The TCPA Compliance Checklist for Brands That Call or Text Leads.

If your brand calls or texts the leads it generates or buys, you are operating in one of the most litigated corners of U.S. marketing law. The TCPA turns a single mistimed text into a line item with a price tag, and a sloppy lead list into a class action. The good news: compliance is mostly operational discipline, not magic. This is the checklist we run with performance clients before a single number gets dialed.

The stakes, briefly.

The reason this topic gets its own playbook is the damages math. The TCPA allows statutory damages of $500 per violating call or text, rising to $1,500 for willful or knowing violations, with no cap on the total. Multiply that across a campaign that touched tens of thousands of numbers and you understand why plaintiffs' firms treat outbound lists as a business model.

Two facts shape everything below. First, liability sits with the caller — the brand whose offer is being marketed — not just the vendor pressing the button. Second, when a dispute arises, the practical burden of proving you had valid consent falls on you. If you cannot produce the record, you effectively do not have the consent. The rest of this is about earning, keeping, and proving that consent.

1. Consent: get it, and keep the proof.

Marketing calls and texts placed with an autodialer / ATDS or a prerecorded voice generally require prior express written consent. That consent has to be specific, documented, and tied to your company by name.

2. Scrubbing: clean the list before every campaign.

Consent gets you the right to contact someone. Scrubbing makes sure you are not contacting someone you are forbidden to reach. Do it before every send, not once at onboarding.

• Scrub every campaign against the National DNC (Do Not Call) Registry before dialing or texting.
• Maintain and scrub against your own internal do-not-call / opt-out list — numbers that asked you specifically to stop.
• Honor company-specific and reassigned-number risks; numbers change hands, and an old consent does not survive a new owner.
• Keep dated scrub logs showing which lists you checked and when, so you can prove the campaign was cleaned.

3. Opt-outs and revocation: honor them fast.

A consumer can take back consent. When they do, the clock is short and the standard is generous to them.

4. How you dial and text.

The mechanics of contact carry their own rules, independent of consent.

• Understand whether your equipment qualifies as an autodialer / ATDS and whether you are sending prerecorded or artificial-voice messages — both trigger heightened consent and disclosure requirements.
• Respect calling-time-of-day limits; the federal window generally permits telemarketing calls only between 8 a.m. and 9 p.m. in the consumer's local time, and some states are stricter.
• Identify yourself: state your company name and a way to be contacted, and follow identification rules on every call and message.
• Watch quantity and frequency caps; some states limit how many marketing contacts you can make in a given period.
• Speed matters, but never at the cost of consent — pair fast follow-up with clean lists, as we cover in our note on speed-to-lead.

5. State mini-TCPA laws: the patchwork.

Federal law is the floor, not the ceiling. A growing number of states have passed their own state mini-TCPA laws — Florida, Oklahoma, and Washington among the most cited — and they often impose stricter consent rules, tighter calling windows, and separate penalties enforceable on their own.

The operational takeaway: you must know where each consumer is and apply the strictest applicable rule. Build state into your scrubbing and timing logic, and have counsel map the states you actually contact.

6. Records: assume you will have to prove it.

Because the burden of proving consent effectively sits with you, your recordkeeping is your defense. Keep it organized, dated, and retrievable on demand.

• Consent records: the certificate, the exact language shown, timestamp, URL, and IP for every lead.
• Scrub logs: which lists (National DNC, internal DNC, state lists) you checked and when, per campaign.
• Opt-out logs: each request, its channel, and the time you suppressed the number.
• Call and message logs: who was contacted, when, by what method, and under which consent record.
• A retention policy long enough to cover the statute of limitations your counsel identifies.

7. Vendors and contracts.

Most brands do not call alone — they use lead sellers, dialers, or call centers. Each adds risk you must contract around and verify in practice.

• Get written compliance representations and warranties: the vendor affirms the leads or services are TCPA- and state-law compliant.
• Require indemnification so the vendor bears the cost if their failure causes your liability — while remembering this is money, not immunity.
• Demand transferable proof of consent for every purchased lead, and audit a sample before you scale.
• Verify their actual practices: how they capture consent, where the certificates live, how they handle opt-outs, and whether they scrub.
• Reserve the right to terminate and to request records on demand.

8. Stand up a real compliance program.

Individual checks are not enough; they have to live inside a program someone owns. Here is how to stand one up.

The bottom line.

TCPA compliance is not a clever loophole or a one-time setup — it is a discipline: earn clear, company-specific consent, keep the proof on every lead, scrub before every campaign, honor opt-outs the moment they arrive, respect the state patchwork, and document all of it so you can prove it later. Do that, and outbound becomes a durable growth channel instead of a liability waiting to compound. If you want a candid second set of eyes on how your brand generates, buys, and contacts leads — with compliance built into the funnel rather than bolted on after — start a brief with us, and pair it with qualified legal counsel before you rely on any of this.