Your Lead Consent Records Are a $1.5M Liability — If You Can't Store Them Properly

In a TCPA lawsuit, the burden of proof is on the caller, not the consumer. If you cannot produce evidence that a lead gave express consent to be called — and that the consent was current when you dialed — the court presumes the call was illegal. Under the TCPA, statutory damages run from $500 to $1,500 per call. A single campaign of 1,000 non-compliant calls can produce liability between $500,000 and $1.5 million, and class actions multiply that exposure across every recipient.

The legal standard is straightforward. The storage standard is where most agencies fail.

What You Actually Have to Keep

The TCPA's statute of limitations is four years, but the prevailing guidance — echoed by the American Bar Association and every major insurance compliance firm — is that consent records, call logs, and DNC-scrub documentation must be retained for a minimum of five years to cover state-law claims that layer on top of the federal statute. The records you must be able to retrieve on demand include:

• The consumer's express written consent, with a timestamp and the exact language they agreed to
• The source of the lead (which vendor, which campaign, which landing page)
• The date, time, and result of every call made under that consent
• Evidence of DNC scrubbing before each dial

If your insurance CRM does not capture and preserve all four of those data points in a way you can export on 48 hours' notice, you do not have consent records — you have a liability you can't defend.

When the Lead Vendor's Problem Becomes Your Lawsuit

A lead provider hands you a file and certifies it as TCPA-compliant. The paperwork looks clean. Then the lawsuit arrives, and it names you, not the vendor. This is not a hypothetical: in Moore v. Torchlight Technology Group, the lead generator Call Centrix failed to maintain and produce the consent records for the calls it made on Torchlight's behalf. The court held that Call Centrix's failure to ensure vendor compliance "resulted in this very lawsuit," and ordered it to indemnify the buyer — but only after Torchlight had already been dragged into the litigation and spent years defending it.

The practical lesson: the consumer sues the entity that called them. That's your agency. Whether you can shift the cost back to a vendor depends on a contract clause you may never actually enforce. Our security posture treats consent-record integrity as a platform-level control because that's the only layer the agency actually controls.

Stale Consent Is the Same as No Consent

The most common TCPA violation in insurance is not cold-calling without any consent — it's calling leads whose consent has aged out. A consent captured 12 months ago is not a license to call forever. If you store leads in a flat spreadsheet with no timestamp, no consent-source field, and no expiry flag, you are one dialer session away from a class action.

The Takeaway

Lead data is not an asset you own — it is a liability you are responsible for storing. The agency that survives a TCPA action is the one that can prove, from its own platform, that every dial was consented, current, and scrubbed. Treat your lead management system as a compliance record first and a sales tool second, and make sure your onboarding and data migration process preserves consent provenance when you move platforms.

— G. David Humphries, Kaffeine Security