SMS lead generation: buying leads, affiliates and the consent trap

Lead-gen operators and advertisers keep asking us the same question: "I bought these leads, and the form said they agreed to be contacted. Can I text them?" Usually the answer is no. The exception is narrow: you can text them only if the form named your business as the one they agreed to hear from, and you can prove it.

Consent to receive marketing texts belongs to the person and the specific seller they agreed to. It does not travel with the lead record when that record is sold, resold, shared with partners or pulled from a co-registration network. This post explains why, how carriers enforce it separately from the law, what a buyable lead has to look like, and what compliant capture looks like when you run the form yourself. This is practical guidance, not legal advice. For anything high-stakes, a TCPA attorney is worth the hour.

The short answer: consent doesn't transfer

Under the TCPA, marketing texts sent with an autodialer-type system need prior express written consent. That consent has to be specific to the seller. A form that says "you agree to be contacted by our marketing partners" doesn't name the business that later sends the text. For that business, it isn't a written agreement to receive texts from them.

Three common lead-gen setups fail for that reason:

• Aged or bulk lists. Someone filled out a form months ago for a different company. You bought the record. You have their number, not their consent.
• "Marketing partners" consent. The form linked to a list of hundreds of partner companies, or said "and its affiliates." Regulators and courts have looked hard at this pattern. Carriers treat it as shared consent and reject it.
• Affiliate traffic. An affiliate drove the lead to a page you don't control, with opt-in wording you never saw. If you can't produce the exact language and timestamp, you can't defend the text.

The FCC adopted a "one-to-one consent" rule in late 2023 aimed squarely at lead generators. A federal appeals court vacated it in January 2025, so it never took effect. Some sellers read that ruling as "anything goes again." It isn't. The underlying requirement still stands: consent has to be clear, written and given to the seller. The carrier rules described below never relied on the FCC rule in the first place. We go deeper on the distinction in prior express written consent vs implied consent.

Carriers enforce this separately from the law

Even if your lawyer is comfortable, the phone networks have their own rules, and those rules are stricter in practice.

When you register a 10DLC campaign, you describe how recipients opted in. Carrier and industry guidelines say consent can't be sold, shared or transferred between companies. T-Mobile's code of conduct goes further and lists affiliate marketing and lead generation built on shared consent among disallowed content. If your campaign description says "we purchase leads from vendors," expect a rejection. If you describe your own form but actually send to bought lists, you are now misrepresenting your traffic. Carriers detect that through spam complaints and opt-out spikes, and they can filter or suspend the campaign.

That suspension usually costs more than any single lawsuit risk. A suspended brand can take every legitimate use case down with it: appointment reminders, order updates and replies to real customers. Our 10DLC enforcement guide covers what that looks like.

The math on texting a bought list

Here is a worked example with stated assumptions. You buy 1,000 leads with "marketing partners" consent and send each one a single text.

• Messaging cost on Ready Standard: 1,000 × 1 segment × ($0.0075 + $0.0045 carrier fee). That is $8 plus the carrier fee, and it excludes the compliance surcharge.
• Statutory TCPA exposure if the consent doesn't hold: $500 per text, up to $1,500 if a court finds it willful. 1,000 texts × $500 = $500,000, or up to $1.5 million.
• Exposure if a lead vendor's list includes known serial TCPA plaintiffs: you only need one of them to find you.

Ready's all-in prices per segment include the carrier fee but not screening: Scrub lists and Number validation, the two switches in Settings under Compliance, each add $0.003 per segment when switched on, shown as screening on your bill, and both are off by default. Unless you turn the opt-out footer off, the first text to each contact, and one again from time to time, also gets "Reply STOP to opt out" and your business name if the message does not already have them, so a text close to the segment limit can bill one more segment.

Plaintiffs don't need every one of the 1,000 recipients to join a class action for this to go badly. The point is the ratio. You save perhaps $8 in sends and a few hours of building your own capture funnel, and you take on six-figure downside plus the chance of losing your sending registration.

We don't cost out cold-list texting as a normal campaign, and we'd suggest you don't either. Cold contact belongs on the phone and in the mail, with its own DNC rules. SMS is for people who opted in to you or who replied to you.

What a buyable lead actually looks like

Buying leads isn't inherently the problem. The problem is the consent attached to them. A lead you can text has all of these:

1. Your business is named on the form, in the consent sentence itself, not buried in a linked partner list. Exclusive leads, sold once to one named seller, are the realistic version of this.
2. The consent language specifically mentions text messages, marketing purpose, that consent isn't a condition of purchase, message frequency, "Msg & data rates may apply," and how to opt out (reply STOP).
3. Proof per lead: the timestamp, IP address, the page URL, the exact wording shown, and ideally a third-party form-certification record or session replay.
4. A contract that lets you request that proof on demand and puts indemnity on the vendor if it doesn't exist.

If a vendor hesitates on items 1 or 3, treat the leads as call-or-mail only. We walk through vetting questions in TCPA compliant leads: how to vet lead vendors.

Shared lead vs exclusive lead vs your own form

What compliant capture looks like when you run the form

The cleanest lead-gen setup is a funnel you own. Paid traffic and affiliates send people to your landing page, your form names your business, and your systems store the record. Affiliates get paid for the click or the submit. They never touch the consent.

A form that holds up has:

• An unchecked SMS consent checkbox, separate from the submit button and any terms checkbox.
• Consent text next to it, for example: "By checking this box, I agree to receive recurring marketing texts from Acme Solar at the number provided. Consent is not a condition of purchase. Msg frequency varies. Msg & data rates may apply. Reply STOP to opt out, HELP for help." Then links to your privacy policy and terms.
• A privacy policy that says mobile numbers and SMS consent are not shared with third parties for marketing. Carriers check for this line.
• A stored record per lead: number, timestamp, IP, page URL, and the exact wording version shown. Our post on how to document SMS consent covers the fields.
• A confirmation text sent right after opt-in, which also flags typos and fake numbers early.

If you're registering a campaign for this funnel, the opt-in description and sample messages should match that form word for word. This guide to consent language that passes registration has wording that clears on the first submission.

Worked example: texting your own leads

This example assumes 2,000 people a month opt in through your form, and each gets a 2-segment confirmation and welcome message.

• Sends: 2,000 × 2 = 4,000 segments
• Cost on Standard: 4,000 × $0.0075 = $30, plus 4,000 × $0.0045 in carrier fees
• Litigator and DNC scrub on the standalone product: 2,000 contacts × $0.005 = $10

About $40 a month to text people who asked to hear from you, with a paper trail behind every one. Some of those sends might pass through a cheaper raw API, and that's fine. The cost difference is small next to the exposure in the earlier example.

Where Ready fits, and where it doesn't

We make Ready, so here is exactly what it does and doesn't do on this problem:

• Registration in-app. Brand and campaign registration run inside the app. The first charge at submit is $25, then $25/mo for registration + $2 per number. Most approvals take 2 to 7 days. We'll register an honest description of your own funnel. We won't help describe bought-list traffic as something else.
• Attestation per send. Every bulk send and every API send that sets consent_attested records the sender's opt-in attestation: who sent, to how many, and when. On the API, that's consent_attested on POST /v1/messages. This is your promise, not a per-contact consent record. The timestamp, wording and page URL for each lead have to live in your own form or CRM.
• Scrubbing. The standalone TCPA & DNC Litigator Scrub is $0.005 per contact. You can also switch on scrubbing at the account level for $0.003 per segment (off by default). It screens known litigators and DNC complainers. It reduces risk. It does not make bad consent good.
• Opt-outs and quiet hours. STOP is honored and propagates across campaigns. Sends are held outside permitted local hours and only charged when they go out. Campaigns, drip campaigns and automations wait up to 24 hours for the window; a one-to-one or API text is held only if the window opens within 6 hours, otherwise it is refused and must be resent; a one-to-one reply to someone who texted you in the last 24 hours goes out at any hour.

What Ready won't do is make a purchased "partners" list textable. No platform can, and any vendor that implies otherwise is selling you the liability.

The practical takeaway

Consent belongs to a person and a named seller. Here is how that plays out:

• Bought leads without your name on the form: call them (after a DNC scrub) or mail them. Text them only after they opt in to you directly.
• Exclusive leads that name you, with proof: fine to text.
• Your own capture funnel, with affiliates paid for traffic: the strongest position, legally and with carriers.

If you're building that funnel and want the sending side handled, you can start on Ready. To send, you add a card and get a number, which is $2 a month with the first month charged when you get it. The first 20 texts are free one-to-one sends, so use them to test your confirmation flow before you register.