TCPA regulations for lead generators in 2026

Understand what the TCPA regulates

Congress enacted the Telephone Consumer Protection Act in 1991. The statute and implementing FCC rules restrict certain calls and texts, including communications involving an automatic telephone dialing system or an artificial or prerecorded voice. Requirements depend on the technology used, the destination, the communication's purpose, and applicable exemptions. Text messages are treated as calls under the TCPA, so moving a campaign from voice to SMS does not remove the need for a legal review.

For lead businesses, separate the consent analysis from the broader question of whether contact is allowed. A call outside a particular automated calling restriction may still face federal do-not-call requirements, state telemarketing laws, or an internal suppression request. A record marked approved in a CRM does not resolve those separate obligations. Map the actual outreach method and campaign purpose before deciding which permission and screening steps apply.

TCPA statutory damages can be $500 per violation, with up to $1,500 for a knowing or willful violation. Liability depends on the claim and facts. Those amounts explain why preserving the underlying agreement matters, but no certificate guarantees a defense. This article is general information, not legal advice. Laws and interpretations change, and qualified counsel should evaluate your campaign.

TCPA guidelines for collecting written consent

Prior express written consent is required for covered telemarketing calls and texts using an autodialer or an artificial or prerecorded voice. For wireless marketing texts, the autodialer question is particularly relevant. A written agreement should clearly authorize the seller to deliver or cause delivery of the covered communications to the specified telephone number. The agreement must include the required disclosure that consent is not a condition of purchasing property, goods, or services.

An electronic signature can satisfy the signature requirement when the process meets applicable electronic signature rules. The action must communicate agreement to the relevant terms. Simply collecting a number for a quote or placing a disclosure in an unrelated policy does not establish the same thing. Review how a reasonable visitor encounters the wording, including on a phone screen and after validation errors change the page layout.

• Identify the seller receiving authorization and the channels covered by the agreement.
• Describe the applicable automated technology or artificial or prerecorded voice use clearly.
• Connect the disclosed agreement to the number provided and the signature action.
• Make the purchase condition disclosure visible before the visitor agrees.
• Preserve the exact disclosure version associated with each submission.

Use the TCPA consent requirements FAQ to review recurring questions, and apply the TCPA compliance checklist when assessing a form. A checklist helps organize review, while the full interaction supplies the evidence needed to assess an individual lead.

TCPA rules after the major court decisions

Facebook v. Duguid, decided by the Supreme Court in 2021, narrowed the definition of an automatic telephone dialing system. The decision focuses on equipment using a random or sequential number generator in the manner described by the statute. It does not establish that every platform sending messages from a stored list is outside every TCPA restriction. Artificial or prerecorded voice restrictions and other applicable rules require their own analysis.

In January 2025, the Eleventh Circuit vacated the FCC one-to-one consent rule in Insurance Marketing Coalition v. FCC. The rule never took effect. Do not present it as a current obligation requiring a separate agreement for every seller. Its vacatur also does not establish that vague language authorizing unidentified partners always creates valid permission. Existing consent requirements still require attention to what the consumer actually authorized.

In June 2025, the Supreme Court held in McLaughlin Chiropractic v. McKesson that district courts are not bound by FCC interpretations when independently interpreting the TCPA in the context addressed by the case. That decision makes current legal analysis important when a program relies on an agency interpretation. It does not automatically invalidate all FCC rules or remove the need to comply with applicable regulations.

Keep the one-to-one consent rule status guide with your policy review materials. When counsel changes an interpretation or campaign standard, record the decision and update the affected forms, intake controls, and training together. Leaving an obsolete rule in a vendor questionnaire can create confusion even after your own disclosure has been corrected.

Review the agreement when a lead changes hands

A lead purchase transfers data under a commercial arrangement. It does not independently establish that the consumer authorized your proposed outreach. Buyers should examine the seller named in the disclosure, the communication contemplated, and the connection between that agreement and the number they receive. A vendor's contractual promise supports accountability, but the promise is separate from evidence of the consumer's agreement.

For lead generators, preserve the version of any seller selection interface that the consumer encounters. If a person chooses a provider, keep that selection associated with the submission. If the form uses a partner list, retain the relevant list and how it was presented. Counsel can then evaluate the scope of the agreement without reconstructing an earlier page from the current website.

Define an intake path for missing, inaccessible, or mismatched records. Put the affected lead on hold while the source supplies the original evidence. Avoid replacing a missing record with a fresh screenshot that shows what the form looks like today. Review should address the actual collection event and the buyer's intended use before the lead reaches the dialer or messaging queue.

Preserve the facts behind each submission

A useful consent record connects the disclosure, affirmative action, phone number, seller, and collection context. Store the page URL, timestamp, form version, and submission action alongside the lead reference. Where appropriate, retain the displayed page and visibility information so a reviewer can assess whether the disclosure was reasonably available. Technical metadata can support the record, but an IP address alone does not prove who completed a form.

ConsentVerified captures disclosure text, visibility, checkbox or button action, timestamps, page URL, IP address, and user agent. A certificate ID and hash help connect the captured interaction to its retained record. TCPA consent verification lets buyers review phone matching, the seller named, consent age, and disclosure checks before deciding how to handle the lead.

Treat automated checks as review inputs. A favorable disclosure score does not establish identity, resolve all jurisdictional issues, or prove that consent remains effective. A timestamp shows when an event was captured, rather than creating a universal consent expiration period. Investigate inconsistent facts and retain the reasoning behind exceptions so a later reviewer can understand the decision.

Check do-not-call obligations separately

The National Do Not Call Registry is part of a separate screening process for telemarketing. Review applicable federal and state do-not-call requirements and your own internal suppression list before outreach. Any exception or permission-based basis for calling a registered number needs its own support. A consent certificate does not automatically establish that every do-not-call requirement has been satisfied.

Keep screening results associated with the contact decision, including the relevant lists, check time, and treatment of a match. Establish who can approve an exception and what evidence that decision requires. A DNC scrubber supports list checks, while your policy determines how results and exceptions affect the queue. The process also needs a way to prevent a later import from restoring an internally suppressed record.

Consumer requests directed to your business matter even when a number is absent from an external registry. Agents, support staff, and vendors should know where to send those requests. Reconcile suppression information across the systems making contact, rather than treating a successful list upload as proof that every downstream queue is current.

Apply local calling hours and state requirements

Federal telemarketing calling hours generally run from 8 a.m. to 9 p.m. at the recipient's location. Treat that as a federal boundary rather than a universal operating window. State laws, campaign requirements, or other restrictions may be tighter. Schedule outreach using the recipient's applicable local time, with a documented approach for situations where location is uncertain.

Area codes alone are an unreliable guide to where a person is located. Mobile users move and retain numbers after relocating. Use available, appropriate location information and route uncertainty for review. Check the release time when a queued communication is actually sent, because a contact approved earlier may reach the queue after the allowed window closes.

State mini-TCPA laws can impose different consent standards, technology definitions, contact limits, and remedies. Review the states relevant to the consumer and the campaign. Do not assume that a federal autodialer analysis answers the state law question. If calls are recorded, call recording consent laws by state require a separate review from permission to place the call.

Honor later requests to stop

The FCC revocation framework allows consumers to revoke consent by any reasonable means. Build a process that recognizes the substance of a request, including a response to an agent or a plain-language text asking the business to stop. A program should not insist on a particular form or exact keyword when the applicable rules recognize another reasonable method.

Record the request, when it arrived, its context, and the action taken. Apply the relevant timing and scope requirements, and escalate uncertainty without continuing the affected outreach while the request is being resolved. Where rules differ across message categories or programs, counsel should define the treatment and your systems should implement that decision consistently.

For texting, keep STOP handling connected to the suppression process and monitor reasonable requests that automated keyword handling misses. Read the TCPA text message rules for messaging-specific controls. Preserve the original opt-in even after suppression so the history explains both the initial permission and the later withdrawal.

Make the contact decision reviewable

Assign responsibility for disclosure approval, source onboarding, intake checks, suppression, and evidence retrieval. Each handoff should state what happens when a check fails. Staff need a clear hold or escalation route when a lead arrives without usable evidence. A requirement written into a source agreement will have limited operational value if the dialer accepts the record anyway.

• Review live forms after disclosure or seller selection changes.
• Confirm that vendor evidence remains accessible after the lead is delivered.
• Check suppression before queued calls or messages are released.
• Reconcile complaints with the underlying agreement and contact history.
• Export a complete evidence package to confirm that records remain retrievable.

Use a retention policy informed by applicable claims, contracts, privacy obligations, and counsel's advice. Preserve records subject to a legal hold and control access to exports. Avoid making the retention period depend only on how long a lead remains active in a sales system. The evidence may still matter after the sales opportunity closes.