You can buy a lead perfectly legally and still land in trouble the moment you pick up the phone. The ethics rules govern whether you may purchase leads. A separate federal law, the Telephone Consumer Protection Act, governs how you may contact them. TCPA class actions are a real and expensive risk for law firms, and the exposure is entirely avoidable with the right consent practices.
TL;DR: Consent Is the Whole Game
To call or text a purchased lead with an automated system, you generally need prior express written consent. The most defensible consent comes from the consumer submitting an intake form to a single, named firm. The FCC's short-lived one-to-one consent rule was struck down in 2025, but single-firm consent is still the safest path. Documented lead provenance is your evidence. Scrub against Do Not Call and honor stop requests.
We are not attorneys and this is not legal advice. Always do your own research and confirm legal requirements in your area before buying leads.
Key Facts at a Glance
- Governing law
- TCPA
- Required to call/text
- Prior express written consent
- Most defensible
- Documented single-firm consent
- Also scrub
- Do Not Call registry
- What protects you
- Documented lead provenance
Key Facts
Why the TCPA Matters for Lead Buyers
The TCPA restricts calls and texts made with automatic telephone dialing systems and prerecorded or artificial voice messages. It carries statutory damages per violation, and because those add up quickly across a calling list, it is a favorite of class-action plaintiffs. For a law firm, a TCPA problem is both a financial and a reputational one.
The important mental model is separation. Buying a lead is an advertising-and-ethics question, covered by the Model Rules. Contacting that lead is a TCPA question. You have to clear both, and they are not the same analysis.
The Consent Standard
Prior express written consent is the gold standard, and for automated calls or texts to a cell phone it is generally what you need. Valid consent means the consumer agreed, in a signed writing that can be electronic, to receive calls or texts at the number they provided, with the agreement clearly disclosing what they are consenting to and not being a condition of purchase.
The key point for lead buyers is that consent is not something you can manufacture after the fact. It has to have been obtained at the point the consumer submitted their information. That is why the quality and structure of the intake form that produced your lead is a compliance asset, not just a conversion detail.
Single-Firm Consent and the One-to-One Rule
The FCC tried to hard-wire this into a rule. In late 2023 it adopted a one-to-one consent requirement that would have barred a single form from authorizing contact by a long, sometimes hidden, list of marketing partners. In January 2025, before it took effect, the Eleventh Circuit vacated that rule in Insurance Marketing Coalition v. FCC, holding the agency had exceeded its authority, and the FCC then repealed it. So bundled consent is again technically permissible under federal law.
That is a legal technicality, not a reason to relax. Courts still ask whether consent was clear and unmistakable, and a plaintiff's lawyer will still probe whether a consumer really agreed to hear from your firm specifically. Single-firm consent remains the most defensible position, whether or not a rule compels it.
More Defensible: Single-Firm Consent
- ✓Consumer submits a form to a single, named firm
- ✓The consent language identifies who will contact them
- ✓Clear record of what was agreed and when
- ✓Easy to defend if a dispute arises
Harder to Defend: Shared or Bundled Consent
- ✗One form consents to many unnamed companies
- ✗Consumer does not know who will call
- ✗Consent is diluted across a marketing list
- ✗Permissible today, but a bigger litigation target
For a firm buying leads, this points toward exclusive, single-firm lead sources. A lead generated by a consumer filling out one firm's intake form carries far cleaner, more provable consent than a contact sold simultaneously to a panel of buyers.
Lead Provenance Is Your Protection
If a TCPA claim ever arrives, the question will be simple: can you show the consumer agreed to be contacted? The answer lives in the lead's provenance, the documented trail of where it came from and how consent was captured.
A well-documented lead carries the landing page or ad the consumer came from, the exact consent language they saw, a timestamp, and submission metadata. That record turns a potential dispute into a short conversation. This is a practical reason to favor transparent sources like Google Search leads, where the whole path from query to form submission is visible and recorded, over opaque contacts with no verifiable origin.
Ask for the Consent Record
A compliant provider can tell you exactly what consent language each consumer agreed to and when. If a provider cannot produce that, you are the one holding the TCPA risk.
Do Not Call and Calling Times
Consent handles the automated-contact question, but two housekeeping obligations remain. First, maintain Do Not Call discipline. A consumer who submitted an intake form has generally invited contact about that matter, but you must still honor any internal Do Not Call or stop request the moment it is made. Second, respect calling-time windows and applicable state restrictions.
Confirm consent before the first automated contact
Verify the lead carries valid, documented prior express written consent tied to your firm.
Honor stop requests immediately
The moment a consumer asks not to be contacted, add them to your internal Do Not Call list and stop.
Respect calling windows
Keep contact within permitted hours and observe any stricter state-specific rules that apply.
Retain the consent record
Store the provenance data so you can demonstrate compliance if a question ever comes up.
A Contacting Checklist
- Does each lead carry documented, one-to-one consent?
- Can the provider show you the exact consent language and timestamp?
- Is the lead exclusive to your firm, not sold to a panel?
- Do you honor stop requests and internal Do Not Call instantly?
- Are you contacting within permitted hours?
Frequently Asked Questions
Do I need consent to call a personal injury lead I bought?
To place an autodialed call or send a text using an automatic system, or to use a prerecorded message, you generally need prior express written consent from the consumer. If you dial manually and the number is not on the Do Not Call registry, the analysis is different, but relying on consent is the safest and most scalable approach. The consent should come from the consumer's own submission, not be assumed.
What is one-to-one consent under the TCPA?
One-to-one consent is the idea that a consumer's agreement to be contacted should apply to a single, identified business rather than an open-ended list of marketers. The FCC adopted it as a rule in 2023, but the Eleventh Circuit vacated it in January 2025 before it took effect, and the FCC repealed it, so it is not currently a federal requirement. It remains a strong best practice: consent captured on a single firm's intake form is far easier to defend than bundled consent shared across many buyers.
How does lead provenance protect me under the TCPA?
Provenance is the documented record of where a lead came from and how consent was captured: the landing page, the consent language the consumer saw, the timestamp, and the IP or submission metadata. If a TCPA dispute arises, that record is your evidence that the consumer agreed to be contacted. Leads without a clear consent trail leave you exposed regardless of how good they look.
Do I still need to check the Do Not Call registry?
Yes. Even with consent, maintaining Do Not Call compliance is good practice, and internal Do Not Call requests must always be honored. Consumers who submitted an intake form asking to be contacted have generally invited the call, but you should still respect calling-time restrictions and honor any request to stop.
We are not attorneys and this is not legal advice. Always do your own research and confirm legal requirements in your area before buying leads.
More in Compliance & Ethics
Buying personal injury leads is permitted under the ABA Model Rules when structured correctly. The complete compliance overview: advertising rules, fee-splitting, TCPA consent, and where the ethical lines are.
Attorney Advertising Rules and Lead Generation: What Model Rules 7.1-7.3 RequireModel Rule 7.2 permits paying lead generators, as long as they do not recommend you. Here is how the advertising rules (7.1-7.3) and ABA Formal Opinion 501 apply when a law firm buys personal injury leads, and what to check in your state.
Fee Splitting and Lead Generation: Why Flat Per-Lead Pricing Is CompliantModel Rule 5.4 prohibits sharing legal fees with nonlawyers. A flat per-lead price is a fixed marketing cost and stays clear of that line. A percentage of the recovery does not. The difference explained.
Lead Generation vs Lawyer Referral Services: The Ethical DistinctionA lead generator delivers advertising contacts you choose to pursue. A referral service recommends a specific lawyer, which triggers different rules. Why the distinction decides whether a service is compliant.