When a consumer dials your number, the call itself is not telemarketing under the Telephone Consumer Protection Act (TCPA). That is why inbound pay-per-call is often described as “TCPA-safe.” The description is incomplete. Many inbound calls are prompted by outbound activity — a text message, a callback, a ringless voicemail, an outbound dial that becomes a live transfer — and that outbound activity is squarely regulated.
The TCPA allows statutory damages of $500 per violation, up to $1,500 if the violation is willful or knowing, and class actions multiply that quickly. In my experience, buyers rarely get into trouble because of a bad intention. They get into trouble because they could not prove where a call came from. These are the things I believe every buyer should demand.
1. Clarity on how the call was generated
Ask every publisher to state, per source, how calls are generated: search, social, display, TV or radio, IVR, SMS, outbound dialing, or transfers. The answer determines which rules apply. A paid-search call to a number on a landing page carries very different risk from a call returned after a text message.
Require sub-IDs or source IDs on every call so you can isolate and pause a single source without shutting down a publisher.
2. Consent evidence for anything outbound-adjacent
For telemarketing calls or texts that use an autodialer or an artificial or prerecorded voice, the FCC requires prior express written consent: a signed (including E-SIGN-compliant electronic) agreement that clearly authorizes the seller to contact a specific number, with a disclosure that consent is not a condition of purchase. If a call reached you through any such channel, you should be able to see that consent.
In practice, that means:
- A consent certificate per lead from an independent provider (for example ActiveProspect TrustedForm or Verisk Jornaya), ideally with a session replay showing exactly what the consumer saw and clicked.
- The exact disclosure language, and confirmation that your company — or the seller you are buying for — is named in it. A consent form that names hundreds of “marketing partners” is a liability, not an asset.
- A match between the consent and the call: the phone number on the certificate should match the caller ID or the number dialed.
- An agreed freshness window between the consent timestamp and the call.
The FCC’s “one-to-one consent” rule was vacated by the Eleventh Circuit in January 2025, but many sophisticated buyers have kept one-to-one, seller-specific consent as a contractual standard anyway. It is easier to defend and easier to explain.
3. Scrubbing that matches the risk
For outbound-generated traffic, ask what is scrubbed and when: the National Do Not Call Registry, internal and client DNC lists, the FCC’s Reassigned Numbers Database, and known-litigator lists. Ask how revocations are handled. Under FCC rules that took effect in 2025, consumers may revoke consent by any reasonable means, and revocations must be honored within ten business days.
State laws matter as well. Florida, Oklahoma and Maryland, among others, have their own telemarketing statutes, some stricter than the federal rules. Make sure your publishers know which states they are generating calls from and what those states require.
4. Messaging infrastructure that is registered
If texting is part of the funnel, it should run on registered A2P 10DLC campaigns or other carrier-approved routes, with opt-out handling that works. Unregistered or “grey” routes are a warning sign about the rest of the operation.
5. Recordings and the right to audit
Record every inbound call, retain the recordings in line with your industry requirements (Medicare programs have their own retention rules), and keep the ability to request the source evidence behind any call. Spot-check regularly rather than waiting for a complaint. A publisher who cannot produce consent evidence within a day or two for a specific call should not be sending you calls.
6. Contract terms that put responsibility where it belongs
- Written representations that all traffic is generated lawfully and with valid consent where required.
- Indemnification, supported by insurance, for claims arising from the publisher’s traffic.
- A ban on undisclosed sub-publishers, or prior written approval for each one.
- The right to reject, not pay for, or claw back non-compliant calls.
- Audit rights and a defined turnaround for evidence requests.
- Creative and landing-page approval before launch, and notice before any change.
The standard to aim for
The question to ask of any call is simple: if this consumer complained tomorrow, could we show, within an hour, exactly how and why they called us? If the answer is yes for every source, your inbound program is genuinely consented. If not, the gap is where your risk lives.
The best publishers already work this way and are glad to be asked. Demanding evidence does not shrink your supply; it filters it toward partners worth keeping.
This article is general industry commentary, not legal advice. TCPA and state telemarketing rules change frequently; consult qualified counsel about your specific program.