TCPA Compliance for Bought Leads: The Consent Chain
Buying leads is fast, but it hands the riskiest part of compliance, consent, to whoever collected the data. When you dial a purchased list, you rely on a consent chain you didn't build and often can't see. If that chain is broken, the lawsuit names you, the caller, not the vendor who sold the list.
This guide explains what "consent" has to look like on a purchased lead, how to vet a lead vendor, and the checks to run on every list before it reaches your dialer.
You inherit the seller's consent problems
When a lead generator collects a phone number, the consent is whatever their web form said at that moment. If the form was vague, buried the disclosure, or listed hundreds of "marketing partners", that weakness travels with the lead. The moment you call, it becomes your problem.
Courts have repeatedly held that "the vendor told us they had consent" isn't a defense on its own. The question is whether you can produce proof that this consumer agreed to receive your calls on this number.
What valid consent looks like
For autodialed, prerecorded or artificial-voice sales calls and texts to cell phones, the TCPA requires prior express written consent. That means a written agreement, and an e-signature or a checked box on a web form can qualify, that:
- Clearly authorizes the seller (your company) to deliver marketing calls or texts
- Identifies the phone number the consumer agreed to be called on
- Says the consumer understands the calls may use automated technology or prerecorded voice
- States that consent is not a condition of buying anything
- Was given before the first call
What happened to the one-to-one consent rule?
In 2023 the FCC adopted a rule that would have required consent to name one seller at a time and limited calls to topics related to the original website. In January 2025, before the rule took effect, the U.S. Court of Appeals for the Eleventh Circuit struck it down in Insurance Marketing Coalition v. FCC. So the rule doesn't apply.
That doesn't make "you agree to be called by our 2,000 partners" consent safe. The existing standard still requires consent that clearly authorizes the seller, and plaintiffs argue that a buried partner list doesn't do that. Many lead buyers still ask for seller-specific consent as best practice, and some state laws set their own consent requirements.
How to vet a lead vendor
| Question to ask | Good answer | Red flag |
|---|---|---|
| Can I see the actual form the consumer filled out? | Live URL and screenshots of the consent wording | "It's standard language, don't worry" |
| Do you provide a consent record per lead? | Timestamp, IP, page URL, exact wording, phone number entered | Only a spreadsheet with names and numbers |
| Does the consent name my company? | Yes, or you can add it | Only "partners" with a long hidden list |
| How old are the leads? | Days old, with a capture date on each | "Aged" or unknown dates |
| How many buyers get each lead? | One, or a small disclosed number | Sold to unlimited buyers |
| Will you indemnify me for consent defects? | Yes, in writing, and they can pay | Refuses, or a shell company |
| How do you handle opt-outs? | Shared with buyers quickly | No process |
Third-party consent certificate services can capture a recording of the form session and give each lead a verifiable token. They make proof much easier, but they only show what happened. If the consent wording was weak, the certificate proves weak consent.
Checks to run on every purchased list
Even with good consent records, scrub every list before you dial. Bought data is often stale, padded with recycled numbers, or mixed with numbers that never came from the form.
- Remove internal DNCDrop anyone who has already asked your company not to call.
- Scrub federal and state DNCRequired for any number without valid written consent, and a cheap backstop for the rest.
- Remove honeypots and litigatorsPurchased lists are where trap numbers and serial plaintiffs hide.
- Check line typeKnow which numbers are mobile, since automated calls and texts to mobiles need written consent.
- Check for reassignmentFor older leads, check the Reassigned Numbers Database before dialing.
- Check calling hoursDial each number only inside its local legal window.
- Keep the reportSave the dated scrub report with the lead file and the consent records.
Our DNC vs. honeypot vs. litigator comparison explains what each check catches, and how to read a scrub report shows what to do with the results.
Aged leads carry extra risk
Leads sold as "aged" (weeks or months old, often resold many times) combine every risk on this page: older consent, more buyers, and more chance the number has been reassigned to someone who never filled out anything. If you buy aged leads, scrub them more strictly than fresh ones and check reassignment. See the Reassigned Numbers Database.
Contract terms to put in writing
- The vendor warrants that every lead has prior express written consent naming your company
- A consent record is delivered with each lead and kept for at least four years
- Opt-outs received by the vendor are passed to you within a set number of days
- The vendor indemnifies you for consent defects, backed by insurance or a deposit
- You can audit the vendor's forms and traffic sources
Frequently asked questions
Is it legal to call purchased leads?
Yes, if you have valid consent for the type of call you're making and you comply with Do Not Call rules. For autodialed or prerecorded sales calls and texts to cell phones, that means prior express written consent that clearly authorizes your company.
Is the FCC's one-to-one consent rule in effect?
No. The Eleventh Circuit vacated it in January 2025, before it took effect. Consent still has to clearly authorize the seller, so vague partner-list consent remains risky.
Who is liable if a lead vendor's consent was invalid?
Usually the company that made or benefited from the calls. You can seek indemnity from the vendor under your contract, but the plaintiff will generally sue the caller and the brand.
Do I need to scrub leads that have consent?
Valid prior express written consent can allow calls to numbers on the DNC Registry, but scrubbing is still the cheapest way to catch bad records, honeypots, litigators and stale numbers. Most compliance teams scrub every list regardless.
How long should I keep consent records?
At least four years, which is the federal statute of limitations for TCPA claims. Some state laws allow longer.
Run your next lead list through a free scrub: 500 numbers, full report, no card.
This article is general information, not legal advice. Consent requirements depend on the call type, the technology used and state law, so check with counsel.