TCPA Compliance Checklist When Buying Legal Leads

The Telephone Consumer Protection Act (TCPA) is one of the biggest legal risks in buying leads. When your firm or call center calls or texts a consumer, you are the one making contact, so you can be the one sued if that contact was not properly authorized. Because the TCPA provides statutory damages per call or text, generally $500 per violation and up to $1,500 if the violation is found to be willful, exposure adds up quickly.

This checklist covers what to verify before you buy legal leads, and what to keep doing after. It is a practical guide, not legal advice. Your firm should review its own obligations with TCPA counsel.

Part 1: Consent

Consent is the foundation. If consent is missing or defective, scrubbing and good calling practices will not fix it.

Is there express written consent on every lead?

Calls and texts using regulated technology for marketing purposes generally require prior express written consent. Ask the vendor to confirm that every lead includes it, and ask how it is captured.

Can you see the actual consent language?

Ask for the exact text shown to consumers, next to the submit button. Review it with counsel. Look for:

• A clear statement that the consumer agrees to be contacted about their inquiry
• Who may contact them, described so a consumer would reasonably understand it
• That contact may be by call or text, including to a mobile number
• That consent is not a condition of purchase
• That message and data rates may apply
• How to opt out
• Links to the privacy policy and terms

Does the consent cover your firm?

Consent must extend to the business actually making the contact. If the consent language names only the vendor, or uses vague language like "marketing partners" with no meaningful disclosure, that may not be enough. Exclusive leads, where one buyer receives each lead, make this much simpler than shared leads that go to many buyers.

Is consent language versioned?

Forms and pages change. Ask the vendor how it tracks which version of the consent language a specific consumer saw.

Part 2: Independent proof

Does every lead include a TrustedForm certificate?

A TrustedForm certificate is created by an independent third party and records the consumer's session on the form, including the consent language displayed and the time of submission. It is much stronger evidence than a vendor's own database entry.

At Case Growth Pro, a TrustedForm certificate is posted with every lead and every transfer.

Are you retaining certificates?

Certificates generally need to be claimed or retained in your own TrustedForm account to be available later. Make sure your team or your platform does this for every lead.

Do the certificate and the lead data match?

Spot check. Does the certificate's page and timestamp line up with the lead record? Does the phone number match?

Part 3: Scrubbing

Are leads scrubbed against known TCPA litigators?

A small number of serial plaintiffs file a large share of TCPA lawsuits. Litigator scrubbing services such as The Blacklist Alliance maintain lists of known litigators. Every lead we deliver is scrubbed through The Blacklist Alliance.

Are leads scrubbed against the federal Do Not Call registry?

Prior express written consent can permit calls to numbers on the national registry in some circumstances, but scrubbing adds a layer of protection and is standard good practice.

Do you maintain your own internal Do Not Call list?

You must honor opt out requests your own firm receives. Make sure every opt out is recorded and that numbers on your internal list are never called again for marketing.

When was the scrub performed?

Scrubbing should happen close to delivery. A scrub run weeks earlier may miss recent additions.

Part 4: How contact happens

Does the vendor use prerecorded or artificial voice messages?

These carry additional consent requirements and heightened risk. We do not use prerecorded or automated messaging.

What caller ID practices are used?

Caller ID should be accurate and not misleading. Our outbound calls use dynamic caller ID.

Are calling hours respected?

Federal rules restrict telephone solicitation outside certain hours in the consumer's local time, and some states impose narrower windows. Make sure both the vendor and your team call within permitted hours for the consumer's location.

Is the contact expected?

A consumer who knows a call is coming is far less likely to complain. Warm transfers, where the consumer is introduced to your firm, and clear disclosure of who will be calling both help.

Part 5: State laws

Several states have their own telemarketing laws, sometimes called "mini TCPA" laws, with requirements that go beyond federal rules. Examples that buyers frequently ask about include the Florida Telephone Solicitation Act, the Oklahoma Telephone Solicitation Act and Maryland's telemarketing law. Requirements can include stricter consent standards, calling hour limits and limits on the number of calls.

Do you know which state laws apply to the leads you buy?

Review the rules for every state you buy in with counsel, and make sure your vendor's practices and your own calling cadence comply.

Part 6: Opt outs and revocation

Can consumers revoke consent by any reasonable means?

Under federal rules, consumers can revoke consent in any reasonable way, such as saying "stop calling me," replying STOP to a text or submitting a request online. Your team needs to recognize and honor all of these.

How fast are opt outs processed?

Opt outs should be honored promptly. Ask counsel what timeframe applies, and make sure your systems can meet it.

Does the vendor pass opt outs to you, and vice versa?

If a consumer opts out with the vendor after delivery, you need to know. If they opt out with you, the vendor should know too. See our TCPA and consent disclosure for how we handle this.

Part 7: Contracts and records

Does your vendor agreement address compliance?

Look for representations about consent and lead sourcing, indemnification for compliance failures, and a clear process for providing records if a lead is challenged.

Where does the vendor's traffic come from?

Vendors who buy leads from other vendors may not be able to vouch for consent practices upstream. Ask where traffic comes from and how partner sources are vetted. Ours comes from O&O traffic acquisition channels and properties, supported by a vetted network of owned and partner traffic sources held to the same consent standards. See how it works.

Can the vendor produce records on request?

If a consumer challenges a call, you will need the consent record, certificate, scrub result and delivery record quickly. Confirm the vendor can produce them.

How long are records kept?

Retention periods should be long enough to cover the limitations period for potential claims. Agree on them in writing.

The quick checklist

Before buying:

• Express written consent on every lead
• Reviewed the actual consent language with counsel
• Consent covers your firm as the caller
• TrustedForm certificate on every lead
• Litigator and federal DNC scrub on every lead
• No prerecorded or artificial voice messages
• Traffic source is known and controlled
• Vendor contract covers compliance and records
• State telemarketing laws reviewed for every state you buy in

After buying:

• Retain every TrustedForm certificate
• Call within permitted hours
• Maintain and honor your internal Do Not Call list
• Recognize revocation by any reasonable means
• Share opt outs with your vendor

Summary

TCPA compliance in lead buying rests on three things: valid consent that covers your firm, independent proof of that consent, and contact practices that respect consumer choices. Exclusive leads from a vendor that holds every source to one documentation standard make all three easier to achieve.

Read more about our approach on the compliance page, or request pricing for TCPA conscious MVA leads.