Resource libraryResource23 min read

Roofing Storm Marketing Compliance Checklist: Direct Mail, Calls, Texts, Email, Canvassing, and Tracking

A practical compliance checklist for roofing direct mail, telemarketing, SMS, email, canvassing, QR tracking, privacy, and storm-related advertising claims.

Important: This guide is general educational information, not legal advice. Marketing, privacy, telemarketing, contractor-licensing, insurance, solicitation, call-recording, and consumer-protection requirements vary by channel, technology, state, municipality, and campaign. Have qualified counsel review your company's actual practices, forms, vendors, scripts, and target markets before launch. Recheck requirements regularly, because laws and regulatory guidance change.

This roofing marketing compliance checklist walks every storm channel you run, direct mail, calls, texts, email, canvassing, and tracking, and gives you the controls to launch fast without launching reckless.

Why storm marketing needs a real compliance workflow

Speed pays after severe weather. Uncontrolled speed costs you.

You can fire up direct mail, canvassing, calls, texts, email, search ads, social audiences, QR codes, landing pages, and referral campaigns within days of an event. Each channel carries its own obligations. You are also handling property records, owner information, customer lists, vendor data, call recordings, photographs, and insurance-related language.

A footer slapped on the bottom of a postcard cannot govern all of that.

Run compliance the way you run campaign operations:

Identify the trigger and target audience.
Determine which rules apply to the channel and market.
Apply consent and suppression controls.
Review claims, scripts, creative, forms, and disclosures.
Preserve proof of approval and campaign lineage.
Monitor complaints and opt-outs.
Stop activity fast when a problem appears.
Retain records under a written policy.

The point is not timid marketing. The point is that every message you send is accurate, permission-aware, auditable, and fair to the homeowner.

The five rules that apply to every channel

1. Tell the truth

Do not make a statement that is false, misleading, unverifiable, or likely to create a mistaken impression. The overall message is what counts, not merely whether each sentence is technically defensible in isolation.

Avoid implying that:

A specific roof is damaged before a qualified inspection.
A weather map proves damage at the property.
An insurance company has approved or will pay a claim.
A claim must be filed by an invented deadline.
The contractor is affiliated with a government agency, insurer, manufacturer, or homeowners association when it is not.
An inspection is required by law or an insurer when it is not.
A "free roof" is available.
A deductible can legally be waived in every jurisdiction.
A precomputed price is a binding final estimate when site conditions can change it.

Use accurate conditional language. A recent event may justify an inspection. An inspection can determine whether observable damage is present. Coverage decisions belong to the insurer under the policy. Final scope and price depend on verified conditions and contract terms.

2. Identify the business

The homeowner should be able to tell who is contacting them, how to reach you, and why the message was sent.

Use the legal or properly registered business name where required. Include license numbers, qualifying-party information, address, phone, and any other disclosures required by state contractor boards, local ordinances, postal rules, channel rules, or your counsel.

Never dress a marketing message up as an official weather notice, insurance notice, warranty directive, parcel assessment, government document, or neighborhood association communication.

Consent is channel-specific. Permission to receive an estimate does not automatically authorize every kind of automated call, recurring text, email campaign, or third-party marketing.

Keep one central suppression system that can stop outreach across every vendor and channel. A person who says "stop," "do not contact me," or equivalent language should never have to repeat the request to each branch or subcontractor.

4. Minimize and secure data

Use only the data the approved purpose needs. Restrict access, encrypt sensitive information, review vendors, and set retention and deletion rules.

Publicly available information is not automatically unrestricted. Data-source contracts, privacy laws, consumer-reporting restrictions, platform policies, and ethical expectations may limit collection, combination, targeting, or resale.

5. Preserve proof

You should be able to reconstruct:

The audience source.
The date the data was obtained.
The applicable consent record.
Suppression files and matching logic.
Creative and script version.
Approver and approval date.
Send or call date and vendor.
Opt-out and complaint history.
Landing-page disclosures.
CRM handoff and subsequent contact.

Without records, you may know you followed a process but be unable to prove it.

Direct-mail compliance checklist

Direct mail works well for property-level storm outreach because it does not need a phone number or email address. It is not regulation-free.

Audience and data

[ ] Document whether the campaign uses addressed mail or USPS Every Door Direct Mail.
[ ] Confirm that address and owner data may be used for the planned purpose under vendor contracts and applicable law.
[ ] Suppress prior company opt-outs when the request reasonably covers postal marketing.
[ ] Remove current jobs, recent roof replacements, duplicates, invalid addresses, deceased records where known, and other inappropriate contacts.
[ ] Separate owner mailing address from property address when the owner is not an occupant.
[ ] Keep sensitive ownership or financial inferences off the outside of the mailpiece.

Postal production

[ ] Validate mailpiece size, weight, address placement, indicia, postage class, and preparation rules with USPS or an experienced mail provider.
[ ] For EDDM, confirm current route, saturation, quantity, bundling, facing-slip, form, and drop-off requirements.
[ ] For addressed mail, use address hygiene and approved postal processing appropriate to volume and class.
[ ] Test every personalized field so one homeowner does not receive another property's information.
[ ] Test every QR code and URL before the final print authorization.
[ ] Retain the approved proof, mailing file hash or version, production count, postal documentation, and in-home estimate.

Creative and claims

[ ] Identify the contractor clearly.
[ ] Include contractor-license and advertising disclosures required in the target state or locality.
[ ] State that weather exposure does not establish damage at a specific property.
[ ] Avoid insurer, government, manufacturer, or HOA visual mimicry.
[ ] Do not print "final notice," "urgent claim notice," "official assessment," or similar language unless it is truthful and appropriately authorized.
[ ] Explain material conditions on any offer, rebate, financing, discount, or inspection promotion.
[ ] Do not advertise a deductible waiver or insurance benefit without jurisdiction-specific legal approval.
[ ] Give the recipient a practical way to request no further marketing.

EDDM vs addressed mail

USPS EDDM targets carrier routes and does not need a named address list on each piece. It covers a broad neighborhood. It is not the same as property-level selection.

Addressed mail fits when Hail Trigger has picked specific properties on scoring, suppression, prior-customer status, or individual attribution. Your campaign team should never describe an EDDM route drop as one-to-one property targeting.

Telemarketing and phone-call checklist

Federal and state rules can apply differently to live calls, prerecorded messages, artificial or AI-generated voice, autodialing technology, residential lines, wireless numbers, business lines, existing customers, and inbound requests. State requirements may be stricter than federal requirements.

Before any outbound calling campaign

[ ] Have counsel classify the campaign, call technology, audience, and applicable federal and state requirements.
[ ] Register for and access the National Do Not Call Registry where required.
[ ] Scrub covered call lists against a version of the Registry downloaded within the legally required interval; FTC guidance describes a 31-day update requirement under the Telemarketing Sales Rule.
[ ] Apply the company's own entity-specific do-not-call list regardless of any external-list exception.
[ ] Apply state do-not-call lists and state-specific restrictions where applicable.
[ ] Validate consent records before any prerecorded, artificial-voice, automated, or otherwise consent-dependent call.
[ ] Do not assume an established business relationship authorizes every call type.
[ ] Define permissible calling days and hours for every target state.
[ ] Confirm caller-identification, disclosure, abandoned-call, and recordkeeping requirements.
[ ] Train representatives to honor a do-not-call request immediately.

During the call

[ ] Identify the caller and contractor accurately.
[ ] State the commercial purpose without a deceptive pretext.
[ ] Do not say that the property was damaged unless verified through an appropriate inspection.
[ ] Do not guarantee insurance coverage, claim approval, or a no-cost roof.
[ ] Do not pressure the homeowner with a false claim deadline.
[ ] Follow the approved script and document material deviations.
[ ] Stop the sales pitch when the consumer asks not to be called.
[ ] Disclose recording or monitoring as required by the states connected to the call and by company policy.

After the call

[ ] Record disposition, consent basis, and any opt-out immediately.
[ ] Synchronize the suppression request across dialers, CRM records, lead vendors, branches, and agencies.
[ ] Investigate wrong-party, reassigned-number, spoofing, and identity complaints.
[ ] Retain call detail and consent evidence according to counsel-approved policy.

A data vendor can hand you a phone number. That number does not establish that the person consented to receive a particular contractor's telemarketing call using a particular technology.

Treat identity data and consent data as separate records. Consent evidence should identify who consented, what they agreed to receive, which seller was named, the channel and technology covered, the disclosure shown, the date and time, the source page or form, and how the record can be authenticated.

SMS and messaging compliance checklist

Texts feel conversational, but marketing texts can create significant exposure. FCC consumer guidance states that commercial texts require written consent. The legal analysis can also depend on the sending technology, content, consent language, seller identity, and state law.

A conservative roofing policy is to send marketing texts only when you hold counsel-approved, prior express written consent for that contractor and message type.

[ ] Do not cold-text a purchased list merely because phone numbers are available.
[ ] Capture affirmative consent through a clear, unchecked mechanism.
[ ] Identify the contractor that will send the messages.
[ ] Describe the marketing nature, expected frequency, and automated technology where applicable.
[ ] State that consent is not a condition of purchase where required.
[ ] Link terms and privacy disclosures.
[ ] Store the exact disclosure version, source, timestamp, number, user action, and verification evidence.
[ ] Separate transactional appointment messages from promotional sequences.
[ ] Reconfirm whether a lead-generator consent names the specific contractor and satisfies current requirements.

Message controls

[ ] Identify the business in the initial message.
[ ] Include recognized opt-out instructions such as STOP where appropriate.
[ ] Process opt-outs immediately and suppress common natural-language requests.
[ ] Do not continue a promotional sequence after revocation.
[ ] Use counsel-approved sending windows by recipient location.
[ ] Avoid misleading statements about damage, insurance, deadlines, or affiliation.
[ ] Monitor carrier, platform, and registration requirements in addition to law.

Operational controls

[ ] Prevent a CRM automation, branch user, or agency from re-enrolling a suppressed number.
[ ] Maintain evidence that the number belonged to the consenting person at the time of consent.
[ ] Establish a process for reassigned numbers and wrong-party complaints.
[ ] Review links for security, accurate domains, and mobile usability.
[ ] Audit all vendors that can send on the contractor's behalf.

Commercial email checklist

The federal CAN-SPAM Act applies to commercial email, including business-to-business marketing. FTC guidance emphasizes accurate header information, nondeceptive subject lines, clear advertising identification, a valid physical postal address, an accessible opt-out mechanism, prompt opt-out processing, and responsibility for vendors sending on your behalf.

Before sending

[ ] Determine whether the message is commercial, transactional or relationship-based, or mixed.
[ ] Use an accurate From name, From address, Reply-To address, and originating domain.
[ ] Write a subject line that accurately reflects the message.
[ ] Clearly identify promotional email as advertising where required.
[ ] Include the company's valid physical postal address.
[ ] Include an easy, conspicuous unsubscribe mechanism.
[ ] Suppress prior unsubscribes and company-wide opt-outs.
[ ] Confirm any state privacy or industry rules that create additional obligations.

After sending

[ ] Keep the opt-out mechanism operating for the required period.
[ ] Honor opt-out requests within the required time; FTC guidance states within 10 business days.
[ ] Do not charge, demand unnecessary personal information, or require more than the permitted steps to unsubscribe.
[ ] Do not sell or transfer suppressed addresses except as allowed to support compliance.
[ ] Monitor agencies and email providers, because the contractor cannot contract away responsibility.
[ ] Record creative version, audience, send time, unsubscribe file, complaints, and vendor.

Deliverability is not compliance

An email can pass a spam filter and still break the law or your own policy. A compliant email can still land in spam. Keep your legal, privacy, authentication, reputation, and content-review workstreams separate.

Door-to-door and canvassing checklist

Canvassing requirements can vary at the state, county, city, and HOA level. Local rules may address solicitor permits, registration, badges, hours, handbills, no-soliciting signs, private communities, identification, background checks, contracts, cancellation rights, and weather-emergency restrictions.

Territory readiness

[ ] Confirm contractor licensing and registration in the work area.
[ ] Confirm solicitor permits and rep credentials for each municipality.
[ ] Map restricted communities, no-soliciting addresses, and prior company opt-outs.
[ ] Establish approved days and hours.
[ ] Train reps to leave immediately when asked.
[ ] Prohibit entry into fenced, posted, unsafe, or clearly private areas.
[ ] Establish severe-weather, heat, traffic, and lone-worker safety rules.

Rep conduct

[ ] Wear accurate company identification.
[ ] State the company and purpose promptly.
[ ] Never claim to represent an insurer, government agency, utility, manufacturer, or neighborhood organization without authorization.
[ ] Never state that the roof is damaged based solely on a map or street observation.
[ ] Do not photograph people, interiors, or restricted areas without appropriate permission.
[ ] Respect no-soliciting signs and verbal refusals according to law and company policy.
[ ] Do not leave materials where prohibited or where they create litter or safety issues.
[ ] Do not use fear, invented deadlines, or claims that "all your neighbors have filed."

At-home contracts

Sales made at a consumer's home can trigger federal or state cancellation, disclosure, and contract requirements. The FTC Cooling-Off Rule and state home-solicitation laws may apply depending on the transaction and jurisdiction.

[ ] Use state-approved contract forms and notices.
[ ] Deliver required copies and cancellation forms.
[ ] Do not start work or collect nonpermitted funds during a cancellation period.
[ ] Explain financing, contingencies, insurance-related provisions, and cancellation rights accurately.
[ ] Preserve signed documents, timestamps, and delivery evidence.

Digital advertising and audience checklist

Storm-related digital campaigns can involve uploaded customer lists, property-derived audiences, geofencing, retargeting, lookalikes, search ads, social ads, and platform lead forms.

Audience controls

[ ] Confirm the company has the right to upload or use the audience data.
[ ] Review each advertising platform's customer-list, housing, financial, sensitive-event, and personalized-ad policies.
[ ] Do not target or imply sensitive personal circumstances that the platform or law restricts.
[ ] Suppress current customers or prior opt-outs where appropriate.
[ ] Avoid audience definitions that could create unlawful discrimination or unfair treatment.
[ ] Document the source and date of each uploaded list.
[ ] Delete or refresh platform audiences according to policy.

Ad creative

[ ] Match the ad to the landing page.
[ ] Identify the contractor and service area accurately.
[ ] Distinguish weather awareness from verified property damage.
[ ] Substantiate claims such as ratings, certifications, warranties, "number one" status, savings, or response times.
[ ] State material terms for promotions, financing, rebates, and limited availability.
[ ] Do not use a homeowner's property image in an ad without approved rights and context.

Lead forms

[ ] Explain who will contact the consumer and by which channels.
[ ] Use separate, conspicuous consent language for consent-dependent calls or texts.
[ ] Do not bundle unrelated sellers into vague consent.
[ ] Store the form version and proof of submission.
[ ] Secure data transmission and restrict lead access.

QR code, landing page, and attribution checklist

Property-specific tracking sharpens measurement, but design it so attribution never turns into unnecessary surveillance or data exposure.

QR and URL design

[ ] Use HTTPS and a domain clearly associated with the contractor or disclosed service provider.
[ ] Do not place a homeowner name, phone number, email, claim detail, or other sensitive information in a visible URL.
[ ] Use random or non-guessable identifiers rather than sequential property IDs.
[ ] Prevent one recipient from viewing another property's personalized information.
[ ] Set expiration, fallback, and redirect behavior.
[ ] Test printed codes at actual size, finish, lighting, distance, and device type.
[ ] Maintain a manual response option for recipients who do not use QR codes.

Landing-page disclosures

[ ] Identify the contractor.
[ ] State why the recipient may have received the message without claiming verified damage.
[ ] Link a current privacy notice.
[ ] Explain material data collection and tracking where required.
[ ] Use separate consent language for calls, texts, or email.
[ ] Provide a contact and opt-out mechanism.
[ ] Make accessibility, mobile speed, and form validation part of QA.

Analytics

[ ] Define which events are necessary for campaign measurement.
[ ] Avoid sending sensitive form values to analytics or advertising platforms.
[ ] Prevent personally identifiable information from appearing in page URLs or UTM parameters.
[ ] Configure retention and user access.
[ ] Review cookie, tracking, and consent requirements for target jurisdictions.
[ ] Reconcile anonymous analytics with identified CRM records only under an approved data design.

Privacy and data-governance checklist

Privacy obligations can depend on the states involved, company size, revenue, data volume, consumer type, use case, and contractual relationships. Do not assume privacy laws apply only to national technology companies. They can reach a roofing company too.

Data inventory

[ ] Map every source of property, owner, phone, email, customer, job, payment, image, location, device, and campaign data.
[ ] Identify the legal entity controlling each dataset.
[ ] Record the purpose, permitted use, retention period, users, vendors, and transfer locations.
[ ] Mark sensitive fields and prohibit unnecessary collection.

Vendor management

[ ] Review data-source rights, accuracy disclaimers, resale restrictions, and deletion obligations.
[ ] Use written agreements with processors, agencies, call centers, print houses, data providers, and software vendors.
[ ] Require reasonable security, incident notification, access controls, confidentiality, and data return or deletion.
[ ] Confirm whether subcontractors or offshore personnel can access homeowner data.
[ ] Audit integrations and revoke unused credentials.

Consumer requests

[ ] Publish a truthful privacy notice that reflects actual practices.
[ ] Create a process for access, correction, deletion, opt-out, or appeal requests where required.
[ ] Verify identity without collecting excessive new information.
[ ] Synchronize approved deletion or suppression across systems and vendors.
[ ] Distinguish deletion from legally necessary retention and explain exceptions accurately.

Security

[ ] Require multifactor authentication for systems containing homeowner or customer data.
[ ] Use role-based access and least privilege.
[ ] Encrypt data in transit and at rest where appropriate.
[ ] Log exports and large downloads.
[ ] Prohibit shared accounts.
[ ] Maintain backups, incident response, and credential-rotation procedures.
[ ] Train employees to recognize phishing and social engineering after major storms.

Storm-restoration marketing leans on inspections, claims, adjusters, deductibles, estimates, supplements, and insurance proceeds. That language deserves specialized legal review.

Claims and coverage

[ ] Do not state that a loss is covered, approved, or payable before the insurer decides under the policy.
[ ] Do not guarantee that the carrier will replace the roof.
[ ] Do not imply that the contractor controls the claim decision.
[ ] Distinguish a contractor's repair estimate from an insurer's coverage determination.
[ ] Do not create a false filing deadline or misstate policy notice requirements.
[ ] Train staff to direct policy-specific questions to the insurer or an appropriately licensed professional.

Adjusting and claim assistance

State law may restrict who can negotiate coverage, interpret policy, act as a public adjuster, receive claim-assistance compensation, or represent the insured.

[ ] Define what sales representatives may and may not say.
[ ] Review supplement, authorization, assignment, contingency, and direction-to-pay documents by state.
[ ] Avoid titles or statements that imply an unlicensed adjusting role.
[ ] Separate construction advocacy about scope from legal or coverage advice.

Deductibles, rebates, and incentives

Some states specifically prohibit or regulate waiving, rebating, crediting, or absorbing an insurance deductible. General advertising rules can also make "free roof" language misleading.

[ ] Obtain jurisdiction-specific approval for every deductible-related statement.
[ ] Show discounts and credits accurately on contracts and invoices.
[ ] Do not conceal an incentive from an insurer.
[ ] Explain financing or promotional terms separately from insurance proceeds.
[ ] Train employees and subcontractors on the approved language.

Call recording, photos, drones, and field documentation

Call recording

Consent requirements vary by state and can depend on where each party is located. A centralized call center can connect states that follow different rules.

[ ] Map the states of callers and recipients.
[ ] Use counsel-approved disclosures and consent flows.
[ ] Configure pauses or disable recording when appropriate.
[ ] Restrict access and retention.
[ ] Do not reuse recordings for training, AI, or advertising beyond the disclosed purpose without approval.

Property photos and video

[ ] Photograph from lawful locations.
[ ] Obtain permission before entering property or restricted areas.
[ ] Avoid capturing people, interiors, license plates, children, or neighboring private spaces unnecessarily.
[ ] Remove geolocation metadata where it is not needed.
[ ] Secure customer and claim documentation.
[ ] Obtain releases before using identifiable property media in advertising or case studies.

Drones

[ ] Use appropriately certificated pilots and compliant operations where required.
[ ] Follow airspace, flight, safety, and local restrictions.
[ ] Obtain property permission and insurer or customer approvals as applicable.
[ ] Maintain equipment, pilot, flight, and incident records.
[ ] Do not treat a drone image as automatic proof of covered damage.

Red-flag phrases and safer alternatives

The following alternatives are examples for editorial discussion, not preapproved legal language. Counsel should adapt them to the jurisdiction, offer, and evidence.

Red-flag phrase	Why it creates risk	More accurate direction
"Your roof has hail damage."	Treats an uninspected property as a verified fact	"Recent severe weather was reported near your area. A qualified inspection can assess your roof's condition."
"Insurance will pay for a new roof."	Guarantees a coverage outcome the contractor does not control	"Coverage depends on your policy, documented conditions, and your insurer's determination."
"Free roof."	May conceal deductible, contract, financing, or insurance obligations	Describe the actual inspection, promotion, financing, and customer obligations precisely
"We work for your insurance company."	Can falsely imply agency or affiliation	"We are an independent roofing contractor. We can provide inspection findings and a repair estimate."
"Government storm notice."	Misrepresents commercial advertising as official communication	Clearly brand the contractor and label the purpose accurately
"You must file today."	Uses an invented or unsupported deadline	Refer only to verified policy, legal, offer, or scheduling dates with appropriate context
"Everyone on your street was approved."	Likely unverifiable and may disclose or imply private information	"We are currently serving homeowners in the area." Use only when truthful
"We waive your deductible."	May violate state law or create insurance-fraud concerns	Use only counsel-approved pricing and deductible language for the jurisdiction
"Guaranteed approval."	Unsupported guarantee	State the exact service or workmanship guarantee, eligibility, exclusions, and remedy
"No obligation" when a contingency agreement is required	Hides a material term	Describe what the homeowner is signing and when obligations arise

Required records by campaign type

Campaign or process	Minimum records to consider retaining
Addressed direct mail	Source list, suppression results, creative proof, personalized-field QA, print count, postal documentation, campaign ID, mail date, vendor invoice
EDDM	Selected routes, route counts, map export, creative proof, USPS forms, payment, drop-off evidence, campaign ID
Calls	Source, DNC scrub date and version, consent or exception basis, script, caller, date/time, disposition, recording notice, opt-out, vendor logs
SMS	Consent disclosure and version, affirmative action, timestamp, source, seller identity, number, message log, opt-out, platform record
Email	Source, suppression file, creative, headers, physical address, opt-out mechanism, send log, unsubscribe and complaint history
Canvassing	Territory, permits, rep credentials, assignment, approved script, dispositions, no-solicit or opt-out records, contract documents
Digital ads	Audience source and rights, platform, creative, targeting, spend, landing page, lead-consent evidence, deletion or refresh date
QR or landing page	Identifier logic, destination version, security test, privacy and consent language, analytics configuration, response log
CRM handoff	Source fields, property ID, consent fields, qualification event, duplicate decision, owner, creation time, downstream status
Insurance-related sale	Inspection record, photos, estimate, scripts, contract, required notices, deductible treatment, authorizations, communications

Counsel should set the actual retention schedule. Keeping everything forever creates privacy and security risk. Deleting too early can destroy evidence you need for contracts, warranties, taxes, disputes, or regulatory inquiries.

A 40-point prelaunch checklist

Governance

[ ] The campaign has a named business owner.
[ ] Legal or compliance review requirements are documented.
[ ] Target states and municipalities are listed.
[ ] Contractor licenses, registrations, and advertising disclosures are current.
[ ] Vendors and subprocessors are approved.

Audience

[ ] The data source and permitted use are documented.
[ ] Property and owner records have been normalized.
[ ] Existing customers and active jobs are matched appropriately.
[ ] Duplicates and recent roof work are handled.
[ ] Company-wide opt-outs are suppressed.
[ ] Channel-specific consent is verified.
[ ] National and state DNC requirements are applied to calls.
[ ] Wrong-party and reassigned-number risk is addressed.
[ ] Audience logic can be explained.

Claims and creative

[ ] The message does not state unverified damage as fact.
[ ] Insurance coverage and claim outcomes are not guaranteed.
[ ] No false government, insurer, manufacturer, or HOA affiliation appears.
[ ] Offers, discounts, financing, and deadlines include material terms.
[ ] Required license numbers and business identification appear.
[ ] Images, testimonials, ratings, and certifications are authorized and substantiated.
[ ] State-specific deductible and claim language is approved.
[ ] The final creative version is locked and archived.

Channel execution

[ ] Mail specifications and proofs are approved.
[ ] Call technology, script, hours, and caller ID are approved.
[ ] SMS consent, sender identity, opt-out, and timing are approved.
[ ] Email headers, subject, address, ad identification, and unsubscribe are approved.
[ ] Canvassing permits, badges, hours, and rep training are complete.
[ ] Digital platform policies and audience rights are verified.
[ ] QR codes, links, phone numbers, forms, and fallback paths have been tested.

Privacy and security

[ ] The privacy notice reflects the campaign.
[ ] No sensitive data appears in URLs, UTM parameters, or public-facing codes.
[ ] Access is role-based and multifactor authentication is enabled where available.
[ ] Data-retention and deletion rules are assigned.
[ ] Vendor data transfer is secure.

Measurement and response

[ ] Campaign and property identifiers are preserved.
[ ] Consent and suppression fields pass into the CRM.
[ ] Opt-outs synchronize across systems.
[ ] Complaint escalation has an owner and response target.
[ ] A stop-campaign mechanism has been tested.
[ ] Postcampaign review and record retention are scheduled.

Complaint and incident response playbook

A homeowner complaint should never disappear into a branch inbox.

Level 1: Routine preference request

Examples: unsubscribe, do not mail, do not call, wrong person, moved, or no-soliciting request.

Confirm the request without arguing.
Add the appropriate company-wide suppression.
Synchronize vendors and systems.
Document completion.

Level 2: Accuracy or conduct complaint

Examples: false damage claim, misrepresented affiliation, aggressive canvasser, repeated contact, wrong property details, or an unhonored opt-out.

Pause further contact to the person and property.
Preserve messages, call records, creative, and data lineage.
Notify the campaign owner and compliance contact.
Correct suppression or workflow defects.
Respond using an approved process.
Determine whether other recipients were affected.

Level 3: Security, legal, or regulatory incident

Examples: exposed personal data, cross-property landing-page access, mass consent failure, regulator inquiry, lawsuit, threatened claim, vendor breach, or widespread unapproved messaging.

Activate the incident-response plan.
Preserve evidence and restrict alteration.
Involve counsel and security leadership.
Suspend the affected campaign or integration.
Assess notification obligations.
Remediate root cause before restart.

How Hail Trigger supports compliance operations

Software does not make a campaign lawful. It makes your approved controls consistent and auditable.

Hail Trigger can be configured, subject to the live product and your company policy, to support:

Central property and contact suppression.
Rule-based exclusion of inappropriate records.
Audience-source and campaign lineage.
Separate consent fields by channel.
Creative approval and version control.
Unique campaign and property identifiers.
Qualified CRM handoff with source and consent context.
Opt-out synchronization.
Role-based access.
Complaint investigation through a property timeline.
Campaign stop rules.
Attribution without placing unnecessary personal data in public URLs.

Have counsel and your security or privacy owner review the implementation. A default software setting is not a substitute for a jurisdiction-specific policy.

Quarterly compliance review agenda

At least quarterly, and after major legal, vendor, or workflow changes, review:

Target states, licenses, and local solicitation rules.
Federal and state telemarketing requirements.
DNC access, scrubbing, internal suppression, and training.
SMS consent language and proof.
Email templates and unsubscribe performance.
Direct-mail claims, offers, and contractor disclosures.
Canvasser permits, conduct, and complaints.
Landing pages, privacy notices, cookies, and analytics.
Data-source contracts and vendor access.
Insurance, deductible, contingency, and claim-assistance language.
Security incidents and high-volume exports.
Complaint patterns by branch, rep, vendor, creative, and channel.
Retention and deletion jobs.
CRM and suppression synchronization failures.
New product features or automations that change data use.

Document decisions, owners, deadlines, and completed remediation.

Frequently asked questions

Is direct mail exempt from all roofing marketing laws?

No. Direct mail does not operate under the same phone and text consent rules, but postal standards, deceptive-advertising law, contractor-license disclosures, offer terms, privacy obligations, data contracts, and state or local rules can still apply.

Can a roofer text a purchased homeowner list?

A phone number in a purchased dataset is not proof of consent. FCC guidance states that commercial texts require written consent, and state law or the sending technology can create additional requirements. Use counsel-approved prior express written consent tied to the specific contractor and campaign.

How often should a telemarketing list be checked against the National Do Not Call Registry?

FTC guidance under the Telemarketing Sales Rule describes updating call lists against the Registry at least every 31 days. Other federal, state, internal, and consent rules also apply, so counsel should define the complete process.

Can a contractor say a home was hit by hail?

A contractor may accurately describe verified weather information and its limitations. It should not convert a map or neighborhood report into a definitive statement that a specific roof has damage. A qualified inspection is needed to assess property condition.

Can a roofer promise insurance will replace the roof?

No contractor should guarantee a coverage decision it does not control. Coverage depends on the policy, facts, documentation, and the insurer's determination. State laws may also limit claim-assistance activity by contractors.

Does an existing customer relationship allow calls and texts?

Not automatically for every channel or technology. Existing-business-relationship concepts can be limited, do not override a person's company-specific opt-out, and may not authorize prerecorded, automated, or marketing communications. Obtain legal review.

Is a QR code itself a privacy problem?

Not inherently. Risk arises when the code or destination exposes personal data, uses guessable identifiers, lacks security, tracks more than necessary, or gives inadequate notice and consent. Use a privacy-by-design implementation.

Who is responsible when an agency or vendor sends the campaign?

The contractor may remain legally responsible even when a vendor designs, sends, calls, texts, or processes data on its behalf. Contracts, oversight, approval, monitoring, and audit rights are essential.

Put this workflow to work

Build compliance into audience selection, campaign approval, suppression, response tracking, and CRM handoff. A disclaimer pasted on five minutes before launch is not a control. Use Hail Trigger to make your approved controls repeatable and auditable across every property campaign.

Sources checked

FCC, Stop Unwanted Robocalls and Texts: https://www.fcc.gov/consumers/guides/stop-unwanted-robocalls-and-texts
FTC, Complying with the Telemarketing Sales Rule: https://www.ftc.gov/business-guidance/resources/complying-telemarketing-sales-rule
FTC, Q&A for Telemarketers and Sellers About the National Do Not Call Registry: https://www.ftc.gov/business-guidance/resources/qa-telemarketers-sellers-about-dnc-provisions-tsr-0
National Do Not Call Registry: https://www.donotcall.gov/
FTC, CAN-SPAM Act Compliance Guide for Business: https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business
USPS, Every Door Direct Mail: https://www.usps.com/business/every-door-direct-mail.htm
USPS Domestic Mail Manual, EDDM-Retail: https://pe.usps.com/text/dmm300/143.htm
FTC, Cooling-Off Rule consumer guidance: https://consumer.ftc.gov/consumer-alerts/2015/12/ftcs-cooling-rule