How to Vet a Lead Vendor's Consent Practices

Why this matters

A bought lead is a phone number plus a claim that the person agreed to hear from you. When your office calls or texts that number, the call is yours, and so is the liability if the claim was false. Telephone Consumer Protection Act suits are filed per call and per text, with a fixed statutory amount for each one that a court can triple if the violation was willful, so a shop that texts a few hundred bad leads a month can build a class action in a quarter without anyone meaning harm. The vendor's contract will say the vendor is responsible. The plaintiff's lawyer will sue you anyway, because you are the one whose name was on the message.

What changed in 2025, and what did not

The one-to-one rule is gone. In late 2023 the Federal Communications Commission (FCC) adopted a rule requiring that consent to marketing calls name a single seller at a time, which would have ended the lead form that lists hundreds of "marketing partners" behind a link. In January 2025 the U.S. Court of Appeals for the Eleventh Circuit vacated it before it took effect. That rule is not in force, and you should not build your vetting around it.

The underlying consent requirement is still there. Under the TCPA, 47 U.S.C. 227, and the FCC's rules at 47 CFR 64.1200, a telemarketing call or text to a cell phone made with an artificial or prerecorded voice, or with an autodialer, needs the called party's prior express written consent: a signed written agreement (an electronic signature counts) that clearly authorizes that seller to deliver marketing by those means to that number, and that tells the person consent is not a condition of buying anything. Telemarketing means a message encouraging a purchase. A reply to a customer who asked you to call about their job is not telemarketing; a first-contact sales text to a purchased lead almost always is.

The federal floor is not the whole picture. The Supreme Court narrowed the federal autodialer definition in 2021, which made some defense lawyers relax. Several states answered with their own statutes, often called mini-TCPAs. Florida and Oklahoma, for example, reach automated texting systems the federal definition no longer does, and limit the number of attempts allowed in a day (Florida also narrows the calling hours). Read your own state's statute before you read anything else, because it may be the stricter layer. This article is not legal advice, and the decision to keep buying from a vendor whose answers worry you is one to take to an attorney who handles TCPA defense.

Do Not Call is separate. A number on the National Do Not Call Registry cannot get a telephone solicitation from you without an established business relationship or the person's signed permission, whatever the vendor says about autodialers. The Telemarketing Sales Rule and the registry mechanics belong to a sibling card; here, it is one more thing the vendor's consent record has to cover.

Step 1: Get the consent page itself, not a description of it

Ask the vendor for the exact web page or form a consumer completed, as it looked on the day the lead was captured, for each lead source they sell you. Not a sales sheet, not "our forms are TCPA compliant", but the screen.

Why: consent is only as good as the words the consumer agreed to. Courts examine the actual disclosure: how big the text was, whether it sat next to the submit button, whether the seller's name appeared on the page or only behind a link. A description cannot be examined.

What breaks if you skip it: you find out what the form said for the first time when a plaintiff's lawyer attaches it to a complaint.

Step 2: Find your own name on that page

Read the consent language and answer one question: does it name your business, in words a consumer would recognize, at the point where they agreed? A form that says "you agree to be contacted by home service providers and their partners" does not name you. A form that names you only inside a hyperlinked list of several hundred companies names you in a way courts have viewed skeptically, and the vacated one-to-one rule was aimed at exactly that practice. Its vacatur removed a new prohibition; it did not make the old practice safe.

Why: prior express written consent authorizes a seller. The consumer has to have authorized you.

What breaks if you skip it: you buy a lead whose consent ran to the vendor and its affiliates, and you are not one of them.

Step 3: Ask how a lead is sold, and to how many shops

An exclusive lead goes to one buyer. A shared lead is sold to several, often three to five, sometimes more. Ask the number, and ask whether it is a cap or an average.

Why: the consumer who filled in one form and then gets eight calls in twenty minutes is the consumer who files suit. Shared leads are not illegal, but every additional buyer is another set of calls the consumer never pictured when they clicked, and the form's consent language has to cover every one of them by name.

What breaks if you skip it: your call is the sixth one and the person on the other end is already furious, already screenshotting, and already looking up a lawyer.

Step 4: Require a per-lead consent record you can retrieve for years

For every lead, the vendor should deliver or store: the timestamp of the submission, the page URL, the IP address, the consent text displayed, the phone number entered, and ideally a session recording or a certificate from an independent third-party service that captured what the consumer saw and did. Write into the contract that the vendor keeps this for at least as long as the four-year federal limitations period courts apply to TCPA claims, and that you can pull a record within a few business days.

Why: when a demand arrives, the first question is "show me the consent for this number on this date." A shop that can produce it in a day often ends the matter; a shop that has to ask a vendor that has since gone out of business cannot.

What breaks if you skip it: the vendor folds or stops answering, and your only evidence of consent folds with it.

Step 5: Test the records yourself before you buy at volume

Pick ten leads from a trial batch and request the full consent record for each. Check that the timestamp precedes the lead's delivery to you, that the phone number in the record matches the one you were sent, and that the record shows your name on the page from Step 2.

Why: a vendor can show you a clean sample form and run a different one in production. Pulled records from your own leads are the only evidence of what you actually bought.

What breaks if you skip it: you vet the brochure, not the product.

Step 6: Put the contact rules into your own system, not the vendor's promise

Before any lead is called or texted, your office should scrub it against the National Do Not Call Registry and your own internal do-not-contact list, respect calling hours (the federal floor is between 8 a.m. and 9 p.m. in the consumer's local time under 47 CFR 64.1200(c)(1), and some states set narrower windows), and honor an opt-out on the first request. The FCC's rules on how consumers may revoke consent were tightened in 2024 and 2025, with part of that change delayed, so re-check the current revocation rule rather than relying on an older summary.

Why: a vendor can deliver valid consent and you can still violate the law by calling at 9:30 p.m. or texting a number that said STOP yesterday. Those are your acts.

What breaks if you skip it: consent was perfect and the claim is about your timing.

Step 7: Write the contract for the day it goes wrong

Three clauses carry real weight: a warranty that every lead was generated with prior express written consent naming your business, an indemnity that covers your defense costs and not just a judgment, and a right to audit and terminate. An indemnity is only worth the vendor's ability to pay, so ask whether they carry insurance that covers TCPA claims, since many general liability policies exclude them. Read your own policy too, and ask your agent in writing whether a TCPA suit would be covered.

Why: courts can hold a seller vicariously liable for calls placed on its behalf. The contract does not prevent that, but it determines who pays for the defense.

What breaks if you skip it: you inherit the defense of a vendor's practices with no right to recover any of the cost.

A worked vetting, start to finish

A plumbing shop is offered shared leads at a volume of about 40 a week. The owner runs the steps.

Step 1. The vendor sends the landing page for its "free plumbing quote" form. The consent line sits under the submit button in small gray text.

Step 2. The line reads: "By clicking, you agree to receive calls and texts, including by automated means, from our network of trusted providers." "Network" is a hyperlink to a list of 214 companies. The shop's name is number 131. The owner notes this as a weak point, not a fatal one, and moves to the numbers.

Step 3. The vendor says each lead goes to "up to four" buyers. Asked whether that is a cap, the rep says it is the typical figure and that high-demand zip codes can go to six.

Step 4. The vendor offers timestamp, IP, URL and a third-party session certificate, retained for two years. The owner asks for four years in writing; the vendor agrees.

Step 5. From a trial batch of 10 leads the owner requests every record. Results:

• 7 of 10 are complete: timestamp before delivery, numbers match, certificate shows the page with the link.
• 2 of 10 have certificates showing a different page, one for a roofing offer whose consent line names "home improvement partners" with no list at all.
• 1 of 10 has no certificate; the vendor says it "came through an affiliate."

That is 3 of 10 leads, 30 percent of the sample, where the shop cannot show consent naming it. At 40 leads a week, 30 percent is about 12 leads a week the office would be texting with nothing behind them.

The call. The owner does not sign the volume contract. He tells the vendor he will buy only from the plumbing page, only exclusive or capped at four, only with certificates on every lead, and with affiliate traffic excluded. The vendor offers a smaller exclusive product at a higher per-lead cost. The owner takes it on a 60-day trial, with a second pull of 10 records at day 30.

What would change it. If the trial batch had come back 10 of 10 clean on the same 214-company page, the hyperlinked list would still be the weak point, and that judgment is exactly where the owner should hand the form and the records to counsel rather than decide alone. In Florida or Oklahoma the shop would also need to confirm that its own texting platform and call cadence fit the state statute, because clean consent does not answer a frequency limit. If the shop dialed every lead by hand from a desk phone with no prerecorded message, the federal autodialer question narrows, but Do Not Call, calling hours and the state layer all still apply, so manual dialing is not an exemption from this vetting.

The failure mode that looks like success

The most common bad outcome is not a refused vendor. It is a vendor who passed vetting once, two years ago, and has since changed forms, added affiliates and resold to more buyers. The tell is a rising rate of "I never asked for this" answers on first contact, or a spike in STOP replies. Make the office log those per lead source. When one source starts producing more than about 1 in 20 first contacts that deny asking, pull ten records again before buying another week of it.

References

• Telephone Consumer Protection Act, 47 U.S.C. 227, and FCC rules at 47 CFR 64.1200 (prior express written consent definition, calling hours, Do Not Call)
• Insurance Marketing Coalition v. FCC, U.S. Court of Appeals for the Eleventh Circuit, January 2025 (vacating the one-to-one consent rule)
• See related: TCPA and 10DLC Compliance for Business Texting
• See related: The Telemarketing Rules and Outbound Calls
• See related: Electronic Signature Legality (ESIGN Act and UETA)