The quote form is a legal surface: what US lead capture has to get right
In most markets a contact form is a design problem. In the United States it is also the record of what a person agreed to, and that record is what gets examined when a lawyer, a carrier or a state regulator takes an interest. The rules live in four separate places, none of which talk to each other: telephone consumer protection for calls and texts, carrier registration for messaging, federal email rules, and a growing set of state privacy laws. This is what each one asks of the page itself. It is not legal advice, and none of it substitutes for counsel who knows your industry.
Consent belongs next to the button, not buried in the terms page
The Telephone Consumer Protection Act supports private lawsuits with statutory damages per message, which is why it drives so much of what US lead forms look like. Marketing calls and texts placed with an autodialer or a prerecorded voice require prior express written consent, and the standard is about clarity: the person has to see, at the point of submitting, who will contact them, by what channel, that consent is not a condition of purchase, and how to opt out. A pre-ticked box is not consent, and a link to terms containing the disclosure is a weak position to defend.
The rules around lead sharing have been unsettled. The FCC adopted a one-to-one consent requirement aimed at lead generators, and the Eleventh Circuit vacated it before it took effect, so the earlier standard governs. If you buy leads, sell leads, or pass a submission to partners, that is the area to review with counsel rather than to infer from a blog post, including this one. The FCC has also tightened how quickly a revocation must be honored and made clear that consumers can revoke by any reasonable means, which makes opt-out handling an engineering problem, not just a policy line.
- Unchecked, separately visible consent, never bundled with the terms acceptance
- Name the actual company that will make contact, and the channels: call, text, email
- State plainly that consent is not required to buy, and give the opt-out method
- Capture the artifact: exact wording shown, timestamp, page URL, IP, form version
- Honor revocations quickly and across every tool, not only where they arrived
If you plan to text, carrier registration is a website requirement
This is the part that catches US teams by surprise. Sending application-to-person messages from a ten-digit number requires brand and campaign registration under A2P 10DLC, and unregistered traffic is filtered or blocked outright by the carriers. Registration is reviewed against evidence, and much of that evidence is on your website.
In practice, campaigns are rejected for reasons that are website problems: the opt-in flow is behind a login so the reviewer cannot see it, the sample messages do not match what the form promises, there is no privacy policy link, or the privacy policy does not state that mobile opt-in information is not sold or shared with third parties for marketing. Handling for STOP and HELP has to work, and the messages themselves need to identify the sender. Building the form and the policy without checking the registration requirements first means a launch delayed by weeks while the campaign is resubmitted.
- A publicly reachable page showing the opt-in, with the exact consent wording
- A privacy policy that addresses mobile opt-in data and third-party sharing explicitly
- Sample messages that match the promise made at the form
- Working STOP, START and HELP handling, and sender identification in the message
- Message frequency and any data-rate disclosure where required
Email: the unglamorous rules that are still enforced
CAN-SPAM is old and widely ignored until it is not. It applies to commercial email including the automated follow-up sequences fired by your CRM, not just to newsletters. The requirements are simple: no deceptive headers or subject lines, a valid physical postal address in the message, a clear and working way to opt out, and opt-outs honored within ten business days. The FTC's compliance guide sets it out plainly.
The failure mode is almost always fragmentation. Someone unsubscribes from the marketing platform, but the sales sequence runs from a different tool with its own list, and the messages keep arriving. Treat suppression as a single source of truth that every sending system reads from, and audit it whenever a new tool joins the stack.
State privacy laws changed what your tags are allowed to do
California's privacy law defines sale and sharing broadly enough to cover passing identifiers to advertising platforms through ordinary pixels, which means your remarketing tag is in scope. Consumers get an opt-out, the site needs the required choice link, and the Global Privacy Control browser signal has to be honored as an opt-out request rather than treated as advisory. A growing number of states have their own comprehensive laws with different triggers, different rights and different exemptions, so a site with national traffic is dealing with several overlapping regimes.
There is a second, less obvious exposure. Plaintiffs have used state wiretapping statutes, notably California's, against businesses running session replay, chat widgets and analytics that capture user input, on the theory that a third party is listening in on a communication. Whatever the eventual outcome in court, the defensive posture is the same: know which tools capture what, disclose them, mask sensitive fields, and put the tags that need consent behind a consent mechanism rather than firing them on page load.
- Inventory every tag and widget and what each one actually collects
- Gate advertising and analytics tags that require consent, rather than loading them unconditionally
- Publish the required privacy choice link and honor Global Privacy Control
- Mask form inputs in session replay, and disclose replay and chat recording
- Keep the privacy policy owned by one person and reviewed when tools change
Build it so it does not rot six months later
The pattern that survives is to store the consent artifact with the lead record itself. When a submission lands in your CRM it should arrive with the exact consent text that was on screen, a version identifier, the timestamp, the page and the IP. Reconstructing that a year later from a Git history and a screenshot is the position nobody wants to be in, and it is the position most companies are in.
Then decide who owns it. The form, the privacy policy, the tag manager and the messaging tool are usually touched by four different people, none of whom think of themselves as responsible for compliance. Every new tool, every new ad platform, every new automation is a change to what the page collects and where it goes. Put one name against it and review it on a schedule, because the version that fails is always the one someone added quickly for a campaign.
Frequently asked questions
Can I just put the consent language in my terms and conditions?
It is a much weaker position. The standard is whether the person clearly saw and agreed to what they were consenting to, so disclosure at the point of submission, unbundled from other acceptances, is what holds up. Keeping the language visible next to the button also costs you very little in conversion once it is written like a human wrote it.
We only email leads, never text or call. Does TCPA matter?
Not for email itself, which is CAN-SPAM territory. But phone numbers collected today get called or texted later, often when a new sales tool arrives. If you capture a phone number, get the consent language right now rather than retrofitting it against a list whose provenance you can no longer prove.
Why was our SMS campaign rejected when everything looks fine on our end?
Registration is judged against publicly verifiable evidence. The usual causes are an opt-in the reviewer cannot reach, sample messages that do not match the form's promise, a missing privacy policy link, or a policy that does not address mobile opt-in data sharing. All four are website fixes, which is why registration requirements should shape the build rather than follow it.
Do state privacy laws apply to a small business?
It depends on the state and on thresholds tied to revenue and to how much personal data you process, so some small businesses fall outside some laws. Coverage is expanding and the thresholds differ, so 'we are too small' is a conclusion to verify with counsel, not to assume. The engineering work of controlling your own tags is worth doing regardless.
Will all this consent language hurt our conversion rate?
Written badly, yes. Written as a plain sentence in normal type, the effect is usually small, and the leads you lose are disproportionately the ones who did not want to be contacted. Compare it against a single statutory-damages claim and the arithmetic is not close.
If your form was designed before any of this existed, send us the page and tell us how you follow up: call, text, email, or all three. We will show you what the page has to say, what has to be recorded with each lead, and what has to be true before a carrier will deliver your messages, then quote the build against that. For the legal call, work with your attorney; we handle what has to exist on the site.