For outbound call centers, data is both the biggest cost and the biggest risk. Records without valid consent expose you to lawsuits and regulator action; stale or recycled records destroy contact rates. Vetting vendors properly is not optional.
Questions to ask every data vendor
- Where does the data come from? Ask for the exact websites or sources, and visit them. A vendor who will not name sources is a red flag.
- What did the consumer agree to? Ask for the exact consent language shown at the time of capture. It should clearly cover being contacted by you, for this type of product, by the methods you will use.
- Can you prove each record's consent? Look for consent certificates or session records (date, time, IP, page, disclosure shown). See consent certificates.
- How old is the data? Fresh data contacts far better and is easier to defend. Aged data is cheap for a reason.
- How many times has it been sold? Exclusive or limited-sale data performs better than records sold to dozens of buyers.
- Is it scrubbed? Against national and state DNC registries, known litigators and internal opt-outs — and how recently.
Audit before you scale
Buy a small test file first. Pull a random sample and verify the consent records against the source site. Call the sample and listen: do consumers remember requesting information? Track contact rate, transfer rate and complaints by file. Only scale vendors who pass.
Red flags
- Consent language that lists hundreds of "marketing partners" in a hidden link.
- Source websites that do not exist, look abandoned or have nothing to do with the product.
- Prices far below the market for "fresh" data.
- No willingness to sign a contract with warranties and indemnities.
- Consumers frequently saying "I never signed up for this".
The legal picture in brief
In the US, marketing calls using automated dialing technology or prerecorded or artificial voices, and marketing texts, generally require prior express written consent. The FCC's 2023 "one-to-one consent" rule was vacated by the Eleventh Circuit in January 2025, so consent does not have to name a single seller under federal rules — but it must still be clear and must cover you, and state laws and buyer requirements may be stricter. Calls to numbers on the National DNC Registry require consent or an established business relationship. In the UK, live marketing calls must be screened against TPS/CTPS, and live calls about claims management or pensions are generally prohibited without the person's prior consent.
Contracts protect you
Put warranties in writing: the vendor warrants that consent was obtained as described, agrees to provide proof on request within a short time, and indemnifies you for claims caused by its data. Keep copies of everything for at least five years.
BFOUNT asks every outbound publisher about data sources and consent language during onboarding. Clean data gets approved faster. Apply here.