Aged leads are cheap for a reason. Every day that passes between the moment a consumer fills out a form and the moment you call them, your legal risk increases. The consent may have been valid when it was captured. It may not have been. Either way, by the time the lead reaches you, the evidence trail has gone cold and the burden of proof is entirely on your shoulders.
If you are buying aged or third-party leads, here is what you need to know about TCPA consent verification before you dial.
The Risk Profile of Aged and Third-Party Leads
When you purchase leads from a third-party provider, you are inheriting someone else’s compliance practices. You did not design the form. You did not write the disclosure. You did not control whether the consent checkbox was pre-checked. You have no firsthand knowledge of what the consumer saw or did.
This matters because under the TCPA, the caller bears the burden of proving that valid prior express written consent existed at the time of the call. The FCC has been clear: you cannot outsource your compliance obligations by pointing to a lead vendor.
Aged leads compound this risk in several ways:
- Consent decay. Even if consent was valid at capture, the consumer may have forgotten they opted in, changed their mind, or revoked consent through a channel you are not aware of.
- Form changes. The lead seller may have modified their consent form since the lead was captured. The form you see during due diligence may not be the form the consumer saw.
- Multiple resales. Aged leads are often sold multiple times. Each resale further distances the caller from the original consent event, making it harder to reconstruct what happened.
- Regulatory changes. The FCC’s January 2025 one-to-one consent rule changed what constitutes valid consent. Leads captured before the rule’s effective date under the old multi-seller consent model may not meet current standards for calls made after the rule took effect.
”The Lead Provider Said They Had Consent” Is Not a Defense
This is the single most common and most dangerous assumption in the lead buying industry. Lead sellers routinely represent that their leads are “TCPA compliant” or that “consent was obtained.” These representations are commercially useful but legally insufficient.
In TCPA litigation, the defense of “I relied on my vendor’s assurance” has been tested repeatedly and it does not hold up on its own. Courts examine whether the caller took reasonable steps to verify that consent existed, not simply whether someone told them it did.
The FCC’s framework places the obligation on the party making the call. A contractual indemnification clause with your lead vendor may give you a financial backstop, but it does not prevent the lawsuit, the legal fees, the operational disruption, or the reputational damage.
What to Demand from Lead Sellers
If you are buying leads from third parties, your purchase agreement should require the seller to provide verifiable consent artifacts, not just a warranty that consent exists. Here is the minimum you should demand:
Consent certificates
A structured record generated at the moment of consent that includes the consumer’s phone number, the timestamp, the IP address, the full disclosure text, and the identity of the specific seller the consumer consented to hear from. The certificate should be cryptographically hashed so that any modification after the fact is detectable.
Session recordings
A visual recording of the consumer’s consent session showing the form as rendered, the disclosure as displayed, and the consumer’s interaction with the consent mechanism. This is the evidence that shows what the consumer actually saw and did, not just what the form was designed to look like.
Disclosure snapshots
A capture of the exact page content at the time of consent, preserving fonts, layout, colors, and positioning. A screenshot is better than nothing, but a DOM snapshot with associated CSS is more defensible.
Metadata
IP geolocation data, browser user agent strings, device type, and any other signals that corroborate the identity of the person who gave consent and the circumstances under which they gave it.
If your lead vendor cannot provide these artifacts for every lead, that tells you something important about the quality of their consent process.
Reasonable Reliance Is Shifting
The concept of “reasonable reliance” on third-party consent has been part of TCPA jurisprudence for years, but the standard for what qualifies as “reasonable” is tightening.
Historically, some courts accepted that a caller could reasonably rely on a lead vendor’s representation that consent was obtained, particularly if the caller had a contractual assurance and no reason to suspect otherwise. But recent enforcement actions and rulings are moving the bar higher.
The FCC’s one-to-one consent rule explicitly contemplates that callers will need to verify that consent was granted to them specifically, not just to a generic list of marketing partners. This makes blind reliance on vendor assurances even more risky.
Regulators and courts are increasingly asking: what did you do to verify consent before you called? The answer “nothing, I trusted my vendor” is becoming less acceptable. The answer “I independently verified the consent certificate and reviewed the session recording” is substantially stronger.
How Consent Verification APIs Change the Equation
The technology now exists for lead buyers to independently validate consent before making a single call. Instead of trusting a vendor’s word, you can programmatically verify that a consent record exists, that it names your company as the consented seller, and that the underlying evidence is intact.
Here is how this works in practice:
-
Lead arrives with a consent certificate ID. When you purchase a lead, the seller includes a unique certificate identifier alongside the consumer’s contact information.
-
You query the verification API. Before the lead enters your dialer, your system calls the consent verification API with the certificate ID. The API returns the certificate details: timestamp, disclosure text, consented seller, hash verification status, and a link to the session recording.
-
Automated validation. Your system checks that the certificate is valid, the hash has not been tampered with, your company is named as the consented seller, and the consent was captured within your acceptable time window.
-
Dial or reject. Leads with verified consent enter your calling queue. Leads without verified consent are flagged for review or rejected.
This process takes milliseconds and eliminates the gap between “we were told there was consent” and “we verified there was consent.” It also creates an audit trail showing that you took affirmative steps to validate consent before calling, which is exactly the kind of evidence that supports a reasonable reliance defense.
eConsent’s API lets lead buyers verify consent certificates in real time. Each certificate includes a direct link to the session recording, the full disclosure text, and a SHA-256 hash for tamper detection. Buyers can validate consent independently without needing access to the seller’s account or platform.
A Practical Framework for Aged Lead Compliance
If you are buying aged leads today, here is a practical framework to reduce your exposure:
-
Require consent certificates as a condition of purchase. No certificate, no buy. This is the simplest filter and it eliminates the lowest-quality inventory immediately.
-
Verify certificates programmatically before dialing. Do not rely on manual review. Integrate consent verification into your lead ingestion pipeline so every lead is checked automatically.
-
Set a maximum consent age. Even valid consent gets stale. Establish a policy for the maximum age of consent you will accept, and enforce it programmatically. Thirty to sixty days is a reasonable range for most verticals.
-
Audit your lead sources regularly. Periodically pull consent certificates and session recordings for a sample of leads from each source. Review them for disclosure quality, checkbox behavior, and compliance with the one-to-one consent rule.
-
Document everything. Your compliance process itself is evidence. Document your verification procedures, your vendor requirements, and your audit results. If you are ever challenged, this documentation demonstrates that you took reasonable steps.
The Bottom Line
Aged leads can be a profitable part of your lead strategy, but only if you treat consent verification as a prerequisite, not an afterthought. The cost of verifying consent before you call is trivial compared to the cost of defending a TCPA class action after you call without it.
Stop trusting. Start verifying.
eConsent lets lead buyers verify consent certificates and session recordings via API before a single call is made. Start for free or schedule a demo to see verification in action.