How To Build a TCPA-Compliant Lead Qualification Workflow

Written by: Matt Beucler, CEO, Plura AI

Updated September 2026

Key Takeaways

• TCPA-compliant lead qualification uses two separate gates: consent verification and sales qualification. Both must pass before any dial.
• Gate 1 verifies prior express written consent, attaches a certificate, and scrubs against National DNC, state DNC, internal suppression, and the Reassigned Numbers Database.
• Gate 2 applies sales criteria only after consent is confirmed. This sequencing ensures a sales-qualified lead is also legally callable.
• Retain consent records, scrub logs, and call records for at least four years to align with the federal statute of limitations and audit expectations.
• Plura AI enforces both gates inside one platform as its own FCC-licensed carrier, automating consent verification, DNC scrubbing, and opt-out processing before dial. See the two-gate workflow in action.

The 7-Step TCPA-Compliant Lead Qualification Workflow

Step 1: Capture PEWC

Place consent language directly adjacent to the phone field on every lead form. That placement matters because the language must name the specific calling entity, identify the channel (autodialed calls, prerecorded messages, or texts), and include a “not a condition of purchase” statement. The consumer then has to take an affirmative action, which means a checked checkbox rather than a pre-checked one. A pre-checked box has never satisfied the “clearly and unmistakably stated” consent standard under FCC or court readings of the TCPA.

Use this consent language template as a starting point and adapt it to your entity name and channels:

“By checking this box and clicking Submit, I agree that [Company Name] may contact me at the phone number I provided above using autodialed calls, prerecorded messages, or text messages for marketing purposes. Consent is not a condition of purchase. Reply STOP to opt out of text messages. Standard rates may apply.”

Step 2: Attach a Verification Certificate

Attach a session certificate from a service such as TrustedForm or Jornaya to the lead record at the moment of form submission. A defensible TCPA consent record ties together five elements: the TrustedForm certificate or Jornaya LeadiD, the exact disclosure language the consumer saw verbatim, the timestamp and IP address of the submission, the specific web form or URL where consent was captured, and the checkbox state showing the affirmative act. Write this record to append-only or write-once storage. A record that could have been edited is a record a plaintiff may argue was edited.

Step 3: Run Pre-Dial Scrubbing

Scrub every number against four sources in sequence before any dial attempt:

1. National DNC Registry (scrub at least every 31 days per FTC Telemarketing Sales Rule requirements)
2. State DNC registries applicable to the contact’s location
3. Internal suppression list that holds all prior opt-outs and do-not-call requests
4. FCC Reassigned Numbers Database (RND) at reassigned.us

The RND query requires submitting the phone number and the later of the consent date or the last verified date the consumer was on that number. A “No” response creates a safe harbor from TCPA liability if the number was reassigned and the database erroneously returned that result. That safe harbor only applies if the caller retains the query record itself, because the caller bears the burden of proof. No query means no safe harbor under 47 CFR § 64.1200(m). Consult qualified counsel regarding your specific scrubbing obligations.

Step 4: Apply Outreach Guardrails

Federal rules under 47 U.S.C. § 227 and 47 CFR § 64.1200(c)(1) restrict telemarketing calls to 8 a.m.–9 p.m. in the called party’s local time zone, not the caller’s. State Mini-TCPA laws impose tighter windows in some jurisdictions. Florida’s FTSA and Oklahoma’s OTSA both restrict calls and texts to 8 a.m.–8 p.m. recipient local time, one hour earlier than the federal cutoff. Oregon HB 3865, effective January 1, 2026, restricts telemarketing contact hours to 8 a.m.–8 p.m. and limits daily calls to three per consumer, expressly extending these restrictions to text messages.² Immediate caller identification is required on every call. Opt-out requests must be honored within 10 business days under 47 CFR § 64.1200(a)(10), with real-time processing as the operational standard. Consult qualified counsel for the specific rules applicable to your campaigns and contact locations.

See how Plura automates calling-window enforcement and opt-out processing at the platform level.

Step 5: Run Sales Qualification as a Separate Gate

Gate 2 opens only after Gate 1 passes. Sales qualification, such as budget, authority, need, timeline, or operator-defined criteria, functions as a distinct process from consent verification. Plura’s AI Lead Intelligence layer enriches every lead with 30+ data sources in real time during the conversation across voice, SMS, RCS, and webchat. Agents then receive only contacts who have cleared both gates. This distinction means a sales-qualified lead becomes legally callable only when the consent gate and the sales gate both succeed.

Step 6: Write the Disposition Taxonomy

Standardize disposition codes across every agent and campaign so reporting stays consistent. A consistent taxonomy makes audit-readiness operational rather than aspirational. Recommended codes:

• Qualified, Consent Verified: Both gates passed; dial permitted.
• Consent Unverifiable, Suppress: Certificate missing, stale, or unreadable; suppress immediately.
• DNC, Suppress: Number matched on National, state, or internal DNC list.
• Reassigned Number, Suppress: RND returned “Yes” (disconnected since consent date).
• Opted Out, Suppress: Consumer revoked consent through any reasonable method.

Step 7: Retain the Record

TCPA claims are subject to the general federal four-year statute of limitations under 28 U.S.C. § 1658, meaning a plaintiff can sue over a call or text made up to four years before filing. Retain consent records, call logs, opt-out records, DNC scrub certifications, and RND query records for a minimum of four years after the last contact made under that consent. Many operators use five years as a practical floor, consistent with the FTC’s 2024 amendments to the Telemarketing Sales Rule. Plura’s Stateful Conversation Database logs every interaction with an immutable, timestamped record keyed to the customer token across voice, SMS, RCS, and AI webchat.

¹

Retention only works if the right data is captured in the first place. The field schema below defines what every contact record needs to carry so the four-year retention requirement is actually satisfiable.

The TCPA-Compliant Lead Qualification CRM Field Schema

Every contact record should carry these fields. The table below maps each field to its data type and the operational reason it exists, so you can see at a glance which fields support a defensible consent record and which support audit reporting. Plura’s Unified Inbox and Stateful Conversation Database key every interaction to the same customer token, so consent and qualification status persist across voice, SMS, RCS, and webchat without manual re-entry.

Field Name	Data Type	Definition	Notes
consent_status	Enum	Current consent state: Verified, Unverifiable, Revoked	Updated on every opt-out event
consent_timestamp	DateTime (UTC)	Server-side timestamp of the affirmative consent action	Must be server-side, not client-side
consent_source	URL + Certificate ID	Source URL and TrustedForm/Jornaya certificate ID	Retain certificate for 4+ years
consent_language	Text (versioned)	Exact disclosure text shown at opt-in, version-controlled	Store verbatim; do not summarize
seller_named_in_consent	Boolean + String	Whether the calling entity is named; entity name if true	Generic “partners” language is weak evidence
DNC_status	Enum	Result of most recent DNC scrub: Clean, Matched-National, Matched-State, Matched-Internal	Log scrub date and registry version
opt_out_status	Boolean + DateTime	Whether consumer has revoked consent; timestamp of revocation	Honor within 10 business days; real-time preferred
disposition	Enum	Outcome code from Step 6 taxonomy	Required for audit-ready reporting
campaign_id	String	Campaign identifier linking contact to specific consent flow	Enables campaign-level audit exports

These fields create a single source of truth for consent, suppression, and outcomes, which simplifies audits and internal reviews.

The 2026 Legal Reality for TCPA-Compliant Lead Qualification

Key Federal and State Changes

The FCC’s one-to-one consent rule, adopted in December 2023, was vacated by the Eleventh Circuit Court of Appeals on January 24, 2025, in Insurance Marketing Coalition Ltd. v. FCC, No. 24-10277 (11th Cir. 2025), three days before its scheduled effective date.² The FCC did not appeal. By August 2025, the FCC formally reinstated the prior consent definition via a Federal Register notice published August 29, 2025 (90 FR 42137).

The vacatur removed the one-seller-per-consent restriction. It did not remove the baseline PEWC requirement under 47 CFR § 64.1200(f)(9), DNC registry obligations, consent revocation requirements, or state Mini-TCPA laws. Scrutiny around lead-generation practices remains elevated, and the ruling should not be interpreted as a signal to relax compliance standards.

What Changed in 2026

• The FCC’s “revoke-all” cross-category consent revocation requirement remains waived until January 31, 2027, per FCC Order DA 26-12, CG Docket No. 02-278.
• Oregon HB 3865, effective January 1, 2026, restricts telemarketing contact hours to 8 a.m.–8 p.m. and limits daily calls to three per consumer, expressly extending these restrictions to text messages.
• Texas SB 140, effective September 1, 2025, broadened “telephone solicitation” to include texts and images and introduced a private right of action with statutory damages up to $5,000 per violation..
• TCPA year-to-date filings reached 1,532 cases through June 2026; in February 2026, 72.3% of that month’s 292 filings were class actions.³

This article describes the regulatory framework neutrally. Consult qualified counsel for guidance on your specific obligations under federal and state law.

Common Challenges and Troubleshooting

Consent unverifiable at dial time. The certificate was not attached at form submission, or the vendor’s retention window expired. Fix: write certificates to your own append-only storage at the moment of submission, not on a delayed batch job.

Stale partner lists predating the appellate vacatur. Lists sourced before January 2025 may carry consent language that named the FCC’s one-to-one framework as the basis for multi-seller consent. Broad “partner” consent clauses remain higher risk because courts continue to scrutinize whether disclosure was genuinely clear and conspicuous. Audit the actual disclosure language, not just the source of the number.

Reassigned numbers. Around 35 million U.S. mobile numbers are disconnected and made available for reassignment each year. Query the RND before re-engaging any contact not reached in 45 days or more. Log every query result.

Fragmented systems. Consent may live in the form platform, DNC scrub results may live in a separate tool, and the dialer may read neither. Fix: route every contact through a single pre-dial gate that checks all four suppression sources before the number reaches the dialer queue. Plura’s CRM integration layer connects consent records and suppression status to the dialing workflow so both travel with the contact.

Inconsistent disposition logic. Agents use different codes for the same outcome, which makes audit exports unreliable. Fix: enforce the Step 6 taxonomy at the system level, not as a training guideline.

Walk through how Plura enforces the two-gate model operationally inside one platform.

Measuring Success

Use these operational metrics to track a TCPA-compliant lead qualification workflow:

• Consent-verification rate: Percentage of contacts with a retrievable, timestamped certificate at dial time.
• DNC-suppression rate: Percentage of contacts removed before dial due to DNC matches.
• Reassigned-number hit rate: Percentage of contacts flagged by RND query before dial.
• Opt-out processing time: Time from revocation request to suppression across all active campaigns.
• Contact rate: Connected calls as a percentage of dial attempts on Gate 1-cleared contacts.
• Audit-readiness: Whether a defensible consent record, scrub log, and disposition code can be produced on demand for any dialed number within 48 hours.

Review these metrics monthly. Plura’s conversation intelligence layer surfaces compliance and conversion metrics in one dashboard, with audit-ready exports available in one click.

Frequently Asked Questions

Who Can Be Sued for TCPA Violations?

The TCPA’s private right of action allows any recipient of a non-compliant call or text to sue directly, without FCC involvement. Courts have applied vicarious liability to the party that benefits from a call even when a third party technically dialed it, meaning the business whose product or service was promoted is typically the party sued, not the lead aggregator or dialing vendor upstream. Affiliate or vendor relationships do not transfer TCPA exposure. Consult qualified counsel regarding your specific liability posture.

Who Is Exempt from TCPA Rules?

The TCPA includes narrow exemptions for emergency messages, certain HIPAA-covered healthcare communications, and non-commercial nonprofit and political messages for live-agent calls to residential landlines. These exemptions are not self-executing, and the moment a message includes promotional language it is reclassified as marketing and the full prior express written consent standard may apply. There is no blanket B2B exemption for calls or texts to mobile phones. Consult qualified counsel to determine whether any exemption applies to your specific use case.

What Does TCPA Not Cover?

The TCPA does not govern commercial email, which falls under CAN-SPAM, 15 U.S.C. § 7701 et seq. It also does not govern purely manual calls made without any automated dialing equipment to numbers that are not on the National DNC Registry, or calls made by live agents to verified business landlines for non-marketing purposes. The Supreme Court’s 2021 decision in Facebook, Inc. v. Duguid narrowed the definition of an automatic telephone dialing system (ATDS), meaning some dialing platforms may fall outside the ATDS definition under Section 227(b). However, prerecorded or artificial voice calls to cell phones require prior express written consent regardless of how the call is dialed. State Mini-TCPA laws may cover conduct the federal statute does not. Consult qualified counsel for a complete picture.

What Is the Difference Between a Qualified Lead and a Legally Callable Lead?

A qualified lead has met your sales criteria, such as budget, authority, need, and timeline, or whatever gates your team applies. A legally callable lead has cleared a separate set of requirements: prior express written consent is documented and verifiable, the number is not on any applicable DNC list, the number has not been reassigned since consent was obtained, the contact has not revoked consent, and the call falls within applicable time-window restrictions. A lead may be fully sales-qualified yet remain uncallable if any of the legal requirements are missing. Both gates must pass before a dial is made.

Plura supports this two-gate workflow by enforcing consent verification, DNC scrubbing, and opt-out processing inside one platform before dial, with immutable audit-ready logging on every outbound contact.

See how Plura operationalizes consent verification and sales qualification inside one system.

---

Read Next

• TCPA-Compliant Lead Qualification: Consent and DNC Guide
• Automated Lead Qualification: TCPA and DNC Best Practices
• TCPA-Compliant Speed to Lead: Move Fast Without the Risk
• TCPA Compliance for Contact Centers: The 2026 Guide
• TCPA Compliance for Automated Sales Campaigns in 2026