Lead Buying Compliance Checklist
40 items across 7 sections. Check every box before you buy leads, make your first call, send a text, or launch an email campaign. Your progress saves automatically.
Why Compliance Matters (More Than You Think)
Fines: TCPA violations carry penalties of $500 per violation (standard) and $1,500 per willful violation. Federal DNC registry violations can reach $43,280 per violation. A single day of calling an unscrubbed list of 200 leads could expose you to $100,000 to $300,000 in fines.
Lawsuits: Class action attorneys actively monitor for systematic TCPA violations. One complaint can trigger regulatory scrutiny and legal action that costs far more than any lead campaign could generate.
Reputation: A single compliance violation can damage your professional reputation, jeopardize your license, and destroy trust with prospects and partners.
The good news: Compliance is straightforward once you have a system. This checklist IS that system. Check every box, document everything, and you're protected.
Key Regulations Explained
TCPA (Telephone Consumer Protection Act) — Governs all phone calls and text messages to consumers. Requires prior express consent for manual calls and prior express written consent (PEWC) for auto-dialers, prerecorded voice, AI voice, and marketing texts. Penalties: $500/violation standard, $1,500/willful. For a deep dive, see our TCPA compliance guide for lead buyers.
DNC (Do Not Call) Registry — Federal and state registries that consumers can join to block telemarketing calls. You must scrub your list every 31 days. Exemptions: 3 months after an inquiry, 18 months after a transaction. Penalties up to $43,280 per violation. See our DNC compliance guide for details.
FCC 1:1 Consent Rule — The FCC proposed a rule requiring one-to-one consent for lead selling. This rule was vacated by the 11th Circuit Court of Appeals in January 2025 and never took effect. Lead generators are not currently required to obtain per-seller consent, though best practices still recommend clear consent language.
CAN-SPAM Act — Governs commercial email. Requires accurate sender identification, physical mailing address, functional unsubscribe mechanism, and honest subject lines. Violations can reach $51,744 per email.
State laws — California (CCPA/CPRA), Florida, New York, and several other states have telemarketing and privacy laws that are stricter than federal rules. Always check the requirements for the lead's state, not just your state.
FAQ
Do I really need to DNC scrub aged leads?
Yes. Fines are $500 to $1,500 per violation, per call. Aged leads may have added themselves to the DNC registry since the original inquiry. The small cost of scrubbing (pennies per lead) is negligible compared to the risk. Scrub every list, every time, regardless of what your vendor promises.
How often do I need to scrub against the DNC registry?
Every 31 days. This is a federal requirement, not a suggestion. If your last scrub was more than 31 days ago, you must re-scrub before calling. Keep dated records of every scrub to establish safe harbor protection.
What happened to the FCC 1:1 consent rule?
The FCC 1:1 consent rule was vacated by the 11th Circuit Court of Appeals in January 2025. It never took effect. Lead generators are not currently required to obtain one-to-one consent naming each specific seller. However, best practices still recommend clear, transparent consent language.
What is the DNC exemption window for aged leads?
There are two exemption windows. Inquiry-based: You can contact a consumer for 3 months after they submit an inquiry (even if they are on the DNC list). Transaction-based: You can contact an existing customer for 18 months after their last transaction. After these windows close, DNC rules apply fully.
Do I need written consent to send marketing texts?
Yes. Prior express written consent (PEWC) is required for all marketing texts, auto-dialed calls, prerecorded voice messages, and AI-generated voice calls. Simple verbal or implied consent is not sufficient for these contact methods. Manual dialing to landlines requires only prior express consent (not written).
Compliant and Ready? Get DNC-Scrubbed Aged Leads
- 1Every lead is DNC-scrubbed before delivery — included, not an add-on.
- 2Documented consent and source transparency for every lead.
- 3Return policy for bad data — your compliance safety net.