Text Spam From Lead Generators: Who Is Actually Liable?

By MercPrivacy · Published 2026-09-04 · Updated 2026-09-07

When a quote form turns into a flood of texts, the company that bought your lead and sent or commissioned the messages is usually the liable party, not the website. Here is how the chain works and where the consent fight stands.

When a lead generator's form turns into a flood of texts, the company that bought your information and sent or commissioned the messages is usually the liable party, not the website where you typed your number. Under the TCPA the seller whose product is being pitched answers for texts sent on its behalf, and the do-not-call provision reaches solicitations made by or on behalf of that seller. Each autodialed marketing text to a cell phone without valid consent carries $500, up to $1,500 if willful or knowing, and the lead buyer, a U.S. company with an address and revenue, is the party a claim can actually reach.

This article follows the chain from the form to the text, explains where the consent fight stands after the FCC's lead-generator rule was vacated in 2025, sets out what consent the texting company would actually have to show, describes how a seller becomes responsible for a vendor it never met, and explains why the collectible party is almost always the company that bought the lead rather than the site that sold it.

“The website says you agreed. The company texting you has never heard of the website. Somebody in that chain is wrong, and it is almost never you.”

The Chain From Quote Form to Text Message

It starts with a form: an insurance quote, a solar estimate, a debt-relief check, a home-warranty price, a mortgage rate. Beneath the submit button sits a consent sentence, and inside it a hyperlink reading “marketing partners” that opens a list of dozens or hundreds of company names. Submitting the form is treated as consent for every one of them, plus whichever affiliates they pass the lead to.

The lead is then sold, usually within seconds, through an automated auction that pings prospective buyers with a stripped version of your data and posts the full record to the winners. A single form can be sold to several buyers at once and resold as it ages. Each buyer hands the record to its own call center or texting vendor, which is why the messages arrive from numbers you have never seen, about products you asked about and products you did not. The trap in the form itself is dissected in the quote form trap, and the auction mechanics in how lead auctions work.

The Consent Rule the FCC Adopted and the Court Vacated

In late 2023 the FCC adopted a rule aimed squarely at this chain. It would have required that written consent for lead-generated robocalls and texts authorize a single identified seller at a time, and that the messages be logically and topically related to the website where consent was given. A hyperlinked list of a thousand partners would not have qualified.

In January 2025 the Eleventh Circuit vacated that rule, and the FCC removed it. It is not the federal standard, and any article or demand letter that presents it as one is out of date. What remains is the pre-existing standard: prior express written consent, given in a clear and conspicuous disclosure that authorizes the seller to send marketing messages using automated technology. Whether a partner list behind a hyperlink meets that standard for a company the consumer never saw named is contested and decided case by case on the specific form, disclosure and company. That is a fight, not a rule, and the file should be built for the fight.

What the Company Texting You Would Have to Prove

Consent is the sender's burden. To rely on it, the company that texted you needs a record showing that you, at a specific time and on a specific page, agreed to receive automated marketing texts from that company or a list on which it was identifiable, in a clear and conspicuous disclosure, and that agreeing was not a condition of getting the quote. Electronic signatures and checkboxes can satisfy the form, but the substance has to be there.

What lead buyers usually hold is thinner: a lead record with a timestamp, an IP address, the form's URL, and often a third-party certificate of the page session. That record is only as good as the page it captured. If the disclosure named a different company, if the partner list was reachable only by clicking, if the form was on a site you have never heard of, or if the lead was resold beyond the original buyers, the record does not carry the consent it claims. The consent they claim you gave walks through what those records look like and how they fall apart.

Texts sent after you replied STOP need no consent analysis at all. They are messages you expressly refused, and they are the messages that establish knowing conduct.

How a Seller Becomes Liable for a Vendor It Never Met

Sellers routinely argue that an independent vendor did the texting and that they cannot be responsible for it. The law has two answers. The TCPA's do-not-call provision expressly reaches solicitations made by or on behalf of a seller, so a seller that had the messages sent for its benefit is within the statute's own words. And under FCC guidance and the cases applying it, a seller can be vicariously liable for a third party's calls and texts under ordinary agency principles: actual authority, where the seller directed or controlled the campaign; apparent authority, where it let the vendor hold itself out as the seller; and ratification, where it accepted the leads and the sales after learning how they were generated.

The facts that matter are the ones sellers would rather not discuss: the contract with the lead vendor, the scripts and offers the seller supplied, the complaints it kept buying through, and the revenue it booked from the leads. How responsibility divides between the company whose product was sold and the operation that pressed send, and why the seller is the one worth naming, is the subject of seller vs dialer: who pays.

Why the Lead Buyer Is the Party That Can Be Reached

The lead generator is often a thin company with a portfolio of websites, a mailbox address and no assets that matter. The texting vendor is frequently offshore, or a shell that changes names when complaints accumulate. The lead buyer is different: a licensed insurance agency, a solar installer, a mortgage lender, a home-warranty company or a debt-relief firm, a U.S. business with an office, a compliance officer, insurance, and a vendor contract that usually contains an indemnity clause it will want to invoke. It is the party that can respond to a demand, produce the consent record, and stand behind a resolution.

Identifying the buyer is therefore the whole task. The product pitched narrows it; the landing page, opened on a separate device without submitting anything, often names it; the live agent, when a text leads to a call, will give a company name and a license number if asked plainly. If you have texts from six numbers about four products and cannot see the companies behind them, the free 30-minute assessment exists to map that chain with you before you decide whether it is worth pursuing.

What to Do When the Texts Start

Reply STOP once to each sending number and screenshot the reply. Screenshot every message with the number, full text and timestamp, and keep the thread. Write down which form you filled out, on which site and date, because that record links the campaign to its source and lets you request your data and consent record from the site operator. Log each product and sender as a separate campaign; each buyer is a separate party with its own count.

Do not fill out another quote form to see who is texting you, do not click links from the receiving phone, and do not call the numbers back from it. Each of those actions generates a fresh lead record with a fresh timestamp, and the next consent certificate will have your name on it.

Where MercPrivacy Fits

MercPrivacy is a data-privacy and unsolicited-contact defense firm in Houston, Texas. On a lead-generator text problem we build the evidence file, trace the campaign from the form you submitted through the auction to the buyers actually texting you, identify each U.S. company behind the messages, examine the consent records they rely on, and count the messages per sender against those records. We also work the source, requesting deletion and suppression of the lead data where the operators' processes allow, and re-checking because leads are resold.

We are not a law firm and do not give legal advice. When a matter warrants a demand or a lawsuit, a licensed attorney is engaged, and any settlement paperwork goes through that attorney. Our own investigative, documentation and administrative work is billed as a straightforward recurring service fee set out in writing before any work starts. More on the spam texts page.

Frequently Asked Questions

Is the website or the company texting me responsible for lead-generator spam?

Usually the company texting you, or the seller it texts for. The TCPA holds a seller responsible for solicitations made on its behalf and, under agency principles, for vendors it directed, held out or ratified. The website that collected your information may share responsibility depending on its role, but the lead buyer is the party with the consent burden, the assets and the incentive to resolve the matter.

I filled out a quote form; did I consent to all of these texts?

Not necessarily. Consent must be clear and conspicuous and must authorize the specific seller, or a list on which it was identifiable, to send automated marketing texts. Whether a partner list behind a hyperlink does that for a company you never saw named is contested and decided on the specific form. The company relying on it has to prove it, and texts sent after you replied STOP need no consent analysis.

Does the FCC's lead-generator consent rule still apply?

No. The FCC adopted a rule in late 2023 that would have required consent to name one seller at a time and to be topically related to the website, but the Eleventh Circuit vacated it in January 2025 and the FCC removed it. The governing standard is the pre-existing prior-express-written-consent requirement, and partner-list consent is now a fact-specific dispute rather than a per se violation.

How do I find out who bought my lead?

Start with the product pitched and the landing page behind each link, opened on a separate device without submitting anything. When a text leads to a call, ask the agent plainly for the company name and license number. Request your data and consent record from the site where you submitted the form. Log each sender and product separately; each buyer is a separate party with its own count.

How long do I have to act on lead-generator texts?

The limitations period for TCPA claims is generally four years; state text statutes have their own periods to verify. The practical constraint is identification rather than time: lead vendors change names, numbers rotate and landing pages disappear, so capturing the sender, the link and the product while the campaign is live is worth far more than waiting.

This article is for educational purposes only and is not legal advice. MercPrivacy is not a law firm; when a matter requires legal representation, a licensed attorney is engaged. Statutory figures are the amounts the statutes provide, not predictions of any outcome, and laws change — verify the current text before relying on it.