Last updated 2026-07-09
TL;DR
The FCC's January 2025 one-to-one consent rule is the biggest shift in lead gen compliance in a decade. It kills the old shared-consent model that powered most lead aggregators. Penalties run $500, $1,500 per violation under 47 USC 227. State laws in Florida, Oklahoma, and Washington add more exposure. Here's what changed, what's still unsettled, and what to actually do.
What is the current state of lead generation compliance?
Lead generation compliance is the set of rules that govern how you collect consumer contact information, get permission to contact them, and actually make contact. The main federal framework is the Telephone Consumer Protection Act (TCPA), 47 USC 227, which covers autodialed calls, prerecorded calls, and text messages to cell phones [1]. The FTC's Telemarketing Sales Rule (TSR) covers live telemarketing and adds its own do-not-call restrictions [2]. On top of that sits a growing stack of state laws, each with its own twist.
For years, lead gen companies ran on a simple trick. A consumer filled out one web form and checked one box consenting to be contacted by a long list of advertisers. That single checkbox was treated as consent for dozens of companies. Courts started chipping away at this around 2021. The FCC finished the job in late 2023 with a rule that took effect January 27, 2025 [3].
The picture today is genuinely messier than it was two years ago. Federal rules changed. Several states passed new laws. The plaintiffs' bar is active and well-funded. And plenty of small outbound teams are still running practices that made sense in 2020 but create real liability now.
None of this is legal advice. If you have specific exposure questions, talk to a TCPA attorney. What this article gives you is the factual landscape, so you don't walk into a vendor call or a board meeting blind.
What did the FCC's 2024 to 2025 one-to-one consent rule actually change?
This is the big one. On December 13, 2023, the FCC adopted a Report and Order that rewrote how prior express written consent works for lead generation [3]. The rule took effect January 27, 2025.
The core change is simple. A consumer's consent has to go to one seller at a time, and that seller has to be clearly and conspicuously named. Listing 47 companies in fine print and calling one checkbox consent for all of them no longer works under the TCPA. The FCC's order says the consent must be "logically and topically associated" with the website where the consumer gave it.
That wording kills the shared-consent, or "co-registration," model that powered much of the lead aggregation industry. Buy leads from a publisher who collected consent on a generic comparison site, and if your company's name wasn't named at the point of consent, you probably do not have valid TCPA consent to call or text that person with an autodialer.
The rule also says robotexts and robocalls tied to a single consumer interaction have to come from one company, not a bundle of partners. Trade coverage calls this the "one-to-one" rule or the closing of the lead-gen loophole.
A federal court in Florida temporarily stayed a different piece of FCC guidance in 2024, so there's litigation noise around the edges. But the one-to-one consent rule itself survived its early challenges and is in force as of this writing [4]. Check tcpa news today as the case law develops.
Here's the practical part. If you buy third-party leads and autodial them, audit your lead sources now. Ask every vendor to show you the exact consent language consumers saw when they submitted. If the form didn't name your company, that lead is high-risk.
What are the TCPA penalties for lead generation violations?
The TCPA sets statutory damages at $500 per violation for negligent violations and $1,500 per violation for willful or knowing violations [1]. Each call or text is a separate violation. The statute has no cap.
The math gets terrifying fast. A campaign that sends 100,000 texts without valid consent faces $50 million at the $500 rate, or $150 million if a court finds willfulness. Class actions aggregate individual claims, so even a modest campaign can generate settlement pressure in the tens of millions.
The largest TCPA-adjacent settlements run into nine figures. Dish Network paid $280 million in a DOJ and FTC action in 2017 [5]. Most small-company cases settle for far less, but even a $500,000 settlement ends a 10-person business.
The TSR carries its own civil penalties. Under the 2021 inflation adjustment, TSR violations can bring penalties up to $51,744 per violation [2]. That figure adjusts periodically.
State attorneys general pile on. Florida's mini-TCPA, passed in 2021, allows $500 per call and $1,500 for willful violations, mirroring federal exposure with a lower call-volume threshold to trigger the law [6].
Here's what catches teams off guard. The TCPA is a private right of action. You don't need a regulator to come after you. Any consumer, or a plaintiff's attorney working on their behalf, can file suit. Class certification makes the economics attractive for plaintiffs' lawyers. That's why tcpa sms compliance practices matter even for small teams sending a few thousand texts a month.
Which state laws are adding new compliance burdens for lead generators?
Federal law is the floor, not the ceiling. A growing set of states passed laws stricter than the TCPA, and any team calling nationally has to track all of them.
Florida. Florida's Telephone Solicitation Act (FTSA), amended in 2021 and tweaked again in 2023, uses a broader definition of "autodialer" than the current federal reading and covers calls and texts to Florida numbers no matter where the sender sits [6]. A 2023 amendment narrowed the private right of action a bit, but the law still creates real exposure.
Oklahoma. Oklahoma passed a telemarketing law in 2022 that requires do-not-call compliance and sets its own consent standards for automated contacts. Less litigated than Florida's law, but real.
Washington. Washington's Commercial Electronic Mail Act (CEMA) and its separate telemarketing rules cover text-based marketing and add opt-out and identification requirements that go past federal standards [7].
Texas and California. California's CCPA and CPRA add a data layer. Collect leads involving California residents and you have to treat their data as personal information with disclosure, access, and deletion rights [8]. The CPRA amendments in force since January 1, 2023 strengthened enforcement. Texas's Data Privacy and Security Act (TDPSA) took effect July 1, 2024 and follows a similar structure.
The table below compares these laws on the dimensions that matter for outbound teams.
| State | Law | Private right of action? | Per-violation penalty | Notes |
|---|---|---|---|---|
| Federal (TCPA) | 47 USC 227 | Yes | $500, $1,500 | Class actions common |
| Florida | FTSA | Yes (limited post-2023) | $500, $1,500 | Broader autodialer definition |
| Washington | CEMA + telemarketing rules | Yes | Varies | Covers SMS marketing |
| California | CCPA/CPRA | Yes (limited) | $100, $750/consumer/incident | Data rights, beyond calls |
| Texas | TDPSA | AG only | Up to $7,500/violation | Effective July 1, 2024 |
If your leads come from multiple states, assume the strictest standard applies to each consumer's state of residence. Nobody has a clean, centralized tracker for all 50 states. The closest thing is your own counsel plus monitoring from resources like the NCSL's telemarketing pages [9].
How do FTC telemarketing rules affect lead generation compliance?
The FTC's Telemarketing Sales Rule, 16 CFR Part 310, runs parallel to the TCPA and covers different ground [2]. The TCPA focuses on the technology used to call (autodialers, prerecorded messages). The TSR focuses on the content and conduct of the call. Both can hit the same campaign.
Under the TSR, you have to check the National Do Not Call Registry before calling consumers. The rule requires scrubbing within 31 days of each call. Registry access costs $72 per area code per year as of 2024, with the first five area codes free [10]. You can't call a registered number without an established business relationship or written consent.
The TSR also restricts calling before 8 AM or after 9 PM local time, misrepresenting the product or the call's purpose, failing to identify yourself right away, and various deceptive tactics. Lead buyers who resell to companies that then make TSR-violating calls can catch liability too, depending on how tightly they're tied to the downstream calls.
The FTC has been busy. In 2024 the agency brought several actions against lead generators in mortgage, insurance, and student loan spaces for producing leads through deceptive means and selling them to callers. The theory is straightforward. If the lead itself came from a deceptive practice, the seller may be liable for the downstream harm.
One trap to avoid. The TSR does not cover text messages, because it covers "telephone calls." The TCPA does cover texts. Don't confuse the two. If you run SMS campaigns, your primary federal hook is the TCPA, not the TSR.
What does valid TCPA consent actually look like for lead forms today?
After the one-to-one rule, valid prior express written consent for autodialed marketing calls or texts has to meet several specific tests [1][3].
First, it has to be a written agreement. A verbal "yes" doesn't satisfy "prior express written consent" for marketing calls. Written includes electronic records, like a web form submission.
Second, the consumer has to authorize one specific seller. No bundling consent across a list of companies. Your legal name, or a name the consumer would recognize as yours, has to appear in the consent language.
Third, the language has to clearly disclose that the consumer is agreeing to autodialed calls or texts and that consent is not a condition of buying anything. The FCC has required the "not a condition" language since 2012, and it still applies.
Fourth, the consent has to be "logically and topically associated" with the page where you capture it. Collect leads on a life insurance comparison page, and consent to call about life insurance holds. Use that same record to call about home security, and it doesn't.
A compliant web form disclosure reads something like this: "By submitting this form, you agree to be contacted by [Your Company Name] at the phone number provided, including by autodialed or prerecorded calls and text messages. Consent is not required to purchase any products or services."
For SMS, use a double opt-in where the consumer confirms their number before you start messaging. See our guide to sms double opt in for how that flow works technically and legally.
Keep the records. Timestamp the submission, capture the IP address, log the exact consent language shown. If you get sued, the first thing you'll need to produce is proof the consent existed. Vendors who promise "clean leads" but can't show you the actual consent record are a liability, not an asset.
How has TCPA litigation changed in 2024 and 2025?
Litigation volume stayed high. The plaintiffs' bar filed thousands of TCPA cases in federal court across 2023 and 2024. The Judicial Panel on Multidistrict Litigation has handled several consolidated proceedings. Class certification got a bit harder after the Supreme Court's TransUnion v. Ramirez decision in 2021, which required plaintiffs to show concrete harm beyond a bare statutory violation. The practical effect has been modest, because plaintiffs' attorneys have gotten better at pleading concrete harm [4].
The Eleventh Circuit (Florida, Georgia, Alabama) stays the hottest TCPA venue, thanks to Florida's large consumer population, aggressive plaintiff firms, and the state's own telemarketing law. The Ninth Circuit (California) runs a close second.
A notable 2024 shift: courts started holding lead buyers liable, more than the companies that placed the calls. Buy leads from a publisher whose forms used deceptive consent practices, and you may carry liability as the "seller" on whose behalf those leads were generated, even if you never touched the form.
The ATDS question keeps generating litigation. The Supreme Court's 2021 Facebook v. Duguid decision narrowed the autodialer definition to systems that randomly or sequentially generate numbers [11]. That narrowing helps companies using CRM dialers with pre-loaded lists, but it doesn't erase TCPA risk, because prerecorded voice and texting rules still apply broadly.
Settlement values for small-to-midsize class actions typically land between $1 million and $20 million, depending on class size and the strength of the liability case. Individual claims, which are rarer, settle for a few thousand dollars each. The money for plaintiffs' lawyers is in class actions, so that's where the risk concentrates for high-volume campaigns.
What is the FCC's treatment of ringless voicemail and AI-generated calls?
Two technologies caused a lot of confusion, and 2024 brought clarity on both.
Ringless voicemail (RVM) drops a prerecorded message straight into a voicemail box without ringing the phone. The FCC treats it as a "call" under the TCPA. In 2022 the agency issued guidance confirming RVM is subject to TCPA consent requirements for prerecorded calls [3]. You need prior express written consent for marketing, or prior express consent for informational messages, to send RVM to cell phones.
AI-generated voice calls got a major ruling in February 2024. The FCC issued a declaratory ruling that AI-generated voices in prerecorded calls count as "artificial or prerecorded voices" under the TCPA [3]. The ruling responded to robocall scams using cloned voices, but it also lands on legitimate sales teams using AI voice tools. Use a voice synthesis tool to deliver a prerecorded pitch to cell phones, and you need prior express written consent.
This matters for the flood of AI sales tools hitting the market. Tools that auto-generate and deliver prerecorded pitches to prospect lists get no TCPA exemption for using machine learning instead of a recorded file. The FCC's stance is technology-neutral. The output is what counts, not the input method.
Live AI agents, where a human can take over and the call isn't prerecorded, sit in a grayer zone. The analysis turns on whether the system qualifies as an ATDS. That area is actively litigated, so get your counsel involved before you deploy any AI calling tool at scale.
How should lead generation companies audit their compliance right now?
A practical audit covers four areas: consent collection, lead sourcing, outreach technology, and record-keeping.
Consent collection. Pull the actual form language from every page where you collect leads. Does it name your company? Does it mention autodialed calls or texts? Does it carry the "not a condition of purchase" language? Buying leads from a publisher? Get the actual form screenshot and the consent language word for word. If the vendor won't share it, don't buy those leads.
Lead sourcing. Map every lead source to its consent record. For third-party leads, make the vendor certify in writing that consent was collected under the FCC's one-to-one rule effective January 27, 2025. Any lead generated before that date on the old shared-consent model is suspect for autodial campaigns.
Outreach technology. Figure out whether your dialer or texting platform qualifies as an ATDS. Even if it doesn't, prerecorded messages and most SMS platforms still carry TCPA obligations. For SMS, confirm your opt-in flow meets current requirements. See our guide to sms opt in requirements for a step-by-step breakdown.
Record-keeping. Your consent records should include the consumer's phone number, the consent timestamp, the IP address, the exact consent language shown, and the URL of the capture page. Store them for at least 4 to 5 years. The TCPA's statute of limitations is 4 years under federal law.
LeadCompliant offers a free TCPA compliance kit with audit checklists and consent language templates if you want a structured start. For DNC scrubbing, free tools let you check numbers against the federal registry before you build your findings into a remediation plan.
After the audit, the three highest-priority fixes for most teams are: update consent language on every lead capture form, stop autodial campaigns to any leads sourced under the old shared-consent model, and put a documented scrubbing process against the national and state DNC registries in place.
What should B2B lead generation teams know about TCPA and GDPR compliance?
B2B is not a TCPA-free zone, though plenty of sales teams treat it that way. The TCPA applies to calls and texts to cell phones regardless of whether the person is acting in a business or personal capacity. Text or autodial a prospect's mobile number and you need TCPA-compliant consent, even if that person works at a Fortune 500 company.
Where B2B gets more room is on the FTC's DNC rules. The National DNC Registry covers residential consumers, not businesses. Business-to-business telemarketing calls generally fall outside the federal DNC registry, though some state DNC lists reach broader [2].
For teams with any European exposure, GDPR adds a consent layer on top of the TCPA. GDPR requires a lawful basis for processing personal data. For marketing, that usually means explicit opt-in consent or a legitimate interests analysis. The GDPR consent bar arguably sits higher than current TCPA rules. It has to be freely given, specific, informed, and unambiguous. Pre-ticked boxes don't count. Our guide to b2b lead generation platforms gdpr compliance covers the overlap in more detail.
Here's the honest read for most small US outbound teams. GDPR enforcement against US companies with no European presence is limited, though not zero (the Irish DPC and UK ICO have pursued US companies). But if you buy leads that include European contacts, or if your capture pages are reachable from Europe, document your lawful basis carefully.
What are the most common compliance mistakes lead generation teams make?
After watching enforcement actions and litigation over the past several years, the same patterns keep showing up.
Assuming the lead vendor handled it. Lead buyers routinely assume the publisher got valid consent and never check. Under the one-to-one rule, that assumption is now a liability. See the consent documentation. Don't take the vendor's word for it.
Reusing one consent record across product lines. A consumer who opted in for auto insurance quotes did not consent to mortgage refinancing calls. Running cross-sell campaigns on shared consent records is one of the most common triggers for class actions.
Not scrubbing against the DNC before every campaign. The FTC requires scrubbing within 31 days of each call [2]. Teams scrub at the time of lead purchase, then call the same list six months later without re-scrubbing. Numbers get added to the registry constantly.
Missing state-level time restrictions. Federal law bans calls before 8 AM or after 9 PM local time. Some states go stricter. Florida bans calls after 8 PM. California limits some calls to 8 AM to 9 PM Pacific. If your dialer isn't timezone-aware, you're probably calling someone at a prohibited hour.
No written opt-out process for SMS. Someone texts STOP and your system doesn't honor it within 10 business days (TCPA) or immediately (best practice). Every message after that opt-out is a fresh violation. This one is easy to fix with any decent marketing text message service.
Weak record retention. Courts routinely sanction defendants who can't produce consent records. If your CRM doesn't log consent at the field level with timestamp and IP, you're flying blind in litigation.
What's coming next in lead generation compliance: rules to watch
A few regulatory and legal developments are worth tracking in 2025 and beyond.
The FCC has signaled interest in broader lead-gen rulemaking, beyond the one-to-one consent rule. There's talk of requiring sellers to keep and share consent records with the FCC on request, though no final rule has been adopted as of mid-2025.
The FTC's rulemaking on junk fees and deceptive lead generation continues. The agency has proposed rules that would make it harder to generate leads through comparison sites that hide their commercial relationships with sellers. If finalized, that reaches large parts of the insurance and financial services lead gen industry.
State privacy laws keep multiplying. Montana, Texas, Oregon, and Florida all have privacy laws in effect or taking effect in 2024 to 2025. Each carries its own consent and data rights provisions that interact with TCPA compliance in ways courts haven't fully sorted out.
AI regulation is coming. The FCC's February 2024 AI voice ruling was reactive, but rulemaking is underway to address AI in telemarketing more fully. Several states have introduced bills requiring disclosure that a consumer is talking to an AI agent.
To stay current week to week, the FCC's consumer complaint database (at fcc.gov) shows what consumers are reporting, and the FTC's news releases flag new enforcement actions. Following the dockets directly is the most reliable signal, though few teams have the time. A good compliance newsletter is the next best thing.
Frequently asked questions
Is the FCC's one-to-one consent rule actually in effect right now?
Yes. The FCC adopted the rule December 13, 2023, and it took effect January 27, 2025. Lead generators still using shared consent forms that name multiple companies are out of compliance for any autodialed calls or texts after that date. The rule survived its initial legal challenges as of mid-2025, though litigation continues. Monitor updates through your legal counsel or a reliable TCPA news source.
Can I still buy third-party leads and autodial them after the one-to-one rule?
You can, but only if the lead source captured consent that specifically named your company at the point of submission, on a page topically related to what you're selling. Generic comparison-site leads where your company wasn't named do not qualify. Ask every vendor for the actual form screenshot and consent language. If they can't produce it, don't use those leads for autodialed campaigns.
What is the penalty for calling a number on the Do Not Call Registry?
Under the Telemarketing Sales Rule, violating the National DNC Registry can cost up to $51,744 per call as of the most recent FTC inflation adjustment. The TCPA separately allows $500, $1,500 per call for unauthorized calls to cell phones. These penalties stack, and class actions multiply them by the number of consumers affected. Scrub against the registry within 31 days before any outbound campaign.
Does the TCPA apply to text message marketing the same way it applies to calls?
Yes. The FCC has treated text messages as "calls" under the TCPA since a 2003 ruling. The same prior express written consent requirement that applies to autodialed marketing calls applies to marketing texts sent to cell phones. The consent must name your company, disclose automated messaging, and state that consent is not a condition of purchase. See our breakdown of sms opt in requirements for the full checklist.
How long do I need to keep TCPA consent records?
The federal statute of limitations for TCPA claims is four years under 28 USC 1658. Most compliance attorneys recommend keeping consent records for five years to give yourself a buffer. Records should include the consumer's phone number, the timestamp and IP address of the submission, the exact consent language shown, and the URL of the page. Missing records get treated as no records in litigation.
Are B2B cold calls covered by the TCPA?
If you're calling a business contact's cell phone with an autodialer or prerecorded message, the TCPA applies regardless of the business context. The National DNC Registry exempts business-to-business calls, so you don't need to scrub against the federal DNC for B2B landline calls. But mobile numbers get TCPA protection whether or not the holder uses them for work. Many sales reps underestimate this exposure.
What counts as an autodialer (ATDS) after the Facebook v. Duguid Supreme Court ruling?
The Supreme Court's 2021 Facebook v. Duguid decision narrowed the ATDS definition to systems that use a random or sequential number generator to store or produce numbers to dial. A CRM dialer working from a pre-loaded contact list generally doesn't qualify under this definition. But prerecorded message and SMS rules still apply broadly, so a narrower ATDS definition doesn't erase TCPA risk for most outbound teams.
What does Florida's mini-TCPA add on top of federal TCPA protections?
Florida's Telephone Solicitation Act (FTSA) uses a broader autodialer definition than post-Duguid federal law, meaning equipment that dials from a list can qualify in Florida even when it wouldn't federally. It covers calls and texts to Florida numbers. Penalties mirror the TCPA at $500, $1,500 per violation. A 2023 amendment limited the private right of action somewhat but did not eliminate it.
Do I need separate consent for every type of message I send?
Broadly yes, because the consent must be logically and topically associated with the message type. Consent for auto insurance marketing doesn't cover mortgage offers. Consent for transactional messages (order confirmations, appointment reminders) is a lower bar than consent for marketing. If you plan to send multiple types of communication, your consent language should be broad enough to cover them but specific enough to be meaningful.
Is ringless voicemail a TCPA-free workaround?
No. The FCC confirmed in 2022 that ringless voicemail counts as a "call" under the TCPA because it occupies the recipient's voicemail system, a service they pay for. Marketing RVM to cell phones requires prior express written consent, the same standard as autodialed calls. Anyone selling ringless voicemail as a TCPA-safe alternative to traditional calls is giving you bad information.
How do AI-generated voice calls fit into the TCPA framework?
The FCC ruled in February 2024 that AI-generated voices in prerecorded calls qualify as "artificial or prerecorded voices" under the TCPA. You need prior express written consent to use them for marketing calls to cell phones, the same as any prerecorded message. Live AI agents that aren't prerecorded sit in a grayer area, depending on whether the system is an ATDS, but FCC rulemaking is trending toward treating them similarly.
What's the TCPA statute of limitations and when does it start running?
TCPA claims carry a four-year statute of limitations under 28 USC 1658, the general federal civil limitations period. The clock typically starts when the violation occurred, meaning when the offending call or text went out. For ongoing campaigns, each call or text is a separate violation with its own limitations period, which is why courts often see large class periods spanning years of a company's calling activity.
What is lead generation compliance in the context of IT and data systems?
IT compliance for lead generation means your systems capture, store, and process consent records in a way that's auditable and defensible. That includes server-side logging of form submissions with timestamps and IP addresses, data retention policies aligned with legal hold requirements, integration between your capture forms and your CRM so consent records follow the lead, and regular exports so records survive system migrations. Many TCPA defenses fail not because consent didn't exist but because the systems couldn't prove it.
How often do I need to scrub my lead list against the Do Not Call Registry?
The FTC's Telemarketing Sales Rule requires scrubbing within 31 days before each call. "Before each campaign" is not enough if you're running a 90-day drip sequence. If you call a contact on day one and want to call again on day 45, you need a scrub that covers day 45. In practice, monthly scrubbing is the minimum. Many compliance teams run weekly scrubs for active outbound lists.
Sources
- U.S. Code, 47 USC 227, Telephone Consumer Protection Act: TCPA sets statutory damages at $500 per violation for negligent violations and $1,500 for willful or knowing violations
- FTC, Telemarketing Sales Rule, 16 CFR Part 310: TSR requires scrubbing against the National DNC Registry within 31 days of each call and restricts calls before 8 AM or after 9 PM local time; civil penalties up to $51,744 per violation
- U.S. Supreme Court, TransUnion LLC v. Ramirez, 594 U.S. 413 (2021): Supreme Court required plaintiffs to show concrete harm, not just a statutory violation, affecting TCPA class action certification
- FTC, Dish Network telemarketing enforcement action, 2017: Dish Network settled for $280 million in a DOJ/FTC telemarketing enforcement action in 2017
- Florida Legislature, Florida Telephone Solicitation Act, Section 501.059 Florida Statutes: Florida FTSA applies broader autodialer definition than post-Duguid federal law and allows $500–$1,500 per violation; amended in 2023 to limit private right of action
- Washington State Legislature, Commercial Electronic Mail Act, RCW 19.190: Washington CEMA imposes opt-out and identification requirements on commercial electronic messages including text-based marketing
- California Attorney General, California Consumer Privacy Act / CPRA: CPRA amendments in force January 1, 2023 require handling California resident data as personal information with disclosure, access, and deletion rights
- National Conference of State Legislatures, Telemarketing: State-level telemarketing preemption and DNC registry variations across all 50 states
- FTC, National Do Not Call Registry (telemarketer information): National DNC Registry access fee is $72 per area code per year as of 2024, with first five area codes free
- U.S. Supreme Court, Facebook Inc. v. Duguid, 592 U.S. 395 (2021): Supreme Court narrowed ATDS definition to systems that use a random or sequential number generator to store or produce numbers to dial