TCPA Compliance Checklist for Lead Sellers and Buyers

A TCPA compliance checklist for lead sellers and buyers is a list of checks that must be true before a lead is sold, pinged or called: written consent on file, a consent certificate, Do-Not-Call and litigator scrubs, legal calling hours, opt-out handling, and kept records. This page ties each check to the step where it runs.

Most TCPA compliance checklist pages online are written for dialer and texting teams. A lead seller has a different problem: the risk sits in the consent behind each lead, and it travels to whoever dials the number. So this checklist works as a per-lead gate. If a row fails, the lead does not move. For the legal background, start with our guide to TCPA compliance for lead generation. This page is general information, not legal advice.

Key Takeaways

• Treat the checklist as a gate, not a document. Each row has a step in your flow where it runs, and a lead that fails a row should not be sold, pinged or called.
• Consent is the heaviest row. Store the exact disclosure text, a timestamp, the seller named, and a consent certificate for every lead.
• Scrubs are separate from consent. A clean Do-Not-Call result does not give you permission to autodial a cell phone, and consent does not clear a number on a list.
• The one-to-one consent rule is not in force. A federal court vacated it before it took effect, but naming one seller is still a smart standard.
• Records decide the fight. When a claim arrives, the lead file with its proof is your defense.

The per-lead gate: what must be true before a lead moves

Every TCPA compliance checklist should start from three moments that matter for each lead: when it is sold, when it is pinged to a buyer, and when someone dials it. The Telephone Consumer Protection Act (47 U.S.C. 227) lets a person sue for $500 per violation, and a court may raise that to as much as three times the amount for willful or knowing violations, per the Cornell Law copy of the statute. Lawsuits rarely stop at one call.

So the gate runs in order. First comes proof of consent, captured at form submit. Next come the scrubs, run at intake and again before a call. Last come calling rules, which apply at dial time. Sellers own the first two moments. Buyers own the third, but a buyer inherits the seller's mistakes, so many buyers repeat the seller's checks. Agree in writing who runs which row.

The TCPA compliance checklist table

Use this TCPA compliance checklist as the master list. The last column is the point of the page: it says where in your flow each check runs.

Checklist row one: consent, the certificate and one-to-one status

Federal rules define prior express written consent as a signed agreement that clearly authorizes the seller to send the messages and lists the phone number. It must also say that signing is optional and not a condition of purchase. An electronic signature counts when federal or state law recognizes it. You can read the wording in 47 CFR 64.1200.

Pair the disclosure with a certificate. Our explainer on what TrustedForm is shows how a certificate records a form visit, and Jornaya's LeadiD works on the same idea. A certificate proves a moment on a page. It does not prove your wording was legally enough.

On one-to-one consent, the FCC adopted the rule in 2023, but the Eleventh Circuit vacated it on January 24, 2025, as Kelley Drye reported. It never took effect. (Separately, the Fifth Circuit held in February 2026 that oral consent can satisfy the statute for telemarketing calls, a ruling Mayer Brown summarized that applies only in that circuit.) Many buyers and some states still want one named seller, so our one-to-one consent guide explains why to keep that standard.

Checklist rows two to four: DNC, state, litigator and reassigned-number scrubs

Scrubbing means checking a number against lists of numbers you should not contact. Each list answers a different question, and consent never replaces a scrub.

The federal rule lets a seller rely on a registry copy obtained no more than 31 days before the call, per 47 CFR 64.1200(c)(2). Keep records that document the process. State lists vary, so scrub the states you sell in. Florida, for one, has its own telephone solicitation law, section 501.059, which requires prior express written consent for automated or prerecorded sales calls.

Litigator scrubs filter out known serial plaintiffs. The reassigned-number check matters at dial time, since the safe harbor in 47 CFR 64.1200(m) depends on a database check. Our DNC scrubbing guide covers list handling in depth.

TCPA compliance checklist rules for calling: hours, frequency and opt-out

Three calling rules belong on the gate, even for sellers who never dial. Your buyers will, and your contracts should say so.

• Hours. Telephone solicitations may not reach residential subscribers before 8 a.m. or after 9 p.m. at the called party's location, under 47 CFR 64.1200(c)(1). Store the time zone with each lead so a buyer can respect it.
• Frequency. Federal rules focus on hours and consent, but some state laws add limits on call attempts. Check each state you sell in.
• Opt-out. A revocation made in any reasonable way must be honored within a reasonable time, not to exceed ten business days, under 47 CFR 64.1200(a)(10). "Stop," "quit" and plain sentences all count.

A suppression list is the simplest tool for opt-outs: once a number is on it, no lead for that number goes out.

Records on your TCPA compliance checklist, and how long to keep them

A lead file should hold the disclosure text, the timestamp, the page URL, the certificate, every scrub result, and any opt-out. Internal do-not-call requests must be honored for five years under 47 CFR 64.1200(d)(6). For consent records, the sections cited here give no fixed period, so ask counsel.

Many operators keep consent records for at least four years. Federal civil claims under an Act of Congress generally carry a four-year limit under 28 U.S.C. 1658(a), and courts commonly apply it to TCPA suits. Treat four years as a floor and ask counsel for your number. Keep records exportable, so you can hand a buyer the proof with the lead.

What Lead Distro AI does around this TCPA compliance checklist (and what it does not)

Lead Distro AI is a lead distribution and call tracking platform. It connects your own accounts at ingest, and you pay each vendor directly.

• TrustedForm. With your key connected, a certificate is claimed and matched to the lead's email and phone. Mark the field required and a failed check rejects the lead.
• Blacklist Alliance. The litigator scrub can reject or tag matched leads. If the lookup errors or hits its cap, the lead passes unscrubbed.
• Suppression lists. Upload blocked phones and emails, and matching leads are kept from that buyer. See suppression lists in Lead Distro AI.
• Jornaya. The token is captured and passed through to the buyer.

It is not a dialer, it does not write your consent language, and it does not make you compliant. Compliance stays with the operator. Our TCPA compliance software guide maps these tools by job.

Not legal advice, and when to call counsel

This TCPA compliance checklist is general information. It is not legal advice, and no checklist replaces a lawyer who knows your states and verticals.

Bring counsel in before you launch a new vertical, change your consent wording, or sell to a buyer that uses automated dialing or texting. Bring counsel in again after any demand letter or complaint. Rules change through FCC orders and court decisions, so review this list on a set schedule.

FAQ

How do I become TCPA compliant as a lead seller?

Start with written consent that names the seller, states that signing is optional, and lists the phone number. Capture a consent certificate and store the disclosure text, timestamp and page URL with every lead. Scrub each number against federal and state Do-Not-Call lists and a litigator list, honor opt-outs within ten business days, and keep records. Then have counsel review your wording and your buyer terms.

What are TCPA compliance guidelines for lead generation?

The core guidelines are documented prior express written consent, scrubbing numbers against Do-Not-Call lists, calling only between 8 a.m. and 9 p.m. in the called party's time zone, and honoring revocations on time. State laws such as Florida's section 501.059 add rules of their own, so follow the stricter rule where two apply. The guidelines sit in the statute at 47 U.S.C. 227 and the FCC rules at 47 CFR 64.1200. Review them on a schedule, because they change.

Which calls require prior express written consent under the TCPA?

Under FCC rules, autodialed or prerecorded telemarketing calls and texts to cell phones need prior express written consent. Written consent means a signed agreement, which can be electronic, that clearly authorizes the seller and lists the number. In February 2026 the Fifth Circuit (Texas, Louisiana and Mississippi) ruled that oral consent can be enough, so the answer can depend on your location. Ask counsel which standard applies to your calls, and keep written consent as the safe default.

What are examples of TCPA compliance documentation?

Good documentation includes the exact disclosure text the person saw, a timestamp, the page URL and IP address, a consent certificate such as TrustedForm or Jornaya, and the seller named on the form. Add your scrub results, the date of each Do-Not-Call check, your opt-out log, and the buyer contract that says who runs which check. Store all of it where you can export it per lead. If a claim arrives, you want to produce one clean file in minutes, not rebuild the story from several tools and inboxes.

What is not covered by the TCPA rules?

The Do-Not-Call rules protect residential subscribers, so many business-to-business calls fall outside the registry. Calls made with valid consent are not violations of the consent rules. Some callers and call types carry exemptions, and many state laws reach further than the federal rules. Do not assume a call is exempt. Ask counsel to confirm for your call type and states, since damages are counted per call and a wrong assumption gets expensive fast.

Conclusion

A TCPA compliance checklist only helps if each row has an owner and a place in the flow. Capture consent at the form, scrub at intake and again before dial, respect hours and opt-outs, and keep records you can export. Then agree with buyers in writing on who runs which check.

Lead Distro AI can run the TrustedForm check, the litigator scrub and your suppression lists at intake, so a failing lead stops before a buyer sees it. For the full legal picture, return to the pillar guide linked above.