Every outbound call or text based on a web form depends on one question: did this consumer really agree to be contacted? Consent certificates are independent records created at the moment a form is submitted, designed to answer that question with evidence rather than promises.
What a consent certificate records
Services such as ActiveProspect's TrustedForm and Verisk's Jornaya (LeadiD) run a script on the form page. When a consumer submits, they generate a record that typically includes:
- The date, time and page URL of the submission.
- The consumer's IP address, browser and device details.
- A visual replay or snapshot of the page as the consumer saw it, including the consent language.
- How the form was filled in (typed, pasted, auto-filled) and how long it took.
- A unique certificate ID that buyers can verify and claim.
What they prove — and what they don't
A certificate shows that a form was submitted on a certain page with certain disclosures. It does not prove the person who submitted the form was the owner of the phone number, nor that the consent language was legally sufficient. Bots and fraudsters can still submit forms; good certificates help detect them (impossibly fast completion, pasted data, mismatched locations), but they are not a guarantee.
Consent language still matters most
Under the TCPA, marketing calls using automated systems or prerecorded voices, and marketing texts, require prior express written consent: a clear, conspicuous agreement authorising the seller to contact the consumer at the number provided, by those methods, with a statement that consent is not a condition of purchase. The FCC's 2023 one-to-one consent rule was vacated by the Eleventh Circuit in January 2025, but consent must still be clear and must cover the business that calls. Hidden partner lists with hundreds of names invite challenges — and some buyers now require their own brand to be named.
How buyers use certificates
- Before buying — checking that every lead arrives with a valid certificate ID and the disclosure they require.
- During disputes — verifying a lead when a consumer complains.
- In litigation — as evidence of consent, alongside call records and recordings.
Best practice for publishers
- Install the certificate script on every form page and pass the certificate ID with each lead.
- Place consent language directly above the submit button, in readable type — not in a hidden link.
- Name the companies (or clearly defined categories) that will contact the consumer, as your buyer requires.
- Keep certificates and lead data for at least five years.
- Never generate or reuse certificates for leads that did not come from that form.
BFOUNT asks every lead-generation publisher about consent capture during onboarding, and buyers can request proof for any lead. Apply here.