Start / Our vendor
It was our vendor.
It was. And the letter is still addressed to you, because the calls were made for your business. The person called can pursue the company that benefited. Your vendor is a recovery question for later, not a defence now.
Why it lands on you
The TCPA gives the person called a claim against whoever is responsible for the call. The FCC and the courts have long treated a seller as liable for calls placed on its behalf by a vendor, agent or lead generator under ordinary agency principles. You chose the vendor, you set the goal, you paid for the leads, you took the appointments. The claimant does not have to work out your supply chain. They go to the name on the sale.
That is not the same as saying you are automatically liable for anything any vendor does. Agency has limits, and a lawyer will look at the contract, who controlled the script and the list, and whether you knew or should have known. But "we outsourced it" is the start of that analysis, not the end of the letter.
What the vendor owes you
Whatever the contract says. Look for compliance warranties ("all leads are TCPA compliant"), an indemnity clause, record-keeping obligations, and audit rights. If the vendor promised consent and cannot produce it, that is a claim you may have against them for what this costs you. It is a second matter, between you and them, after the first one is resolved. It does not make the first one go away.
What to ask the vendor for, today, in writing
- The full call or text log for the campaign: every number, date, time, outcome, originating number.
- The consent record for each listed number: the form as shown, the timestamp, the IP, the page, and which business was named in it.
- Their Do Not Call Registry scrub record for the list and the date it was run.
- Their internal do-not-call list and whether any listed number was on it.
- A copy of the signed contract and any compliance addendum, in case your copy differs.
Keep the request and the reply. A vendor who will not hand over records about calls you paid for has told you how the recovery conversation will go. The contract may give you a right to the data; check.
What not to do
Do not hand the letter to the vendor and let them respond for you. Their interest is in it being your fault, or nobody's. Do not forward the letter with a note saying "you told us this list was clean"; that email is useful to you later, but write it as a records request, not an accusation, until a lawyer has read the contract. Do not keep running the vendor's list while you sort it out. The rest of that list is on do not do this.
"The vendor said it was clean" is not a consent record. It is a sentence.
The consent question
For marketing calls or texts to a mobile phone using an autodialer or a prerecorded or artificial voice, the rule at 47 C.F.R. § 64.1200(f) requires prior express written consent: a signed agreement, electronic signature allowed, that clearly authorises the specific seller to make those calls to that number, with a statement that consent is not required to buy anything. Most purchased lists cannot produce that per number, naming your business. If the vendor can, the letter looks very different. If they cannot, you now know what you are dealing with. The sum is on how much trouble am I in?
Going forward
Whatever happens with this letter, the fix is in the contract and the records. A vendor who scrubs against the registry and can show it, who collects consent that names you, and who keeps the records and gives you access, is a vendor you can keep. One who cannot is the next letter.
Short version
- My vendor made the calls. Am I liable under the TCPA?
- Usually, yes, if the calls were made on your behalf. Sellers are held liable for calls placed by their vendors and agents under ordinary agency principles. The vendor contract may let you recover from them afterwards; it does not stop the claim against you.
- Can the person who got the call sue the vendor instead?
- They can pursue the vendor as well, but they do not have to, and most pursue the business the calls were for. You cannot redirect the claim by pointing at the vendor.
- What counts as proof of consent from a vendor?
- The actual record for each number: the form wording as published, the timestamp, the IP address, the page, and your business named as the party allowed to call. A spreadsheet column saying "opt-in: yes" is not it.
- Should I stop using the vendor?
- Pause the list and the campaign until consent has been checked. Whether to keep the vendor depends on whether they can produce records and will sign compliance terms.