Last updated 2026-07-11
TL;DR
Every unsolicited call or text to a cell phone can cost $500 to $1,500 under the TCPA. The only reliable fix is to generate leads who gave prior express written consent before you dial. This article covers the consent mechanisms that hold up, the lead-gen channels worth using, and the documentation that survives a plaintiff's attorney.
What is TCPA cold call risk, and why does it matter for lead generation?
The Telephone Consumer Protection Act, codified at 47 U.S.C. § 227, prohibits any call using an automatic telephone dialing system or a prerecorded voice to a cell phone without the called party's prior express consent [1]. Texts to cell phones fall under the same rule. Statutory damages run $500 per violation and up to $1,500 per willful violation, with no cap per plaintiff and no requirement to prove any actual harm [1].
That math turns ugly fast. A single SMS blast to 10,000 people who never opted in produces $5 million to $15 million in statutory exposure. The number is not theoretical. The cash app tcpa class action settlement resolved for $8.5 million, and the credit one tcpa settlement reached $12.5 million. Both came from systematic dialing without adequate consent.
Cold calling means contacting someone who never invited contact. That is the exposure. The answer is not to dial fewer people. It is to generate leads who already invited contact, in writing, using language that meets the FCC's consent standard. Do that and the entire legal posture of your outbound program changes.
What counts as prior express written consent under the TCPA?
The FCC's 2012 order requires "prior express written consent" for autodialed or prerecorded marketing calls and texts to cell phones [3]. The agency defines it as an agreement, signed (including electronically), that clearly authorizes the seller to contact the consumer at a specific number using autodialing or prerecorded messages.
The disclosure has to do four things. It must be in writing. The consumer must sign it, which under the E-SIGN Act includes checking a box or submitting a web form [4]. It must name the specific seller or sellers who will call, not a generic category of businesses. And it must state that consent is not a condition of purchase. The FCC was blunt on that last one: conditioning a sale on consent is prohibited.
Most failing forms fail on the naming point. Language like "you may be contacted by our partners" names nobody. District courts applying the FCC's rule have held repeatedly that vague, catch-all disclosures do not protect the company that eventually dials. If your form does not name your company, you do not have valid consent for your calls. Full stop.
One line of FCC guidance is worth memorizing. Valid consent means "an agreement, in writing, bearing the signature of the person called, that clearly authorizes" the contact [3]. The word "clearly" carries the weight. Ambiguous disclosures lose.
Which opt-in lead generation channels produce the strongest TCPA consent?
Not every opt-in channel gives you equal protection. The channel decides how consent gets captured, what documentation exists afterward, and how fast you can prove consent when challenged. Here is how the main ones stack up.
Owned web forms are the gold standard. You control the page, the disclosure text, the timestamp, and the IP log. When a prospect submits, you record the exact consent language shown, the date and time, the IP address, the form version, and the phone number. That is a complete audit trail. Put the disclosure directly above or beside the submit button, not buried in a terms link at the bottom.
Click-to-text and SMS keyword opt-ins work well for mobile acquisition. The consumer texts a keyword to your short code or long code, and that inbound message is documented consent for the number it came from. Confirm the opt-in with an immediate auto-reply that names who is texting, what they will get, how often, and how to stop [5]. Our guide on text message marketing covers how to write that confirmation.
Paid search and social lead forms (Google Lead Form extensions, Meta instant forms) pre-fill user data and take a tap to submit. The platform logs it. These can work, but you have to add a custom disclosure, because the platform default language is not specific enough to name your company or describe ATDS use.
Co-registration and third-party lead purchases are where most exposure lives. Someone fills out a form on a publisher's site and their data gets sold to many buyers. The disclosure may not name you, may be stale, or may be buried. Buy this way only if you can obtain the original consent record for every lead: the exact disclosure text, the timestamp, and the source URL. No documentation means no valid consent.
Referrals and inbound calls deserve a note. When someone calls you first, you can call back. When a customer hands you a friend's number, you cannot dial it. The friend never consented. Get the referred person's own opt-in before you call.
How should a web opt-in form be structured to satisfy TCPA requirements?
The form itself matters almost as much as the words on it. Courts and the FCC ask whether a consumer could reasonably understand what they agreed to, so placement and prominence of the disclosure get fought over in litigation.
Put the consent disclosure right beside the phone number field or directly above the submit button. Some practitioners use both spots. The text should read without scrolling, in a font size that matches the surrounding copy, not 8-point gray on white. Links to full terms are fine as supplements, but the core consent language has to sit on the face of the form.
The disclosure should include your company name, a statement that you may contact them at the number provided using automated or prerecorded technology, a short description of the purpose ("regarding your insurance quote request"), a line that consent is not required to purchase, and a way to decline (a phone number to call instead).
On the backend, capture and store the full disclosure text at the time of submission (versioned, so you know which language applied), a timestamp with timezone, the IP address, the form URL, the submitted phone number, and ideally the referral source. Keep this data for at least four years. The TCPA statute of limitations is four years under 28 U.S.C. § 1658 [6].
LeadCompliant's free consent checker tells you whether your current disclosure hits every required element. It is a fast first audit before you get into deeper documentation work.
What is the one-to-one consent rule and how does it affect lead buying?
In December 2023 the FCC issued an order, effective January 27, 2025, closing what it called the "lead generator loophole" [7]. Under the rule, prior express written consent must be given to one seller at a time. A single form submission cannot legally authorize calls from multiple unrelated sellers on vague "marketing partners" language.
This aims straight at the comparison-shopping and co-registration model, where one form gets sold to dozens of buyers. After January 27, 2025, each buyer needs its own, separately obtained consent from that consumer. One form, one seller.
For lead buyers, that makes most third-party pools bought before 2025 under the old multi-seller model legally problematic to dial, no matter what you paid. The practical response is simple. Generate your own leads through owned channels, or work only with publishers who can show one-to-one consent naming your company, with documentation.
For lead generators and publishers, the model has to change. Either let each consumer pick which specific companies they want to hear from, or get separate consent for each buyer before you share the record.
How do you stay off the Do Not Call list and why does it matter for opt-in programs?
The National Do Not Call Registry is a separate layer consumers can invoke under the TCPA and the FTC's Telemarketing Sales Rule [9]. Even with valid prior express written consent for autodialed calls, the DNC registry still covers telephone solicitations to residential numbers. A consumer on the registry who never gave you written consent cannot be called for telemarketing.
Consumers register at donotcall.gov. The FTC runs the registry and gives telemarketers paid access to download numbers for scrubbing [8]. You have to scrub your call lists against the registry at least every 31 days.
Here is the good news. A proper opt-in program handles most DNC risk on its own. When someone completes your consent form, they affirmatively invite contact, which creates a specific express invitation that overrides DNC restrictions for your company for a period. The risk shows up later, when that consent expires (they opt out, or too much time passes) and you keep dialing.
For more on registry access and scrubbing, see our guides on the do not call list, the mobile phone do not call list, and how do i get the do not call list.
State rules add another layer. California, Florida, Indiana, and several other states run their own registries, some stricter than the federal list [12]. Operate nationally and you need to scrub against both federal and every applicable state list.
What opt-in documentation should you keep, and for how long?
Documentation decides TCPA cases. A defendant who can produce a complete consent record, showing exactly what disclosure the plaintiff saw, when they saw it, and what number they gave, wins or settles cheap. A defendant who cannot produce records has basically already lost.
Keep the following for every opt-in record:
- The consent disclosure text, versioned by date (store old versions even after you update the form)
- Timestamp of submission, with timezone
- IP address of the submitter
- Phone number as submitted
- Source URL (the page where the form appeared)
- Lead source or campaign ID
- Any later opt-out requests, with timestamps
Store these records for at least four years. The TCPA statute of limitations is four years under 28 U.S.C. § 1658 [6]. Some practitioners keep them five or six years to cover any argument about when the clock started.
For third-party leads, require the publisher to transfer the consent record, more than the contact data, in your purchase contract. Add a representation and warranty clause stating the publisher certifies valid prior express written consent was obtained under 47 U.S.C. § 227 and the FCC's rules. That does not erase your risk, but it creates an indemnification path and signals to a plaintiff's attorney that you took real steps.
Does prior express written consent expire?
The TCPA statute sets no expiration date on consent, and neither does the FCC's rule [1]. But courts have found implied expiration in a few situations, and common sense points the same way.
Consent expires when the consumer revokes it. The FCC lets consumers revoke at any time through any reasonable means: replying STOP to a text, saying "take me off your list" on a call, or submitting an opt-out form [3]. Once you get a revocation, honor it promptly. The FCC standard is that you stop before your next scheduled communication. Keep contacting someone after they opt out and you are in willful-violation territory, which is the $1,500 rate.
Beyond revocation, there is a staleness problem. Courts have questioned whether consent given years earlier, before any real relationship existed, was ever truly "prior express written" consent to the specific contacts being made. Nobody has clean data on exactly how long consent stays fresh. A reasonable operating policy is to treat consent older than 18 to 24 months with extra scrutiny, especially if the person never became a customer.
Run periodic re-consent campaigns on old records. A single compliant email or outreach asking them to confirm they still want to hear from you refreshes the documentation and clears dead leads at the same time.
What opt-in strategies work best for small outbound sales teams?
Small teams do not need heavy technology to run a compliant opt-in program. They need discipline and a few basic systems.
The highest-ROI move for a small team is usually inbound lead generation paired with a tight consent form. Run search or social ads to a dedicated landing page that collects phone numbers behind a fully compliant disclosure. Every lead who submits is a consented lead. Cost per lead goes up versus aged lists, but legal risk drops to near zero and contact rates climb, because the person just asked for help.
For B2B teams, the TCPA's autodialer restrictions do not hit non-residential landlines the same way, but the Do Not Call rules still reach residential numbers called for business purposes. Cold calling direct business lines carries less TCPA risk, though not zero. See our full breakdown of cold calling rules for the B2B nuances.
Webinars, content downloads, and event registrations are underused opt-in channels for small teams. When someone registers for your webinar or downloads your guide, they are raising a hand. Add a clear phone opt-in checkbox to the registration form, separate from the email opt-in, and you get a warm lead with documented consent. Contact rates on these beat cold outreach by a wide margin.
Chatbots and live chat can capture opt-ins too. If someone is chatting about your product, offer to follow up by phone, get the number in the chat, and save the transcript as your consent record.
How do you handle leads from third-party publishers or aggregators compliantly?
Third-party leads are not inherently bad. They are just higher risk, because you did not control the consent collection. Manage that with three practices.
First, audit the publisher's opt-in flow before you buy. Ask for a screenshot or a recorded walkthrough of the exact form the consumer sees. Confirm your company is named. Confirm the disclosure sits above the submit button and reads clearly. Confirm there is no pre-checked box doing the consent work. If the publisher will not show you the form, do not buy the leads.
Second, require a data transfer that includes the consent record for each lead, more than the name and phone number. Batch deliveries should carry a timestamp and source URL per record. If the publisher cannot provide it, they probably do not have it, which means you cannot prove consent when challenged.
Third, scrub every purchased list against the federal DNC registry and any applicable state registries before dialing [8]. That is required regardless of consent status. Run the numbers through a reassigned-number check too. The FCC's Reassigned Numbers Database launched in 2021 and lets callers check whether a number went to a new consumer since consent was obtained [10]. Calling a reassigned number on the prior owner's consent is a TCPA violation.
For any lead-buying program, write a contract clause requiring the publisher to indemnify you for TCPA claims arising from their consent practices. Many will push back. The ones with clean consent processes usually sign it.
What tools and processes help maintain an ongoing compliant opt-in program?
A compliant program is an ongoing process, not a one-time setup. A few tools and habits separate a team that is genuinely protected from one that only thinks it is.
DNC scrubbing: use a service that connects to the FTC's National Do Not Call Registry and scrubs at least monthly. Some integrate directly with your CRM and flag numbers automatically [8]. The do-not-call telemarketer list article covers the access and fee structure for registry data.
Reassigned number checks: the FCC's Reassigned Numbers Database, along with licensed providers, lets you check numbers before dialing. A hit means the number was reassigned since your consent date, so do not call it [10].
Consent management: your CRM or a dedicated consent ledger should hold the full consent record per contact, including opt-out dates. Do not run this on spreadsheets. When a text STOP reply lands, that opt-out has to flow immediately into the system that controls your outbound queue. Delays cause violations.
Form version control: when you update your opt-in disclosure, save the old version with an effective date range. If a complaint comes in about a lead from eight months ago, you need to show what language was live then.
LeadCompliant's free compliance toolkit includes a consent language checker and a form audit checklist built around the FCC's required elements. It saves a few hours of manual review whether you are starting fresh or auditing an existing program.
Internal training matters too. Reps who manually drop numbers into call lists without going through consent capture are your biggest internal risk. Put it in the playbook: no number enters the dialer without a verified consent record attached.
Frequently asked questions
What is the minimum consent language needed on a web form to comply with the TCPA?
Your disclosure must appear in writing near the submit button, name your specific company, state that you may contact the consumer at the number provided using automated or prerecorded technology, describe the purpose of the contact, and confirm that consent is not required to purchase. Vague language like "partners may contact you" does not satisfy the FCC's requirement that the seller be clearly identified.
Can I still cold call if I have an established business relationship with the person?
An established business relationship (EBR) offers some protection for calls to residential landlines under the Do Not Call rules, but it does not replace prior express written consent for autodialed or prerecorded calls to cell phones. For cell contacts using an ATDS, you need explicit written consent regardless of any prior relationship. The EBR exemption is narrower than most teams assume.
How much does a TCPA violation actually cost per call or text?
The TCPA sets statutory damages at $500 per negligent violation and up to $1,500 per willful violation, with no cap on the number of violations in a class action, and no need to prove actual harm. A campaign that sends 50,000 texts without valid consent could face $25 million to $75 million in exposure. That is why nearly every large TCPA case settles.
Does the one-to-one consent rule affect lead generation forms that went live before January 2025?
Yes. The FCC's December 2023 order took effect January 27, 2025, and applies to all calls and texts made after that date, regardless of when the form was submitted. Leads captured before January 2025 under multi-seller disclosures should be treated as lacking valid consent for any individual buyer's autodialed outreach unless the consumer specifically named that buyer on the original form.
Do I need to scrub opt-in leads against the Do Not Call registry?
Yes. DNC scrubbing is a separate legal requirement from consent. A consumer can be on the DNC registry and also have given you valid written consent. For telemarketing calls to residential numbers, the DNC rules still apply. The safest practice is to scrub every list monthly against the federal registry and any applicable state registries, even for leads who opted in through your own forms.
What happens if a consumer's number was reassigned after they gave me consent?
Calling a reassigned number is a TCPA violation. Consent belongs to the person who gave it, not the phone number. The FCC launched the Reassigned Numbers Database in 2021 so callers can check whether a number changed hands since consent was captured. Scrub your lists against the RND before dialing, especially for leads more than a few months old.
Can a text opt-in keyword program replace a web form for TCPA compliance?
A keyword opt-in, where the consumer texts a word to your number, creates strong documented consent because the consumer initiated contact from their own device. You still send a confirmatory auto-reply with your company name, message frequency, data rate disclosure, and opt-out instructions. This method often produces cleaner audit trails than web forms, because the carrier timestamp is independent of your own systems.
How long should I keep consent records to defend against a TCPA claim?
Keep consent records for at least four years. The TCPA statute of limitations is four years under 28 U.S.C. § 1658. Many practitioners keep records for five years to account for disputes about when the limitation period began. Store the exact disclosure text in effect at the time of each submission, more than the current version of your form.
Are B2B cold calls exempt from the TCPA?
Calls to a person's direct business landline for a business purpose carry much lower TCPA risk, because the autodialer restriction was built mainly to protect personal cell phones. But the exemption is fact-specific. If the business number routes to a cell phone, or if you leave prerecorded messages, risk climbs. B2B does not mean zero risk, and DNC rules can still reach residential numbers.
What should I do if a lead asks to be removed from my call list?
Honor it immediately. The FCC requires opt-out requests be processed before your next scheduled contact to that number. Log the opt-out with a timestamp in your CRM and suppress the number in your dialer. An internal do-not-call list must be kept for at least five years under the FTC's Telemarketing Sales Rule, and continuing to call after an opt-out request is a willful violation subject to $1,500 per incident.
Can I purchase an opt-in lead list and dial it safely without auditing the consent records?
No. Buying a list does not transfer legal protection. You must be able to prove valid prior express written consent was obtained for your company specifically. If a plaintiff sues you, they will ask for the consent record for their number. If you cannot produce it, you cannot defend. Always require the original consent records, including timestamps and disclosure text, as part of any lead purchase.
What is the safest opt-in lead generation method for a small team with no compliance staff?
Run your own landing page with a compliant consent form and send traffic to it through paid search or social ads. You control every element of consent capture, you hold the documentation, and every lead who submits has explicitly asked to hear from you. It costs more per lead than buying lists, but the exposure is near zero when the form is built right, which more than pays for itself in a world where one class action can cost millions.
Sources
- U.S. Congress, Telephone Consumer Protection Act, 47 U.S.C. § 227 (via Cornell Legal Information Institute): TCPA prohibits autodialed or prerecorded calls to cell phones without prior express consent and sets damages at $500, $1,500 per violation with no cap in class actions
- U.S. Congress, Electronic Signatures in Global and National Commerce Act (E-SIGN), 15 U.S.C. § 7001 (via Cornell Legal Information Institute): Electronic signatures including web form submissions satisfy the written signature requirement for TCPA consent
- U.S. Congress, 28 U.S.C. § 1658, Statute of Limitations for Federal Statutes (via Cornell Legal Information Institute): The TCPA carries a four-year statute of limitations, requiring consent records be kept at least four years
- FTC, National Do Not Call Registry (donotcall.gov): The FTC runs the National Do Not Call Registry and provides telemarketers paid access to download numbers for scrubbing at least every 31 days
- FTC, Telemarketing Sales Rule, 16 C.F.R. Part 310: The Telemarketing Sales Rule requires internal do-not-call lists be kept at least five years, DNC registry scrubbing every 31 days, and recognizes state DNC programs
- FCC, Reassigned Numbers Database (reassigned.us): The FCC's Reassigned Numbers Database, launched 2021, allows callers to verify whether a number has been reassigned since consent was captured
- FTC, Consumer Advice on unwanted calls and telemarketing: FTC and FCC enforcement, plus private lawsuits, confirm that calling reassigned numbers or numbers without valid consent constitutes a violation
- FTC, Consumer Advice on Do Not Call and telemarketing: Multiple states including California, Florida, and Indiana maintain state-level DNC registries, some with requirements stricter than the federal list