TCPA compliance checklist for lead generators
A TCPA compliance checklist for lead generators covers four stages: form design and consent language before capture, documentation at the moment of capture, what to give buyers on delivery, and ongoing operations and audits. Each item matches a failure point that buyer auditors and plaintiffs' attorneys look for. This is educational content, not legal advice.
A practical operational checklist covering every stage of the lead generation lifecycle, from form design and consent capture to delivery documentation and ongoing compliance auditing.
Educational Content Only: This is educational content, not legal advice. Consult a qualified attorney for compliance guidance specific to your operations.
Pre-capture: Form & consent language
At capture: Documentation
On delivery: What to tell buyers
Ongoing: Operations
Why a TCPA compliance checklist matters
TCPATCPAThe Telephone Consumer Protection Act, the federal law that governs telemarketing calls and texts, autodialers, prerecorded voice messages and the Do Not Call Registry. Glossary compliance is not a one-time setup task. It's an ongoing operational discipline that must be embedded into every stage of the lead generation lifecycle. The items on this checklist each correspond to a specific failure mode that plaintiffs' attorneys, buyer compliance auditors, and regulatory investigators look for when examining a lead generator's practices. A checklist converts abstract legal requirements into concrete operational tasks that can be assigned, verified, and logged.
Buyers in regulated verticals increasingly require formal compliance attestations from their lead suppliers. These attestations (warranties that the leads were generated with TCPA-compliant consent, that documentation is maintained and retrievable, that opt-out requests are processed appropriately) are backed by indemnification clauses that create real financial exposure if the warranties are false. A compliance checklist is the operational mechanism that makes an honest attestation possible: you can only warrant that your consent language meets current standards if you've actually reviewed it against current standards recently.
Compliance gaps become expensive quickly at scale. If your operation generates 500 leads per day with defective consent language, and each of those leads results in an autodialed contact to the consumer, you're accumulating 500 potential TCPA violations per day. At $500 per negligent violation, a single day's exposure is $250,000. Class action attorneys pursue exactly this structure: finding a systemic consent defect and multiplying it across the entire lead volume during the statutory lookback period. Proactive checklist-driven compliance is the mechanism that prevents this from becoming your operational reality.
The checklist also serves as documentation of your compliance diligence. In regulatory inquiries and litigation defense, demonstrating that you had a formal compliance program, conducted regular audits, and made documented improvements over time can be the difference between a settlement and a judgment. Courts and regulators look more favorably on operators who can show consistent compliance effort than on those who appear to have been indifferent to compliance requirements until a complaint was filed.
Consent language: The most common failure point
Most TCPA violations traceable to lead generators ultimately come back to defective consent language. The form exists, the checkbox exists, the consumer clicked submit, but the language itself doesn't meet the applicable standard. This is the most common and the most consequential gap, because it affects every lead generated through that form, not just occasional exceptions.
The specific failure modes in consent language are well-documented. Naming only a category instead of specific companies ("you may be contacted by home improvement companies") rather than identifying the actual entities that will make contact leaves it unclear which sellers the consumer authorized, and some buyers will not accept it. (The FCC's one-to-one consentOne-to-one consentAn FCC rule adopted in 2023 that would have limited each prior express written consent to a single seller. Glossary rule, which would have required naming each seller, was vacated in January 2025 and never took effect.) Using pre-checked consent checkboxes does not constitute affirmative consent: the consumer must take an affirmative, uncoerced action to indicate their agreement. Burying consent language in terms of service, at the bottom of a lengthy page, or in font that is materially smaller than the surrounding text fails the "clear and conspicuous" requirement.
Omitting specific reference to autodialed calls and prerecorded messages is a critical gap. The TCPA standard for automated contact explicitly requires that the consent address those specific modalities. "You may be contacted by phone or text" is not sufficient: the language must state that contact may include autodialed calls, prerecorded messages, and artificial voice calls. If your buyers use predictive dialers, ATDSATDS / autodialerAn automatic telephone dialing system, a category of equipment regulated by the TCPA. Glossary technology, or any automated contact system, and your consent language doesn't specifically authorize that type of contact, every resulting call is potentially a TCPA violation.
The overall standard that guides consent language review is that the consent must be "clear and conspicuous" and the consumer must make an "affirmative, informed choice." Applying this test to your current form is the first step of any compliance audit: if you covered the submit button and showed only the consent language, would the average consumer understand exactly what they were agreeing to? If the answer is no, or maybe, the language needs revision. Consent language that passes this informal test is also more likely to withstand formal legal scrutiny.
Documentation requirements at volume
For lead generation operations processing more than 50 to 100 leads per day, manual documentation becomes operationally unsustainable and legally inadequate. At that volume, individual manual logging of consent records will inevitably have gaps, inconsistencies, and errors. And because TCPA violations are typically pursued at the class level (meaning the entire affected population, not individual complainants) compliance documentation gaps discovered in one lead record are presumed to affect the entire operation.
Structured database storage is the baseline requirement for volume operations. Each lead record in your database should have dedicated fields for: consent language version ID, IP address, UTC timestamp, form URL, source campaign identifier, and a flag indicating opt-out status. These fields should be populated automatically by your lead capture infrastructure at the moment of submission, not filled in manually or appended after the fact. The integrity of the documentation depends on it being created contemporaneously with the lead capture event.
Form versioning is the compliance capability that most lead generators underinvest in relative to its importance. When you update your consent language (to add a new buyer's name, to reflect a regulatory change, to refresh stale language), you need to maintain a complete record of which version was live at what time. This means archiving the previous version with an effective date range before deploying the new version, and associating each lead record with the version ID that was live at the time of capture. Without form versioning, you cannot prove what consent language a specific consumer saw when they submitted their lead, which undermines your ability to defend consent adequacy for historical leads.
Log rotation and archiving policies should be designed with TCPA retention requirements in mind. System logs, access logs, and database snapshots that might contain or corroborate consent records should be retained for the same five-year minimum as primary consent documentation. Many operators have been surprised to discover that their logging infrastructure automatically rotates or deletes logs on shorter cycles: a 90-day log retention policy, for example, is incompatible with TCPA defense needs and should be addressed proactively.
Auditing your compliance program
An internal compliance audit for a lead generation operation doesn't require external legal counsel for every cycle: a well-structured internal review conducted by someone with compliance responsibility can identify the most common gaps efficiently. The audit has four primary areas: current form language review, lead record spot-checking, retention policy verification, and buyer contract review.
Start with current form language. Pull the active consent text from every landing page generating leads and review it against the TCPA prior express written consentPrior express written consentUnder the TCPA, a written agreement signed by the consumer (an electronic signature counts) that clearly authorizes a seller to make telemarketing calls or texts using an autodialer or a prerecorded or artificial voice to a stated number. Glossary standard: Does it clearly identify who may contact the consumer? Does it reference autodialed calls, prerecorded messages, and artificial voice? Does it identify the consumer's submitted phone number as the number to be contacted? Does it state that consent is not required to receive services? Is it clear and conspicuous on the form, adjacent to the submit button, and written in readable font? Document the result and note any gaps for remediation.
For lead record spot-checking, pull a random sample of 20 to 50 recent lead records and attempt to retrieve the complete consent documentation for each. Can you produce the consent language text? The IP address? The timestamp? The form URL? Are the consent language versions retrievable from your archive for the version IDs recorded in those records? If documentation is incomplete for any sample records, this indicates a systemic gap in your capture or storage process that requires investigation and remediation. The goal is 100% completeness on every required field, not a high percentage.
Review your buyer contracts to verify that your compliance practices match the warranties you've provided. If your contract includes a warranty that consent documentation will be provided in real time with each lead delivery but your current system only provides it on request, you have a contractual gap in addition to a compliance gap. Verify that your retention periods meet or exceed what your contracts require. Confirm that your opt-out processing time meets any SLA commitments. Quarterly review for active operations, and immediate review after any significant change (new traffic source, new buyer, new landing page, FCC regulatory update) is the appropriate cadence.
Related resources
What should be on a TCPA compliance checklist?
A complete TCPA compliance checklist for lead generators covers four areas: pre-capture (consent language quality, form design, privacy policy), at-capture (IP address, timestamp, source URL logging), on-delivery (consent documentation included in payload, accurate lead representation), and ongoing operations (quarterly consent language review, opt-out processing, record retention, internal audits). The checklist should be treated as a living document updated when FCC rules change.
How do I document TCPA consent?
TCPA consent documentation should be stored at the individual lead record level and include: the exact consent language shown to the consumer at the time of capture, the consumer's IP address, the UTC timestamp of form submission, the URL of the form page, a form version identifier so you can retrieve the exact form language later, and the lead source or campaign identifier. Consent records should be stored in a structured database and retained for at least 5 years.
What are TCPA violation penalties?
TCPA statutory damages are $500 per violation for negligent violations and up to $1,500 per violation for willful or knowing violations. In class action lawsuits, where each contact to a non-consented consumer counts as a separate violation, damages can reach into millions of dollars quickly. Courts have found lead generators liable through indemnification clauses even when they weren't the party making the contact. Proactive compliance is significantly cheaper than litigation defense.
How often should I audit TCPA compliance?
At minimum, conduct a full compliance audit quarterly and immediately after any significant operational changes: new traffic sources, new landing pages, new buyer relationships, or changes in your consent language. Between audits, pull random samples of lead records monthly to verify consent documentation completeness. Keep an audit log so you can demonstrate ongoing compliance diligence, which matters in regulatory inquiries and litigation defense.
Need TCPA-compliant lead buyers?
Connect with buyers in our network who audit consent and require documented TCPA compliance from their suppliers.
Sell TCPA-Compliant LeadsBuying leads instead? Become a buyer
Related tools: State telemarketing laws, Telemarketing calling hours by state.