When a Vendor Holds the TCPA Consent Record: Foundation and Hearsay

A consent record kept by a lead generator or texting vendor is only useful in a TCPA case if the defendant can get it into evidence. That usually means laying a business-records foundation under Federal Rule of Evidence 803(6), through a witness or a written certification, and authenticating the data under Rule 901. The Ninth Circuit allows a business to offer records it received from others when it kept them in its regular course, relied on them, and had a substantial interest in their accuracy. Contract for that cooperation before a lawsuit.

Why does it matter who holds the consent record?

Because the defendant has the burden, and a record no one can vouch for is just a printout.

In discussing written consent for telemarketing robocalls, the FCC said in its 2012 order that when consent is questioned, “the seller will bear the burden of demonstrating that a clear and conspicuous disclosure was provided and that unambiguous consent was obtained.” Courts weigh FCC statements for themselves after McLaughlin Chiropractic Associates, Inc. v. McKesson Corp., 606 U.S. 146 (2025), but defendants should plan as if they’ll carry this burden.

Proving consent means proving facts the defendant didn’t witness: that a particular person visited a particular page, saw particular disclosures, and checked a box on a particular date. When the page was run by a lead vendor, the evidence of all of that lives in the vendor’s systems. Our post on proving TCPA consent at summary judgment covers what the record should contain. This post is about getting it admitted.

What does the business-records exception require?

Regular practice, a qualified witness or certification, and no sign of untrustworthiness.

Under Federal Rule of Evidence 803(6), a record isn’t excluded as hearsay if it was made at or near the time of the event by, or from information transmitted by, someone with knowledge, it “was kept in the course of a regularly conducted activity,” and “making the record was a regular practice of that activity.” Those conditions must be “shown by the testimony of the custodian or another qualified witness, or by a certification that complies with Rule 902(11) or (12).” And under the same rule, the record comes in only if “the opponent does not show that the source of information or the method or circumstances of preparation indicate a lack of trustworthiness.”

Expect plaintiffs to attack consent records on that last clause. A web-form record with a missing time stamp, an IP address that geolocates across the country, or a consent screenshot generated months later invites a trustworthiness challenge. So does a record whose fields were edited after the fact without an audit trail. Ask vendors early whether their systems log changes, and get that log with the data. A record that can show its own history is much harder to attack than one that can’t, and the request costs the vendor little if it’s made before litigation begins.

Can the defendant’s own witness lay the foundation for vendor records?

Sometimes, in the Ninth Circuit.

In MRT Construction Inc. v. Hardrives, Inc., 158 F.3d 478 (9th Cir. 1998), the court explained: “This circuit has held that records a business receives from others are admissible under Federal Rule of Evidence 803(6) when those records are kept in the regular course of that business, relied upon by that business, and where that business has a substantial interest in the accuracy of the records.” The court affirmed the admission of law-firm bills that the receiving company had kept and relied on.

For consent data, that line of authority helps a defendant that actually received the vendor’s consent records in the ordinary course, stored them, and used them to decide whom to call or text. It helps less when the defendant never saw the records until a lawsuit and asked the vendor to pull them. In my view, the cleanest path is still a witness or certification from the vendor itself, with the defendant’s own records as a backstop.

How do certifications help?

They can replace live testimony, with notice.

Rule 902(11) makes self-authenticating “The original or a copy of a domestic record that meets the requirements of Rule 803(6) (A)-(C)” when shown by a certification of the custodian or another qualified person. The proponent must give the other side reasonable written notice of its intent to offer the record and make the record and certification available for inspection, under Rule 902, “so that the party has a fair opportunity to challenge them.” Rule 902(13) adds a path for “A record generated by an electronic process or system that produces an accurate result,” shown by a similar certification.

Authentication is a separate step. Under Rule 901(a), “the proponent must produce evidence sufficient to support a finding that the item is what the proponent claims it is.” One listed method is “Evidence describing a process or system and showing that it produces an accurate result.” A vendor declaration that explains how its form captured the submission, the time stamp, and the disclosure version does both jobs at once.

What happens at summary judgment if the foundation is missing?

The consent defense can disappear before trial.

Under Federal Rule of Civil Procedure 56(c)(2), “A party may object that the material cited to support or dispute a fact cannot be presented in a form that would be admissible in evidence.” A plaintiff will raise that objection against an unauthenticated spreadsheet from a vendor that no longer exists or won’t cooperate. The defendant then has to show it can produce the record in admissible form at trial.

That’s why the vendor contract matters more than most companies think. Our post on TCPA vendor contracts covers indemnity and consent warranties. I’d add three evidence terms to every lead and texting contract: a duty to preserve consent data for a defined period, a duty to provide a custodian declaration or certification on request, and a duty to make a knowledgeable witness available for deposition and trial.

Vendor-record problems and the answers to them

Underlying TCPA exposure is set by 47 U.S.C. § 227: $500 or actual loss, whichever is greater, under subsection (b)(3), up to $500 under (c)(5) for more than one call in 12 months, and up to $1,500 if the court finds a violation willful or knowing.

What to secure from vendors when a claim arrives

The firm’s California TCPA defense page covers how a consent dispute can decide class certification. When a claim arrives:

1. Send written preservation demands to every vendor that touched the campaign, and put your own call and text logs and consent records under a litigation hold.
2. Export opt-out and internal do-not-call records with dates.
3. Pull National Do Not Call Registry scrub records and Registry versions used.
4. Collect the vendor contracts, the form versions and disclosure language in effect on each consent date, and the name of a knowledgeable custodian at each vendor.
5. Talk to a lawyer before responding to the claim, contacting the consumer, or asking a vendor to create any new document about the consent.

Questions about vendor-held consent records

Can we just attach the vendor’s spreadsheet to our summary judgment motion?

Not safely. Under Rule 56(c)(2), the plaintiff can object that it can’t be presented in admissible form. Attach it with a custodian declaration or a Rule 902(11) certification that tracks Rule 803(6)(A)-(C), and an explanation of how the system captured the data.

What if the lead vendor has gone out of business?

Then the defendant’s own records matter. Under MRT Construction, records a business received, kept in its regular course, and relied on, where it had a substantial interest in their accuracy, can come in through its own witness. That only works if the defendant actually received and used the consent data before the dispute.

Should our vendor recreate a screenshot of the consent page?

Not without care. A screenshot made after a claim arrives isn’t a contemporaneous record, and plaintiffs will say so. If the original page is gone, a declaration explaining what the archived version shows, and how it was preserved, is more credible than a new capture.

Defending a consent case built on vendor data

If your company’s consent defense depends on records a vendor holds, the foundation for that evidence needs as much attention as the consent itself. Rosenberger + Kawabata represents businesses defending TCPA lawsuits and class actions through its business litigation practice, including disputes over lead-vendor consent records. Contact Rosenberger + Kawabata online for a free and confidential consultation, or call (310) 894-6921.

Sources

The rules are Federal Rules of Evidence 803, 901, and 902, and Federal Rule of Civil Procedure 56. The statute is 47 U.S.C. § 227. The FCC order is the 2012 Report and Order, FCC 12-21.

The court decisions are MRT Construction Inc. v. Hardrives, Inc., 158 F.3d 478 (9th Cir. 1998), and McLaughlin Chiropractic Associates, Inc. v. McKesson Corp., 606 U.S. 146 (2025).

This post is general information about the Telephone Consumer Protection Act and related laws as of August 28, 2026. It is not legal advice, and reading it does not create an attorney-client relationship. Courts and the FCC change the rules in this area often, and the outcome of any claim depends on its facts. Past results do not guarantee future outcomes.