The calls were made by a vendor. Is my business still liable under the TCPA?
Almost every business that receives a demand says the same thing first: we did not make those calls, a vendor did. It is usually true and usually does not help: under the FCC's 2013 Dish Network ruling a seller is liable for calls made on its behalf, so the business that bought the leads or took the transfers answers for them. Here is why, and what does help.
The seller is liable for calls made on its behalf
The TCPA imposes liability on whoever "makes" or "initiates" a call. In 2013 the FCC, asked by courts in the Dish Network litigation, ruled that a seller does not have to physically dial to be liable. It is liable for calls made by third parties on its behalf under ordinary federal common law agency principles. Courts have applied that ruling since.
Three routes get there:
- Actual authority. You engaged the vendor to make the calls. The contract, the script, the lead criteria and the payment all show it.
- Apparent authority. The vendor used your name, your branding, your pricing, or had access to your systems, so the recipient reasonably believed the call came from you.
- Ratification. You knew or should have known how the leads were generated and accepted the benefit anyway. Buying transferred calls or leads from a generator you never audited is the usual pattern.
Why the letter came to you and not the vendor
The recipient usually cannot identify the dialer. The call sold your product, the agent used your name, the transfer landed in your office. You are the party the recipient can find and the party with assets. The recipient's claim is against everyone in the chain; the letter went to the end of it.
What a contract does
A well-drafted vendor agreement requires TCPA compliance, prior express written consent in the FCC's form, registry scrubbing, calling-hours controls, record retention and an indemnity. That is useful in two ways: it supports an argument that unlawful calls were outside the vendor's authority, and it gives you a claim against the vendor for what you pay. It does not make the claim against you disappear, and an indemnity from a vendor that has no money is paper.
What to do now
- Identify which vendor made each call in the letter. Transfer logs and lead-source fields usually show it.
- Write to that vendor the same day: consent record, lead source, dialer logs, scrub records and calling-hours controls for every listed number, by a date before your deadline. Put the demand letter on notice to them under the indemnity clause.
- Suspend the vendor's campaigns to your numbers until the records arrive.
- Use what comes back. Consent in the right form, as set out in TCPA consent explained, removes items from the count. No consent, or a vendor that will not answer, tells you the items stand.
The long-term fix
Every vendor dialing for you is a liability you have outsourced the control of but not the consequence. Audit consent capture before you buy, require the records monthly, and keep your own copy. The prevention checklist sets this out.
Quick answers
Is a business liable for TCPA violations by a lead generator?
Often yes. The FCC's 2013 declaratory ruling in the Dish Network matter held that a seller can be vicariously liable for calls made on its behalf under federal common law agency principles: actual authority, apparent authority or ratification. Buying leads generated by unlawful calls and keeping the benefit is the ratification pattern.
Does an indemnity clause protect me?
It shifts cost between you and the vendor. It does not change your liability to the person who received the call. If the vendor is small, offshore or dissolved, the indemnity is worth what the vendor can pay.
What should I ask the vendor for?
The consent record for every number in the letter, the source of the lead, the dialing platform logs, their do-not-call scrubbing records and their calling-hours controls. Ask in writing with a date. A vendor that cannot produce consent for the numbers it called has told you what you need to know.