there to help the lawyer give legal advice, and by work that actually does that. Most TCPA audits need people who aren’t lawyers, such as analysts who can read dialer exports and rerun Registry scrubs against them.

In United States v. Kovel (2d Cir. 1961), Judge Friendly wrote that “What is vital to the privilege is that the communication be made in confidence for the purpose of obtaining legal advice from the lawyer.” The same opinion drew the line that trips companies up: “if the advice sought is the accountant’s rather than the lawyer’s, no privilege exists.”

The Ninth Circuit applied that line against the party claiming privilege in United States v. Richey (9th Cir. 2011). A law firm had hired an appraiser, but the appraisal was required for a tax return, so the court held that communications about preparing it were “not made for the purpose of providing legal advice, but, instead, for the purpose of determining the value of the Easement.” Work product failed too, because the appraisal would have been prepared anyway.

The TCPA version of Richey is the data vendor whose standard scrub report is the product it sells every month. I’d keep two engagements apart. The vendor’s ordinary service stays under the company’s own contract and produces ordinary business records. Any separate analysis counsel needs, such as testing whether past campaigns reached Registry numbers or whether consent records match the numbers dialed, goes under a separate engagement that counsel signs and limits to the legal questions.

Torf protected an environmental consultant’s documents because the company’s lawyer hired the consultant after the EPA told the company it was under investigation, and the court found that the documents’ “litigation purpose so permeates any non-litigation purpose that the two purposes cannot be discretely separated from the factual nexus as a whole.” A demand letter or a regulator’s inquiry is the kind of event that can support that showing.

What should a TCPA audit actually test?

The places where TCPA cases are won and lost. If your vendors handle any of this, the contract terms covered in our post on TCPA vendor contracts and indemnity decide who has the records and who pays when they’re wrong.

On the National Do Not Call Registry, the federal list of numbers whose owners don’t want telemarketing calls, one element of the safe harbor, in § 64.1200(c)(2)(i)(D), requires a scrub against a version of the Registry obtained “no more than 31 days prior to the date any call is made, and maintains records documenting this process.”

On opt-outs, a revocation “must be honored within a reasonable time not to exceed ten business days from receipt of such request,” under § 64.1200(a)(10). Ten business days is a ceiling. I’d measure the actual gap for every request in the sample and treat anything over two or three days as a finding.

On vendors, § 64.1200(d)(3) provides that when do-not-call requests “are recorded or maintained by a party other than the person or entity on whose behalf the call is made, the person or entity on whose behalf the call is made will be liable for any failures to honor the do-not-call request.”

Which audit records should stay privileged, and which should be ready to produce?

Run two tracks, because the TCPA’s defenses depend on records a company has to be able to show. For companies that make telemarketing calls, the Do Not Call rules require “a written policy, available upon demand, for maintaining a do-not-call list,” under § 64.1200(d)(1). The safe harbor in § 64.1200(c)(2)(i) applies only if the call was the result of error and, as part of its routine business practice, the company “has established and implemented written procedures to comply with the national do-not-call rules” and meets the rule’s other standards, including training and scrub records. And the statute’s own affirmative defense, in 47 U.S.C. § 227(c)(5), protects a defendant that “has established and implemented, with due care, reasonable practices and procedures to effectively prevent telephone solicitations in violation of the regulations.” Our post on internal do-not-call policies covers what that written policy should contain.

None of that works if the proof is locked inside a privileged memo. So the program track holds the policies, training records, scrub logs, suppression lists, and change records, kept as ordinary business documents that the company expects to produce. The counsel track holds the lawyer’s assessment of where the program falls short and what to change.

The reason to keep them separate is waiver. The Ninth Circuit said so in Chevron Corp. v. Pennzoil Co. (9th Cir. 1992): “The privilege which protects attorney-client communications may not be used both as a sword and a shield.” A company that tells a jury it acted in good faith because its lawyers reviewed the program is likely to have to hand over what the lawyers said. If the program track can carry the good-faith defense on its own, the company never has to make that choice.

How do you fix problems without creating a willfulness admission?

Fix them fast, and describe the fix, not the violation. For Do Not Call claims, a person who received more than one call in 12 months from the same company in violation of the rules can recover actual losses or up to $500 per violation, whichever is greater, under § 227(c)(5), and a court may increase that to as much as three times that amount if it finds the defendant “willfully or knowingly violated the regulations.” Section 227(b)(3) has a parallel scheme for autodialed and prerecorded calls. I think the most dangerous document a company can create is an internal email showing it learned of a problem and kept sending anyway.

Don’t count on the rules of evidence to clean that up. Federal Rule of Evidence 407 keeps out evidence of measures taken after a harm when offered to prove “culpable conduct,” but it’s a trial rule that doesn’t stop discovery, and it lets a court admit the evidence “for another purpose.” And in a case over a cruise line’s safety-committee minutes, the Ninth Circuit held in Dowling v. American Hawaii Cruises, Inc. (9th Cir. 1992) that no privilege of “self-critical analysis” “protects routine internal corporate reviews of matters related to safety concerns.”

A remediation ticket should say what changed and when: the send-time rule now checks each number’s time zone before release, effective on a stated date. It shouldn’t say why someone thinks the old setting was illegal. That conclusion belongs in counsel’s memo. I’d also set a date for each fix before the audit starts, because the gap between a finding and a fix is where a plaintiff will look for “knowingly.” If a fix will take weeks, counsel should decide whether to pause the affected campaign in the meantime.

When does a privileged audit become discoverable?

In a few predictable ways, most of them within the company’s control.

The facts underneath it aren’t privileged, so a plaintiff can ask for the call logs and scrub records the auditors used. The company can lose protection over the analysis itself by sharing it outside the privileged circle, by relying on it to prove good faith, or by never setting it up as legal work in the first place. Lewis shows the last one. The court let the bank withhold communications among non-lawyers only where the author had been told the audit was being run by counsel to get legal advice, and it ordered production of questionnaires completed by managers when nothing showed they’d been told. Every request for information in an audit should say who is asking and why, and that it’s confidential, in the way Upjohn’s questionnaires did.

Limited disclosures don’t always waive everything. When a disclosure is made in a federal proceeding or to a federal agency, Federal Rule of Evidence 502(a) provides that a waiver reaches undisclosed material on the same subject only if it was intentional and the material “ought in fairness to be considered together.” Once a case is filed, Rule 502(d) lets the court order that privilege “is not waived by disclosure connected with the litigation pending before the court.” It’s worth asking for that order early in any case with a large production. Whatever records the audit relied on also belong in a litigation hold once a claim arrives, and our post on the Telemarketing Sales Rule and TCPA recordkeeping covers which records the FTC’s rule requires a seller or telemarketer to keep.

If an audit turns up a problem

1. Preserve the data the audit relied on: dialer and platform logs, consent records, and scrub files, under a litigation hold if a claim has already arrived.
2. Export the opt-out and internal do-not-call records with the date each request came in and the date it was honored.
3. Keep the National Do Not Call Registry scrub records and note which version of the Registry each campaign was checked against.
4. Gather vendor and lead-source contracts, message templates, and any recorded or AI-voice files tied to the finding.
5. Talk to a lawyer before writing up conclusions, contacting anyone who complained, or offering anything to settle.

For claims involving calling and texting programs flagged in a compliance audit, the firm’s California TCPA defense page sets out what the defense looks at first.

Questions businesses ask about TCPA compliance audits

Should in-house counsel or outside counsel run the audit?

Either can, but outside counsel makes the legal purpose easier to show. In-house lawyers often wear business hats, and the Ninth Circuit’s primary-purpose test asks which role a communication served. When the audit follows a demand letter or a lawsuit, outside litigation counsel also gives the work product argument a clear anchor.

Is a vendor’s standard compliance report privileged if we send it to our lawyer?

Usually not. A report the vendor would have produced anyway is a business record, and forwarding it to counsel doesn’t change that. The Kovel line protects a consultant’s work done to help the lawyer give legal advice, not the consultant’s own service. If counsel needs a vendor to dig into past campaigns, that work should be scoped and engaged separately, with results reported to counsel.

Can we use the audit to prove good faith if we’re sued?

You can, but it’s likely to cost the privilege over the audit and the advice that came with it, under the sword-and-shield rule in Chevron. That’s why the program records matter. Policies, training, scrub logs, and dated fixes can show reasonable procedures without opening counsel’s file.

Defending a TCPA claim after an internal review

If your company is facing a TCPA claim after an internal compliance review, how that review was structured can decide what the plaintiff gets to see. Rosenberger + Kawabata represents businesses defending TCPA lawsuits and class actions through its business litigation practice, including Do Not Call claims and claims over texts sent after an opt-out request. Contact Rosenberger + Kawabata online for a free and confidential consultation, or call (310) 894-6921.

Sources

The statute is the Telephone Consumer Protection Act at 47 U.S.C. § 227. The FCC’s rules are at 47 C.F.R. § 64.1200, as published in the eCFR through December 1, 2025. The procedural and evidence rules are Fed. R. Civ. P. 26, Fed. R. Evid. 407, and Fed. R. Evid. 502.

The court decisions are Upjohn Co. v. United States, 449 U.S. 383 (1981); In re Grand Jury, 23 F.4th 1088 (9th Cir. 2021) (amended Jan. 27, 2022), cert. dismissed as improvidently granted, 598 U.S. 15 (2023); In re Grand Jury Subpoena (Mark Torf/Torf Environmental Management), 357 F.3d 900 (9th Cir. 2004); United States v. Kovel, 296 F.2d 918 (2d Cir. 1961); United States v. Richey, 632 F.3d 559 (9th Cir. 2011); Chevron Corp. v. Pennzoil Co., 974 F.2d 1156 (9th Cir. 1992); Dowling v. American Hawaii Cruises, Inc., 971 F.2d 423 (9th Cir. 1992); and Lewis v. Wells Fargo & Co., 266 F.R.D. 433 (N.D. Cal. 2010).

This post is general information about the Telephone Consumer Protection Act and related laws as of December 1, 2025. It is not legal advice, and reading it does not create an attorney-client relationship. Courts and the FCC change the rules in this area often, and the outcome of any claim depends on its facts. Past results do not guarantee future outcomes.