When Is a Seller Liable for a Vendor’s TCPA Calls?

A company can be held liable for calls or texts it never sent, but only through agency law. The plaintiff has to show that the vendor or lead generator acted with the seller’s authority, appeared to act with it, or that the seller ratified the calls after learning what the vendor was doing. Buying the lead isn’t enough on its own. Contracts, the seller’s actual control over how the vendor worked, and what the seller knew and when usually decide whether the seller answers for the calls.

Can a seller be sued for calls it didn’t place?

Yes, but not automatically. The TCPA doesn’t say who is responsible when one company calls on behalf of another. The Ninth Circuit said so in Gomez v. Campbell-Ewald Co.: “The statute itself is silent as to vicarious liability.” The court filled that gap with ordinary agency principles, holding that “vicarious liability turns on the satisfaction of relevant standards of agency, irrespective of a defendant’s nominal designation.”

The FCC reached the same place in its 2013 Dish Network ruling. The Commission concluded that “a seller is not directly liable for a violation of the TCPA unless it initiates a call, but may be held vicariously liable under federal common law agency principles for a TCPA violation by a third-party telemarketer,” according to FCC 13-54. The ruling covers both the robocall provision and the Do Not Call provision. When the Supreme Court decided the Gomez appeal in 2016, it noted the FCC’s ruling and said of it, “we have no cause to question it,” in Campbell-Ewald Co. v. Gomez.

One caution about the FCC’s part of this. After the Supreme Court’s 2025 decision in McLaughlin Chiropractic Associates v. McKesson Corp., courts in private cases aren’t bound by FCC interpretations, and they read the statute themselves. That matters less here than elsewhere, because the Ninth Circuit grounds vicarious liability in common law agency principles, not only in deference to the agency. Sellers shouldn’t expect McLaughlin to make vendor liability go away, and I wouldn’t advise a client to count on it. Our post on the McLaughlin decision explains how courts now treat FCC rulings.

What does “authority” mean when a vendor makes the calls?

There are three routes, and each one depends on different evidence.

Actual authority. The seller told the vendor, expressly or by implication, to make the calls the way it did, or it controlled how the vendor worked closely enough to be treated like an employer. In Jones v. Royal Administration Services, the Ninth Circuit adopted ten factors from the Restatement of Agency for measuring that control and found that the seller didn’t have enough of it over the vendor that placed the calls. The contract in Jones prohibited unlawful telemarketing, which weighed against any claim that the seller authorized robocalls. I read Jones as a contract-drafting lesson as much as a litigation one.

Apparent authority. The seller’s own conduct made it reasonable to believe the vendor spoke for it. The FCC’s Dish ruling listed examples that may support it, including where “the seller allows the outside sales entity access to information and systems that normally would be within the seller’s exclusive control,” per FCC 13-54. It added that “It may also be persuasive that the seller approved, wrote or reviewed the outside entity’s telemarketing scripts.” Those are the FCC’s illustrations, not rules a court must apply, and after McLaughlin a defendant can argue they stretch the common law. Still, I’d assume a plaintiff will lead with them. Franchise systems raise the same questions, covered in our post on franchisor liability for franchisee texts.

Ratification. The seller learned what the vendor was doing and accepted the benefits anyway. This is the theory that catches companies that never authorized anything, and it’s covered in the next section.

The Do Not Call provision uses its own phrase. A claim under 47 U.S.C. § 227(c)(5) belongs to someone who received more than one violating call in 12 months “by or on behalf of the same entity.” Plaintiffs use that wording to argue the seller is responsible for any call made to sell its products. The Ninth Circuit’s agency decisions arose mostly under the robocall provision, but the Dish ruling applies the same principles to both, so the same evidence of authority and control matters under either one.

How does a seller ratify a vendor’s calls?

By accepting what the vendor produced while knowing, or choosing not to find out, how it was produced. The Ninth Circuit has applied this from both directions, and the two cases show where the line falls.

In Kristensen v. Credit Payment Services, a consumer sued three lenders and two marketing companies over a text sent by a lead generator several layers down the chain. According to the opinion, the company that sent the text had no contact with the lenders, and its representatives hadn’t heard of them before the suit. The court held that “Because AC Referral (which is not a party to this suit) was neither the agent nor purported agent of four of the defendants, they cannot have ratified AC Referral’s acts.” The one defendant that did contract with the texter escaped too, because it lacked knowledge of the violations and of facts that would have prompted a reasonable company to investigate.

Henderson v. United Student Aid Funds went the other way at summary judgment. The loan holder there had audit findings and industry knowledge about its collectors’ calling practices. The court held that a jury could find it ratified the calls “by remaining silent and continuing to accept the benefits of the collectors’ tortious conduct despite knowing what the collectors were doing or, at the very least, knowing of facts that would have led a reasonable person to investigate further.” The court later amended part of its opinion and denied rehearing in its May 2019 order.

The difference between the two cases is mostly about knowledge. My view is that ratification risk is created in a company’s complaint inbox. A consumer complaint about a vendor’s calls, forwarded internally and then filed away while the leads keep coming, is the kind of record that turns a Kristensen defense into a Henderson problem. Treat every complaint about a vendor’s calling as notice, investigate it, and write down what you found and what you changed.

Do layers of lead brokers protect the seller?

Sometimes. In Kristensen, the distance between the lenders and the texter was the reason the ratification claim failed against them. Distance isn’t a strategy, though. A seller that sets the lead specifications, receives consumer complaints, or knows its brokers buy from text-message publishers may find that the layers don’t help much. And the FCC’s illustrations of apparent authority, like letting a vendor use the seller’s brand or customer systems, don’t depend on how many companies sit in between.

The more useful protection is information. A seller that knows which publishers its brokers use, what consent language those publishers display, and what the brokers’ contracts require can defend the chain with documents instead of with ignorance. I’d much prefer to defend a seller that can produce its brokers’ publisher lists than one that never asked. Our post on the Eleventh Circuit’s vacatur of the one-to-one consent rule covers what lead buyers should keep from each consent form.

Agency theories and the records that answer them

Exposure is the same as if the seller had placed the calls: $500 per robocall or robotext under § 227(b)(3), up to $500 per violating call under the Do Not Call provision, and up to $1,500 per call under either if a court finds the violation willful or knowing.

When a claim names your company for a vendor’s calls

1. Put a litigation hold on your own records and send a written preservation demand to each vendor and lead source in the chain, covering call and text logs, platform data, and the consent records for the numbers involved.
2. Ask the vendor for its opt-out and internal do-not-call records for those numbers, with dates, and pull your own.
3. Obtain the National Do Not Call Registry scrub records the vendor used and the version dates, since a Do Not Call claim will test them.
4. Collect every contract in the chain, the scripts and message templates, any recorded or AI-voice files, and your complaint and audit history for that vendor.
5. Talk to a lawyer before tendering to the vendor, terminating the relationship, or responding to the claimant, because each of those steps creates a record about knowledge and control.

The firm’s California TCPA defense lawyers page explains how it approaches claims involving vendor telemarketing and purchased leads.

Questions sellers ask about vendor liability

Does an indemnity clause protect us from the plaintiff?

No. Indemnity shifts cost between the seller and the vendor after the fact. It doesn’t stop a plaintiff from suing the seller, and it’s only as good as the vendor’s ability to pay, so I treat it as a collection question, not a defense. The clauses that matter to the liability question are the ones limiting what the vendor may do, such as prohibitions on unlawful calling methods, because those bear on authority. Our post on TCPA terms in vendor contracts covers the clauses that help.

Is a lead generator our agent if we only buy its leads?

Not by that fact alone. Agency depends on authority, control, or ratification, and a buyer-seller relationship for leads doesn’t establish any of them automatically. In Kristensen, the lenders that bought leads through a broker weren’t liable for a publisher’s texts. A buyer that dictates how leads are generated, or keeps buying after learning of problems, stands on weaker ground.

Can we be liable for a sub-vendor we never heard of?

It’s harder for a plaintiff, but not impossible. Kristensen held that companies can’t ratify the acts of someone who wasn’t their agent or purported agent. Henderson shows the risk when the seller knew enough to ask questions and didn’t. The answer depends on what your company knew about how its vendors found their own vendors.

Should we stop using vendors that call or text for us?

That’s a business decision, and most companies don’t need to. What helps is choosing vendors with documented consent practices, putting compliance terms and audit rights in the contracts, and responding visibly when a complaint arrives. A seller with that record is in a much better position than one whose only evidence is a signed indemnity. Individual executives can face their own exposure, too. Our post on personal liability for owners and officers covers when that happens.

If your company is sued over a vendor’s calls

If your company has been named in a TCPA claim over calls or texts that a vendor or lead generator sent, the contracts and complaint history usually decide whether the seller is responsible. Rosenberger + Kawabata represents businesses defending TCPA lawsuits and class actions through its business litigation practice, including claims involving vendor telemarketing and purchased leads. Contact Rosenberger + Kawabata online for a free and confidential consultation, or call (310) 894-6921. For the first steps after a claim arrives, see our guide for businesses sued under the TCPA.

Sources

The statute is 47 U.S.C. § 227. The FCC’s ruling is In re Joint Petition Filed by Dish Network, LLC, FCC 13-54, 28 FCC Rcd. 6574 (2013). The court decisions are Campbell-Ewald Co. v. Gomez, 577 U.S. 153 (2016); Gomez v. Campbell-Ewald Co., 768 F.3d 871 (9th Cir. 2014); Jones v. Royal Administration Services, Inc., 887 F.3d 443 (9th Cir. 2018); Kristensen v. Credit Payment Services Inc., 879 F.3d 1010 (9th Cir. 2018); and Henderson v. United Student Aid Funds, Inc., 918 F.3d 1068 (9th Cir. 2019), as amended by order of May 6, 2019.

This post is general information about the Telephone Consumer Protection Act and related laws as of September 5, 2026. It is not legal advice, and reading it does not create an attorney-client relationship. Courts and the FCC change the rules in this area often, and the outcome of any claim depends on its facts. Past results do not guarantee future outcomes.