TCPA in 2025: What Lead Buyers Must Know Before Calling a Single Lead

The Good News First: The One-to-One Rule Is Gone

If you've been worried about whether leads you buy are still legal to contact, here's the short version of what happened in 2025.

The FCC had proposed a rule requiring "one-to-one consent"—meaning each seller would need its own individual, named consent from every consumer before calling or texting them. For lead buyers, this would have meant that any lead generated through a comparison shopping site or multi-seller form would have been legally questionable to contact unless your company was specifically named on the consent form.

That rule was struck down. On January 24, 2025, the U.S. Court of Appeals for the Eleventh Circuit vacated the FCC's one-to-one consent requirement in Insurance Marketing Coalition v. FCC, ruling the FCC exceeded its statutory authority. The FCC declined to appeal. By August 2025, the prior TCPA consent standard was formally reinstated.

What this means for you: Leads generated through reputable marketplaces like LeadWaffle—with blanket prior express written consent covering a network of service providers—are still legally compliant to call and text. The consent model that generates the vast majority of purchased leads in the US is intact.

What this doesn't mean: That you can call anyone without consent. The underlying TCPA is very much alive, and the rules that were always there are still there.

---

What the TCPA Actually Requires From Lead Buyers

Whether you're a roofing contractor, mortgage lender, insurance agent, or home services company buying leads through a marketplace, here's what the TCPA requires when you contact those leads.

The Foundation: Prior Express Written Consent

Before using an autodialer (ATDS) or prerecorded/artificial voice message to call or text a consumer for marketing purposes, you must have prior express written consent from that consumer.

"Written" includes electronic consent—a form submission, click-to-agree, or digital signature counts.

The consent must:

• Be given before the call or text (not assumed or implied after the fact)
• Be in writing (a click, checkbox, or electronic form)
• Specifically disclose that the consumer will receive automated calls/texts
• Not be required as a condition of purchasing something
• Cover your company (or a category that includes your company)

When you buy a lead: Your lead seller is responsible for capturing that consent. Your responsibility is to verify they actually did it—and that the consent language covers your company or your industry category.

What to Ask Your Lead Seller

Before using purchased leads with automated outreach, ask:

1. "Can I see a sample of your consent language?" — Read it. Does it mention automated calls/texts? Does it describe your category (e.g., "roofing contractors," "mortgage lenders")?

2. "How do you store consent records?" — You want timestamp, IP address, and the exact consent language shown to the consumer at the time of submission.

3. "Do you scrub against the DNC registry before selling?" — If not, you need to scrub before calling.

4. "What's your policy on re-engagement or aged leads?" — Older leads may have weaker consent documentation. The older the lead, the more important it is to verify.

Reputable platforms like LeadWaffle require sellers to capture proper consent and store records. But you're still the one placing the calls—which means you bear the legal exposure.

---

The New Rule You Must Know: Consent Revocation (Effective April 11, 2025)

The one-to-one consent rule died, but a different FCC rule arrived. The Consent Revocation Rule took effect April 11, 2025, and it has significant operational implications for anyone calling or texting purchased leads.

What It Requires

Consumers can now revoke consent through any reasonable method.

Previously, many companies would specify an exclusive opt-out mechanism: "Text STOP to opt out." If a consumer called in and verbally said "stop calling me" instead of texting STOP, some companies argued that wasn't a valid revocation under their prescribed method.

That argument is now explicitly invalid. Under the April 2025 rule, valid revocation methods include:

• Texting STOP, QUIT, END, CANCEL, UNSUBSCRIBE, or similar
• Verbally requesting removal during a phone call
• Submitting an opt-out request through a website form
• Emailing a removal request
• Any other reasonable communication that clearly communicates a desire to stop receiving calls/texts

You must honor revocations within 10 business days.

Ten business days is the maximum. Best practice is to honor immediately. The moment someone says "take me off your list," the clock starts.

You may send one post-revocation clarification text.

You're permitted to send a single text message (within 5 minutes of receiving the revocation) to confirm the opt-out and clarify scope. This text cannot contain any marketing content.

What This Means in Practice

For your sales team: Every person who calls leads must understand that a verbal "take me off your list" during a call is a valid, legally binding opt-out. That request must be logged immediately and the number added to your suppression list.

For your CRM: Your internal Do Not Contact list needs to accept inputs from multiple sources: text replies, call logs, web forms, and email. If your suppression list only captures formal STOP text replies, you're non-compliant.

For purchased leads specifically: If a consumer opts out with you, they've opted out from your outreach—not from all future lead generation. But you cannot contact them again via autodialed or prerecorded means, regardless of what new consent a lead seller might claim to have captured later.

---

The Calls You Can Make Without Consent (Know the Difference)

TCPA requirements apply specifically to autodialed calls and prerecorded/artificial voice messages for marketing purposes. Human-dialed calls have different rules.

Autodialer (ATDS) calls to cell phones = requires prior express written consent for marketing

Prerecorded message calls = requires prior express written consent for marketing

Live, human-dialed calls to cell phones = do not require prior express written consent under TCPA (but must still honor DNC registry and opt-out requests)

What this means for quick follow-up: When a fresh lead comes in, you can have a human call immediately without worrying about TCPA consent. Your legal exposure is significantly lower on manual calls. If you're using a power dialer that automatically dials from a list without significant human judgment, that likely qualifies as an ATDS and requires consent.

---

The Do Not Call Registry: Still Applies to You

Regardless of whether you have consent issues, every number you purchase must be checked against the National Do Not Call Registry unless you have prior express written consent from that consumer specifically to your company.

The fine: $50,120 per call.

How to scrub:

• Use DNC.com ($65/year + $0.06/scrub)
• Scrub at least every 31 days if you're holding leads that long
• If your lead seller says they scrub before selling, still verify with a spot check

Numbers can be added to the DNC registry between the time a lead was generated and the time you call them. Don't assume a lead's DNC status is static.

---

The Risk of Buying From Non-Compliant Sellers

Here's the critical point most lead buyers miss: when you place the call, you own the legal exposure—regardless of what the lead seller told you about consent.

Courts have consistently held that "the lead seller captured consent" is not a complete defense. If you placed the call, you need to be able to prove:

1. Consent was captured
2. The consent language covered your company or category
3. The consent was obtained before you called
4. The consumer did not subsequently opt out

If your lead seller's consent practices are weak—vague language, no timestamps, no IP records—you're exposed.

Before buying leads at scale, do three things:

1. Review a sample of the consent language used by the seller
2. Request their consent documentation format (what fields they capture)
3. Include a reps-and-warranties clause in your purchase agreement requiring the seller to certify that leads were generated with TCPA-compliant consent

LeadWaffle's marketplace standard: Verified sellers on LeadWaffle are required to maintain consent documentation. You can see seller badges, ratings, and reviews—and request consent language examples before purchasing.

---

Quick Compliance Checklist for Lead Buyers

Before you run your first dialing campaign on purchased leads:

• ✅ Reviewed consent language from lead seller
• ✅ Confirmed consent covers automated calls/texts and your industry
• ✅ Scrubbed numbers against National DNC Registry
• ✅ Added leads to CRM and checked against your internal suppression list
• ✅ Confirmed your team knows how to log verbal opt-outs (required since April 11, 2025)
• ✅ Updated suppression list process to accept opt-outs from any channel
• ✅ Added reps-and-warranties clause to lead purchase agreement
• ✅ Ensured suppression list processing happens within 10 business days of any opt-out request

---

The Bottom Line

The death of the one-to-one consent rule was good news. The blanket multi-seller consent model is intact, and leads generated on compliant platforms are still legal to contact.

But the TCPA hasn't gone away, and the April 2025 opt-out rule raised the bar on how you handle revocations. The lead buyers who get sued are the ones who:

• Assume "the seller captured consent" without verifying
• Ignore verbal opt-out requests during calls
• Only honor STOP texts and not other revocation methods
• Skip DNC scrubbing before dialing

Buy from verified sellers. Verify consent. Honor opt-outs immediately. That's the compliance formula.

Note: This post is for informational purposes only and does not constitute legal advice. TCPA compliance is fact-specific. Consult a qualified attorney for advice tailored to your situation.