TCPA and Lead Compliance for Personal Injury Firms: Buy Leads and Text Clients Without Getting Sued

Before you call or text someone who filled out a lead form, you need real, documented consent, because the TCPA can turn a single unwanted text into a costly problem. The Telephone Consumer Protection Act, usually called the TCPA, is the federal law that shapes how businesses are allowed to call and text consumers. The spirit of it is simple: people should not get marketing calls or texts they never agreed to. For a personal injury firm buying leads and running follow-up campaigns, that spirit has teeth.

This post is a practical overview written owner to owner. It is general information, not legal advice, and it does not create an attorney client relationship. Rules change, courts interpret them differently, and your state may add its own layer. Before you build or change a contact process, talk to qualified counsel who knows the current law in your jurisdiction.

What the TCPA is really about

At its core, the TCPA is about consent. It places limits on calling and texting consumers, especially when you use automated systems to do it at scale. A few ideas worth knowing in plain terms:

• Autodialers and automated texting. The law has long focused on technology that dials or texts numbers automatically. The exact definition has been fought over in court, but the safe mindset is this: if a system, not a human, is reaching out in bulk, treat it as higher risk.
• Consent matters most. Whether a contact is allowed often comes down to what kind of permission the person gave, and whether you can prove it.
• The Do Not Call rules. Separate from the autodialer questions, there are registries and rules around contacting people who have asked not to be contacted.

You do not need to be a TCPA scholar. You need to understand that reaching out to a consumer without the right consent is where firms get into trouble.

Why bought and shared leads raise the risk

When you generate your own leads through your own site and forms, you control the consent language and you hold the records. When you buy leads, you are trusting that someone else collected proper consent and that the consent covers your firm reaching out.

That trust is where exposure hides. A few common problem patterns:

• Shared leads. If the same lead is sold to several firms, the consumer may have agreed to be contacted by one general category of business, not by your firm specifically, and not five times over.
• Vague or buried disclosures. A consent checkbox hidden in fine print, or language that does not clearly name your firm or partners, may not hold up.
• Aged or recycled data. Old lists and reused phone numbers are a classic source of complaints.

This is one of the honest tradeoffs between [buying leads and generating your own](/blog/buy-leads-vs-generate-your-own-personal-injury). Bought leads can be faster, but you inherit whatever consent practices the source used. If you want to understand pricing and quality differences, our notes on [how much personal injury leads cost](/blog/how-much-do-personal-injury-leads-cost) and on [exclusive versus shared leads](/blog/exclusive-personal-injury-leads) are a good starting point.

What good consent looks like

The phrase you will hear from lawyers is prior express written consent. In plain terms, that means the person clearly agreed, in writing, before you contacted them, and the agreement actually described what they were signing up for. Strong consent usually has a few traits:

• Clear and visible. The disclosure is easy to read, not buried in tiny gray text.
• Specific. It names who may contact the person, including your firm or the kinds of partners involved, and how they may be contacted, such as calls and texts.
• Affirmative. The person took a real action to agree, rather than a box being pre checked for them.
• Tied to a record. You can show what the language said and when they agreed.

If you cannot show what someone agreed to and when, you are relying on hope, and hope is not a compliance strategy.

Documenting consent so you can prove it

Consent you cannot prove is not much better than no consent at all. The goal is a clear paper trail for every contact.

• Capture the exact language the person saw when they agreed, not just a yes or no flag.
• Record the timestamp and source so you know where the lead came from and when consent was given.
• Store it where intake can see it. Your intake team should be able to confirm consent before the first outreach. A trained team makes this routine, which is one reason [hiring and training a strong intake team](/blog/how-to-hire-and-train-a-legal-intake-team) pays off, and why a managed [personal injury intake service](/personal-injury-intake-service) can help build these habits in.

Honoring opt-outs and Do-Not-Call

Getting consent is only half of it. You also have to respect when someone wants out.

• Make opt-out easy and honor it fast. If someone replies stop to a text or asks to be removed, that request needs to flow through every system you use.
• Keep a suppression list so a person who opted out does not get contacted again through a different campaign.
• Respect Do Not Call rules. Treat a request to stop as final across calls, texts, and emails, not just the one channel.

This matters for your follow-up too. Email and text nurture sequences are powerful, and we generally think firms [should use email and text follow-up](/blog/should-my-law-firm-use-email-and-text-follow-up), but every automated sequence has to inherit the same consent and opt-out discipline as your first call.

Vendor due diligence

If you buy leads, your vendor’s practices become your risk. Vetting them is part of protecting your firm.

• Ask how consent is collected. Get to see the actual forms and disclosure language, not a summary.
• Ask whether leads are shared or exclusive, and how many times a shared lead may be sold.
• Ask what records they keep and whether they will provide consent proof if a complaint ever arises.
• Read the contract on indemnification so you understand who is responsible if something goes wrong.
• Watch for pressure and vagueness. Many of the [red flags of a marketing agency](/blog/red-flags-personal-injury-marketing-agency) show up here too: dodgy answers, no documentation, and promises that sound too clean.

A vendor that cannot or will not show you its consent process is telling you something. Believe them.

How this ties to your everyday marketing

Compliance is not a separate department from growth. It is the foundation that lets your growth efforts stand. Your bar’s advertising rules, covered in our overview of [bar advertising rules for personal injury lawyers](/blog/bar-advertising-rules-for-personal-injury-lawyers), sit alongside the TCPA as part of the same risk picture. The firms that treat consent and recordkeeping as normal operating procedure are the ones that can scale outreach without lying awake about it.

Think of it as risk management. Good consent practices protect your firm, your reputation, and the trust of the injured people you are trying to help.

A final reminder

This article is general information for personal injury firm owners. It is not legal advice, it is not exhaustive, and laws differ by state and change over time. Use it to ask better questions, then confirm your specific plan with qualified counsel before you act.

At Retainer Reach, we work only with personal injury firms, so consent and compliance are baked into how we think about leads and follow-up. If you want a marketing partner that takes this seriously, take a look at our approach to [personal injury law firm marketing](/personal-injury-law-firm-marketing).