Buying Leads After the One-to-One Rule: Consent Records That Hold Up
The one-to-one consent rule was vacated, but a lead buyer still has to prove consent when a TCPA claim arrives, and the burden is on the caller. A comparison site can collect consent for more than one company. It can’t make a thin record hold up. The strongest record shows the page the consumer saw, the moment they agreed, and that your company was covered. A buyer that holds that record has a real defense to work with.
What did the one-to-one ruling leave in place for lead buyers?
Nearly everything except two new restrictions. The Eleventh Circuit vacated the FCC’s one-to-one and “logically and topically” requirements in January 2025, and our post on the Eleventh Circuit’s one-to-one decision covers what the court set aside. This post is about what a buyer still has to prove.
Start with the court’s own test. In Insurance Marketing Coalition Ltd. v. FCC, the Eleventh Circuit said a consumer need only state, in clear and unmistakable terms, “before receiving the robocall, that he is willing to receive the robocall.” That’s a timing rule and a clarity rule, and both are questions of evidence. A lead record that can’t show when the consumer agreed, or what words they agreed to, fails that test without any help from the vacated rule.
The FCC’s written-consent definition is still on the books, too. Under 47 C.F.R. § 64.1200(f)(9), prior express written consent is a signed written agreement that “clearly authorizes the seller to deliver or cause to be delivered to the person called advertisements or telemarketing messages” by autodialer or by an artificial or prerecorded voice. It requires a clear and conspicuous disclosure, and it lets an electronic signature count. When the FCC adopted that definition in 2012, it said in FCC 12-21 that “should any question about the consent arise, the seller will bear the burden of demonstrating that a clear and conspicuous disclosure was provided and that unambiguous consent was obtained.”
Two cautions keep that in proportion. After McLaughlin Chiropractic Associates v. McKesson Corp., district courts in TCPA lawsuits read the statute for themselves, “affording appropriate respect to the agency’s interpretation,” instead of treating FCC orders as binding. And in the Fifth Circuit, Bradford v. Sovereign Pest Control held that “the statute does not require prior express written consent” for the prerecorded calls in that case, and its reasoning covers autodialed calls too. Our post on the Fifth Circuit’s oral-consent ruling covers it. Neither change helps a buyer that can’t prove consent of any kind.
Does consent on a comparison site cover your company?
It can. To prove it, the record should show your company was covered when the consumer submitted the form. That question matters most for Do Not Call claims.
The Do Not Call rule has its own consent language, and it’s seller-specific. A company can call a number on the National Do Not Call Registry (the federal list of numbers whose owners have asked not to get telemarketing calls) if it has the subscriber’s permission, but under § 64.1200(c)(2)(ii) that permission must be in a signed, written agreement that “states that the consumer agrees to be contacted by this seller and includes the telephone number to which the calls may be placed.” The Eleventh Circuit’s decision didn’t address that paragraph. A Do Not Call claim is a claim for violating the FCC’s regulations, so I’d plan on meeting that requirement instead of arguing around it. A consent form that names a website and its “partners,” with your company buried in a list nobody can reconstruct, is a weak answer to a Do Not Call claim.
A 2024 federal case in Ohio shows the same problem from the other direction. In Schwartz v. The Hall Insurance Group, a case under the TCPA’s autodialer and prerecorded-voice provision, an insurance seller had bought a batch of leads from a lead seller, and according to the order, the form’s disclosure covered contact by “Secure Medicare Enrollment and our Marketing Partners.” In a footnote, the court noted the plaintiff’s argument that the insurance seller wasn’t on the hyperlinked partner list. The court refused to consider his photocopy of the site, noting among other problems that it “appears to have been taken on November 5, 2023, which is not relevant to the state of the website in June 2022 when plaintiff states he received phone calls from HIG.” The plaintiff also denied submitting the form at all, and the court found “a genuine factual dispute as to whether plaintiff gave his consent to be contacted by defendant.” So the insurance seller didn’t win summary judgment on consent. The order doesn’t show that either side produced the partner list as it stood when the form was submitted or when the calls were made. A dated copy of that list is the record a buyer should be holding. Our post on insurance telemarketing and the TCPA covers other places consent breaks down for insurance sellers.
What should a usable consent record contain?
The strongest record shows the consumer’s agreement as it happened, not as the lead seller describes it later. The FTC’s Telemarketing Sales Rule offers a useful benchmark. Where that rule requires consent, 16 C.F.R. § 310.5(a)(8) says a complete record includes the date and “A copy of the request for Consent in the same manner and format in which it was presented to the person providing Consent.” That’s an FTC rule under a different statute, not something a TCPA plaintiff sues under, but I’d build every lead record to meet it anyway. Our post on the Telemarketing Sales Rule’s recordkeeping duties covers what it requires.
| What the record contains | Why it matters | How it fails |
|---|---|---|
| A capture of the page as the consumer saw it, on the device used | Shows the disclosure was clear and conspicuous | A later screenshot or a recreation of the form |
| A timestamp for the submission | Consent has to come before the first call or text | Time missing, or later than the first contact |
| The disclosure language, with the form version | Shows what the consumer agreed to | Language pulled from today’s site, not the version in use |
| Your company named, in the disclosure or a list captured that day | Supports the “this seller” requirement for Do Not Call claims | A “partners” link with no dated copy of the list |
| The phone number entered and the click or signature | Ties the agreement to the number called | Number added or changed later in the chain |
| The source site, the IP address, and any certificate ID | Ties the session to this consumer | Data that points to a different person or site |
| The chain of sellers and aggregators, with dates | Lets you subpoena the publisher who holds the original | A lead that passed through companies you can’t identify |
A lead that comes with only a name, a number, a timestamp, and a vendor’s promise of compliance isn’t a consent record. In my view, a third-party certificate ID is a pointer to evidence, not the evidence. It helps only if the session it points to can still be played back and matches the consumer and the form.
How do purchased-lead consent records fail in court?
Mostly by losing the link between the record and the person who was called. The burden runs against the caller. In the Ninth Circuit, which covers California, Van Patten v. Vertical Fitness Group held that “Express consent is not an element of a plaintiff’s prima facie case but is an affirmative defense,” and that the defendant bears the burden of proving it.
Mantha v. QuoteWizard.com is the cautionary case. According to the District of Massachusetts’s 2022 order, the lead passed from a website operator through two intermediaries before the defendant bought it, and each company in the chain had promised in its contract that the lead complied with the TCPA. Discovery produced two IP addresses tied to the claimed consent. The people with access to them denied under oath any connection to the plaintiff, and a representative of the lead-verification company testified that the identifier attached to the lead wasn’t connected to the plaintiff or the website. The defendant blamed an intermediary for linking the wrong identifier to the lead. The court granted the plaintiff partial summary judgment on consent. The court wrote that the defendant’s position, that someone had entered the plaintiff’s information on the site, “falls short of meeting the burden to establish that Mantha himself consented.” The case later settled, and the court granted final approval of a class settlement in September 2025. A settlement is not an admission of liability.
The other common failure is the disclosure itself. Berman v. Freedom Financial Network was an arbitration ruling, not a consent ruling, but it involved lead-generation sites, and the Ninth Circuit described their notice text as “the antithesis of conspicuous.” The court said it was “printed in a tiny gray font considerably smaller than the font used in the surrounding website elements.” A consent disclosure designed the same way invites the same criticism, and the FCC’s definition asks for a clear and conspicuous disclosure.
Paper promises don’t fix either problem. In its 2014 GroupMe ruling, the FCC let GroupMe rely on consent obtained through an intermediary, but it also said “The TCPA holds a caller liable for TCPA violations even when relying upon the assertion of an intermediary that the consumer has consented to the call.” After McLaughlin, district courts aren’t bound by that ruling, but I wouldn’t build a defense on the hope that a court rejects it.
The exposure is the reason this matters. The statute allows $500 per violation for robocall and robotext claims, up to $500 per violation for Do Not Call claims (which require more than one call in 12 months by or on behalf of the same company), and up to $1,500 per violation if a court finds the violation willful or knowing. Across a purchased list, those numbers multiply quickly.
How should you vet lead sellers and write the contract?
Vet the publisher, not just the broker, and write the contract around evidence you can get on demand. Whether your company answers for a vendor’s calls is a separate agency question, covered in our post on seller liability for vendor calls. The points here are about the consent record itself.
Before buying, ask the broker to identify every publisher whose leads it will send you, and get sample records from each one. Then test those samples against the table above. If the broker can’t name its publishers or produce a full record for a sample lead within a few days, it won’t do better once you’ve been sued. Mortgage lenders buying trigger leads face separate limits, covered in our post on trigger leads and the Homebuyers Privacy Protection Act.
The contract should require the seller to deliver the complete record for any lead within a short, fixed number of business days. It should require the seller to keep those records for as long as a claim could be brought, since time limits apply to TCPA claims, and it should bar resale to sub-publishers you haven’t approved in writing. Add notice of any consumer complaint about a lead, and audit rights. An indemnity is worth having, but in Mantha every company in the chain gave a TCPA warranty and the consent defense still failed. I’d treat indemnity as a way to share the loss, not a way to avoid it, and I’d check whether the seller has insurance or assets behind its promise. Our post on TCPA terms in vendor contracts covers indemnity, audit rights, and the other terms worth asking for.
Then audit. Pull a random sample of leads every month, request the full record for each, and confirm that the capture shows your company named, the timestamp precedes your first contact, and the number matches. Track the failure rate by publisher and drop the ones that can’t produce. In my view, an audit that finds problems and changes nothing can be worse than no audit, because a plaintiff will use it to argue the violations were knowing. Done right, the same audit records support the Do Not Call statute’s affirmative defense for a company that established and implemented, with due care, reasonable practices and procedures to prevent violations.
When a purchased lead turns into a demand letter
- Put a litigation hold on your call and text logs, dialer and platform data, and the consent record for the number in the claim, and send written preservation requests to the lead seller and every company above it.
- Pull your opt-out and internal do-not-call records for that number, with dates, so the consent can be compared with every later contact.
- Pull the National Do Not Call Registry scrub records for the campaign and the version dates used.
- Collect the lead purchase agreement, the publisher list, scripts and message templates, and any recorded or AI-voice files used.
- Talk to a lawyer before you respond to the demand, contact the claimant, or offer anything to settle.
For claims involving purchased leads and comparison-site consent, the firm’s California TCPA defense page sets out what the defense looks at first.
Questions lead buyers ask about consent records
Is a lead certificate from a verification service enough to prove consent?
Not on its own. A certificate ID helps only if it opens a session record showing the page, the disclosure, the timestamp, and the number entered, and if that session matches the person you called. In Mantha, a witness for the verification company testified that the identifier attached to the lead wasn’t connected to the plaintiff or the website. I’d require playable records for a sample of leads before signing with any seller.
Can one form still give consent to several companies?
Yes. In vacating the one-to-one rule, the Eleventh Circuit held that a consumer can agree to calls from more than one seller at once. The practical limit is proof. For Do Not Call claims, the FCC’s rule asks for a written agreement identifying “this seller,” so a dated capture showing your company’s name on the form or the partner list is the safest record to hold.
Does the lead seller’s indemnity protect us from a TCPA claim?
It shifts some of the cost if the seller can pay, but it doesn’t stop the claim. A claim can name the company that called or texted, and that company still bears the burden of proving consent. An indemnity from a thinly capitalized lead seller can be worth less than the defense costs, so I’d check insurance and assets before relying on one.
Do we need written consent for every purchased lead?
It depends on the calling technology and the court. The FCC’s rule requires prior express written consent for telemarketing calls to cell phones made with an autodialer or a prerecorded or artificial voice, and for prerecorded telemarketing calls to home lines, but the Fifth Circuit has held the statute doesn’t require written consent. Do Not Call claims raise their own written-agreement question. In practice, I’d capture written consent anyway, because it meets the strictest version of the rules.
When a purchased lead becomes a lawsuit
If your company is facing a TCPA claim over calls or texts to purchased leads, the consent record and the chain of sellers behind it often decide the case. Rosenberger + Kawabata represents businesses defending TCPA lawsuits and class actions through its business litigation practice, including claims involving purchased leads and comparison-site consent. Contact Rosenberger + Kawabata online for a free and confidential consultation, or call (310) 894-6921.
Sources
The statute is the Telephone Consumer Protection Act at 47 U.S.C. § 227. The regulations are 47 C.F.R. § 64.1200 and the FTC’s recordkeeping rule at 16 C.F.R. § 310.5, both as in effect on September 20, 2026.
The FCC rulings are the 2012 TCPA Order, FCC 12-21, and the GroupMe Declaratory Ruling, FCC 14-33.
The court decisions are Insurance Marketing Coalition Ltd. v. FCC, 127 F.4th 303 (11th Cir. 2025); McLaughlin Chiropractic Associates, Inc. v. McKesson Corp., 606 U.S. 146 (2025); Bradford v. Sovereign Pest Control of TX, Inc., No. 24-20379 (5th Cir. Feb. 25, 2026); Van Patten v. Vertical Fitness Group, LLC, 847 F.3d 1037 (9th Cir. 2017); Berman v. Freedom Financial Network, LLC, 30 F.4th 849 (9th Cir. 2022); Mantha v. QuoteWizard.com, LLC, No. 19-cv-12235 (D. Mass. Feb. 3, 2022); and Schwartz v. The Hall Insurance Group, Inc., No. 1:23-cv-374 (S.D. Ohio Sept. 27, 2024).
This post is general information about the Telephone Consumer Protection Act and related laws as of September 20, 2026. It is not legal advice, and reading it does not create an attorney-client relationship. Courts and the FCC change the rules in this area often, and the outcome of any claim depends on its facts. Past results do not guarantee future outcomes.