TCPA Compliance Checklist for Lead Buyers in 2026

The Telephone Consumer Protection Act (TCPA) is one of the most litigated laws in the United States — and lead buyers are frequently in the crosshairs. A single non-compliant call can result in statutory damages of $500 to $1,500 per violation. With class action lawsuits common in this space, the math gets terrifying fast.

The good news: TCPA compliance is manageable if you have the right processes in place. This checklist covers what every lead buyer needs to know in 2026.

The TCPA restricts how businesses can contact consumers by phone, text, and fax. For lead buyers, the most relevant provisions are:

• Autodialer restrictions: Using an automatic telephone dialing system (ATDS) to call or text a cell phone without prior express written consent is prohibited
• Prerecorded messages: Leaving a prerecorded or artificial voice message on a cell phone without consent is prohibited
• Do-Not-Call (DNC) rules: Calling numbers on the National DNC Registry or a company-specific DNC list is prohibited
• Time restrictions: Calls may only be made between 8 AM and 9 PM in the recipient's local time zone

The FCC has continued to tighten TCPA enforcement, and 2024–2026 have seen significant regulatory updates. Staying current is not optional.

• Obtain prior express written consent before calling or texting any lead using an autodialer or prerecorded message
• Consent must be specific — the consumer must agree to be contacted by your company specifically, not just "marketing partners" in general (this was significantly tightened by the FCC's 2024 one-to-one consent rule)
• Consent must be unambiguous — it cannot be buried in fine print or bundled with other agreements
• Retain consent records — store timestamps, IP addresses, and the exact consent language presented to each consumer
• Verify consent before calling — don't assume your lead vendor's consent is sufficient; request documentation

• Ask for consent documentation — any reputable lead vendor should be able to show you the consent language presented to each lead and when it was obtained
• Review the vendor's privacy policy and terms — confirm they disclose that consumer information may be shared with third parties for marketing purposes
• Confirm one-to-one consent — post-2024 FCC rules require that consent name your company specifically, not just a category of businesses
• Request a sample consent flow — ask the vendor to walk you through exactly what a consumer sees before submitting their information
• Vet vendor reputation — search for TCPA lawsuits naming the vendor; a history of litigation is a serious warning sign

• Scrub against the National DNC Registry — register at donotcall.gov and scrub your lead lists before calling
• Maintain an internal DNC list — any consumer who asks not to be called must be added immediately and honored for a minimum of 5 years
• Honor opt-outs within 30 days — the TCPA requires you to honor DNC requests within 30 days of receipt
• Train your team — every person making outbound calls must understand how to handle a DNC request in real time

• Respect time zone restrictions — calls must be made between 8 AM and 9 PM in the recipient's local time zone, not yours
• Identify yourself immediately — callers must state their name and the company they represent at the start of every call
• Provide a callback number — you must provide a phone number where the consumer can reach you or request to be placed on your DNC list
• Don't call abandoned numbers — if a number has been reassigned to a new consumer, you may not have consent to contact that person

• Obtain written consent before texting — the same consent requirements that apply to autodialed calls apply to text messages
• Honor STOP requests immediately — when a consumer replies STOP, you must cease all text communications immediately
• Include opt-out instructions — every marketing text must include clear instructions for how to opt out
• Don't text after opt-out — sending even a single text after a consumer has opted out is a violation

• Retain consent records for at least 4 years — this is the statute of limitations for TCPA claims
• Log all calls and texts — maintain records of when contacts were made, to what number, and the outcome
• Document your DNC scrub process — keep records showing when you scrubbed your lists and against which registries
• Store opt-out records indefinitely — there is no expiration on a consumer's right not to be called

The FCC's 2024 ruling significantly changed the consent landscape for lead buyers. Previously, a consumer could consent to be contacted by a broad category of "marketing partners." Under the new rule, consent must name each company specifically.

This means:

• Lead aggregators can no longer sell a single consent to multiple buyers
• Each buyer must be named in the consent disclosure the consumer sees
• Retroactive consent is not valid — leads generated before the rule change may not be compliant under the new standard

If your lead vendor hasn't updated their consent flows to comply with the one-to-one rule, you are potentially buying non-compliant leads. This is one of the most important due diligence questions to ask any vendor right now.

TCPA violations carry statutory damages of:

• $500 per violation for negligent violations
• $1,500 per violation for willful or knowing violations

In a class action scenario, where thousands of consumers are affected, these numbers compound rapidly. Settlements in TCPA class actions routinely reach seven and eight figures.

Beyond financial exposure, TCPA violations can damage your brand reputation and result in regulatory scrutiny from the FCC and state attorneys general.

The most effective way to manage TCPA risk as a lead buyer is to work with partners who have built compliance into their lead generation process from the ground up — not bolted it on as an afterthought.

At Big Tai Marketing, TCPA compliance is foundational to how we generate leads. Every lead we deliver comes with documented consent that names our clients specifically, timestamped records, and a clear audit trail. We've been doing this since 2007 and have navigated every major regulatory change in the industry.

If you have questions about your current lead program's compliance posture, we're happy to take a look.