Before your firm calls or texts a purchased lead, confirm that the consumer gave clear consent to be contacted, that the consent language named or clearly covered your firm, and that a record of that consent (the form, the timestamp, and ideally a third-party certificate) is stored with the lead. Your firm places the calls, so your firm carries much of the TCPA exposure.
The Telephone Consumer Protection Act (TCPA) is a federal law that restricts marketing calls and texts made using automated dialing systems or prerecorded voices. It allows private individuals to sue for statutory damages on a per-call or per-text basis, which means that a pattern of non-compliant outreach can produce substantial liability quickly, and class actions under the TCPA are common.
Law firms following up on purchased leads are squarely within its reach. The fact that a vendor generated the lead does not move the responsibility for the call away from the firm that made it. Several states have also passed their own telemarketing laws, some stricter than the federal rule, so the question of consent deserves careful attention before a campaign launches.
What to verify with your lead vendor
The consent language
Read the exact text the consumer agreed to when they submitted the form. It should clearly say that they may be contacted by a law firm, and it should cover the methods you intend to use: phone calls, text messages, and automated means if your intake process uses a dialer or automated texts. Vague language that does not mention law firms, or that does not mention texting, leaves gaps.
Who the consent covers
Consent that lists dozens of unnamed “marketing partners” is considerably weaker than consent to be contacted about the consumer’s specific legal matter by a law firm. The narrower and clearer the consent, the easier it is to defend if it is ever challenged.
A per-lead record
For each lead, there should be a record of the form the consumer used, their IP address, the timestamp of submission, and ideally a third-party consent certificate from a service such as TrustedForm or Jornaya. A certificate captures what the consumer actually saw on the page, including the consent language, at the moment they submitted, which is difficult to reconstruct later from any other source.
How long records are retained
Claims under the TCPA can be brought years after the call was made. Ask how long the vendor keeps consent records and how your firm can access them if a claim is made after the vendor relationship has ended. Storing a copy of the certificate in your own CRM is the safest approach.
Phone verification
Verifying the phone number by SMS before delivery helps ensure your firm is calling the person who actually gave consent. A mistyped number can put your firm in the position of calling someone who never agreed to be contacted, which is exactly the situation the TCPA is designed to address.
Where the rules stand
In late 2023, the Federal Communications Commission adopted a “one-to-one consent” rule that would have required consent to be given to a single identified seller at a time, rather than to a list of partners. The Eleventh Circuit vacated that rule in January 2025, before it took effect.
The underlying requirement did not go away. Prior express written consent is still required for autodialed or prerecorded marketing calls and texts. Many vendors have kept one-to-one style consent as a best practice anyway, because consent given to a single named firm is easier to defend than consent given to a long list.
State laws to know
Florida
The Florida Telephone Solicitation Act (FTSA) creates its own private right of action, separate from the federal TCPA. Amendments in 2023 narrowed the definition of an autodialer and added a notice-and-cure period for text messages, giving recipients an opportunity to object before a claim can be filed. Firms calling Florida claimants should understand both the federal and the state rules.
Other states
Oklahoma, Maryland, and several other states have adopted FTSA-style laws with their own requirements and private rights of action. Check the rules in each state where you buy leads.
Practical safeguards for your firm
Beyond verifying consent with your vendor, a few habits within your own firm reduce exposure considerably:
This article is general information and not legal advice. Firms should have their outbound calling practices reviewed by counsel familiar with the TCPA and applicable state laws.
Frequently asked questions
Does the TCPA apply to law firms calling leads?
Yes. The TCPA applies to calls and texts regardless of the caller’s industry. A law firm calling or texting purchased leads using automated systems needs appropriate consent.
What is a TrustedForm certificate?
It is a third-party record of a consumer’s form submission, including the page, the consent language shown, and a timestamp, which can help document consent if it is challenged.
Is the FCC one-to-one consent rule in effect?
No. The Eleventh Circuit vacated it in January 2025 before it took effect. Prior express written consent is still required for autodialed or prerecorded marketing calls and texts.
Written by the IronFlow Advertising team
IronFlow Advertising builds exclusive lead generation campaigns for law firms, lenders, insurance agencies, and home service companies. Questions about anything in this article? Call (251) 233-4916 or send us a note.