TCPA Compliance for Buying Personal Injury Leads: What Every Firm Should Know

What TCPA requires (in plain English)

To call or text a consumer on a mobile phone using automated dialing technology, you need prior express written consent from that consumer for that specific purpose. "Prior" means before the call. "Express" means clearly stated. "Written" means captured in a form (checkbox, submit-button action, or signature).

For personal injury leads specifically, that means the consumer must have affirmatively agreed to be contacted by law firms (or a specific law firm) about their potential legal matter — before you dial their number.

What consent language should look like

Compliant consent language, displayed immediately above the submit button, should include:

• What the consumer is consenting to (calls, texts, pre-recorded messages, emails)
• Who is contacting them (your firm by name, or a network of participating law firms)
• Using what technology (automated dialing, pre-recorded voice, SMS)
• Regarding what topic (their potential legal matter)
• That consent is not a condition of receiving anything
• How they can opt out (STOP to texts, unsubscribe link, dedicated email address)
• That message and data rates may apply
• A link to the privacy policy and terms of service

What records your vendor must keep

For every lead your vendor sells you, they should be capturing and storing:

• The exact consent language shown to the consumer (with a screenshot or DOM snapshot)
• The full URL of the landing page where consent was captured
• The consumer's IP address at submission
• The user-agent string of the browser they used
• The timestamp of the consent (in UTC, ISO 8601)
• The names of any firms the lead was sold to

These records should be retained for at least 5 years and available to you on request.

The 2024 FCC one-to-one consent rule (current status)

In late 2023 the FCC announced a rule change requiring "one-to-one" consent — meaning consumers would need to consent to a single named firm rather than to a network of participating partners. The rule was scheduled to take effect January 27, 2025, but was vacated in early 2025 by the 11th Circuit Court of Appeals in Insurance Marketing Coalition v. FCC.

As of 2026, one-to-one consent is not federally required — but the direction of regulatory travel is clear, and some states have adopted their own stricter consent rules. Best-practice-oriented lead vendors offer one-to-one consent as a configurable option even where it's not required.

Buyer obligations

Even with perfect vendor consent, you as the buyer have your own obligations:

• Contact the consumer only for the purpose the lead was generated (their potential legal matter).
• Honor STOP / opt-out / DNC requests immediately.
• Maintain your own internal DNC list.
• Don't resell or share leads with other firms without their own separate consent.
• Comply with your state's rules of professional conduct and any state-specific DNC laws.

Bottom line

TCPA compliance is a shared responsibility between the lead vendor and the buying firm. Choose vendors who capture and retain full consent records, and build your own opt-out and DNC processes on top. See our full TCPA disclosure for how we capture and store consent.

Frequently Asked Questions