Contacting STR Owners Legally: TCPA, DNC and CAN-SPAM Basics

Permit records are public. People reliably draw the wrong conclusion from that, which is that anything they do with the records must therefore be fine. Public-record status governs whether you may lawfully hold the data. It says nothing about how you may contact the person in it.

Those are two separate bodies of law, and the second one is where the money is — the Telephone Consumer Protection Act carries statutory damages per violating call, class actions are routine, and "we bought the list from someone else" has never been a defence.

The four rules that apply

The TCPA governs calls and texts. Its sharpest teeth involve automated dialing and prerecorded messages, and calls to wireless numbers.

The Telemarketing Sales Rule and the National Do Not Call Registry govern who you may call for telemarketing purposes and when.

CAN-SPAM governs commercial email — far less onerous than the phone rules, but not nothing.

State law sits on top of all of it, and several states are considerably stricter than the federal baseline. Florida and Oklahoma both have mini-TCPA statutes with their own consent requirements and their own private rights of action.

The B2B assumption, and why it is dangerous here

Here is the belief that gets short-term-rental vendors in trouble.

People know, roughly, that business-to-business telemarketing sits outside some of the consumer rules. That is broadly true as far as it goes: the Telemarketing Sales Rule's Do-Not-Call provisions do not apply to calls to businesses, and live (non-automated) calls to a business landline generally do not require prior consent under the TCPA.

Now look at what is actually in a short-term-rental permit record.

The phone number on a permit application is, very often, the owner's personal mobile number. They are not a company with a switchboard. They are a schoolteacher who rents out a condo, and the number they wrote on the form is the phone in their pocket. Many permit programs specifically require a number that a human will answer around the clock, which pushes applicants toward exactly that.

The moment the number is a personal wireless number, the comfortable B2B framing stops protecting you:

• Calls and texts to wireless numbers using an automatic telephone dialing system or an artificial or prerecorded voice require prior express written consent for marketing — and that requirement does not evaporate because you consider the call business-to-business.
• An individual who registered their personal number on the Do Not Call list has done so regardless of the fact that they also own a rental property.
• Whether a given operator counts as "a business" at all is a judgement call, and it is not your judgement that matters if it is litigated.

There is no blanket B2B exemption that makes short-term-rental outreach automatically compliant. Anyone who tells you otherwise is describing a simpler world than the one you are selling into.

What this means practically

Manual dialing is materially safer than automated dialing. The most severe TCPA exposure attaches to autodialers and prerecorded messages. A human being pressing the digits, having a live conversation, sits in a much better place. It is slower. It is also the reason a lot of successful operations in this space run small, well-trained phone teams rather than power dialers.

Scrub against the Do Not Call registry. Access requires registering as a subscriber. If you are calling individuals — and in this dataset you frequently are — scrubbing is basic hygiene, and skipping it is the kind of shortcut that shows up in a demand letter.

Keep records. Log which list a number came from, when you called, what happened, and every opt-out. If a complaint ever arrives, contemporaneous records are the difference between a nuisance and a serious problem.

Honour opt-outs immediately and permanently. Maintain a suppression list that survives list refreshes. Re-importing a fresh file and calling someone who already told you to stop is one of the most common own goals in the industry.

Respect calling hours. Federal rules restrict telemarketing calls to between 8am and 9pm in the recipient's time zone. Permit data includes the property address, so you have no excuse for getting the time zone wrong — though note the owner may not live where the property is.

Check the state. Florida's mini-TCPA and Oklahoma's equivalent impose their own requirements, and other states have their own registries and restrictions. If a state is a big part of your plan, look it up specifically.

Email is a gentler regime

CAN-SPAM is much less demanding than the phone rules. It does not require prior consent. What it requires is:

• Accurate headers and sender information — no forged "from" addresses or misleading routing.
• A subject line that reflects what the message is actually about.
• Identification of the message as an advertisement, where that is not otherwise obvious.
• A valid physical postal address in the message.
• A working, obvious way to opt out — and honouring opt-outs promptly, within ten business days.

Two footnotes. First, the fact that CAN-SPAM permits unsolicited commercial email does not mean your email service provider does; most mainstream providers prohibit cold sending in their terms regardless of the law, and will close your account before a regulator ever notices you. Second, if you send to recipients outside the US, other regimes apply and several of them do require prior consent.

Direct mail

Physical mail to a property address is the least regulated of the three channels, and it happens to be the natural fit for the address-level markets where no phone number is published. If you are working Texas, Washington, Tennessee, Colorado or any of the other registers that publish addresses without contact details, mail is not a consolation prize — it is the channel the data was shaped for.

Two things we will not do

Worth stating plainly, because it explains some of what you will not find in our product.

We do not scrub Do-Not-Call for you. DNC access is licensed to the organization doing the calling, and the scrub has to reflect your calling program, not ours. We tell you the data is unscrubbed rather than implying a clearance we cannot give.

We do not sell Idaho or Iowa data, for a different reason: both states preempted local short-term-rental permitting, so the registers do not exist. Explanation here. Any vendor offering those states is selling you something other than permit records.

A workable starting posture

For most companies selling into this market, a defensible program looks like this: manual dialing rather than an autodialer, a DNC scrub before every campaign, a permanent suppression list, calling hours based on the recipient's time zone, careful attention to the stricter states, complete records of everything, and a lawyer who has read your actual scripts and process.

None of that is exotic, and none of it slows a good operation down much. What it does do is keep a channel that works from turning into a liability — which matters, because permit data is one of the few genuinely durable lead sources in this industry, and it would be a shame to burn it on a shortcut.

Our full customer terms, including the licence and your compliance obligations, are on the terms page.