TCPA Compliance Checklist for Buying Leads in 2026

TCPA lawsuits start at $500 per call or text — and scale to $1,500 per violation for willful breaches. If you buy leads, your provider's compliance failures become your legal exposure. Here's the checklist to run before you wire anyone money.

1. Express written consent

The consumer must have affirmatively agreed to be contacted — a checked box or form submission with clear disclosure. Pre-checked boxes and buried consent language don't count.

2. Named provider

Post-2025 FCC one-to-one consent rules mean the consent must name your company (or a clearly disclosed single provider). 'Up to 8 marketing partners' language is exactly what plaintiffs' attorneys look for.

3. Capture URL access

Ask to see the actual form or landing page where leads are generated. Legitimate providers show you. If the source is secret, the source is the problem.

4. Audit trail on demand

For every lead, your provider should produce timestamp, IP address and a snapshot of the consent form within 48 hours. Test this before you scale — ask for proof on a sample lead.

5. No purchased databases

If leads come from a bought or brokered list, there is no valid consent for your calls. Full stop. Ask directly where inventory originates.

6. DNC and litigator scrubbing

Ask whether leads are scrubbed against Do-Not-Call registries and known serial-litigator lists before delivery.

7. Written attestation

Get the provider's compliance commitments in writing — exclusivity, consent standard, audit trail SLA. Verbal promises don't survive a deposition.

Every Prime Lead Market lead clears all seven gates — read the full Quality Standard, or see how our 10-gate supplier checklist works.