"TCPA compliant" is printed on nearly every lead vendor's rate sheet. It doesn't protect you. If a consumer sues over a text or an autodialed call, the question is whether you can produce proof that this person agreed to hear from you, on this number, before you contacted them. What the vendor said on a sales call won't answer it. The vendor's insertion order won't either. A promise in a contract is something you can sue the vendor over later. It isn't consent.
This guide is for lead buyers and the agencies that work purchased leads for clients. It covers what a consent record has to show, the red flags in vendor paperwork, how to store proof, and the scrubs to run before the first contact. It is practical guidance, not legal advice. For a high-volume lead program, have a TCPA attorney review your vendor agreements once. That review usually costs less than the first demand letter.
What consent has to show for a purchased lead
Most marketing texts and autodialed calls to cell phones need prior express written consent. For the difference between that and implied consent, see prior express written consent vs implied consent. For a purchased lead, the consent has to survive the trip from the vendor's form to your outreach. In practice that means it must show:
- Who agreed. The phone number the consumer typed, plus the name and any other fields they submitted.
- When. A timestamp down to the second, with time zone.
- Where. The exact URL of the form page. A homepage link is not enough.
- What they saw. The full disclosure text next to the submit button, word for word, as it appeared at that moment.
- That it named you. The disclosure has to identify the seller who will contact them. "Our marketing partners" with a link to a list of 1,400 companies is where most purchased-lead lawsuits start.
- How they agreed. Whether a checkbox was unchecked by default, and what action they took (clicked submit, checked a box, typed a signature).
- That it covered texts. A disclosure that only mentions calls is weak cover for SMS, and the reverse is also true.
A note on the rules: the FCC adopted a "one-to-one" consent rule that would have required each lead to name a single seller. A federal appeals court struck it down in early 2025, before it took effect. That doesn't make a 1,400-partner disclosure safe. Courts still ask whether a reasonable consumer understood that your company would contact them. A disclosure that names you, or names a short list that clearly includes you, is far easier to defend.
Proof beats screenshots
A screenshot of a form shows what the form looks like today. It doesn't show what this consumer saw last Tuesday. Independent form-certification services such as TrustedForm or Jornaya capture the session when the lead is created: a replay, the disclosure text and a certificate ID tied to the lead. If your vendor uses one, require the certificate ID with every lead and claim it at purchase, because certificates expire if nobody claims them. If your vendor doesn't use one, ask how they would prove a specific lead's consent in court. The answer will tell you a lot about the vendor.
Red flags in lead vendor paperwork
Ask any vendor for three things before your first order: a sample consent record for a real lead, a screenshot and URL of every form they generate leads from, and their contract's consent and indemnity sections. Then compare what you get against this table.
| What you see | Why it's a problem | What good looks like |
|---|---|---|
| "All leads are TCPA compliant" with no per-lead record | A claim, not proof | Per-lead timestamp, URL, IP, disclosure text, certificate ID |
| Disclosure names "partners" via a link to hundreds of companies | Weak argument that the consumer agreed to you | Your company named on the form, or a short, specific list |
| Pre-checked consent box | Not an affirmative act by the consumer | Unchecked box, or a clear statement next to the submit button |
| Leads "aged" 60+ days and resold | Consent goes stale, and numbers get reassigned | Lead date disclosed, with a fresh-lead option |
| Vendor won't name the source sites | You can't verify the form exists | Named domains you can visit |
| Consent covers calls only | Texting on call-only consent is exposed | Disclosure names calls and texts |
| Indemnity capped at the lead's purchase price | A $3 cap against a per-text statutory claim | Meaningful indemnity, plus vendor insurance you can verify |
| Sub-vendors and co-registration "networks" | Consent chain you can't trace | Vendor generates its own leads, or discloses every upstream source |
Indemnity deserves a second look. TCPA statutory damages run $500 per violating text or call, and up to $1,500 if a court finds the violation willful. A class action multiplies that by every recipient. An indemnity clause is only worth what the vendor can pay. A small lead shop that takes a class action may not be around to honor it.
Agencies buying on behalf of clients have a second question: who is the seller in the eyes of the law, and who carries the exposure? We cover that split in when your client's bad list gets texted, who gets sued.
Keep your own copy of the consent record
The vendor's database is not your audit trail. Vendors go out of business, change portals and delete old data. When a lead arrives, copy the consent record into your own system and store it next to the contact:
- Phone number, name and the lead ID from the vendor.
- Timestamp, IP address and form URL.
- The full disclosure text, as text rather than a link.
- The certificate ID, claimed and saved.
- The vendor name and the date you bought the lead.
- The date and result of your scrubs (below).
Keep it for at least as long as someone could sue. The TCPA's federal statute of limitations is four years, so many teams keep five. How to document SMS consent so it holds up goes field by field.
What your messaging platform records, and what it doesn't
Be clear about where each piece of proof lives. On Ready, every campaign you send and every API send that attests consent records the sender's opt-in attestation: who sent, to how many and when. Over the API, that is the consent_attested flag on each request. This gives you an audit trail showing that your team asserted consent at send time.
It is not a per-contact consent record. Ready doesn't store the consumer's opt-in time, the disclosure wording or the form URL, and a keyword reply doesn't create one. You keep those records, in your CRM or lead system, as described above. Whatever platform you use, assume the lead-level proof is your job. (A contact who signs up on a Ready-hosted opt-in page is the exception: Ready stores that sign-up, with the time, IP address and exact wording, and support@tryready.com can send you a copy.)
Scrub before the first contact, every time
A valid consent record doesn't make a number safe to contact. Three separate checks catch different problems, and teams often mix them up. See the three lists compliance teams confuse for the full breakdown.
- DNC. The National Do Not Call Registry, state lists and your own internal list. Valid written consent generally overrides the national registry for telemarketing. If you're relying on that, the consent record above is what makes it hold.
- Known TCPA litigators. Some people file TCPA suits professionally. Their numbers show up in purchased lead files more often than chance would suggest.
- Number validation. Catch landlines, disconnected numbers and bad formats before you pay to text them.
Run all three at purchase, then again if the lead sits unworked for weeks. Lists go stale quickly.
What scrubbing costs
Ready's standalone TCPA & DNC Litigator Scrub is $0.005 per contact. One scrub checks each number against known TCPA-litigator lists and DNC-complainer lists and flags matches automatically.
Worked example, assuming a 2,000-lead purchase:
- Scrub: 2,000 × $0.005 = $10
- Exposure from a single texted litigator, at statutory minimums: 1 text × $500 = $500, and that's before a second text, a willfulness finding or a class claim.
If the scrub catches one number in the batch, it has paid for itself many times over. It reduces risk. It doesn't make you lawsuit-proof, and a bad consent record is still a bad consent record after a clean scrub.
To scrub or validate one number at a time over the API:
GET https://api.tryready.com/v1/scrub/+12125550199
X-API-Key: <key>
GET https://api.tryready.com/v1/validate/+12125550199
X-API-Key: <key>You can also switch scrubbing and landline validation on for an account so they run on every send. Each is a $0.003 per-segment surcharge, and both are off by default. Our Standard rate is $0.0075/segment plus a $0.0045 carrier fee. That all-in figure excludes the compliance surcharge. Request details are in the docs.
The first contact: call or text?
Text only when the consent record names you and covers texts. If it does, send a short first message that identifies your company, references the request ("You asked about solar quotes on Tuesday"), and includes opt-out language. On Ready, quiet hours hold sends outside permitted local hours based on the recipient's area. Inbound STOP is honored and the opt-out propagates so the contact can't be texted again from any campaign. Campaigns, drip campaigns and automations wait up to 24 hours for the window; a one-to-one or API text is held only if the window opens within 6 hours, otherwise it is refused and must be resent; a one-to-one reply to someone who texted you in the last 24 hours goes out at any hour.
If the consent record is weak, don't text. Contact by phone or mail, scrubbed against DNC, dialed manually, and judged on its own legal footing. Texting a lead whose consent you can't prove is how a $3 lead turns into a five-figure settlement.
If your team calls, the Ready Dialer handles manual click-to-call from the dial pad, with consented recording. It's billed at $0.025/min for answered time only, so a ring-out costs nothing. It doesn't auto-dial, by design, and that matters for leads where autodialer consent is in doubt.
The practical takeaway
A lead is only as compliant as the record you can produce for it. Before you buy from a vendor, ask for a real per-lead consent record and the forms behind it, and walk away from "partners" lists, pre-checked boxes and capped indemnity. When leads arrive, copy the consent record into your own system and scrub every number before the first contact. Text only the leads whose consent names you and covers texts.
If you want scrubbing, quiet hours and opt-out handling built into the send path, you can sign up and try it on your next batch. The first 20 one-to-one texts are free, and the scrub is $0.005 a contact whenever you need it.