TCPA Compliance for Automotive Leads: What Every Dealer and BDC Manager Needs to Know (2026)

There is a dealership group in Oklahoma that thought they were doing everything right. They were staying in touch with customers, running promotions, and keeping their pipeline warm. In late 2020, they sent marketing texts to approximately 118,000 phone numbers. Four years later, they settled a class action lawsuit for $850,000.

Their mistake was not malicious. It was not even uncommon. They simply did not have proper written consent for every number they contacted. Under the Telephone Consumer Protection Act, the TCPA, that is all it takes.

This guide is written for every dealer principal, general manager, BDC manager, and internet sales director who has ever bought a lead and picked up the phone without thinking twice about whether that contact was legally authorized. We are going to break down what the TCPA actually requires, why automotive dealerships are in the crosshairs more than almost any other industry, and what the role of your lead provider is in all of this, because that part is almost never discussed honestly.

We will also tell you exactly what AutoLeadPro does to handle compliance at the source, not because we want credit for it, but because every dealer buying leads from any provider should know to ask these questions.

What Is the TCPA—and Why Car Dealerships Are Specifically Targeted

The Telephone Consumer Protection Act was signed into law in 1991 to protect consumers from unsolicited telemarketing calls. That sounds simple enough. But over three decades of FCC rulemaking, court decisions, and class action litigation, it has become one of the most complex and heavily enforced consumer protection laws in the United States.

For car dealerships, the TCPA governs every phone call, text message, and prerecorded voicemail sent to a consumer using any form of automated technology. That means your CRM auto-dialer, your BDC texting platform, your ringless voicemail tool, and your appointment reminder system, all of it falls under the law.

Why Dealerships Are High-Risk

The automotive industry sits at the intersection of three things the TCPA was built to regulate: high-volume outbound communication, automated dialing systems, and aggressive follow-up culture. A typical BDC contacts hundreds of leads per day. Even a small percentage of non-compliant contacts can expose a dealership to catastrophic liability. The numbers reflect this reality:

TCPA class action filings increased 112% year-over-year in Q1 2025 alone. (Source: Trade Pending; 2025 TCPA Compliance Guide for Automotive)
TCPA litigation has grown more than 1,200% since 2010. (Source: KPA; TCPA Compliance: What Auto Dealers Need to Know)
Nearly 80% of all TCPA cases filed today are class actions, meaning one mistake can affect thousands of consumers simultaneously. (Source: Active Prospect)
In 2024, automotive dealerships paid over $47 million in TCPA violation settlements. (Source: FCC Enforcement Bureau, cited by Strolid)

The TCPA has also created what legal professionals call an industry of professional plaintiffs, individuals and law firms who actively monitor dealership communications looking for violations to sue over. A quick search for TCPA attorneys returns pages of advertisements from firms specializing in exactly this. Dealerships are a primary target because of the volume of calls and texts they make daily.

This is not a scare tactic. It is the landscape every dealer is operating in right now, whether they know it or not.

What TCPA Violations Actually Cost—In Real Numbers

Before we get into what compliance looks like, let us be direct about what non-compliance costs. Because percentages and legal language are easy to dismiss. Real dollar amounts are not.

Violation Type	Penalty Per Incident	Class Action Exposure
Real-timeNegligent violation	$500 per call/text	$500 x number of victims
Willful violation	$1,500 per call/text	$1,500 x number of victims
Average settlement (2024)	$6,000,000+	Source: CompliancePoint
Industry total paid (2024)	$47,000,000+	Source: FCC / Strolid Research
Real case — Oklahoma (2024)	$850,000	118,000 texts without consent

The Math That Should Concern Every BDC Manager

Your BDC makes 200 outbound contacts per day. Even if only 5% of those contacts lack proper written consent, that is 10 contacts. At $1,500 per willful violation, that is $15,000 in a single day. Over a month of operation, that exposure grows to $450,000. And if those contacts share their experience and a class action is filed, you are looking at numbers that dwarf your annual marketing budget.

The most important line in TCPA case law for dealerships comes from compliance firm KPA: “If you respond to a lead that has not given you consent to call or text, regardless of where the lead was generated, you are liable.” That last phrase, regardless of where the lead was generated, is where most dealers get surprised.

Your liability does not start when your BDC makes the call. It starts when the lead was captured and whether that capture included valid consent.

The Part Nobody Talks About: Your Lead Provider’s Role in Your Compliance

Every TCPA guide written for dealerships focuses on what happens inside the store, how to manage your DNC list, how to train your BDC staff, how to handle opt-outs. That is all important. But it misses the first point of failure in the chain: the lead itself.

When you buy a lead from a third-party automotive lead provider and your BDC calls or texts
that person, the TCPA clock started the moment the buyer submitted their information on your provider’s platform. If your provider did not obtain valid written consent from that buyer, naming your dealership specifically as a company authorized to contact them, your call is non-compliant. Even if you did everything else correctly.

Why Outsourcing Does Not Outsource Liability

This is where dealers make a critical and expensive assumption: they assume the lead provider handles compliance, so they are covered. The law does not work that way.

As compliance firm CompliancePoint states, “Assuming vendors will indemnify you for TCPA compliance is not legally viable.” Dealerships remain fully liable for violations committed by vendors acting on their behalf. Before engaging any third party that will contact leads or provide leads for your team to contact, conduct thorough due diligence. That due diligence is not just a good business practice. For a dealership making hundreds of daily BDC contacts on third- party leads, it is the difference between operating safely and operating at enormous hidden risk.

The Lead Generator Loophole—And Why You Should Not Rely on It

In late 2024, the Eleventh Circuit Court vacated the FCC’s one-to-one consent rule, which would have required lead generators to obtain consent for each specific seller named. The practical effect is that the “lead generator loophole” remains open, meaning some providers are still obtaining consent through broad comparison shopping website language that may not specifically name your dealership.

This provides some legal breathing room in the short term. It is not a long-term compliance strategy. Courts continue to narrow the definition of acceptable consent, FCC rulemaking continues to evolve, and relying on a loophole to protect a $6 million average settlement exposure is not a risk worth taking.

The safest position for any dealership: only work with lead providers who obtain clear,
direct, dealership-specific consent from every buyer before that lead is delivered to you.

What Makes a Lead TCPA-Compliant at the Source

Most dealers cannot answer this question in detail because they have never had to. The lead arrived in their CRM, and they called it. That is the entire process as far as they were concerned. But understanding what valid consent looks like at the point of capture is what separates a defensible lead program from a lawsuit waiting to happen.

The Six Required Elements of Valid Written Consent

Consent Element	What It Means	Why It Matters
Clear disclosure	The consumer knows they’re agreeing to autodialed calls/texts	Without it the consent is invalid
Specific phone number	Must name the exact number being authorized	Blanket authorizations don't hold up in court
Electronic signature	Compliant with E-SIGN Act	Verbal consent is not sufficient
No purchase condition	Consent cannot be tied to buying the vehicle	FCC requirement, non- negotiable
Opt-out notice	Consumer must be told they can revoke at any time	Required on every subsequent message
Third-party disclosure	Must name the specific seller , not just partners	Generic language fails the one- to-one standard

The Consent Language That Actually Holds Up

Valid TCPA consent for automotive leads should read something like this at the point of form submission:

“By submitting this form, I expressly consent to be contacted by [Dealership Name] and AutoLeadPro at the phone number provided, including via autodialed calls, prerecorded messages, and text messages, for the purpose of vehicle financing inquiries. I understand that consent is not a condition of purchase. I may opt out at any time by
replying STOP.”

Notice what this language does: it names the dealership specifically, it names the lead provider, it identifies the communication methods, it states the purpose, it removes purchase conditioning, and it provides an opt-out path. Every element is present.

Compare that to the vague language some lead capture forms use: “I agree to be contacted by dealers and their partners.” That language has failed in court repeatedly. “Dealers and their partners” does not name anyone specifically. It does not identify communication methods. It is not a valid TCPA consent.

How Long Is Consent Valid?

This is a detail most dealers never think about but matters enormously for aged lead programs. TCPA consent for automotive leads expires approximately 90 days after an inquiry or lead submission. If you are working a lead that is 120 days old from a provider who has not re- verified consent, your contact may be non-compliant even if the original consent was valid.

This is why aged lead programs carry elevated TCPA risk and why real-time delivery from a provider with active consent verification is not just a speed advantage, it is a compliance advantage.

The 6 Most Common TCPA Mistakes Dealerships Make

These are not hypothetical scenarios. These are the violations that are generating actual
lawsuits against dealerships right now.

1. Salespeople Texting From Personal Phones

This is one of the most widespread compliance failures in automotive retail. A salesperson gets a hot lead, texts them from their personal iPhone, and closes the deal. Nobody thinks twice. But that text was not sent through a TCPA-compliant system. There is no opt-out mechanism, no consent verification, no audit trail. If that customer later complains, the dealership is exposed and has no documentation to defend itself.

Every customer communication, calls and texts, must flow through your dealership’s authorized CRM system, not personal devices. This requires a clear internal policy and consistent enforcement.

2. Calling or Texting Numbers on the National DNC List

Dealerships are required to suppress against the National Do Not Call list no older than 31 days. Leads that arrive from providers who have not scrubbed against DNC before delivery put your BDC in a difficult position, because the moment your team contacts a DNC-registered number, you are potentially in violation, even if the lead opted in on your provider’s platform.

A lead provider who delivers in real time and scrubs against DNC before delivery is removing this risk for you. A provider who does not leave it entirely in your hands.

3. Failing to Honor Opt-Out Requests Within 30 Days

Federal rules require that internal DNC requests, meaning when a consumer tells your dealership to stop calling them, be honored within 30 days. Many dealers process opt-outs manually and inconsistently. A consumer who asked to be removed in week one and received a follow-up call in week three has a viable TCPA claim regardless of the original consent.

Opt-outs must be logged, timestamped, and suppressed immediately in your CRM. Best practice is within the same business day. “Within 30 days” is the legal floor, not the operational standard.

4. Using Ringless Voicemail Thinking It Is Exempt

This misconception has cost dealerships significant money. Ringless voicemail, where a prerecorded message is delivered directly to voicemail without the phone ringing, is NOT exempt from TCPA requirements. Despite vendor claims that it sidesteps the law, courts and the FCC have consistently held that prerecorded messages delivered to any phone require the same consent standards as a live call. Any provider or vendor suggesting otherwise is exposing you to liability.

5. Assuming Your Lead Provider’s Consent Covers You

As discussed above, this is the assumption that creates the most silent risk. Your provider’s consent form may be valid on their platform and still fail to protect you if it does not name your dealership specifically as an authorized contact. Ask your provider for the exact consent language used on their lead capture forms. If they cannot produce it, treat that as a serious red flag.

6. Not Having Consent Documentation Ready to Produce

When a TCPA lawsuit or demand letter arrives, the first thing you need is proof of consent. Not an explanation of your process. Not an assertion that your provider handles compliance. Documented proof, the timestamp of when the buyer submitted the form, the exact consent language they agreed to, the IP address, the opt-in confirmation. Without this documentation, even valid consent is difficult to defend.

As KPA notes: “Screenshots and IP addresses are insufficient. If you are able to provide witnessed consent from a neutral third party, you can frequently defeat an attorney demand letter before litigation even begins.”

What to Ask Your Lead Provider About TCPA Compliance

Before you sign with any automotive lead provider, including AutoLeadPro, ask these specific questions. How a provider answers tells you more about their operation than any sales pitch.

What is the exact consent language on your lead capture forms? Ask them to show you the actual form language, not a description of it. Valid consent is specific, not general.
Does your consent language name our dealership specifically? Generic consent naming “dealers and partners” is not sufficient. Your dealership should be named.
Do you scrub leads against the National DNC list before delivery? And how often? The list must be accessed no older than 31 days.
Can you provide consent documentation per lead upon request? This means timestamp, IP address, consent language version, and opt-in confirmation for any specific lead.
How do you handle leads where consent cannot be verified? Are those leads withheld or delivered anyway?
What is your process when a consumer opts out? How quickly is that suppressed from future delivery to my dealership?
Do you carry TCPA compliance insurance? And will you provide indemnification language in your contract?

If a provider hesitates on any of these questions, especially questions 1, 2, and 4, you have your answer about how seriously they take compliance.replying STOP.”

How AutoLeadPro Handles TCPA Compliance at the Source

We are going to be straightforward about this section: we are not including it to make a sales pitch. We are including it because the questions above deserve honest answers and because every dealer we work with deserves to understand exactly what we do and why.

Consent Built Into Every Lead Capture Form

Every consumer-facing platform we operate, including saveonacar.com, easyautosolution.com, and searchcarx.com, contains explicit TCPA consent language at the point of form submission. That language identifies the specific communication methods authorized (calls, texts, prerecorded messages), the purpose of contact (vehicle financing), the right to opt out at any time, and the fact that consent is not a condition of purchase.

We do not use broad partner language. The consent is specific to the function of automotive lead delivery and is reviewed regularly as FCC guidance evolves.

National DNC Scrubbing Before Delivery

Every lead is scrubbed against the National Do Not Call Registry before it is delivered to a dealership. Leads that match DNC registrations are not delivered. Period. We do not leave DNC compliance as a step for your BDC team to handle after the fact, it is handled at the source before the lead ever reaches your CRM.

Consent Documentation Available Per Lead

If a dealership ever receives a demand letter or lawsuit referencing a lead we delivered, we can provide the consent documentation for that specific lead: the timestamp of submission, the consent language version in place at that time, the IP address of the submission, and the opt-in confirmation. This documentation is what the KPA guidance refers to when it says witnessed consent from a neutral third party is what defeats attorney demand letters before litigation begins.

Real-Time Delivery Reduces Consent Decay Risk

As noted earlier, TCPA consent for automotive leads expires approximately 90 days after submission. Because we deliver leads in real time, within 60 seconds of verified submission, the consent is as fresh as it can possibly be when your team makes first contact. Aged leads carry elevated TCPA risk because the consent window narrows over time. Real-time delivery is not just a speed advantage. It is a compliance advantage.

What We Cannot Do for You

We want to be honest about the limits of our compliance process. We handle consent at the point of capture. We scrub against the DNC before delivery. We provide documentation when needed. What happens after the lead arrives in your CRM is your responsibility. If your BDC team texts from personal phones, ignores opt-out requests, or uses automated dialers without the right permissions, those are internal compliance failures that no lead provider
can protect you from. TCPA compliance is a shared responsibility. We handle the front end. You handle the back end.

Building TCPA Compliance Into Your BDC Process

Once a compliant lead arrives in your CRM, your internal process determines whether you stay protected. Here is what best practice looks like after delivery:

Use a TCPA-Compliant CRM for All Communications

Every call and text should flow through your dealership’s authorized CRM, VinSolutions, DealerSocket, Tekion, eLead, or similar. These systems log communications, timestamp contacts, maintain opt-out lists, and include opt-out mechanisms in text messages automatically. Salespeople communicating through personal devices bypass every protection these systems provide.

A TCPA-compliant CRM should automatically include “Reply STOP to opt out” in every outbound text, suppress opted-out numbers from future contacts, maintain a timestamped log of every communication, and alert your team when a number is on the internal DNC list.

Honor Opt-Outs Immediately

When a consumer replies STOP, calls to request no further contact, or submits an opt-out through any channel, that request must be logged and suppressed in your system immediately. Best practice is the same business day. The legal maximum is 30 days. Operating anywhere near the 30-day ceiling is operating at the edge of acceptability.

Train your BDC team to treat opt-out requests as high-priority actions, not administrative tasks to get to when time allows.

Ban Personal Phone Communication With Leads

This needs to be a written policy with real enforcement. Not a suggestion. Not something mentioned in onboarding and then ignored. A written, signed policy that every BDC team member acknowledges, with consequences for violation. One salesperson texting a lead from their personal phone is one incident that creates dealership-wide liability.

Conduct Regular Compliance Audits

At minimum quarterly, review a sample of outbound contacts against your consent documentation. Verify that opt-outs are being processed. Check that your CRM’s DNC suppression is functioning. Review any ringless voicemail or prerecorded message campaigns with your compliance counsel. Compliance is not a one-time setup. It is an ongoing operational discipline.

Train Your Team on Real Scenarios

Generic TCPA training that covers definitions and penalty amounts is not sufficient. Your BDC team needs to know what to do when a consumer says “stop calling me” mid-call, what happens if a lead asks where their information came from, how to handle a consumer who claims they never consented, and what to do if they receive a demand letter or legal notice. Scenario-based training prepares your team for the situations that actually generate liability.

Frequently Asked Questions

What is TCPA compliance for car dealerships?

TCPA compliance for car dealerships means following the Telephone Consumer Protection Act when contacting leads and customers by phone, text, or automated message. The law requires prior express written consent before using any automated dialing system, prerecorded
message, or SMS marketing communication. Violations carry penalties of $500 to $1,500 per incident, with class action exposure multiplying that figure by the number of affected consumers.

How much does a TCPA violation cost a car dealership?

Each violation carries a penalty of $500 for negligent violations and $1,500 for willful violations.
The average TCPA class action settlement in the automotive industry exceeds $6 million. In 2024, automotive dealerships collectively paid over $47 million in TCPA settlements. A single texting campaign to unconsented numbers can generate hundreds of thousands in liability
almost instantly.

Am I liable if my lead provider sends me non-consented leads?

Yes. Dealerships remain liable for TCPA violations even when the non-compliance originated
with a third-party lead provider. As compliance firm KPA notes, if you respond to a lead that has
not given consent to be contacted, regardless of where the lead was generated, you are liable.
This is why auditing your lead provider’s consent practices is not optional; it is a direct line to your dealership’s legal exposure.

Express written consent under the TCPA is a clear, affirmative agreement by a consumer to receive autodialed calls, prerecorded messages, or text messages from a specific seller. It must
include the consumer’s signature (electronic is acceptable), identify the specific phone number
being authorized, name the seller or sellers who may contact them, state that consent is not a condition of purchase, and inform the consumer of their right to opt out at any time.

TCPA consent for automotive leads generally expires approximately 90 days after the initial inquiry or lead submission. After that window, re-consent is required for compliant contact. This makes aged lead programs particularly high-risk from a TCPA compliance standpoint, and is one reason real-time lead delivery carries a compliance advantage over aged or recycled lead
products.

What should I do if a consumer opts out?

Opt-out requests must be honored as soon as possible and no later than 30 days after the request is made. Best practice is to process opt-outs the same business day they are received, suppress the number from all future automated contacts in your CRM, add the number to your internal DNC list, and document the timestamp of the opt-out request and the suppression
action. Failing to honor opt-outs promptly is one of the most common sources of TCPA class action litigation.

Yes. Ringless voicemail, sometimes marketed as “drop voicemail” or “direct-to-voicemail” technology, is a prerecorded message and requires the same TCPA consent standards as a live
autodialed call. Despite vendor claims to the contrary, courts and the FCC have consistently held that delivering a prerecorded message to a consumer’s voicemail without prior express written consent is a TCPA violation. Any automotive marketing vendor claiming their ringless voicemail product is TCPA-exempt should not be trusted.

How do I verify that my lead provider is TCPA compliant?

Request the exact consent language used on their lead capture forms. Confirm that your dealership is named specifically in that language. Ask whether they scrub leads against the National DNC Registry before delivery and how often. Request consent documentation for a sample of leads. Ask whether they carry TCPA compliance insurance and will provide indemnification language in your contract. Ask what happens to leads where consent cannot be verified. A compliant provider will answer every one of these questions specifically and without hesitation.

An existing business relationship provides limited protection under TCPA for certain types of calls, but it does not substitute for express written consent for autodialed or prerecorded
marketing messages to wireless numbers. For text message marketing specifically, prior express written consent is required regardless of an existing relationship. Relying on the
existing business relationship exception for SMS marketing is a high-risk approach that has not
held up consistently in litigation.

Top Lead Generation Companies in the U.S for Car Dealerships

Best Automotive Lead Providers for Dealerships|

Get Top Verified Subprime Auto Leads with Real-Time Transfers