TCPA Compliance for Lead Buyers in 2026: The Documentation Checklist

If you buy inbound leads for insurance, financial services, legal, or high-ticket home services, TCPA compliance in 2026 looks different from 2024, but not in the way most people expected. The FCC's 1:1 consent rule was vacated by the Eleventh Circuit in January 2025 in Insurance Marketing Coalition v. FCC, and the FCC subsequently confirmed the rule change was struck down. There is no federal 1:1 consent rule in effect today. That said, the enforcement climate has continued trending against sloppy consent capture: plaintiff firms have gotten sophisticated, settlements are up, and several states have enacted their own 1:1-style rules that pick up where the FCC's vacated rule left off. This is the practical compliance checklist for what every lead buyer should have documented, in writing, on file, before they take delivery of a single new lead in 2026.

Not legal advice, talk to your attorney, but this covers the operational specifics that separate compliant lead buying from settlement risk.

Prior Express Written Consent (PEWC), the foundation

Every outbound call or SMS to a lead requires prior express written consent if the outreach uses an autodialer or prerecorded voice, or if the number is on the Do Not Call registry. "Written" in the TCPA sense means an electronic record, check-the-box, signature, e-signature, is fine, as long as the consent is unambiguous and specific.

The four things PEWC must contain, per FCC guidance:

1. The specific entity that will contact the prospect. Not "and our trusted partners." Not "our advertising partners may contact you." The named company that will call.
2. What number(s) the consent covers. Landline, mobile, or both.
3. The types of contact covered. Calls, SMS, both.
4. A clear disclosure that consent is not required as a condition of purchase. This is often overlooked and is a common plaintiff-firm exhibit.

If your lead vendor's consent capture is missing any of these four elements, the leads are effectively worthless from a compliance standpoint. Ask for a sample audit trail before signing any new vendor. Expect a real vendor to provide it within one business day.

The 1:1 consent rule, vacated by the Eleventh Circuit

Some background is worth getting straight, because the state of federal 1:1 consent is widely misreported. In December 2023, the FCC adopted an amendment to the TCPA implementing rules that would have required consent to be specific to one clearly-identified seller and "logically and topically associated" with the reason the consumer completed the form. The rule was originally scheduled to take effect January 27, 2025.

On January 24, 2025, three days before the effective date, the Eleventh Circuit issued its opinion in Insurance Marketing Coalition Ltd. v. FCC, No. 24-10277. The court vacated the rule, holding that the FCC exceeded its statutory authority under the TCPA. In the court's reading, the underlying statute permits consent to be given for multiple sellers in a single disclosure, and the FCC cannot layer on a one-seller-per-consent requirement by regulation. The vacatur was national in effect and immediate. The FCC subsequently acknowledged the rule change was struck down and has not attempted to resurrect it in the same form.

Practical implications:

• There is no federal 1:1 consent rule in effect today. Multi-seller consent that meets baseline PEWC requirements is still permissible under federal TCPA rules.
• State-level 1:1 rules exist and are enforceable. The Florida Telephone Solicitation Act (FTSA) and similar state statutes in Oklahoma, Washington, and Maryland impose stricter consent-specificity requirements that resemble the vacated federal rule. If you deliver calls or texts into any of these states, the state rule governs regardless of federal status.
• Plaintiff-firm targeting has continued. Even without the FCC rule, courts have been receptive to arguments that generic "trusted partners" consent language fails the specificity prong of federal PEWC. The direction of case law has not reversed.
• Compliance-forward lead buyers have kept moving toward per-seller consent anyway. Not because the federal rule requires it, but because it reduces plaintiff-firm exposure and cleans up per-lead audit trails.

What to actually do given this state of the world: do not assume the vacatur eliminates your compliance obligations. It removed one specific federal requirement that never took effect. Everything else about PEWC, DNC scrubbing, state-level rules, and plaintiff-firm exposure is unchanged.

The documentation checklist, what you need on file

For every lead you take delivery of, your vendor should be able to produce, on request, an audit trail containing:

• ✓ Timestamp of the consent event (ISO-8601, with timezone)
• ✓ IP address of the device that submitted the consent
• ✓ URL of the exact page where consent was captured (not just the domain)
• ✓ Exact consent language the prospect saw at the time (screenshot ideal, HTML snapshot acceptable)
• ✓ Named seller(s) the consent covers, as they appeared to the prospect
• ✓ User-agent string (helps rebut claims that the consent was submitted by a bot or third party)
• ✓ Session data, the fields the prospect filled in, in what order
• ✓ Opt-out record, timestamp and mechanism of any subsequent opt-out

If your vendor cannot produce all eight items on a random sample within one business day, treat that as a hard exclusion criterion. The reputable vendors have this instrumented and can produce it via API. The ones who can't are the ones plaintiff firms are targeting.

DNC scrubbing, federal and state

Federal DNC registry scrubbing is the floor, not the ceiling. State DNC lists cover different phone numbers, refresh on different schedules, and carry independent penalty structures. Buyers in TX, FL, WA, IN, MO, WY, LA, MS, TN, and OK specifically should be running state DNC scrubs on top of federal, those states have historically active plaintiff bars.

Operational implementation:

• Scrub every lead against federal DNC within 30 days of dial (registry data has 31-day freshness requirements)
• Scrub against applicable state DNC lists on the same cadence
• Scrub against your own internal DNC list (past opt-outs)
• Establish a suppression list update SLA with your vendor, opt-outs should propagate within 24 hours, ideally faster
• Log every scrub decision with timestamp, "we called this number because it was clean on the federal list on YYYY-MM-DD" is a defensible position

Vendor vetting, the questions to ask before signing

Before onboarding a new lead vendor, get written answers to these questions. If any answer is evasive or missing, walk.

1. How is consent captured? Ask for a live URL of a working consent form.
2. What is the named seller(s) on the consent language? Your entity name should appear.
3. How many other firms are covered by the same consent? For exclusive leads, the answer should be zero. For shared, get the exact number.
4. What audit-trail elements are captured per lead? Cross-check against the 8-item checklist above.
5. What is the opt-out propagation SLA? Under 24 hours is standard; over 48 is a risk signal.
6. Do you carry E&O insurance covering TCPA claims arising from your consent capture? If yes, get the certificate. If no, the vendor is transferring their compliance risk onto your balance sheet.
7. Will you contractually indemnify me for TCPA claims arising from your leads? This is where reputable vendors distinguish themselves. Refusal to indemnify is a red flag.
8. How do you handle scrub-list updates from client opt-outs? The answer should be automated and near-real-time.

Vertical-specific notes

Insurance leads. The most-litigated TCPA vertical. Plaintiff firms specifically target insurance producers because policy commissions are large enough to justify settlements. If you buy insurance leads, or specifically life insurance leads, treat every one of the checklist items above as non-negotiable. Note: the Insurance Marketing Coalition that won the 1:1 vacatur represents insurance-industry lead buyers, and the industry's reaction has been mixed, some see the vacatur as regulatory relief; others are moving toward per-seller consent voluntarily to reduce plaintiff-firm exposure.

Financial services. Not just wealth management, mortgage, refinance, tax resolution, debt consolidation, and business lending all sit in the TCPA hot zone. Financial services leads have the added complication of Reg S-P privacy overlay for SEC-registered firms.

Legal. Plaintiff firms often are the TCPA plaintiffs in enforcement cases, so the legal-leads segment has some of the most rigorous consent capture in the market. Personal injury and mass tort volume specifically operates under close scrutiny. See our legal leads guide for the plaintiff-firm sourcing framework.

Home services. Roofing, HVAC, and plumbing sit outside most TCPA litigation but are increasingly targeted as consumer-protection cases. The HVAC and roofing lead markets have been operationally sloppy on consent capture historically, the compliance-forward operators are pulling ahead.

What changed from 2024 to 2026

1. The FCC 1:1 rule was vacated. January 2025, Eleventh Circuit, Insurance Marketing Coalition v. FCC. There is no federal per-seller consent requirement today.
2. State-level rules stepped in. Florida, Oklahoma, Washington, and Maryland enacted or strengthened state-level 1:1-style rules that apply regardless of federal status.
3. Settlement values climbed. Median TCPA settlement per lead has roughly doubled since 2023 as plaintiff firms have gotten better at proving individual damages.
4. Multi-defendant strategies emerged. Plaintiff firms now regularly sue the lead marketplace, the vendor of record, and the ultimate buyer as separate defendants. Being three-steps removed from the consent capture no longer insulates you.
5. Aggregator liability tightened. Buyers who rely on "our vendor handles compliance" have watched courts hold them jointly liable when the underlying consent was defective.
6. E&O coverage became a differentiator. Vendors carrying meaningful E&O and offering indemnity have become sought-after; those who don't are pricing accordingly (i.e. their leads are cheaper but riskier).

Quick reference, do and don't

Do:

• Insist on the 8-item audit trail per lead, per vendor, before signing
• Verify your entity name appears in the consent language
• Run federal + applicable state DNC scrubs before every batch
• Log every consent, every scrub, every opt-out with timestamps
• Require E&O + indemnity from any vendor handling more than $5k/month of your spend
• Comply with state-level 1:1 rules (FL FTSA, OK, WA, MD) even though the federal rule was vacated
• Read the 7-point vendor evaluation checklist before onboarding

Don't:

• Assume your vendor's compliance transfers to you, courts have said it doesn't
• Rely on generic "trusted partners" consent language
• Skip the DNC scrub because "the vendor said the number is opted in"
• Buy leads from any vendor that won't produce a sample audit trail
• Read the 1:1 rule vacatur as "consent capture is loose again", plaintiff firms and state regulators have kept the pressure on

Bottom line

TCPA compliance in 2026 is an operational discipline, not a policy document. The FCC's 1:1 rule was vacated, so federal PEWC is what governs; state-level rules and plaintiff-firm exposure fill in the gaps. The buyers who get it right have automated audit trails, sub-24-hour opt-out propagation, contractual indemnity from every meaningful vendor, and a checklist their compliance team runs monthly. The buyers who get it wrong are learning that the true cost of a shared-lead marketplace runs higher than the sticker price.

If you are re-evaluating your lead mix in light of the current enforcement climate, start by reading how exclusive vs shared leads compare on real cost-per-signed-job, then work through the vendor evaluation checklist. The compliance overhead of an exclusive vendor almost always beats the settlement exposure of a shared-list operator working at scale.

Correction, 2026-07-22: This piece originally described the FCC's 1:1 consent rule as "delayed by litigation, now targeting later in 2026." That framing was materially incorrect. The rule was vacated by the Eleventh Circuit in Insurance Marketing Coalition v. FCC in January 2025, and the FCC has not attempted to resurrect it. The article has been rewritten to reflect the accurate legal status. State-level 1:1-style rules (FL, OK, WA, MD) remain in effect and enforceable.