Is Lead Generation Legal? Laws Every Law Firm Must Follow

Key Takeaways

• Is Lead Generation Legal? Laws Every Law Firm Must Follow
• Why does lead generation legality matter to your firm?
• Which laws apply to lead generation?
• How do you run or buy lead generation without legal risk?

Is Lead Generation Legal? Laws Every Law Firm Must Follow

The short answer to is lead generation legal is yes. Collecting, buying and selling leads is lawful in the United States, but federal and state law regulate how you get consent, how you contact people and what you do with their data.

Lead generation means attracting people who show interest in a service and capturing their contact details so someone can follow up. For a law firm, that is an injury victim who fills out an intake form, calls a tracked number, or appears in a list a vendor sends you. The law does not care what you call it. It cares about consent, honesty and privacy.

This article explains why the legal risk lands on the firm that makes contact, which laws apply, where the FCC's one-to-one consent rule stands, how to run or buy leads safely, and what lawyer ethics rules add. GavelGrow has marketed only for law firms since 2015, so we look at this from the intake desk. This is general information, not legal advice.

Key Takeaways

• Is lead generation legal? Yes, if you collect valid consent and contact people lawfully.
• Who is liable for bad leads? The firm that calls or texts them, not only the vendor.
• Is buying leads banned? No, but the buyer needs proof of valid consent.
• Do bar rules apply? Yes, state ethics rules apply on top of every statute.
• What should you keep? A timestamped consent record for every lead you contact.

Why does lead generation legality matter to your firm?

The firm that calls, texts or emails a lead carries the legal risk, no matter who supplied the name. That is why "is this legal?" is the wrong question for a vendor and "show me the consent" is the right one.

Legal practice, regulated method

Nothing in federal law bans lead generation. Firms collect inquiries through websites, ads and phone calls every day, and buying leads from a third party is lawful in most settings. Trouble starts with how the lead was captured and what you do next: contacting someone without valid consent, running misleading ads, or selling personal data without the notices state law requires.

What one violation can cost

The Telephone Consumer Protection Act (TCPA) allows $500 per unlawful call or text, and up to $1,500 per message when a court finds the violation willful or knowing. Those numbers multiply fast. If your intake team sends one text each to 200 purchased leads without valid consent, exposure runs from $100,000 (200 x $500) to $300,000 (200 x $1,500) before legal fees.

Plaintiffs' lawyers also argue that a vendor's calls are your calls. For attorneys there is a second exposure: discipline from the state bar.

Whoever makes the contact owns the risk, so a lead's origin is your problem even when you did not create it.

Which laws apply to lead generation?

Six bodies of law matter most: the TCPA, the national Do Not Call rules, the FTC Act, CAN-SPAM, state telemarketing laws, and state privacy and data broker laws. Each one governs a different step between capturing a lead and signing the case.

The laws at a glance

Use this table to match each step of your funnel to the rule behind it.

Where the FCC one-to-one consent rule stands

The FCC adopted a rule in December 2023 that would have required consent to name one seller at a time and be topically related to the site where the person gave it. It was set to take effect on January 27, 2025. Plenty of articles still describe it as in force, but the Eleventh Circuit vacated it in January 2025, before it started. Lead buying was never banned, and one-to-one consent is not a current federal requirement. Proposals to revive it exist, so check the status before you rely on either position.

Do not relax, though. The existing written-consent rule still requires a signed agreement that clearly authorizes the specific seller contacting the person. Consumers can also revoke consent by any reasonable means under the FCC's revocation rules. Consent bundled across dozens of unnamed partners is the kind plaintiffs attack. Treat one-to-one as your own standard.

A lead is only as legal as the consent behind it, and the buyer has to be able to prove that consent.

When data broker laws reach you

Most firms that collect their own inquiries are not data brokers. A data broker sells or licenses personal information about people it has no direct relationship with. Vendors that compile and resell contact lists often qualify, which means registration, public disclosures and deletion duties. If you resell leads to other firms, talk to counsel before you do.

State privacy laws add a broader point. They define a "sale" as handing over personal information for money or other value, which triggers notice and opt-out rights. California's Delete Act also lets consumers send one deletion request to every registered broker. Thresholds and exemptions vary by state.

How do you run or buy lead generation without legal risk?

You protect yourself by capturing consent that names your firm, proving it later, and policing every vendor in the chain. Four habits cover most of the ground.

Write consent language that holds up

A sound consent block names your firm, covers calls and texts sent with automated technology, says consent is not a condition of getting legal help, and sits beside an unchecked box. Here is a starting point for your counsel to adapt:

By checking this box and submitting this form, I authorize [Firm Name] to contact me at the phone number above by call and text message, including with automated dialing technology or prerecorded messages, about my legal matter and the firm's services. Consent is not a condition of receiving legal services. Message and data rates may apply. Reply STOP at any time to opt out.

Never pre-check the box, and never hide the seller's name behind a link to a long partner list.

Build the process around it

Consent is only the first control. These steps keep the rest of the funnel clean:

1. Store the consent record: timestamp, phone number, form version, the exact wording shown and the page URL.
2. Scrub numbers against the National Do Not Call Registry and your internal list. A person's inquiry gives you a limited window, three months under the Telemarketing Sales Rule, so it is not permanent permission.
3. Honor STOP replies and unsubscribe requests immediately, and never let an email opt-out sit past 10 business days.
4. Contact leads only between 8 a.m. and 9 p.m. in their time zone.
5. Keep ads truthful: no guaranteed outcomes, no "best lawyer" claims, and a check of your state bar's advertising rules.
6. Keep consent records for at least four years, the usual limitations period for TCPA claims.

If you run intake in-house, the GavelGrow platform logs TCPA consent in an append-only audit log on its hosted intake forms and handles STOP and HELP keywords automatically. Track costs $199 a month with a 7-day free trial and no card required.

Vet every lead vendor

Ask where each lead came from, then ask to see the consent page and the record for a single lead. Put warranties, indemnification and audit rights in the contract. Non-compliant leads are your risk, not the vendor's, so walk away from any seller that cannot produce a record per lead or sells the same lead to many buyers at once.

If a vendor cannot hand you the consent record for one lead, that lead is a liability, not an asset.

What lawyer ethics rules add to the statutes

State bar rules sit on top of the statutes and can make a lead arrangement improper even when it is lawful for any other business. The ABA Model Rules are a useful reference, but each state adopts its own version, so read yours.

The rules that touch lead generation

Four Model Rules come up most often:

• Rule 7.1 bars false or misleading communications about a lawyer or the lawyer's services.
• Rule 7.2(b) generally bars giving anything of value for recommending your services, while allowing you to pay for advertising. Paying a lead generator is usually acceptable only when it does not recommend you and its marketing is truthful.
• Rule 7.3 restricts live person-to-person solicitation of prospective clients, with exceptions.
• Rule 5.4 bars sharing legal fees with nonlawyers, which is why percentage-of-fee deals draw scrutiny.

Practical limits for your contracts

The fee structure matters. A flat fee per lead is more widely accepted than a percentage of each signed case, and some states have issued ethics opinions on both. Read your bar's opinions or ask ethics counsel before you sign.

Contact initiated by the person, such as a form submission asking for help, also differs from unsolicited outreach. Never promise results in your own marketing, and avoid superlatives like "best" or "top."

Statutes tell you whether a lead is lawful, and your state bar tells you whether a lawyer may pay for it.

Frequently asked questions

Is it legal for a law firm to buy leads?

Yes in many cases, subject to your state bar's rules and to valid consent for every lead you contact. The buyer carries the TCPA exposure, which is $500 per unlawful call or text and up to $1,500 if willful. Before you buy, confirm the vendor does not recommend you in a way that breaks Rule 7.2 in your state, and ask for the consent record behind each lead.

Did the FCC ban lead buying in January 2025?

No. The FCC's one-to-one consent rule was scheduled to start on January 27, 2025, but the Eleventh Circuit vacated it in January 2025 before it took effect. Buying leads remains lawful, and the older written-consent rule still applies. Because proposals to restore one-to-one consent exist, check the current status before changing your process.

Can you text a lead who filled out your web form?

Yes, if the form's consent language clearly authorizes your firm to send marketing texts, and you keep the record. Marketing texts sent with automated technology require prior express written consent. Honor STOP replies immediately, and send only between 8 a.m. and 9 p.m. in the lead's time zone.

Can a lawyer pay a lead generator per signed case?

It depends on your state. ABA Model Rule 5.4 bars sharing legal fees with nonlawyers, and some bars treat a percentage of each signed case as fee sharing. Flat per-lead fees are more commonly accepted, but not everywhere. Check your bar's ethics opinions or ask ethics counsel before you sign any contract.

What is the biggest legal mistake in lead generation?

Contacting purchased leads without proof of valid consent. A vendor's promise that leads are "compliant" does not protect you, because plaintiffs' lawyers will argue the vendor's calls are yours. Before the first call or text, you should hold a timestamped consent record naming your firm, a Do Not Call scrub, and a contract that makes the vendor answer for its sourcing.

Trust the record, not the promise.

The bottom line on lead generation law

Lead generation is legal. The risk sits in consent, contact, advertising, data handling and, for lawyers, bar rules. If you can show a consent record that names your firm, scrub before you dial, keep ads truthful and hold vendors to written warranties, you are on solid ground in most cases.

Rules differ by state and change over time, so have counsel review your forms and vendor contracts. If you want a second set of eyes on your intake and consent flow, book a free strategy call with GavelGrow and we will walk through it with you.

Frequently Asked Questions