The lead came in three minutes ago. Sarah, the office manager at a busy trade school, sees the notification on her screen. The person wants information about the upcoming welding program. Sarah reaches for her phone to call and book a tour.

Then she stops.

She remembers a headline about a $1,500 fine for a single unauthorized text message. She thinks about the lead generator website where this person found the school. Did they check a box? Was that box specific enough? Is she about to walk the school into a lawsuit?

Sarah puts the phone down. She decides to wait until she can look into the rules. By the time she feels safe enough to call, two days have passed. The lead has already booked a tour with the school down the street.

This is the hidden cost of TCPA confusion. It isn’t just the risk of a fine. It is the paralysis that stops your team from doing the one thing that grows your business: talking to people who asked for help.

And here is the thing worth knowing before anything else: most businesses lose more money from leads they were too afraid to call than they would ever pay in fines. The goal isn’t to avoid calling people. It’s to call them correctly — so there’s nothing to be afraid of.

What Sarah actually needs to know

The Telephone Consumer Protection Act governs how businesses can contact people by phone and text. If you use any kind of automated system to reach leads — including Leverly AI — you need consent before you contact them.

That’s the whole rule in plain language. Everything else is detail.

The detail that matters most for admissions coordinators and office managers: the person who filled out your form almost certainly already gave you that consent — as long as your form is set up correctly. If it is, Sarah can pick up the phone right now.

What “set up correctly” actually means

Your lead form needs a clear statement near the submit button. It should say that by clicking, the person agrees to receive calls or texts from your school — even if they’re on a Do Not Call registry — and that those communications may use automated technology.

It does not need to be long. It needs to be honest and specific.

A statement like this works:

“By submitting this form, you agree to receive calls and texts from [School Name] about our programs, including messages sent using automated technology. You can opt out at any time.”

That statement, combined with the person clicking submit, is your consent. Under federal law, a click counts as a signature.

What it cannot be: buried in fine print three pages away from the button. What it cannot do: grant consent to contact them about things unrelated to what they asked about. If someone submitted a form about your welding program and you start texting them about your cosmetology program, that connection breaks down.

The part most teams skip: keeping the record

Consent you can’t prove is the same as no consent.

If a complaint is filed, saying “I’m sure they checked the box” does not hold up. You need a record that shows the date, the time, the IP address, and the exact language the person saw when they clicked submit.

The cleanest way to handle this automatically is TrustedForm by ActiveProspect. It records the form session and generates a timestamped certificate you can pull if you ever need it. Leverly works with TrustedForm and can help you get it in place on your forms.

At minimum, your CRM or lead system should be logging when a lead came in and what form they filled out. Most do. Most teams just never check that the logging is actually working.

The rules changed — here is what that means for you

In late 2025, following court challenges, the FCC rolled back the strict “one-to-one consent” requirement that had been proposed for lead generation. The short version: if someone fills out a form asking to hear from schools in your category, they don’t have to have clicked your school’s name specifically to give valid consent.

This matters if you buy leads from third-party sources. Those leads may now be more actionable than they were under the proposed rules — but the consent language on the original form still needs to be solid, and you still need to verify it before calling.

If you generate your own leads through your own forms and ads, this change doesn’t affect you much. Your form, your consent, your record. That’s the cleanest situation to be in.

What happens if something goes wrong

The TCPA is a strict liability statute. That means intent doesn’t matter. If a message went out without proper consent, the violation happened — even if it was an honest mistake.

Fines start at $500 per message or call. If a court finds the violation was willful, that triples to $1,500. Professional litigators exist specifically to find these gaps — they sign up for lead lists, wait for a non-compliant message, and file. They are not looking for a relationship with your school. They are looking for a settlement.

The best protection isn’t to stop calling leads. It’s to make the process clean enough that there is nothing to find.

Some states have stricter rules than federal law — Florida, Oklahoma, and Washington among them. The safest approach is to use a system that handles timing and opt-out rules automatically, so your team doesn’t have to track which state allows calls until what hour.

When a lead replies STOP, the conversation ends immediately. No manual process, no grace period. Leverly AI handles this automatically — no lead stays in the queue after an opt-out.

What this means for Sarah

Sarah can pick up the phone. She just needs two things to be true:

1. Her form has clear consent language near the submit button.
2. Her system is logging when leads came in and what they agreed to.

If both are true, she is not walking the school into a lawsuit. She is doing her job — and doing it within the window where it actually works. Calling two days later isn’t safer. It’s just slower, and slower costs enrollments.

The leads that came in today are still warm right now. Tomorrow they are someone else’s students.

Common questions

Do I need one-to-one consent if I buy leads from a third party?
The strict one-to-one requirement proposed in 2023 was rolled back in late 2025. You still need the lead to have given express written consent to hear from a category of providers that includes you. Have your lead sources reviewed to confirm the disclosure language covers you.

How long do I need to keep consent records?
The statute of limitations for TCPA claims is typically four years. Keep records — IP address, timestamp, form version — for at least that long.

Does STOP mean stop immediately?
Yes. Always. Any opt-out request must be honored immediately. A system that handles this automatically removes the risk of human error.

What is the best way to document consent?
TrustedForm by ActiveProspect records the form session and generates a certificate tied to the lead record. At minimum, your system should log the lead’s contact info, the form they submitted, and the timestamp.

What does non-compliance actually cost?
Beyond legal fees, the real cost is the leads you didn’t call because you weren’t sure you could. If you’re paying for leads and too afraid to follow up fast, your cost per enrollment goes up every month. Fix the process so the fear goes away.

If your forms aren’t set up for clean consent documentation, that’s the place to start — before your next lead campaign goes live. Hear how Leverly AI handles inbound lead follow-up, or book a 15-minute walkthrough to talk through your current setup.

TCPA in 2026: What Every Admissions Coordinator Needs to Know Before Calling a Lead Back