How do you buy or generate leads without breaking the TCPA?

This page explains the federal and state rules that decide whether a call or text to a lead is legal, written for owners who buy leads or run their own forms. It is a plain-English summary, not legal advice. Telemarketing law changes often, the penalties are per call, and a short consult with a TCPA attorney before a calling or texting program launches is cheap insurance.

The Telephone Consumer Protection Act (47 U.S.C. 227) restricts calls made with an automatic telephone dialing system or an artificial or prerecorded voice, and it created the national Do Not Call framework¹. What makes it dangerous is the private right of action. A person can sue for actual losses or $500 per violation, whichever is greater, and a court can increase the award to up to three times that amount for willful or knowing violations¹. For Do Not Call violations, a person who receives more than one call within any 12-month period from or on behalf of the same entity can sue for up to $500 per violation, also trebled for willful or knowing conduct¹.

Each call or text can be a separate violation. That is why a small texting campaign to bad leads can turn into a large claim.

The FCC’s rules (47 CFR 64.1200) draw lines by type of call and type of technology²:

The rules cover text messages as well as voice calls²³.

What counts as prior express written consent. It is a written agreement, signed by the person (electronic signatures count where federal or state law recognizes them), that clearly authorizes the seller to deliver advertisements or telemarketing using an autodialer or prerecorded voice, and that names the phone number². The agreement must clearly and conspicuously disclose that the person is authorizing those calls and that signing is not a condition of buying anything².

What counts as an autodialer. In Facebook v. Duguid (2021), the Supreme Court held that equipment is an autodialer under the federal statute only if it has the capacity to store or produce telephone numbers using a random or sequential number generator¹¹. Many modern texting and CRM tools do not. That narrowed federal exposure, but it did not help in states that wrote broader definitions, covered below.

Registrations on the national registry must be honored indefinitely, or until the consumer cancels or the number is removed². If you make telephone solicitations, the FTC says you must synchronize your lists with the registry at least every 31 days⁶. For fiscal year 2027, which began October 1, 2026, access costs $85 per area code per year after the first five area codes, which are free, up to $23,425 for all area codes⁷.

Two common exceptions matter for service businesses:

• Established business relationship. Under the FCC rule, this exists for 18 months after a customer’s purchase or transaction, and for three months after an inquiry or application². A customer who asks you to stop calling ends it, even if they keep doing business with you².
• Written permission. A signed written agreement in which the consumer agrees to be contacted by that seller at that number².

You also need an internal do-not-call list. For telemarketing calls, the FCC requires a written policy, staff training, recording each request, honoring it within a reasonable time not to exceed ten business days, and continuing to honor it for five years². The FTC says the national registry covers intrastate telemarketing calls under the FCC’s rules⁶, so calling only within your own state does not exempt you.

In 2023, the FCC adopted a rule that would have required consent to be given to one seller at a time and limited calls to topics “logically and topically” related to the website where consent was collected³. This was aimed squarely at comparison-shopping and lead generation sites that collect one consent for many sellers.

On January 24, 2025, the U.S. Court of Appeals for the Eleventh Circuit vacated that part of the order in Insurance Marketing Coalition v. FCC³. The court held that the FCC exceeded its statutory authority because the new restrictions conflicted with the ordinary meaning of “prior express consent,” which only requires that a consumer “clearly and unmistakably” state, before the call, that they are willing to receive it³. The court said “one-to-one consent is not required”³.

So, as of October 2026, federal law does not require one-to-one consent. The 2012 rule requiring prior express written consent for autodialed or prerecorded telemarketing is still in place; the court noted it was not at issue³. One-to-one consent is still good practice. A form that names one business is far easier to defend than one that names fifty “marketing partners.”

This area changed twice in two years, so check the date on any advice you read.

The 2024 rules now in effect. A person may revoke consent, including written consent, “by using any reasonable method”². Replies of “stop,” “quit,” “end,” “revoke,” “opt out,” “cancel” or “unsubscribe” to a text are reasonable means per se, and other words count if a reasonable person would understand them as a revocation². Requests must be honored within a reasonable time not exceeding ten business days². You may send one confirmation text that only confirms the request, with no marketing, and it is presumed fine if sent within five minutes².

The “revoke all” provision was delayed. The part of the 2024 rule requiring a revocation in response to one type of message to apply to all robocalls and robotexts on unrelated matters was postponed to January 31, 2027⁵.

The September 30, 2026 FCC order. The FCC voted to rewrite these rules⁴. Under the new text:

• Callers may designate an exclusive means to revoke consent: an automated voice or key-press opt-out on a call, a reply text using one of the standard words, or a designated website or phone number. The method must be clearly disclosed on the call or in the text⁴.
• A revocation in response to an informational message may be treated as applying only to that category of informational messages⁴.
• A revocation in response to marketing still revokes consent to all future marketing calls and texts from that caller⁴.
• Callers that do not designate an exclusive means must still process revocations made by any reasonable means. Either way, the ten business day limit stays⁴.
• The changes take effect 30 days after publication in the Federal Register and replace the January 31, 2027 date⁴. As of October 7, 2026, check the Federal Register for the publication date before relying on them.

The FCC also asked for comment on shortening the ten business day deadline, for example to seven business days⁴. For a service business sending marketing texts, the practical rule does not change: when someone says stop, stop all marketing to that number.

Several states have their own telemarketing laws. Two that matter most for lead buyers:

Notice that both statutes say “selection or dialing” (Oklahoma) or “selection and dialing” (Florida), not “random or sequential number generator.” That is broader than the federal definition after Duguid¹¹, so a texting platform that is not an autodialer under federal law may still fall under these state laws. Both states also presume that a call to one of their area codes is made to a resident⁹¹⁰.

If a claim comes, the business that can produce the consent record usually wins the argument. The FTC’s Telemarketing Sales Rule, which applies to sellers and telemarketers in covered telemarketing, requires keeping records for 5 years, including each consent with the person’s name and number, a copy of the consent request in the format it was shown, the purpose, a copy of the consent and the date⁸. Even if your calling is not covered by that rule, use the same list as your standard:

• The exact form or page where consent was given, as it looked that day (a screenshot or page capture).
• The consent language and the seller names it listed.
• Date, time, IP address and the phone number entered.
• Any consent certificate from a capture service (tools such as TrustedForm and Jornaya record the session).
• Every opt-out, with the date received and the date processed.
• Your written do-not-call policy and training records².

1. Show me the form. Ask for the live URL and a screenshot of the exact consent language the consumer saw.
2. Is my business named in the consent? If the language lists “partners” behind a link, ask how many and whether your name appears.
3. Can I get a consent record for every lead? A certificate, timestamp, IP address and page capture, delivered with the lead or on request within a set time.
4. How long do you keep the records? At least five years is a sensible floor given the TSR’s retention period⁸.
5. Do you scrub against the National Do Not Call Registry and state lists? How often?
6. Are any leads sourced from third parties, aged lists or co-registration? Resold and aged leads are where consent records most often break down.
7. Who pays if a lead turns out to be bad? Get indemnity in writing, and ask whether the seller carries insurance.
8. How do you handle opt-outs? If a consumer tells the seller to stop, how fast will you be told?

The inputs are illustrative; the per-violation amounts come from the statute¹.

A roofing company buys 2,000 “storm leads” from a new vendor at $15 each, or $30,000. It loads them into an automated texting tool and sends each number two promotional texts. That is 4,000 texts.

• Suppose 10% of the leads (200 numbers) never gave valid written consent. Those 200 numbers received 400 texts.
• At $500 per violation: 400 x $500 = $200,000 in potential statutory damages.
• If a court finds the violations willful or knowing, up to three times that: $600,000¹.

Now compare the cost of prevention. Registry access for the five area codes the company actually calls is free; three more would cost 3 x $85 = $255 a year⁷. Asking for and spot-checking consent records costs staff time. One question, “show me the consent record for these ten leads,” is the cheapest compliance step there is.

• Get prior express written consent, with the required disclosures, before any autodialed or prerecorded marketing call or text, and keep the proof for at least five years.
• Scrub against the National Do Not Call Registry at least every 31 days and keep your own do-not-call list with a written policy.
• One-to-one consent is not federal law after the 11th Circuit’s January 2025 ruling, but naming each seller is still the safest form design.
• Honor every opt-out within ten business days and treat a “stop” to a marketing message as stopping all marketing. Watch for the Federal Register date of the September 2026 FCC order.
• Check Florida and Oklahoma rules if you call or text there, and do not buy leads from anyone who cannot hand you a consent record for each one. This is not legal advice; have a TCPA attorney review your forms and lead contracts.