The Personal Injury Lead Buyer's Compliance Guide for Law Firms

TCPA vicarious liability makes the vendor's mistakes your problem

The Telephone Consumer Protection Act (47 U.S.C. § 227) is the single largest legal risk for any law firm buying personal injury leads. The statute gives consumers a private right of action worth $500 per violation, tripled to $1,500 per violation for willful conduct. Violations stack per call and per text, with no damages cap. A campaign that generates 5,000 non-compliant text follow-ups can carry theoretical exposure north of $7.5 million.

Here is what most personal injury firms miss: TCPA liability does not attach only to whoever physically dialed the phone. Under federal common-law agency principles — codified in the FCC's 2013 DISH Network declaratory ruling — TCPA liability also attaches to the "seller on whose behalf" the calls are made. That is you, the law firm, when your lead vendor calls or texts a consumer to warm the lead for transfer, or when the consumer is contacted downstream in ways the vendor set in motion. The framework recognizes three routes to liability: actual authority, apparent authority, and ratification (knowingly accepting the benefits of illegal calls).

Recent enforcement is unforgiving:

• Allstate (March 2024): summary judgment loss with willfulness findings based on the acts of independent lead-gen partners — described by defense-side commentators as putting "the entire insurance industry on notice."
• September 2025: a major bank faced up to $3.3 billion in claimed TCPA exposure after using a lead generator that called third-party-data leads on its behalf.
• February 2025: a lead buyer beat the autodialer claim but stayed in the case on DNC and state-registration theories arising from a lead generator's transfer flow.

The 2025 vacatur of the FCC's one-to-one consent rule in Insurance Marketing Coalition Ltd. v. FCC, No. 24-10277 (11th Cir. Jan. 24, 2025), did not eliminate this exposure. It only removed the FCC's specific one-to-one requirement. Courts still police consent quality on common-law grounds — and after McLaughlin Chiropractic Associates v. McKesson, 606 U.S. 146 (June 20, 2025), district courts are no longer bound by FCC interpretations under the Hobbs Act and interpret the TCPA independently. Predictability just went down across the country.

Practical implication for your firm: your professional liability policy may exclude TCPA class actions entirely. Ask your carrier in writing before you buy leads. If TCPA is excluded, the vendor's indemnity clause is what actually stands between your firm and a seven-figure defense bill.

What every consent artifact must include — and what your vendor must hand over per lead

If you cannot prove consent, you do not have consent. Every TCPA case is won or lost on artifacts.

The industry-standard consent certification is TrustedForm (from ActiveProspect); Jornaya (Verisk LeadiD) is an acceptable equivalent. Both third-party services capture:

• Certificate ID and independently-verifiable URL
• Timestamp in UTC and consumer-local time
• Landing page URL
• Exact consent language as it appeared on the page at submission
• Session replay of the consumer's interaction with the form
• Consumer IP address and user-agent string
• Device and behavioral metadata

Certificates should be retained for a minimum of five years to comfortably cover the TCPA's four-year catch-all limitations period, the federal DNC five-year honoring window, and the class-period lookback most plaintiffs' firms plead.

The consent language itself must meet the standard in 47 C.F.R. § 64.1200(f)(9) — the FCC's implementing rule for prior express written consent (PEWC):

An agreement, in writing, bearing the signature of the person called that clearly authorizes the seller to deliver or cause to be delivered advertising or telemarketing calls or texts using an autodialer or prerecorded voice, to a specified telephone number, with clear and conspicuous disclosure that (a) consent authorizes such calls, and (b) consent is not a condition of purchasing any property, goods, or services.

Two operational rules that matter for your buying decisions:

1. Your firm should be named in the consumer's consent. Hyperlink-only "marketing partners" lists — where the consumer clicks through to see who might call them — remain a favorite target for plaintiffs' firms. Courts can find such "consent" is not express consent to the specific caller. Even though the FCC's one-to-one rule was vacated, one-to-one-quality consent is the market standard, and buyers who accept blanket partner-list consents inherit the litigation risk.
2. An electronic signature satisfies the written-signature requirement under E-SIGN, provided the checkbox/submit interaction and the disclosure meet the § 64.1200(f)(9) clarity standard.

Ask your vendor for a screenshot of the actual live consent language on the form the consumer saw. If the vendor cannot produce that on demand, you cannot prove consent in discovery — and consent quality is the whole ballgame in TCPA defense.

Attorney advertising rules — you're the licensed lawyer, so you own this risk

Every state's Rules of Professional Conduct apply to you, the licensed attorney, not to the marketing vendor. Your Bar association will not accept "the vendor didn't tell me" as a defense to a rule violation. Before you sign with any lead vendor, you need to know which of your state's advertising rules apply, and whether the vendor's funnel design puts you in violation.

The states that require registration, filing, or Bar approval

• Florida. Rule 4-7.22 requires lead vendors ("qualifying providers") to register annually with The Florida Bar. Buyer law firms must report new qualifying-provider relationships within 15 days. Failing to verify your vendor's Bar registration puts your license at risk before a single lead is delivered.
• Louisiana. LSBA requires attorney ad filing, currently $175 per ad, with the filing number printed in the advertisement. This applies to landing pages the vendor operates on your behalf.
• Mississippi. Rule 7.5 requires every attorney ad to be filed with the Mississippi Bar before first run. $25 base fee, $150 late fee.
• Connecticut. Practice Book § 2-28A requires attorney ad filings.
• California. Business & Professions Code § 6155 treats attorney-matching services as regulated "referral services" requiring State Bar certification. A lead vendor that presents itself as connecting consumers with attorneys can trigger § 6155 obligations that flow through to the buyer firm.

States that ban or restrict lead purchases outright

• Indiana. Rule of Professional Conduct 7.3(d) flatly prohibits for-profit lawyer referral services. Per-lead payments that a court or Bar disciplinary board could recharacterize as prohibited referral fees are an ethics risk. Structure any Indiana pay-per-lead contract as flat-fee advertising with contemporaneous documentation, or don't buy Indiana leads.
• Hawaii. Retained a pre-2018 Rule 7.2 stating only not-for-profit referral services may be paid. Combined with HRPC 7.3(e), which imposes a 30-day post-accident PI solicitation moratorium.
• Kansas. KRPC 7.2 predates the ABA's modern lead-gen comment — per-lead payments must be carefully papered as flat-fee advertising, not paid recommendations.
• Arkansas. Ark. Code § 16-22-101 criminalizes unapproved lawyer referral services. Any "we'll match you with an attorney" language on a landing page can put the arrangement inside the statutory definition.

Post-accident solicitation blackouts

• Michigan. MCL 750.410b criminalizes direct solicitation of MVA victims within 30 days of an accident. $30,000 fine.
• Indiana. 30-day post-accident MVA solicitation blackout, plus a $50 pre-filing requirement on solicitation letters.
• Hawaii. HRPC 7.3(e) 30-day moratorium.
• Florida. 30-day post-accident direct-solicitation restrictions apply.

If your vendor is generating leads for you in a state where per-lead payment is prohibited or where the funnel violates a solicitation moratorium, you are the one violating your state Bar's rules — not the vendor. The Bar disciplines lawyers, not marketing companies.

Call recording laws — one-party vs all-party consent

State recording laws determine what disclosure is required when your intake team records calls with consumers you contacted from purchased leads. Because you are calling consumers your vendor sourced, the recording exposure attaches to your operation as well as the vendor's.

All-party consent states — every party on the call must be aware and consent to recording:

• California, Connecticut, Florida, Illinois, Maryland, Massachusetts, Montana, Nevada, New Hampshire, Pennsylvania, Washington
• Delaware — one-party by wiretap act but 11 Del. C. § 1335(a)(4) makes it a crime to record without all-party consent; treat as all-party

Nevada is criminal. Recording a call without all-party consent is a category D felony under NRS 200.620 as clarified in Lane v. Allstate. This is not an administrative fine — this is prosecution risk.

Massachusetts imposes criminal penalties plus civil liability under G.L. c. 272 §99, and Chapter 93A adds treble-damages exposure for consumer-protection violations that ride along.

Florida criminalizes non-consensual recording under §934.03. Combined with the Florida Telephone Solicitation Act (FTSA) class-action regime, Florida is uniquely dangerous.

Operational rule for your intake team: run the entire operation as if you're always in an all-party consent state. Play a recorded disclosure at the top of every outbound call ("This call may be recorded for quality and training purposes. If you don't wish to be recorded, please let me know."). Log the disclosure timestamp in the CRM. Do the same for inbound calls to the number you gave your vendor. It costs nothing operationally and eliminates the recording-consent claim from every future case.

Sensitive data privacy laws — injury data is now regulated everywhere

A recent wave of state privacy laws specifically regulates the collection, use, and sale of injury and health-adjacent data. Personal injury lead data — accident details, injury severity, treatment status — sits squarely inside "sensitive" or "consumer health" categories in most of the new statutes.

The statutes that matter most for buying PI leads:

• Maryland Online Data Privacy Act (MODPA): Bans the sale of sensitive personal data — including health data and injury details — with no consent exception. Threshold: only 10,000 Maryland consumers. Effective October 2025. If your vendor is sourcing Maryland leads and selling them to you, MODPA compliance is a threshold question.
• Minnesota Consumer Data Privacy Act (MCDPA): Live July 31, 2025. Bans selling sensitive data without opt-in consent even below the standard consumer thresholds. Every Minnesota lead form needs an explicit sale-consent checkbox.
• Nevada SB 370: Requires separate written authorization before selling injury-related consumer health data. General consent to be contacted is not enough.
• Nebraska NDPA: No volume thresholds at all. Bans selling sensitive (injury/health) data without consent even for the smallest lead vendors.
• Colorado Privacy Act (CPA): Opt-in required before processing injury/health intake data. 25,000-consumer + revenue-from-sale threshold catches most active lead sellers.
• California Consumer Privacy Act (CCPA/CPRA) & Delete Act: Data-broker registration required. Delete Act's DROP (Data Removal from Public Registry) processing started August 1, 2026 — vendors must honor bulk deletion requests through a state registry.

If your vendor is sourcing leads from these states without opt-in consent for the sale of injury data — not just consent to be contacted — you're purchasing illegally-sourced information. When the consumer complains to their state AG, the vendor's liability attaches to you as the downstream recipient. Ask your vendor: which state privacy laws apply to your operation, and how do you document opt-in sale consent per state?

The 6 red flags in any personal injury lead vendor contract

Before you sign with any lead vendor, run the contract through these six tests. Any one of them being missing is a walk-away issue.

1. No indemnity for the vendor's TCPA, DNC, and state-law violations

If your vendor's dialer violates TCPA and you're named as a co-defendant under vicarious liability, contractual indemnity is what actually pays your defense. Insist on: (a) indemnification for TCPA/DNC/state-mini-TCPA claims arising from the vendor's acts, (b) defense obligation (not just indemnity), (c) no cap or a cap that bears some relationship to reality — $1M minimum for a serious vendor. Watch for indemnity that only covers the vendor's "gross negligence" — that's useless in TCPA cases where strict liability applies.

2. No audit rights

You should be entitled to pull 25 random leads per quarter and demand full consent-artifact production within 5 business days — including cert IDs, screenshot of consent as displayed, IP/UA/timestamps, and call recordings if the vendor made any pre-transfer calls. Vendors who won't agree to audit rights don't have artifacts to show you.

3. No per-lead consent artifact delivery

If TrustedForm or Jornaya certificate IDs aren't being delivered with every lead record (not "on request"), you can't defend a TCPA case. Every lead ingest should include the cert ID, form version, consent language snapshot, and source campaign attribution stored on the lead record in your CRM. If your vendor sends leads over email or CSV without cert IDs, you're accepting undefendable data.

4. Multi-buyer "marketing partners" consent forms with dozens of named companies

Even though the FCC's one-to-one rule was vacated in 2025, courts still test whether consent was truly express as to your specific firm. Long partner lists (especially hyperlink-only ones the consumer had to click through to see) are the fact pattern plaintiffs pursue. Your firm should be named directly in the consent flow, either alone or in a short on-page list of participating firms in the same geographic and vertical area.

5. No service-level agreement on opt-out honoring

Federal rule (47 C.F.R. § 64.1200(a)(10)-(12), effective April 2025) requires revocation to be honored within 10 business days by "any reasonable method" — including any of STOP/QUIT/END/REVOKE/OPT OUT/CANCEL/UNSUBSCRIBE and free-text variants. Best practice is same-day, automated, across all channels (SMS, calls, email, and the vendor's downstream buyer-transfer eligibility flag). Contract should require the tighter timeline. Vendors without an automated opt-out pipeline are a compliance disaster waiting to happen.

6. No state attorney advertising rule attestation

For every state your vendor generates leads in, they should attest in writing that they're compliant with that state's Bar rules governing lead generation for attorneys. Specifically: Florida qualifying-provider registration, Louisiana LSBA ad filings, Mississippi pre-filing, Indiana referral-service structure, Michigan/Hawaii solicitation blackouts. If your vendor cannot attest to compliance in every state where they're running leads for you, you are the one who violates your Bar rules when you accept those leads.

State risk hotspots — a PI firm's quick reference

Not every state carries equal risk. Here are the jurisdictions where buying PI leads requires the closest attention:

• Florida: Bar-registered qualifying provider required. Annual Bar reports. Buyer firm must report vendor relationships within 15 days. FTSA class actions active. All-party recording is a felony.
• Illinois: Rule 7.2 rewrite (effective July 1, 2025) makes lead vendors "intermediary connecting services" requiring annual written compliance certifications to buyer firms. Plus BIPA biometric exposure and Illinois mini-TCPA at $500/violation.
• California: B&P § 6155 referral-service certification exposure. CCPA/CPRA data-broker registration. Delete Act DROP processing live since August 2026.
• Nevada: All-party recording is a category D felony. SB 370 requires separate written authorization before selling injury-related consumer health data.
• Maryland: Still applies contributory negligence (only 4 U.S. jurisdictions do). MODPA bans sale of injury/health data with no consent exception. All-party felony recording law. Private-right-of-action mini-TCPA.
• Louisiana: LSBA attorney ad filing mandatory ($175/ad, filing number printed in ad). LDPA data-sale rules effective 2027. 1-year civil-law prescriptive period is the shortest deadline in the U.S.
• Indiana: For-profit referral services flatly banned (Rule 7.3(d)). 30-day post-accident MVA solicitation blackout. State DNC has no inquiry-based exemption.
• Michigan & Hawaii: 30-day post-accident MVA solicitation blackouts with criminal penalties.
• Massachusetts: All-party felony wiretap. Chapter 93A treble damages for consumer-protection violations. Comprehensive privacy law expected imminently.
• Alabama, Maryland, North Carolina, Virginia: Still apply contributory negligence — a plaintiff even 1% at fault recovers nothing. Case selection matters more here than anywhere.
• Kentucky & Tennessee: 1-year statute of limitations on PI (MVA in KY, all PI in TN) — lead-to-signed-case velocity is critical.

What to demand from your lead vendor before you sign

Before you write a check to any personal injury lead vendor, your intake ops person and outside counsel should confirm every item below is either delivered per lead or contractually guaranteed:

• TrustedForm (ActiveProspect) or Jornaya (Verisk LeadiD) consent certificate ID delivered with every lead record
• Your firm named directly in the consumer's consent — not hidden behind a hyperlink to a "marketing partners" list
• Consent language meeting the 47 C.F.R. § 64.1200(f)(9) prior-express-written-consent standard, screenshot-verifiable on demand
• All-party recording disclosure spoken on every call the vendor makes prior to transfer
• Opt-out honored within 10 business days across ALL channels (SMS, calls, email, buyer-transfer flag) — automated and same-day is market standard
• Contractual indemnification for the vendor's TCPA, DNC, and state-mini-TCPA violations, with defense obligation
• Quarterly audit rights — 25 random leads pulled, full artifacts produced within 5 business days
• Annual written compliance certification for every state where leads are generated
• State attorney advertising rule attestation for Florida, Louisiana, Mississippi, and any state where you practice
• Retention of consent records for a minimum of 5 years, produced on discovery request
• National DNC scrub on ingestion + weekly; litigator/serial-plaintiff scrub via a litigation-firewall service
• Timezone-aware send window enforcement (federal 8 a.m.–9 p.m. recipient-local; tighter for Florida/Oklahoma at 8 p.m., Pennsylvania at 9 a.m.–7 p.m. weekdays and no Sundays or holidays)

Any vendor who cannot commit to all of the above is a vendor whose leads will show up in your discovery in a class-action complaint at some point. The savings on a cheaper, lower-compliance vendor never covers a single TCPA defense bill.

The bottom line

Buying personal injury leads is a legitimate, high-ROI marketing channel — and it can be operated safely. But the compliance framework is real, and unlike an in-house Google Ads program (where your marketing agency's errors mostly hurt only your marketing agency), lead-vendor errors flow directly to your law firm through TCPA vicarious liability, state Bar rules, and state privacy statutes.

Your defense against all of this is vendor selection and artifact discipline. Choose a vendor who ships consent certificates with every lead, indemnifies you contractually, respects state Bar and privacy rules by design, and treats compliance as a first-class product feature rather than a legal cost center. Firms that get this right buy leads at scale for years without incident. Firms that don't become the named defendants in the next TCPA class action.

Frequently Asked Questions