CRM consent records: an audit before any AI or outbound calling

The pitch for AI calling usually shows up as a demo. A voice agent works through a call list and drops a meeting on a rep’s calendar while you watch. What the demo skips is the question your CRM has to answer before the first call goes out: who agreed to be called, on which number, when, and who has since said stop.

Across the 150+ B2B companies we’ve worked inside, roughly 7 in 10 had material CRM data accuracy problems.

Consent is CRM data. It sits in the same fields, gets typed in by the same reps and gets split by the same duplicates, so it inherits the same problems you can read about in what dirty CRM data looks like up close. A human team calls through those problems slowly. An AI dialer calls through them at whatever pace you set.

This is a CRM consent records checklist you or an admin can run in your own CRM this week. Each section starts with what the rule expects, then asks yes or no questions you can answer by looking at your records.

Why is consent a CRM problem before it is a legal one?

In February 2024 the FCC ruled, in Declaratory Ruling FCC 24-17, that calls using an AI-generated or simulated voice count as artificial or prerecorded voice calls under the TCPA. The caller needs the called party’s prior express consent, and prior express written consent when the call contains telemarketing or an advertisement. Whether you have that consent is a record in your CRM. A belief that the list is clean proves nothing.

That ruling covers the voice on the call. AI that researches accounts, drafts emails or preps a rep before a call is a different question. The legal detail, including who the rules cover, lives in our paper on whether AI cold calling works. If you are still deciding whether an AI SDR belongs in your motion at all, start with that question.

This paper stays on the records. Your team thinks it has a compliance question. It has a data question with a regulator attached.

A consent record has four parts. Count how many yours stores.

Under the FCC’s rules, 47 CFR 64.1200(f)(9), prior express written consent is a written agreement, signed by the person called, that authorizes calls using an autodialer or an artificial or prerecorded voice, names the phone number those calls may go to, and discloses that signing is not a condition of purchase. A CRM record that proves it holds four things: the number, the date and time, the source and the wording the person saw.

A checkbox called “OK to call” with no date and no source can’t show any of that. It records that someone, at some point, clicked something.

Checklist

• Is consent stored against a specific phone number, or against the person in general?
• Does each consent entry carry a date and time?
• Does the record show the source: which form, page or signed document?
• Can you pull up the exact wording or form version the person agreed to?
• Is there one record per person? Duplicates split consent across two contacts, and the dialer can reach the one without it. If you run HubSpot, read how duplicate contacts build up.

Does your CRM even have a place for phone consent?

Check before you assume. The consent fields HubSpot and Pipedrive document are built around email and messaging, so phone consent for calling usually needs its own field or record. When a HubSpot user manually subscribes a contact, HubSpot asks them to select a legal basis for communicating and enter an explanation of the consent, when data privacy settings are turned on (HubSpot Knowledge Base, updated June 18, 2026).

HubSpot also ties one calling block to email. When a contact’s “Unsubscribed from all email” property is true, a user can’t call that contact without first giving a one-time legal basis for communicating with them (same HubSpot article, updated June 18, 2026). That guardrail fires on an email unsubscribe. It is not a phone do-not-call flag, and a person who says stop on a call hasn’t touched their email settings.

For texting, HubSpot requires explicit consent from contacts before you message them by SMS, and lets you manually opt in only contacts who have given express and verifiable consent (HubSpot Knowledge Base, updated September 29, 2026).

Pipedrive’s Campaigns tool tracks consent in a custom field called marketing status, and that status is attached to an email address (Pipedrive Knowledge Base, updated September 3, 2026).

If you run Salesforce, check which field or record your team treats as the phone opt-out and whether it carries a date.

Before you add a new field, look for an old one someone already built and abandoned. Field bloat is how a CRM ends up with more than one “Do Not Call” checkbox and no agreement on which one counts.

Checklist

• Is there a phone consent field that is separate from email subscription status?
• Is it tied to a specific number?
• Does it carry a date and a source?
• Does your dialer read that field, or a separate list someone exported once?

Opt-outs have a clock, and the CRM has to start it

A person can revoke consent, including prior express written consent, by any reasonable method that clearly says they want no further calls or texts (47 CFR 64.1200(a)(10)). The same rules say a revocation must be honored within a reasonable time, not to exceed ten business days from receipt. Anyone calling for telemarketing must also keep a record of do-not-call requests and honor each one for 5 years (47 CFR 64.1200(d)(6)).

“Any reasonable method” means the stop request can arrive anywhere: a reply email, a voicemail, a line in a rep’s call notes or a sentence said to the AI voice agent itself. The ten-day clock starts when the request arrives. The CRM needs one opt-out field, with a date, that all four of those channels feed.

If that field depends on a rep remembering to type it in after a bad call, read why good reps enter bad data before you trust it.

Checklist

• Where do verbal “stop calling me” requests get written down?
• Who updates the opt-out field, and how fast?
• Does the dialer read that field before each call?
• When two records merge, does the opt-out and its date survive?

Is your do-not-call scrub documented anywhere?

The FCC’s safe-harbor rule, 47 CFR 64.1200(c)(2), expects a caller to check numbers against a version of the national do-not-call registry no more than 31 days old, and to keep records documenting that process. A scrub that ran inside a dialer, with no log anyone on your team can pull, leaves you nothing to show. The audit question is whether you can prove when the last scrub ran and against which version.

Checklist

• When did the last scrub run?
• Which registry version did it use?
• Where is the log, and who can open it?
• Are scrub results written back to the CRM, or only to the dialer?

The table maps each rule above to a record you can check.

Call logs and recordings are evidence too

In HubSpot calling, recording and transcription are on by default, so inbound and outbound calls get recorded unless an admin turns recording off or sets exceptions. HubSpot says it is the users’ responsibility to obtain consent from call participants (HubSpot Knowledge Base, updated September 14, 2026). Recording consent is a separate question from calling consent, and your CRM should store them separately.

HubSpot can require call outcome logs only for outbound calls placed from the HubSpot browser or already-logged calls, not for inbound, mobile or imported calls (HubSpot Knowledge Base, updated September 1, 2026). If your dialer’s calls land in HubSpot as imported calls, that requirement doesn’t reach them. The same article says admins can block outbound and inbound high-risk or non-compliant phone numbers in the calling settings, which applies to HubSpot’s own calling tool rather than a third-party dialer.

An AI dialer that writes call results back to your CRM is an agent with write access. Decide what it may change before it starts.

Checklist

• Is each AI-dialer call logged back to the right contact with an outcome?
• Is your recording setting a decision someone made, or a default left as it shipped?
• Is recording consent stored apart from calling consent?
• If you use HubSpot calling, has an admin reviewed the blocked-numbers setting?

What should you do before turning on AI calling?

Get the records right before the dialer starts, in five steps. The order matters: merging duplicates first means the consent fields you add next attach to one record per person, and the opt-out routing you build after that has a single place to land.

1. Merge duplicates so consent isn’t split across two records.
2. Add a dated phone consent field tied to the number, and a dated opt-out field.
3. Route each stop request, from any channel, to that opt-out field.
4. Document the registry scrub and write the results back to the CRM.
5. Log each dialer call back to the contact with an outcome.

You can run this checklist yourself this week. Pull ten contacts your team plans to call and try to answer each question from the CRM alone. If the answers live in someone’s memory, a spreadsheet or a dialer export, you’ve found the gap while it is still ten contacts and not ten thousand calls.

Or have the CRM checked before a dialer touches it. The free CRM Diagnostic is read-only, runs 40+ automated checks and works on HubSpot, Salesforce and Pipedrive, so you know where your data stands before you put a calling program on top of it.

This is not legal advice. Rules as of October 2026; check with counsel before any calling program.