TCPA Compliance When Buying Legal Leads: Whose Name Is on the Letter?

When a TCPA complaint lands, the name on it is the firm that placed the call, not the marketer who sold the lead.

In most contact-privacy regimes, the duty belongs to the party that contacts the consumer, not the party that assembled the record. So buying leads is a documentation decision as well as a pricing decision.

Your firm understands the law better than any vendor. Ask what the vendor can provide as proof of consent for every delivered lead.

Below are the consent chain and the records to require.

Whose name is on the letter

The Telephone Consumer Protection Act is a US federal statute governing telephone calls and text messages. One of its features is a private right of action. Individuals can sue on their own behalf, which is why an entire plaintiff's bar has organized around it.

Lead buyers repeatedly overlook one point: liability follows the caller.

A demand letter or lawsuit alleging an improper call or text names your firm because your firm made contact. The marketer that sold the lead, especially a cheap lead with no consent trail, may become difficult to reach at that moment.

That is the problem with buying leads based on price alone. Your firm still has to prove consent, even when someone else generated the form.

Ask the vendor whether it can document consent for any lead it has sent you and exactly what records it would provide.

The answer comes in four parts.

The four records to demand

1. The consent record. For each lead, the vendor should provide a timestamp, the IP address behind the submission, and a screen capture of the form showing the exact consent wording visible when the person submitted it.

The TCPA framework calls for consent before automated calls or texts go to a mobile number. Your firm, not the applicant, has to prove that consent existed. A lead is only as defensible as its supporting record. We keep that record for every lead that leaves our system and provide it when you ask.

2. Do-Not-Call screening. A number of jurisdictions operate their own Do-Not-Call registries. You will find them in the US, the UK, France, and Singapore, among others. Dialing a listed number can generate exposure all by itself.

Vendors should check US phone numbers against the Federal DNC list before delivery, not leave your intake team to discover the issue after calling. We run that check automatically. This matters most where a plaintiff's bar specializes in DNC and TCPA claims.

3. Compliant capture. Consent only means something if it was gathered properly to begin with, on the landing page, before any lead existed. For leads coming from or sitting in Europe, that means GDPR-grade consent and privacy practices built into the page itself. Holding every page to that bar is simpler and safer than deciding case by case, so ours meet it wherever a given lead happens to land.

4. Clean handoff. A vendor should not call, email, or text your leads while generating them. Contact from the vendor makes the consent and supporting records less clear. After delivery, the relationship and its records should belong to you alone, without an intermediary already having contacted the prospect.

A note for firms operating from abroad

Immigration practice is unusually cross-border, which adds one more consideration.

The TCPA concerns calls and texts to US numbers, which means a firm contacting US prospects can fall within its reach no matter where its office sits.

Email works differently. Take CAN-SPAM, the US email law: on its own terms it generally will not touch a sender based outside the United States who never writes to a US person. Yet the major mailbox providers apply its core expectations anyway, so a real postal address and a functioning unsubscribe are worth including whether or not the statute formally binds you.

Comparable regimes exist elsewhere. Canada runs CASL. Australia has its Spam Act. The UK enforces PECR. Each lands in roughly the same place, and each carries real consequences for operators who ignore them.

Build your process around the strictest standard you may need to meet rather than trying to handle each jurisdiction separately. Confirm your specific exposure with counsel who knows your practice. None of this replaces that advice.

Why this is a lead-quality question, not just a legal one

Consent records are part of lead quality.

You can work a lead with a full consent record confidently and defend it if challenged. A lead without one is a liability you paid to acquire.

The cheapest leads are cheap in part because nobody spent anything documenting consent. Both a clean consent trail and a low fake rate flow from owning the traffic and the capture instead of reselling whatever a cut-rate ad network passes along.

Ask the vendor for proof, not just promises.

Next:

• Cheap legal leads uncovers the screening, intake, and risk costs hidden behind a low price.
• Why fake legal leads exist connects unverified traffic with bad contact details and missing consent.
• Immigration lawyer leads follows the process from generation and verification through delivery with consent records attached.