Lead Generation Compliance: TCPA, Consent, and State Laws

Lead generation compliance means capturing consumer consent the way federal and state law require, proving you captured it, honoring every request to stop, and vetting any leads you buy so you don’t inherit someone else’s violations. The core federal rules come from the Telephone Consumer Protection Act, the Federal Trade Commission’s Telemarketing Sales Rule, and the CAN-SPAM Act. Roughly twenty states now layer their own privacy statutes on top, and several add their own telemarketing rules with private rights of action. Penalties start at $500 for a single unwanted call or text and climb past $53,000 per violation for deceptive telemarketing, so a lead list assembled without proper consent can generate class-action exposure in the millions before anyone notices the problem.

The Federal Statutes You Have to Follow

Telephone Consumer Protection Act

The TCPA is the statute that drives most lead generation litigation. It prohibits using an automatic telephone dialing system or a prerecorded voice to call or text a cell phone without the called party’s prior express consent, and when the call is telemarketing, the standard rises to prior express written consent.¹ Almost every lead sold for outbound marketing triggers the written-consent requirement.

Consumers can sue for $500 in statutory damages per violation, tripled to $1,500 if the violation was willful or knowing.¹ Multiply that by the thousands of contacts in a single campaign and the math gets ugly fast.

Telemarketing Sales Rule

The Telemarketing Sales Rule, at 16 CFR Part 310, gives the FTC authority over deceptive and abusive telemarketing. Before a consumer pays for anything, the seller must clearly disclose the total cost, all material restrictions, and the refund policy, and any false or misleading statement made to induce a purchase is a separate violation.² The TSR also runs the federal Do Not Call framework and sets the recordkeeping requirements every telemarketing operation has to meet. As of 2025, the maximum civil penalty is $53,088 per violation, and that figure is adjusted for inflation each year.³

CAN-SPAM Act

CAN-SPAM governs commercial email. Every marketing message must carry accurate header information, a non-misleading subject line, a clear label identifying it as advertising, a valid physical postal address, and a working opt-out mechanism that stays active for at least 30 days. Once a recipient opts out, you have 10 business days to stop emailing them.⁴ There’s no private right of action here; enforcement comes from the FTC and state attorneys general, and each violating email can carry a penalty of up to $53,088.⁵ Buying email leads doesn’t shift responsibility; the sender owns compliance for whatever it sends.

What Counts as Valid Consent

For any marketing call or text using an autodialer or prerecorded voice, the TCPA requires prior express written consent. That means a clear and conspicuous disclosure telling the consumer they agree to receive marketing calls or texts, plus an affirmative action to grant it, like clicking an unchecked box. Pre-checked boxes don’t count. The disclosure can’t be buried in terms of service or hidden below the fold.

The E-SIGN Act is what makes an electronic checkbox click or typed signature legally equivalent to a handwritten signature. Under that statute, electronic consent is valid when the consumer affirmatively agrees and has not withdrawn consent.⁶

Documentation is where cases are won or lost. If a consumer disputes consent, the company calling them carries the burden of proof. At a minimum, capture and store:

The exact date and time of the form submission, accurate to the second.
The consumer’s IP address and, where possible, the browser user-agent string.
The exact text of the consent disclosure displayed at the moment of submission.
A screenshot or archived copy of the lead capture page as it appeared when the consumer clicked.
Evidence of the affirmative action — the checked box or comparable step, not a passive form submission.

Store this for at least five years to line up with the TSR’s recordkeeping rule.⁷

Two Recent Rule Changes to Build Into Your Forms

AI-Generated Voices

In February 2024, the FCC issued a declaratory ruling confirming that AI-generated human voices, including voice cloning, count as an “artificial or prerecorded voice” under the TCPA. Any call using AI-simulated speech needs the same consent as a traditional robocall, and telemarketing use requires prior express written consent.⁸ AI voice calls must also identify the initiating entity, and telemarketing calls must offer a way to opt out. If AI voice is anywhere in your funnel, the full TCPA consent apparatus applies from the first form field on.

One-to-One Consent

The FCC adopted a rule in late 2024 that would end the practice of bundling consent across multiple sellers on a single lead form. Under the rule, prior express written consent for robocalls and robotexts applies to only one seller at a time, so a comparison-shopping site would need a separate checkbox for each seller, and resulting calls or texts must be logically and topically related to the site where consent was given.⁹ The original effective date was January 27, 2025, but the FCC postponed it pending judicial review.¹⁰

Courts look at how much control the buyer exercised. Reviewing or approving call scripts, directing which geographic areas to target, sharing branding, and accepting leads without independently verifying consent records all support a vicarious liability finding.¹¹

Before making any outbound contact on a purchased lead, independently confirm the consent record exists, contains all required elements, has not been revoked, and specifically names your company as the seller. Vendor contracts should include compliance warranties, indemnification, and audit rights. Auditing lead suppliers at least twice a year is a reasonable minimum. Companies that treat purchased leads as automatically clean are the ones that show up in class-action complaints.

Do Not Call and Opt-Out Mechanics

Every seller and telemarketer has to download the National Do Not Call Registry and scrub listed numbers from call lists. The registry must be refreshed no more than 31 days before any call, which is why most operations run a monthly scrub.¹²

You also have to maintain an entity-specific do-not-call list. When a consumer tells you not to call again, that request has to be recorded and honored. The TSR prohibits interfering with that right, including making the consumer sit through a pitch or charging a fee to be added.¹³ Any later call to that consumer needs to be the result of genuine error, not sloppy list management.

For email, honor unsubscribe requests within 10 business days as CAN-SPAM requires.⁴ For text-message marketing, a “STOP” reply should stop the messages immediately. Automated systems need to recognize standard opt-out keywords, send a single confirmation, and then send nothing further. Log every opt-out with date, channel, and consumer identifier; that log is your evidence if someone later claims you kept contacting them.

The Two Defensive Tools That Actually Work

TSR Safe Harbor

The TSR includes a safe harbor for accidental Do Not Call violations, but it requires meeting all of the following:

Written procedures for honoring do-not-call requests, established and implemented.
Staff and any compliance vendors trained on those procedures.
An actively maintained entity-specific do-not-call list.
Use of a version of the National Do Not Call Registry downloaded no more than 31 days before each call, with records to prove it.
Active monitoring and enforcement of your own written procedures.

Meet all five and the burden shifts, so a violating call has to be an isolated error rather than a systemic breakdown. A pattern of “errors” tells the FTC the procedures are inadequate, and the safe harbor evaporates.¹⁴

Reassigned Numbers Database

One of the most common accidental TCPA violations is calling a number that has been reassigned to a new person since the original consumer gave consent. The FCC’s Reassigned Numbers Database lets you check whether a number has been disconnected or reassigned since the consent date. Querying before you call provides a safe harbor, but only if you can show three things: you obtained consent from the intended recipient, you checked the database before calling, and the database wrongly returned a “no” response.¹⁵ Access is a paid subscription through reassigned.us, with individual queries up to 50 numbers and batch queries up to 250,000. For older lead lists, it’s one of the cheapest forms of insurance available.

State Laws on Top of the Federal Floor

About twenty states now have comprehensive consumer data privacy laws, and the count keeps growing. These laws govern how businesses collect, store, sell, and share personal information generally, which puts lead generation squarely in scope.

California’s combination of the CCPA and CPRA remains the most expansive framework. California residents can request to know what personal information a business collects, ask for its deletion, and opt out of its sale or sharing. Businesses that sell personal information must display a “Do Not Sell or Share My Personal Information” link on their website.¹⁶ As of 2025, the California Privacy Protection Agency can impose fines of up to $2,663 per unintentional violation and $7,988 per intentional violation.¹⁷ A national lead generator needs a compliance framework flexible enough to shift by consumer residence.

Several states also have telemarketing statutes that reach further than the TCPA. Florida’s Telephone Solicitation Act creates a private right of action for $500 per violation or actual damages, whichever is greater, with treble damages available for willful or knowing violations, and Florida uses a broader definition of automated dialing than the federal statute. Florida also imposes a text-message wrinkle: before suing over unwanted texts, a consumer must reply “STOP” and give the sender 15 days to comply.¹⁸ Washington adds its own timing and identification rules for solicitation calls.¹⁹ A single national campaign may simultaneously be subject to different consent standards, damages structures, and cure periods depending on where each consumer lives.

Record Retention

The Telemarketing Sales Rule requires sellers and telemarketers to keep records related to their telemarketing activities for five years from the date each record is produced. That covers advertising materials and scripts (five years after last use), records of each telemarketing call, all consent records and express-agreement documentation, contracts with service providers (five years after the contract expires), and records of consumers who requested placement on the entity-specific do-not-call list.⁷

Five years is a floor. TCPA cases often involve calls made years earlier, and state limitations periods vary. Destroy consent records at year five, get sued in year six under a longer state statute, and you have nothing to defend yourself with. Storage is cheap; being unable to prove consent is not.

1
Office of the Law Revision Counsel. 47 USC 227 – Restrictions on Use of Telephone Equipment
2
eCFR. 16 CFR Part 310 – Telemarketing Sales Rule
3
Federal Trade Commission. FTC Publishes Inflation-Adjusted Civil Penalty Amounts for 2025
4
Office of the Law Revision Counsel. 15 USC 7704 – Other Protections for Users of Commercial Electronic Mail
5
Federal Trade Commission. CAN-SPAM Act – A Compliance Guide for Business
6
Office of the Law Revision Counsel. 15 USC 7001 – General Rule of Validity
7
eCFR. 16 CFR 310.5 – Recordkeeping Requirements
8
Federal Communications Commission. Implications of Artificial Intelligence Technologies on Protecting Consumers from Unwanted Robocalls and Robotexts
9
Federal Communications Commission. One-to-One Consent Rule for TCPA Prior Express Written Consent Frequently Asked Questions
10
Federal Communications Commission. FCC Declaratory Ruling 13-54 – TCPA Vicarious Liability
12
Federal Trade Commission. National Do Not Call Registry FAQs
13
eCFR. 16 CFR 310.4 – Abusive Telemarketing Acts or Practices
14
Federal Trade Commission. Complying with the Telemarketing Sales Rule
15
Federal Communications Commission. Reassigned Numbers Database
16
State of California – Department of Justice – Office of the Attorney General. California Consumer Privacy Act (CCPA)
17
California Privacy Protection Agency. California Privacy Protection Agency Announces 2025 Increases for Penalties
18
The 2025 Florida Statutes. Florida Code 501.059 – Telephone Solicitation
19
Washington State Legislature. RCW 80.36.390 – Telephone Solicitation