A Pre-Launch Risk Review for Dealership Automated Outbound Campaigns

The campaign that looks free until it isn't

A vendor pitches you a reactivation campaign. Thirty thousand records out of your CRM, automated calls and texts, "we handle everything." The setup fee is small. The projected show count looks good. Your GM wants it live by the fifteenth.

Here's what nobody says out loud in that meeting: when the complaints and demand letters come, they arrive at your store. The vendor's name isn't on the caller ID. Your rooftop is. And the questions you'll be asked — who consented, when, through what form, and why did you keep dialing after they said stop — are all questions about records you either have or don't.

So before the campaign launches, run a review. Not a legal opinion. A records check. Five areas, half a day of work, and a written answer to each question with a screenshot or an export attached.

If you can't produce the evidence, the campaign doesn't go out. That's the whole gate.

1. Consent records: can you show it per record, not per policy?

The failure mode isn't "we never collect consent." It's "we collect consent and can't retrieve it for a specific phone number eighteen months later."

Pick ten random records from the campaign list. Not the first ten — random. For each one, answer:

• What form or interaction produced the consent?
• What exact language did the customer see or hear at the time?
• What date and timestamp?
• What phone number was consented, and does it match the number you're about to dial?
• Who or what system captured it, and where does that record live?

You want five of those ten to be from the oldest cohort in the list. If your reactivation pull goes back four years, test four-year-old records. That's where the retrieval gap shows up.

The language matters as much as the timestamp. Automated calling consent and "customer gave us their number" are not the same thing. A phone field filled in on a service RO is contact information. A checkbox that says the customer agrees to receive automated calls and texts about offers, including at that number, is consent. If your web form's disclosure has changed twice since 2022, you need to know which version each record was captured under — and the vendor's platform probably doesn't store that.

Ask the vendor directly: "For record 88412, show me the consent artifact — the form version, the timestamp, and the IP or channel it came through."

If the answer is a policy document instead of a record, you have your answer.

The purchased-list problem

If any portion of the list came from a third-party data source, appended numbers, or a "matched" file, treat that segment as a separate campaign with separate approval. Appended numbers are the single most common source of wrong-party contact — you dial a number that was reassigned, the new owner has no relationship with your store, and you've just made an automated call to a stranger.

Simplest control: exclude appended numbers from any automated channel. Use them for mail or manual outreach only.

2. Suppression controls: what's on the list that shouldn't be?

Your do-not-contact population is bigger than your DNC file. Build the suppression stack explicitly and confirm each layer is actually applied at send time, not just "available in the system."

Check for:

• Internal do-not-call and do-not-text flags in the CRM
• Customers who opted out through the vendor's platform on a prior campaign
• Litigation or complaint history flags
• Active deals in process — you don't want a reactivation blast landing on someone who's in the finance office
• Employees, family plans, and vendor contacts
• Recent contact within your own frequency cap (a customer who got a service reminder, a trade offer, and a sales text in the same week will complain even if every one of them was compliant)

Then do the reverse test. Take twenty records you know are suppressed, and confirm they are absent from the final send file. Not from the source pull — the final file the dialer or messaging platform will actually execute against.

Suppression that lives one system upstream of the send is suppression that will eventually fail. Every handoff between CRM, data vendor, and dialer is a place where a flag gets dropped in a field mapping.

3. Opt-out handling: test it like a customer

Your opt-out process should work on the first attempt, in plain language, on every channel, and propagate back to the CRM.

Test it yourself. Put your own cell on the list. Then:

• Reply STOP to a text. Confirm you get one confirmation and nothing after.
• Reply "stop texting me" in a full sentence. Many platforms only catch exact keywords. A customer who writes "please take me off your list" and keeps getting messages is a complaint waiting to happen.
• On a voice campaign, press the opt-out key. Then call back and confirm the number is now suppressed.
• Tell a live rep verbally to stop. Watch whether that rep knows where to record it — and check the CRM two days later to see if it's there.

That last one is where most stores fail. The automated channels usually handle opt-outs cleanly because the platform is built for it. The human channel doesn't. A customer tells a BDC agent "don't call me anymore," the agent marks the call as "not interested," and the number stays live for the next campaign.

Define one field, one place, one name for it. Then verify the vendor consumes it.

Manager check with the BDC: "Customer says stop calling. What exactly do you click, and how long until the dialer knows?"

If the answer is longer than one sentence, fix it before launch.

4. Number hygiene: are you dialing who you think you are?

Old CRM data is full of numbers that no longer belong to the person in the record. Dealership CRM reactivation campaigns reach back years by design, which makes this worse, not better.

Before send:

• Run the file against a reassigned-number check and a line-type check
• Strip or route wireless numbers according to how your campaign is configured
• Remove disconnected and invalid numbers — they hurt deliverability and inflate your cost per contact
• Deduplicate across household records so one family doesn't get four texts

Also look at the caller ID you're presenting. If the vendor dials from a rotating pool of numbers that don't belong to your store, you're both harder to trust and easier to flag as spam. Ask for branded caller ID or numbers registered to your rooftop, and check that inbound calls to those numbers reach a live person.

A customer returning a missed call should not hit a dead line. That's a business problem before it's a compliance problem.

5. Vendor audit evidence: what can they actually produce?

This is the part of the vendor risk review people skip because it feels like paperwork. It's the part that matters most when something goes wrong, because the only defense is documentation.

Ask for, in writing, before signing:

• A sample record-level consent export in a format you can read
• Their retention period for consent artifacts and call recordings
• Their opt-out propagation timeline, in hours
• Which suppression sources they ingest, and how often
• Their process when a complaint comes in — who gets notified at your store, and how fast
• Whether subcontractors touch the dialing, and who they are
• Indemnification language and what triggers it

Then ask the question that separates real vendors from resellers: "Walk me through the last complaint you handled for another dealer client. What did you produce, and how long did it take?"

A capable partner has a rehearsed answer. A reseller changes the subject.

Put it on one page

Make this a signed pre-launch form, not a conversation. Five sections, one owner per section, one date, and the evidence attached.

Re-run the whole thing quarterly, and any time you change vendors, change your web form language, or add a new channel. Dealership outbound compliance isn't a one-time clearance — it's a condition your data drifts out of.

The upside of doing this: you launch with a list you trust, which means your BDC stops apologizing on the first ten seconds of every call. Cleaner list, better conversations, fewer complaints for you to personally handle at 6 p.m. on a Friday.

And once the campaign is live, the same discipline applies to what happens on the calls it generates. Reviewing a sample of those conversations each week — what reps said, whether opt-out requests were honored on the spot, whether the pitch matched the disclosure — is how you find out the gate is still holding. Tools like MoreSignal make that sampling routine instead of something you get to when there's time.