TCPA Vendor Contracts: Indemnity, Consent Warranties, and Audits

An indemnity clause won’t stop a plaintiff from suing your company over a vendor’s calls or texts. The contract decides who pays for the defense, how fast you can prove consent, and whether money backs the vendor’s promise. The key terms are consent records on demand, Do Not Call scrubbing, a duty to defend, notice and cooperation, survival, insurance naming you as an additional insured, and limits on subcontracting. A company with them can better prove what happened and make the vendor share the defense.

Why does a company need TCPA terms in a vendor contract at all?

Because the company whose products are being sold can end up as the defendant, and several federal district courts have held that the TCPA gives it no right to contribution or indemnity from the vendor.

Liability for a vendor’s calls runs through agency law. The Ninth Circuit put it this way in Jones v. Royal Administration Services: “A defendant is vicariously liable for violations of the TCPA where common law principles of agency would impose it.” The FCC’s Do Not Call rules go further on one point. When someone else records or keeps the do-not-call requests, the company on whose behalf the calls are made “will be liable for any failures to honor the do-not-call request,” under 47 C.F.R. § 64.1200(d)(3). Franchise systems raise the same agency questions, covered in our post on franchisor liability for franchisee texts.

Once a company is sued, it can’t count on the statute to shift the loss. In Lemieux v. Lender Processing Center, No. 16-cv-01850 (S.D. Cal. Jan. 31, 2018), a mortgage lender sued the lead generators it blamed for a call. The court agreed with other courts that “claims for contribution and indemnity are not available under the TCPA,” dismissed those claims, and declined to exercise jurisdiction over the lender’s state-law breach-of-contract claim. That left any contract claim for state court. Without strong contract terms, the company that didn’t dial may pay for the company that did, and I’d start any vendor negotiation from that fact.

Which clauses do the real work?

The ones that produce evidence and money when a claim arrives. A general promise to obey the law is a start, not the end.

A specific compliance covenant. In Jones, the seller’s contract barred “any act or omission that violates applicable state or Federal law,” including robocalling, and because the plaintiffs offered no evidence contradicting that limit, the court held that the express language precluded the claim that the vendor had actual authority to place the calls. The plaintiffs didn’t pursue apparent authority or ratification on appeal, so the court didn’t decide those theories. Name the prohibited practices, such as prerecorded or AI-voice calls without the required consent and calls to numbers on any do-not-call list.

Consent warranties with record production on demand. In the Ninth Circuit, “Express consent is not an element of a plaintiff’s prima facie case,” as the court held in Van Patten v. Vertical Fitness Group. It’s a defense the caller must prove, so the warranty needs a deadline. Require the full consent record for any number within a few business days of a request: the date and time, the web page or form, the disclosure language the consumer saw, the number entered, and the company names the consent covered. The FCC’s one-to-one consent rule doesn’t change this. The Eleventh Circuit held that “the FCC exceeded its statutory authority under the TCPA” in adopting it, and vacated that part of the order in Insurance Marketing Coalition Ltd. v. FCC on January 24, 2025. The eCFR’s text of § 64.1200(f)(9) still prints the one-to-one wording as of this post, but the court has vacated it. A warranty that the consent authorized calls or texts from your company, and not only from the lead generator, is still worth demanding.

Do Not Call scrubbing you can verify. The FCC’s safe harbor for registry violations requires, among other things, using a version of the registry “no more than 31 days prior to the date any call is made” and keeping records of the process, under § 64.1200(c)(2). The contract should require the vendor to scrub against the registry, your internal do-not-call list, and its own list before every campaign and at least every 31 days while it runs, and to keep the scrub logs. The FTC’s Telemarketing Sales Rule says “No person may participate in any arrangement to share the cost of accessing the National Do Not Call Registry,” including cost-sharing through a telemarketer, under 16 C.F.R. § 310.8. Registry access is tied to each seller, directly or through someone else, so ask which account the vendor uses for your campaigns. Our post on the Telemarketing Sales Rule covers the FTC’s parallel recordkeeping duties.

Opt-out handoff. Since April 11, 2025, requests to revoke consent for calls and texts that need it “must be honored within a reasonable time not to exceed ten business days from receipt of such request,” under § 64.1200(a)(10). Weekly spreadsheets of STOP replies cut it close. Require daily transfer in both directions. The separate FCC requirement that a revocation sent in response to one type of message apply to all of a caller’s robocalls and robotexts on unrelated matters has been delayed “until April 11, 2026” by a Bureau order, which notes banking groups’ point that callers often outsource customer calls and texts to third parties. I’d build that plumbing into the contract now anyway.

Limits on subcontracting. No sub-vendors or publishers without your written approval, the same terms flowed down to each one, and a current list of every entity that touches your campaigns. I’d treat an unnamed sub-vendor as one of the biggest gaps a contract can leave, because you can’t produce records from a company you can’t name.

Audit rights. The right to request records on short notice, to review scripts and message templates before use, and to sample consent records each month. Audits do double duty. The Do Not Call statute gives a defendant an affirmative defense if it “established and implemented, with due care, reasonable practices and procedures to effectively prevent telephone solicitations in violation of the regulations,” under 47 U.S.C. § 227(c)(5). Documented audits are part of how a company shows that.

How does California law treat indemnity and the duty to defend?

California fills in a lot of the indemnity contract for you, unless the contract says otherwise. Civil Code § 2778 sets default rules for “the interpretation of a contract of indemnity.” An indemnity against claims or liability “embraces the costs of defense” incurred in good faith and with reasonable discretion, and the indemnitor is “bound, on request of the person indemnified, to defend actions or proceedings brought against the latter in respect to the matters embraced by the indemnity.”

The California Supreme Court explained what that means in Crawford v. Weather Shield Mfg., Inc. (2008) 44 Cal.4th 541. The duty to defend is separate from any obligation to reimburse defense costs after the fact, and “the duty arises immediately upon a proper tender of defense by the indemnitee, and thus before the litigation to be defended has determined whether indemnity is actually owed.” That matters because a TCPA class action can be expensive to defend long before anyone decides whose fault the texts were.

Three drafting points follow from § 2778 and Crawford.

First, say “defend” expressly, and say the duty covers claims “alleged” to arise from the vendor’s calls, texts, or leads. A vendor form may limit the obligation to reimbursing defense costs after a final judgment, and § 2778‘s defaults yield when “a contrary intention appears.” I’d strike that language first.

Second, deal with mixed fault. Crawford repeats the rule that when a party seeks indemnity for its own active negligence, or regardless of the indemnitor’s fault, the language “must be particularly clear and explicit, and will be construed strictly against the indemnitee.” A TCPA complaint against a seller can accuse both companies of wrongdoing. If you want the vendor to cover losses caused by your company’s own active fault, or to pay regardless of who was at fault, the clause has to say so in clear, explicit words.

Third, tender in writing and promptly. Under § 2778, if the indemnitor gets no reasonable notice of the suit or isn’t allowed to control the defense, a judgment against the indemnitee is “only presumptive evidence” against the indemnitor. The statute also gives the indemnified party the right to conduct its own defense. A seller that wants its own counsel should spell out in the contract how that choice affects the vendor’s obligations.

All of this assumes California law governs. A vendor contract may pick another state’s law, and that choice can change the defaults.

What should happen after the contract ends?

The indemnity and the duties to keep records and cooperate should survive termination, because TCPA claims can surface long after a campaign ends. Time limits apply to these claims, and survival should run at least as long.

Record retention deserves its own clause. Under § 64.1200(d)(6), “A do-not-call request must be honored for 5 years from the time the request is made.” A vendor that deletes opt-out and consent data when the contract ends leaves you unable to prove what happened on its calls, so require retention and a turnover before any deletion.

The vendor should also tell you within a few business days about any complaint, demand letter, lawsuit, regulator inquiry, or carrier blocking notice involving your campaigns, and make records and witnesses available for your defense. I’d also add a clause barring the vendor from settling a claim in your company’s name without your consent.

What is a vendor’s indemnity worth if the vendor can’t pay?

It can be worth very little, and a plaintiff’s lawyer knows that as well as you do. The Ninth Circuit said in Jones that the vendor’s “impecuniosity and unresponsiveness are immaterial to the issue of actual authority.” A broke vendor doesn’t make the seller liable. In my view, though, it does make the seller the defendant worth suing.

Before relying on an indemnity from a small lead generator or texting shop, I’d want money behind it, sized to the call volume. Start with insurance that actually covers TCPA claims and names your company as an additional insured by endorsement. Ask for the policy, not a certificate. The policy may carry an exclusion for TCPA or unsolicited-communication claims, and if it does, additional-insured status may do little for this risk.

When insurance is thin, use a holdback or escrow from invoices, or an express right to set off defense costs against what you owe the vendor. If the contracting entity has few assets, ask for a guaranty from its parent company or owner. Then carve the indemnity and the TCPA covenants out of any limitation-of-liability cap and consequential-damages waiver, or the rest of the work won’t matter much.

My view is that a modest indemnity from a vendor with real insurance beats an unlimited one from a company that can’t fund a defense. Before signing, search federal court records for prior TCPA suits naming the vendor.

If a vendor’s calls draw a demand letter

Move on the contract and the records in the same week. These steps keep both intact:

1. Put a litigation hold on call and text logs, dialer and platform data, and the consent records for every number in the claim, and ask the vendor in writing to do the same.
2. Pull your opt-out and internal do-not-call logs, and the vendor’s, with the date each request arrived and when it was processed.
3. Get the vendor’s registry scrub records and the registry version dates used for the campaigns named in the claim.
4. Collect the vendor contract, any sub-vendor contracts, scripts, message templates, and recorded or AI-voice files, then send a written tender of defense under the contract’s notice clause.
5. Talk to a lawyer before responding to the demand letter, contacting the claimant, or offering anything to settle.

For claims involving vendor telemarketing and lead-generator texts, the firm’s California TCPA defense page sets out what the defense looks at first.

Questions companies ask about TCPA vendor contracts

Can the contract make the vendor solely liable to the person who got the calls?

No. The contract binds your company and the vendor, not the plaintiff. A plaintiff can still sue the seller on an agency theory, or under the Do Not Call rules where opt-outs weren’t honored, though the contract’s limits on the vendor’s authority can matter to the agency question. Between the two companies, the contract decides who bears the cost and who runs the defense, which is why the duty to defend and the insurance terms matter so much.

Should we agree to indemnify the vendor in return?

Usually, within limits. A vendor may ask for protection against claims caused by data you supplied or opt-outs you failed to pass along. I think that’s fair if it’s tied to your own data and conduct. Resist broad language making you responsible for any claim arising from the campaign, which can swallow the vendor’s own indemnity.

Does the vendor’s limitation-of-liability clause apply to TCPA claims?

It may, depending on how the clause is written. A vendor form may cap total liability at fees paid over a short period and waive consequential damages. TCPA statutory damages are $500 per violation, or actual loss if greater, for autodialed and prerecorded calls. Do Not Call claims, which require more than one call in 12 months by or on behalf of the same company, carry up to $500 per violation. A court may, in its discretion, increase either up to $1,500 if it finds the violation willful or knowing. A fee-based cap can be a small fraction of a class claim. Carve the indemnity and the TCPA covenants out of the cap and the waiver.

Is a certificate of insurance from the vendor enough?

No. A certificate shows that a policy existed on the date it was issued. It doesn’t show what the policy excludes, and it doesn’t make your company an insured. I’d ask for the policy itself, or at least the exclusions and the additional-insured endorsement, require notice before cancellation, and recheck at renewal.

Defending claims over a vendor’s calls and texts

If your company has been sued or received a demand letter over calls or texts a vendor placed for it, the vendor contract and the records it requires can shape both the defense and who pays for it. Rosenberger + Kawabata represents businesses defending TCPA lawsuits and class actions through its business litigation practice, including claims involving vendor telemarketing and lead-generator texts. Contact Rosenberger + Kawabata online for a free and confidential consultation, or call (310) 894-6921.

Sources

The statute is the Telephone Consumer Protection Act at 47 U.S.C. § 227. The FCC’s rules are at 47 C.F.R. § 64.1200, as published in the eCFR on July 15, 2025. The delay of the revoke-all requirement is in the FCC’s Order, DA 25-312 (Apr. 7, 2025). The FTC’s registry-access rule is 16 C.F.R. § 310.8. California’s indemnity rules are in Civil Code § 2778.

The court decisions are Crawford v. Weather Shield Mfg., Inc. (2008) 44 Cal.4th 541; Jones v. Royal Administration Services, Inc., 887 F.3d 443 (9th Cir. 2018); Van Patten v. Vertical Fitness Group, LLC, 847 F.3d 1037 (9th Cir. 2017); Insurance Marketing Coalition Ltd. v. FCC, No. 24-10277 (11th Cir. Jan. 24, 2025); and Lemieux v. Lender Processing Center, No. 16-cv-01850 (S.D. Cal. Jan. 31, 2018).

This post is general information about the Telephone Consumer Protection Act and related laws as of July 15, 2025. It is not legal advice, and reading it does not create an attorney-client relationship. Courts and the FCC change the rules in this area often, and the outcome of any claim depends on its facts. Past results do not guarantee future outcomes.