TCPA Compliance Checklist for Lead Forms

Define the outreach before reviewing the form

Different outreach methods can trigger different obligations. Prior express written consent is required for covered telemarketing calls and texts using technology subject to the applicable TCPA rules. Artificial or prerecorded voice calls have their own coverage considerations. A system's marketing label does not decide its legal classification.

Map the actual channel, technology, purpose, seller and recipient location before approving wording. Federal TCPA rules, state laws, do-not-call requirements and carrier standards can overlap. This checklist is general information, not legal advice. ConsentVerified is a compliance tool, not a law firm.

• Identify every seller that will make or cause the outreach.
• Describe whether the campaign uses calls, texts, artificial voice or prerecorded voice.
• Have counsel assess the technology and consent standard that apply.
• Identify relevant state restrictions and buyer or carrier requirements.
• Assign an owner who can stop contact when required evidence is missing.

Keep this scope with the form approval. A disclosure approved for one campaign should not silently become approval for a materially different use of the lead.

Review the core disclosure elements

Where prior express written consent is required, the agreement must clearly authorize the relevant seller's covered communications to the specified number and include the required disclosures. Electronic consent can qualify, but the signature process must show agreement to the terms presented.

• Name the seller seeking consent using a name the consumer can recognize.
• State that consent covers marketing or telemarketing communications as applicable.
• Identify calls and texts separately when both are requested.
• Address an automatic telephone dialing system and artificial or prerecorded voice where relevant to the outreach.
• State clearly that consent is not a condition of purchasing goods or services.
• Tie consent to the phone number the consumer provides.
• Explain which affirmative action signifies agreement to the disclosure.
• Provide accessible privacy policy and terms links without using them to hide the consent request.

Avoid broad language that authorizes any future use by any recipient. The disclosure should correspond to the outreach your team actually intends to make. Review TCPA consent requirements when building the approval criteria, and preserve the approved disclosure as a versioned record.

Make agreement clear and intentional

A form submission and marketing consent are related only when the page makes that relationship clear. A consumer asking for information has not necessarily agreed to every kind of marketing contact. Review the action, surrounding disclosure and page design together.

• Use an affirmative action that clearly communicates agreement to the consent terms.
• If using a checkbox, leave it unchecked until the consumer selects it.
• If relying on a button action, make the agreement associated with that action conspicuous and unambiguous.
• Keep marketing consent distinguishable from unrelated acknowledgments.
• Record the checkbox state or button action and the associated disclosure version.

A checkbox alone is not a legal safe harbor, and a button label alone cannot cure hidden wording. Ask whether a person can understand what contact they are authorizing before taking the action. Have counsel review any arrangement that makes optional marketing consent appear necessary to complete a purchase.

Inspect placement on the actual page

Text can be accurate and still fail to communicate effectively because of its presentation. Check the form on mobile and desktop, including states with validation errors, expanded fields or a displayed keyboard. The relevant question is what the consumer encountered at the moment of agreement.

• Place the disclosure close to the action that records consent.
• Use readable type, sufficient contrast and adequate spacing.
• Keep overlays, banners and sticky controls from covering the wording.
• Confirm that a consumer can open the privacy policy and terms without losing the form state.
• Review conditional wording and seller lists after all selections are made.
• Capture the actual rendered disclosure, not just text stored in a configuration file.

Preserve the result of the page review. A later screenshot of the current page does not establish how an older version looked when a particular lead submitted the form.

Add the SMS program disclosures

SMS programs need a review that covers legal consent requirements and applicable carrier or messaging standards. These are related obligations with different sources. Message frequency, rates and HELP instructions should not be described as universal statutory TCPA wording requirements.

• Identify the brand or seller sending messages and describe the program purpose.
• State the message frequency or explain that frequency varies when that accurately describes the program.
• Include the disclosure that Msg and data rates may apply.
• Explain how to opt out using STOP.
• Explain how to obtain assistance using HELP.
• Link to the messaging terms and privacy policy.
• Preserve web opt-in or keyword opt-in evidence for the relevant program.

Check that the actual messages and support behavior match these statements. A form promising an opt-out mechanism creates an operational obligation to honor it. Review SMS consent and 10DLC compliance together. Campaign registration is separate from proving that a particular recipient authorized the messages.

Control resale and seller identification

A lead transfer does not automatically expand the scope of consent. Determine whether the receiving seller and proposed communications fit the agreement the consumer actually made. A contract between businesses cannot supply consumer authorization that the original interaction did not obtain.

• Replace vague references to marketing partners with identified sellers in the consent process.
• Make any seller selection or list clear and accessible before agreement.
• Preserve the exact seller list and selections shown for each submission.
• Prevent downstream recipients from adding themselves to an older consent record.
• Require fresh consent when the intended use falls outside the existing authorization.

The FCC's vacated one-to-one rule did not take effect. That does not turn an unrestricted partner list into reliable permission. Read the one-to-one consent rule status for the distinction between that court ruling, continuing federal requirements and stricter contractual or state obligations.

Create evidence for every submission

A certificate per submission helps keep the disclosure, action and delivered lead connected. It is an evidence control rather than a certification that all legal requirements have been met. The capture process must preserve the facts your later review needs.

• Assign a certificate identifier to each completed submission.
• Capture the disclosure text, page URL, timestamp and relevant page presentation.
• Preserve the seller names, requested channels and affirmative action.
• Connect the submitted phone number to that specific interaction.
• Retain relevant session metadata with appropriate access controls.
• Detect missing or failed capture before releasing the lead for outreach.

Do not reuse an earlier certificate for a new submission merely because the phone number matches. Preserve both records and their relationship. If third-party evidence is contractually required, confirm that the delivered certificate URL or token resolves to the correct interaction.

Verify the lead before dialing or texting

A lead should pass the required checks before it enters an active contact queue. Verification after the first call cannot prevent that call from occurring without an adequate basis. Decide in advance which results block delivery and which require manual review.

• Confirm that the evidence belongs to the delivered phone number and submission.
• Confirm that the contacting seller is within the recorded authorization.
• Check that the disclosure covers the channel and relevant technology.
• Review the submission date, subsequent events and any campaign-specific freshness requirement.
• Check for revocation, internal suppression and other contact restrictions.
• Save the verification result, decision time and reason for any override.

Consent does not have a universal expiration period that applies to every campaign. The age of a lead is one factor in assessing the record and applicable requirements. Use lead buyer consent verification to build acceptance rules that remain distinct from a vendor's assertion that a lead is compliant.

Scrub DNC lists and internal suppression records

Consent evidence and do-not-call screening answer different questions. A record of agreement does not justify ignoring a later request to stop contact. Federal and state DNC rules may also have different coverage and exceptions that need legal review.

• Check the applicable federal and state DNC lists using an appropriate update schedule.
• Check the seller's internal do-not-call and suppression records before contact.
• Document any exception relied on and the evidence supporting it.
• Recheck restrictions when an older lead returns to an active campaign.
• Restrict access to suppression data and prevent imports from overriding it.

A DNC scrubber helps apply list checks consistently, but configuration matters. Define which lists apply, how updates reach contact systems and what happens during a service interruption. Keep the screening outcome with the contact decision rather than treating it as an unrelated database task.

Apply quiet hours where the recipient is located

Calling windows and messaging restrictions can depend on federal rules, state law and program terms. Use the recipient's relevant local time and apply the most restrictive applicable rule. An area code alone may not reliably establish where the recipient is located.

• Determine which time zone information the workflow can reasonably support.
• Apply applicable calling and texting windows before scheduling contact.
• Address stricter state rules, holidays and frequency limits where relevant.
• Keep uncertain location records out of automatic scheduling until resolved.
• Preserve the rule and time information used for each contact decision.

Do not assume that an opted-in lead can be contacted at any hour. Consent, timing and contact frequency are separate controls, and changing campaign software should not remove any of them.

Handle revocation across the contact workflow

A consumer may withdraw consent through applicable reasonable methods. Do not design the process to recognize only one keyword while ignoring other clear requests. Have counsel confirm current requirements, processing deadlines and the scope of suppression for your programs.

• Capture STOP messages, spoken requests, support messages and other recognized revocation methods.
• Timestamp the request and preserve the original communication.
• Apply suppression within the applicable deadline and prevent further prohibited outreach.
• Synchronize the decision with dialers, messaging platforms, vendors and internal lists as needed.
• Investigate cases where a suppressed record is imported again.

Keep the revocation record linked to the original consent evidence. A later reviewer needs to understand both when permission was obtained and when it was withdrawn. Audit whether confirmation messages and HELP responses follow applicable rules rather than treating them as ordinary promotional messages.

Keep evidence for the relevant legal period

The federal TCPA generally has a four-year statute of limitations. That period is not an automatic instruction to delete every consent record four years after collection. A claim can relate to later calls or texts, and state requirements, contracts or litigation holds can affect retention.

• Set the retention period with counsel using contact history and applicable claims periods.
• Keep disclosure versions, seller lists, certificates and verification results connected.
• Retain DNC checks, revocations and contact records needed to explain the chronology.
• Confirm that subscription storage terms support the retention policy.
• Suspend routine deletion when a legal hold applies.
• Test retrieval and export before a complaint or audit arrives.

Federal TCPA statutory damages can range from 500 to 1,500 USD per call or text where applicable, depending on the violation and any qualifying enhancement. Evidence storage does not eliminate that exposure. Its purpose is to preserve facts for a defensible assessment of what occurred.

Assign owners and audit the handoffs

Use the table to turn the checklist into operating responsibilities. The suggested owners are roles your business can assign, rather than assumptions about its structure. Record unresolved findings and hold affected traffic until the responsible reviewer approves a resolution.

• Audit lead vendors against the forms actually generating your traffic.
• Review changes to disclosures, routing, capture scripts and seller lists.
• Test missing evidence, conflicting records and suppression failures.
• Require corrective action and confirm that it reaches downstream systems.

Vendor promises should be tested against delivered records. A completed questionnaire cannot establish what happened on a particular submission, and a certificate cannot show that a later revocation was honored without the surrounding records.