Do Bought Insurance Leads Count as TCPA Consent?

Here is the structural problem, and everything else follows from it.

The TCPA creates liability for the caller. Not the data broker, not the lead generator, not the aggregator three hops upstream who actually ran the web form. When a plaintiff’s firm files, the defendant is the agent or agency whose phone number placed the call, because that is who the statute names and that is who the recipient can identify.

So “my vendor said they had consent” describes a commercial relationship, not a legal defence. The question that matters is: what can you produce, in four years, when someone asks?

Four years is not arbitrary. It is the TCPA’s statute of limitations, which means a call you place today is litigable until 2030, long after the vendor relationship ended and possibly after the vendor stopped existing.

Nothing on this page is legal advice, and we are not a law firm. It is written so you know what to bring to counsel.

What prior express written consent actually requires

For calls using an automatic telephone dialing system or an artificial or prerecorded voice to a wireless number for telemarketing purposes, the FCC requires prior express written consent. The definition lives at 47 C.F.R. § 64.1200(f)(9), and the full rule text is on eCFR.

The elements it requires:

• A written agreement, signed by the consumer — an electronic signature under E-SIGN counts
• That clearly authorises the seller to deliver telemarketing calls or texts using an autodialer or prerecorded voice
• That includes the telephone number to which the calls may be placed
• That includes a clear and conspicuous disclosure that the consumer is agreeing to receive such calls, and that consent is not a condition of purchase
• Identifying the specific seller authorised to call

Read that last element carefully, because it is where bought leads most often fail. Consent runs to a named seller. A web form authorising “our marketing partners” to call does not obviously authorise you unless you are identifiable from the record.

The six-part record you need to hold yourself

Not the vendor. You. In your own system, exportable, retained four years minimum.

1. The exact consent language displayed to the consumer — verbatim, as rendered, not a summary
2. The source URL where it was displayed
3. Timestamp, date and time
4. IP address of the submission
5. The list of sellers named in the disclosure, and whether you were among them
6. The form record or call recording itself

If any of those is missing, you have a lead. You do not have a consent record.

The test to run before signing a lead contract: pick ten specific leads by name — not a sample the vendor selects — and ask for all six components. Give them five business days. What comes back tells you more about the vendor than any reference call, and it costs you nothing to ask.

The one-to-one consent history, and where it landed

The FCC adopted a rule in December 2023 that would have required consent to be given to one identified seller at a time, ending the practice of a single web form authorising a long list of partners. It was scheduled to take effect in January 2025.

The Eleventh Circuit vacated that rule in Insurance Marketing Coalition v. FCC in January 2025, holding that the FCC had exceeded its authority by adding requirements beyond the statutory meaning of “prior express consent.” The court’s opinion is the primary source.

So one-to-one consent is not currently a federal requirement. Two things follow, and both matter:

First, multi-seller consent forms remain legally viable federally — but the underlying requirement that consent identify the seller has not gone anywhere. A form naming forty “partners” is weaker evidence than one naming three, and it is weaker still if you cannot show you were on the list at the time of capture rather than added later.

Second, several states have moved in this direction independently, and state mini-TCPA statutes are not affected by an Eleventh Circuit ruling on federal agency authority. Jurisdiction matters here more than it used to — see state mini-TCPA laws.

Reassigned numbers

Consent attaches to a person, and phone numbers change hands. A valid consent obtained in 2024 from the person who then held a number does nothing when a different person answers it in 2026.

The FCC operates the Reassigned Numbers Database for exactly this. Querying it before calling establishes a safe harbour against liability for calls to a number that was reassigned after consent was given — provided the database returned “no” and the query is documented.

Two practical points:

• The safe harbour depends on your query, logged with its date. A vendor’s assurance that they scrub is not your safe harbour.
• The older the data, the more this matters. On aged lead files it is close to essential; on real-time leads it is a smaller risk.

What indemnity clauses actually do

Every lead contract has one. It says the vendor will defend and indemnify you against TCPA claims arising from their leads.

What it does: gives you a contractual claim against the vendor.

What it does not do: stop you being the named defendant, stop your E&O premium moving, stop the litigation consuming your months, or produce money if the vendor is a thinly-capitalised LLC that dissolves when the first class action lands.

Treat indemnity as a partial financial backstop from a counterparty whose ability to pay you have not verified. It is not a compliance control. The compliance control is holding the six-part record yourself.

What to do this week

1. Pick ten leads from your current vendor and request the full six-part record. Note how long it takes and what is missing.
2. Check your own system stores all six fields per lead, with timestamps that include a time, not just a date. Consent timestamps degraded to dates are a common and unrecoverable data loss, particularly after a system migration.
3. Confirm your retention period is at least four years, and that it covers recordings and form records, not just the contact row.
4. Log your Reassigned Numbers Database queries with dates, if you are querying. If you are not querying, decide deliberately rather than by default.
5. Read the consent language your vendors use. Not the contract — the language the consumer actually saw. If you have never seen it, you are relying on a document you have not read.

Related

State mini-TCPA laws for where the jurisdiction question bites. Calling hours by state for the timing rules that apply regardless of consent. A2P 10DLC registration for the parallel regime governing text messages. And what to do if a demand letter arrives, which is the page you hope not to need.

No page in this section links to any product, by policy, enforced by the build.