TCPA Consent Records vs. CCPA Deletion Requests: What to Keep

A deletion request can wipe out the very record that defeats a TCPA claim. California’s privacy statute lets a business keep information it needs to comply with a legal obligation or to defend legal claims, and the FCC’s rules require a company to keep do-not-call requests for five years. A company that decides in advance which calling and texting records stay, and why, avoids both a privacy complaint and a hole in its defense.

Does a CCPA deletion request erase our TCPA consent records?

Not automatically. The California Consumer Privacy Act gives a consumer “the right to request that a business delete any personal information about the consumer which the business has collected from the consumer,” under Civil Code § 1798.105(a). The same section lists exceptions. A business isn’t required to delete if keeping the information is reasonably necessary to “Comply with a legal obligation,” in subdivision (d)(8).

A second section is broader. Civil Code § 1798.145(a)(1) says the Act’s obligations “shall not restrict a business’s ability to” “Comply with federal, state, or local laws” and “Exercise or defend legal claims.”

I’d treat those two exceptions differently in practice. The legal-obligation exception fits records a rule makes you keep. The legal-claims exception fits records tied to a claim you’re facing or can point to. I wouldn’t lean on it for a log you’re keeping on the theory that someone might sue someday, and I’d write down the reason for each category of record you retain.

Which TCPA records does a rule make you keep?

The clearest one is the do-not-call record. Under 47 C.F.R. § 64.1200(d)(6), a company making telemarketing calls “must maintain a record of a consumer’s request not to receive further calls. A do-not-call request must be honored for 5 years from the time the request is made.” That is a legal obligation by any reading, so a deletion request shouldn’t remove the entry that tells you not to contact the person.

The National Do Not Call Registry safe harbor also depends on paperwork. To use it, a caller must show it “uses a process to prevent telephone solicitations to any telephone number on any list established pursuant to the do-not-call rules, employing a version of the national do-not-call registry obtained from the administrator of the registry no more than 31 days prior to the date any call is made, and maintains records documenting this process,” per § 64.1200(c)(2)(i)(D). Those scrub records are about the company’s process, not about one consumer’s profile, and they usually don’t contain the consumer’s personal data beyond a number.

Consent records are the gray area. No rule I’m aware of tells you how long to keep a customer’s consent form, so it’s an open question whether the legal-obligation exception covers them. Their protection comes from the legal-claims exception once a dispute exists, and from the preservation duty once litigation is reasonably foreseeable. Federal Rule of Civil Procedure 37(e) says that if electronically stored information “that should have been preserved in the anticipation or conduct of litigation is lost because a party failed to take reasonable steps to preserve it,” a court can order curative measures, and on a finding of intent to deprive can instruct the jury to presume the information was unfavorable. The text is at Rule 37(e). A deletion request that arrives alongside a demand letter should trigger a hold, not a purge. That’s the point where the privacy team and the litigation team need to be talking to each other, and in many companies they never have.

What should a deletion workflow do with the phone number?

Keep a suppression entry. The CCPA addresses this directly: “The business may maintain a confidential record of deletion requests solely for the purpose of preventing the personal information of a consumer who has submitted a deletion request from being sold, for compliance with laws or for other purposes, solely to the extent permissible under this title,” in § 1798.105(c)(2).

Picture the failure I’d expect. A customer asks for deletion, the system purges the number and the consent log, and a month later a purchased list or a re-import puts the same number back on a campaign. The company now has no consent record and no record of the request, and it has texted someone who asked to be forgotten. A suppression entry that holds the number and the date of the request prevents that. A deletion request is not itself a stop request under the TCPA, but I’d treat it as one for marketing until the customer says otherwise, because the cost of being wrong is a claim.

Some teams hold only a hashed version of the number in the suppression list. That can work as a technical matter, but whether a hash still counts as personal information is a question for your privacy counsel, and I wouldn’t adopt it without asking.

What happens if the records are gone when the lawsuit arrives?

The court asks whether the loss was avoidable. Rule 37(e) asks whether the party “failed to take reasonable steps to preserve” the information and whether it can be “restored or replaced through additional discovery.” A retention schedule written before the dispute, applied consistently, is the best evidence that the deletion was routine and not a reaction to a claim. A purge done the week after a demand letter looks very different, even if the underlying request was a genuine privacy request.

Copies matter too. Your texting platform and your lead vendor may hold logs you’ve deleted, and so may the carrier. If those can be subpoenaed, the plaintiff may get the records anyway, and a court may ask why your own copy is missing. I’d find out what each vendor retains before you need to answer that question, and I’d put the answer in the contract.

What to put in the retention plan

1. Write a retention schedule that names each TCPA record category, how long it is kept, and the legal reason, so a deletion request has a documented answer.
2. Route every deletion request through a check against open claims and litigation holds before anything is purged.
3. Build a suppression list that survives deletion and feeds every campaign and vendor platform.
4. Tell service providers and texting platforms which logs they must keep and which they must delete, in the contract.
5. Have counsel review the schedule before a dispute starts, since an after-the-fact explanation of a purge is a much harder conversation.

The firm’s California TCPA defense page describes how demand letters and class actions proceed. For what happens when logs vanish, see the earlier post on TCPA spoliation of dialer and SMS data, and for the audit side, how to run a privileged TCPA compliance audit.

Questions businesses ask about privacy requests and TCPA records

Is a deletion request the same as asking us to stop texting?

Not by its terms. The TCPA’s stop rules apply to a request not to receive calls or messages, and a deletion request asks for something else. A customer may mean both. I’d read an ambiguous request as covering marketing contact and suppress accordingly, while keeping the transactional messages the customer still expects.

Can we keep the consent record just in case?

Sometimes. If a dispute exists or is reasonably foreseeable, the legal-claims exception and the preservation duty support keeping it. If neither is true, a documented retention schedule with a stated legal reason is safer than an open-ended practice of keeping everything.

Does the five-year rule apply to every list?

It applies to the record of a consumer’s request not to receive further telemarketing calls, per the FCC’s rule. It doesn’t say anything about the lifespan of consent records. Treat them separately in the schedule.

Do our vendors have to delete too?

The statute directs a business to notify service providers or contractors to delete. The exceptions apply to them as well, so your contract should say which TCPA logs a vendor keeps.

Defending claims that turn on missing records

If your company has been sued or received a demand letter and the consent logs or opt-out history are incomplete, how and why the records were retained or deleted will matter. Rosenberger + Kawabata represents businesses defending TCPA lawsuits and class actions through its business litigation practice, including claims involving consent records and do-not-call compliance. Contact Rosenberger + Kawabata online for a free and confidential consultation, or call (310) 894-6921.

Sources

The privacy statutes are California Civil Code § 1798.105 and Civil Code § 1798.145. The FCC’s rules are at 47 C.F.R. § 64.1200, as published in the eCFR on January 22, 2026. The federal rule is Federal Rule of Civil Procedure 37.

This post is general information about the Telephone Consumer Protection Act and related laws as of January 22, 2026. It is not legal advice, and reading it does not create an attorney-client relationship. Courts and the FCC change the rules in this area often, and the outcome of any claim depends on its facts. Past results do not guarantee future outcomes.