How to Choose a TCPA Compliant Call Buying Platform

Buying calls without checking compliance is one of the fastest ways to burn cash and invite a lawsuit. I've watched agencies spend six figures a month on inbound calls, only to get a demand letter because nobody checked where the consent actually came from. Here's what to look for before you sign with any call buying platform.

What is a TCPA compliant call buying platform?

A marketplace or call tracking system that documents consumer consent, scrubs against Do Not Call lists, and gives you an audit trail proving a call was generated lawfully. It won't guarantee legal immunity. But it gives you the paperwork to defend yourself.

Here's the thing: the platform isn't what makes you compliant. You are. The TCPA was enacted in 1991, long before pay-per-call marketplaces existed, and it still carries statutory damages of $500 to $1,500 per violation. Per call, not per campaign. Run a few thousand calls through a bad source and the math turns ugly fast. Courts have made clear that both the company that originated the call and the buyer who benefited from it can be on the hook. So when a platform tells you "don't worry, we're TCPA compliant," ask them to show you the consent record for the call, not just tell you it exists.

Start with the consent trail, not the price sheet

Every insurance vertical, auto, ACA/U65, Medicare, final expense, needs documented prior express written consent before any dialer touches a consumer. In practice, that means the platform should integrate with a third-party consent verification tool like Jornaya (also known as LeadiD) or TrustedForm. These generate a certificate the moment a consumer submits a form or clicks to call, timestamping consent and capturing what disclosures were shown.

If a platform can't produce a Jornaya token or TrustedForm certificate on demand for a call you bought, that's a red flag. Ask for a sample certificate before you commit budget. A legitimate marketplace hands it over without hesitation. One that hedges, or says "we'll get that to you" after the sale, isn't one you want to build volume with.

Don't just take the platform's word on it, either. Pull three or four certificates yourself and check the timestamps against when the call actually happened. I've seen gaps of weeks between when consent was captured and when the call was dialed. That's real exposure under DNC scrubbing rules.

Check how recently they scrub against the Do Not Call registry

FTC guidance generally treats a National Do Not Call Registry scrub as valid for 24 to 31 days before contact. Industry practice tends to land at the shorter end, closer to 30 days, and the tighter you keep that window the safer you are. Ask any platform you're evaluating exactly when in their process the DNC scrub happens: at lead capture, right before the call, or both. The best ones scrub at multiple points, not just once at intake.

This matters more than people think in the Medicare and final expense space, where lead lists sit around longer and get resold or reused. A number clean 45 days ago might not be clean today. If a vendor can't tell you their scrub cadence in specific days, they probably aren't doing it consistently.

One-to-one consent and why it changes the Medicare game

The FCC's 2023 rule change on "one-to-one consent" was originally set for enforcement in early 2025, and it's still tangled up in legal challenges as of this writing. Don't treat that as a reason to ignore it, though. The rule requires that consumer consent be tied to a single specific seller, not shared across a network of buyers from one generic form fill. That's a direct hit to how a lot of Medicare and health insurance lead generation has worked for years, where one form submission gets sold to five or ten different buyers under a single blanket consent.

If you're buying Medicare Advantage or Medicare Supplement calls, ask the platform directly how they're preparing for one-to-one enforcement, whatever the courts eventually decide. Platforms already restructuring their consent flows to name specific buyers are ahead of the curve. Platforms that shrug and say "we'll deal with it when it's final" are putting your license and your wallet at risk. Not just theirs.

Medicare campaigns also carry CMS marketing rules on top of TCPA, and those get updated annually, typically effective October 1. A platform serving this vertical needs to track both sets of rules. If they only talk about TCPA and never mention CMS guidelines, they're not thinking about your whole risk picture.

Evaluate the platform's tech, not just its compliance pitch

Ringba, Retreaver, and Invoca are the names you'll hear most in the insurance call space, and each offers tracking built around consent recording and DNC scrubbing. What separates them in practice is how granular the reporting gets. You want a platform where you can pull call recordings, consent certificates, and DNC scrub logs for any individual call, on demand, without opening a support ticket and waiting three days.

Look for real-time call scoring too. A platform that flags a call as high risk before you even pay for it, because the certificate is missing or the number just got scrubbed off DNC, saves you money and legal headaches at once. If a vendor's dashboard only shows conversion rates and duration, with nothing about compliance status per call, you're flying blind on the exact thing that creates liability.

Get your own indemnification in writing

Everyone skips this part. It's also the one that actually protects you. Buying calls from a "TCPA compliant" platform doesn't shield you from liability if a consumer sues. You need your own indemnification agreement with the platform, spelling out who eats the cost if a call turns out to have bad consent. Get it in writing before you spend a dollar. Not after a demand letter shows up.

Keep your own documentation trail too. Save the certificates. Save the scrub logs. Save the recordings. If you ever get named in a suit, the difference between a quick dismissal and a six-figure settlement often comes down to whether you can produce your own paper trail, independent of the platform's.

Pricing for verified, compliant calls generally runs $15 to $75 or more per call depending on vertical, required duration, and exclusivity. Medicare and final expense sit at the higher end because of the compliance overhead and the conversion value. If a platform is quoting you $8 calls in the Medicare space, ask yourself what got cut to hit that price.

If you'd rather generate your own inbound calls instead of buying them from a marketplace, that's a whole different skill set, and it's worth learning properly. I wrote The Pay Per Call Revolution to walk through exactly how that works, along with a companion workbook that follows along step by step.

FAQ

Does using a TCPA compliant platform protect me from lawsuits? No. It reduces your risk and gives you documentation, but courts have held both originators and buyers liable. You still need your own indemnification agreement and your own records.

How often should Do Not Call scrubbing happen? Industry practice generally keeps scrubs within 24 to 31 days before contact, with many platforms scrubbing closer to 30 days or less. Multiple scrub points beat one.

What's the difference between Jornaya and TrustedForm? Both generate consent certificates at the point of lead capture, timestamping what the consumer saw and agreed to. They function similarly, and either is acceptable, but the platform should use at least one of them consistently.

Why are Medicare calls more expensive than auto insurance calls? Medicare campaigns carry CMS marketing rules on top of TCPA, plus higher conversion value, which pushes verified Medicare calls toward $50 to $75+ compared to $15 to $30 for many auto calls.

What should I do before the one-to-one consent rule takes effect? Ask your call buying platforms now how their consent language is structured, and whether it names a single buyer or covers a network. Don't wait for the courts to settle the legal challenges before asking.