Is lead generation legal?

Yes. Lead generation is legal in the United States, and so is selling leads. What makes a lead gen business legal or not is how it collects and uses the leads: consent for calls and texts, truthful ads, honest privacy notices, Do Not Call rules, state laws and ad platform policies. This page is general information, not legal advice.

This page explains in general terms which rules apply to collecting and selling leads, and links to the official text of each. It is general information, not legal advice. Rules change through new laws, agency orders and court decisions, so read the current official sources and talk to a lawyer about your own business.

Is lead generation legal in the United States?

Yes. Collecting the details of people who ask to be contacted about a service, and passing those details to a business that provides it, is a lawful business model. The Federal Trade Commission has studied the lead generation industry, including at its 2015 Follow the Lead workshop, which looked at how leads are collected and sold and what consumers and businesses should know.

The law focuses on conduct. A lead gen business is on the right side of the rules when the people it collects asked to be contacted, understood who would contact them and how, and were not misled to get there. The sections below set out the rules that decide that.

Is lead generation illegal?

Lead generation itself is not illegal, but some practices in it are. In general terms, a lead gen business breaks the rules when it:

• Has leads called or texted by autodialer or prerecorded voice without the consent the FCC rules require.
• Calls numbers on the National Do Not Call Registry for telemarketing without a basis the rules allow.
• Runs ads or pages that are false or misleading, such as fake news stories, invented reviews or promised outcomes.
• Hides that a page is an ad, or hides that the details will be passed to other companies.
• Sells data in a way its privacy notice did not disclose, or ignores rights that state privacy laws give consumers.
• Submits fake or fabricated leads, or leads from people who never filled in the form.

Each of these is covered by a specific rule, listed below with its official source.

Is selling leads legal?

Yes. Selling leads is legal, and buyers, brokers and publishers do it every day. The legal questions are about the lead, not the sale: whether the person gave consent that covers the company that will contact them, and whether they were told their details would be shared.

Consent matters most here. Under 47 CFR 64.1200, prior express written consent authorizes "the seller" to call or text, and the rule defines the seller as the business on whose behalf the call is made. So a lead sold to a buyer is only useful if the consent on the form covers that buyer. This is why lead forms name the companies that may make contact, and why buyers ask for a consent record with each lead.

You may have read about the FCC's one-to-one consent rule, which would have limited consent to one seller at a time. A federal appeals court vacated it in January 2025, before it took effect. See the one-to-one consent rule for what happened.

The rules that apply to lead generation

Consent and the TCPA

The TCPA, at 47 U.S.C. 227, restricts calls made with an automatic telephone dialing system or an artificial or prerecorded voice, and gives people a right to sue over violations. The FCC rules in 47 CFR 64.1200 require prior express written consent for telemarketing calls and texts to wireless numbers made that way.

The rule defines that consent as a written agreement, which can be signed electronically, that clearly authorizes the seller to make such calls to a stated number. It must include a clear and conspicuous disclosure that the person is authorizing those calls and that agreeing is not a condition of buying anything. In a lead form, that is the consent text next to the submit button. For how it is placed on a form, see how to build a lead generation website. For more detail, see TCPA basics for lead gen affiliates and TCPA consent.

State rules

States can add their own rules on top of federal law. Florida is one example: section 501.059 of the Florida Statutes prohibits telephonic sales calls that involve an automated system for selecting and dialing numbers, or a recorded message, without the prior express written consent of the person called. Other states have their own telemarketing and Do Not Call laws.

Privacy is the other state layer. The California Consumer Privacy Act, as described by the California Attorney General, gives California consumers rights that include the right to know what personal information a business collects, the right to delete it (with some exceptions) and the right to opt out of its sale or sharing. Whether a law like this applies to your business depends on its terms. See our TCPA state laws page for the states you target, and check each state's official source.

Truthful ads and privacy notices

The FTC's advertising FAQs for small businesses set out the basics under the FTC Act: advertising must be truthful and not deceptive, advertisers must have evidence to back up their claims, and ads cannot be unfair. For lead gen, that covers the ad, any pre-lander and the form page. Article-style ads must make clear they are ads; the FTC explains this in its native advertising guide.

A lead generation site also needs a privacy notice that says plainly what it collects and who it shares or sells the data to. A notice that says data is never shared, on a site that sells leads, is the kind of mismatch the truthful-advertising rules address. Accident and injury traffic has a further rule set: see attorney advertising rules for MVA traffic.

Steps to keep a lead gen business within the rules

1. 1

   Step 1: Decide who captures consent

   If you run your own forms, you write the consent language and keep the records. If you send traffic to a program's landers, the program captures consent and your job is not to change or undermine it.

2. 2

   Step 2: Read the official sources

   Read 47 CFR 64.1200 paragraphs (a) and (f), and the FTC advertising FAQs. You do not need to memorize them; you need to recognize what works against them.

3. 3

   Step 3: Name who will contact the person

   On your own forms, the consent text should cover the buyers who will call or text. Agree this with your buyers.

4. 4

   Step 4: Keep a consent record for every lead

   Store the consent text shown, the time, the page and the data entered. See TCPA record keeping.

5. 5

   Step 5: Check every ad and page for claims

   Remove promised outcomes, fake urgency, invented reviews and anything that says the person will not be contacted.

6. 6

   Step 6: Check the state layer

   List the states you target and read their telemarketing and privacy rules from official state sources.

7. 7

   Step 7: Get legal review

   Have a lawyer review your consent language, privacy notice and terms before launch, and again when rules change.

Common mistakes

• Thinking the law is only the caller's problem. The form and the traffic decide whether valid consent exists.
• Consent text that does not cover the buyer. A lead whose consent names a different company may not be usable.
• A privacy notice that does not match what you do. If you sell leads, say so.
• Copying another site's consent block. It was written for a different business and different buyers.
• Relying on old summaries. TCPA rules have changed in recent years. Check the eCFR text, not a forum post.
• Treating a checklist as legal approval. Only a lawyer who knows your business can give legal advice.

Frequently asked questions

Related guides

• Start a lead generation business: Every decision, in order.
• TCPA basics for lead gen affiliates: Where affiliates fit in the consent chain.
• Consent language publishers must not change: The parts of a consent block.
• TCPA compliance: Consent, records and state rules.
• Publisher traffic guidelines: The rules for every Summit campaign.

Already generating leads on your own forms? Sell your leads instead.