Most sales teams think of the terms of service on a lead form as insurance. Somebody clicked the box, the box contained an arbitration clause, and if that person ever sues, the clause quietly moves the fight out of open court into a cheap private forum. That has been the working assumption for the better part of a decade.
On August 10, Judge F. Kay Behm of the U.S. District Court for the Eastern District of Michigan declined to play along. In Dobronski v. Rocket Mortgage, the court denied the company's motion to compel arbitration without prejudice, froze all proceedings on the merits, and ordered limited discovery plus a summary trial on exactly one question: did the plaintiff, or anyone acting on his behalf, actually fill out the online inquiry form that carried those terms? Everything else waits. As Troutman Amin's summary of the order framed it, no form, no forum.
This is one district judge in one case, and it binds nobody. It is still the most instructive thing to happen to lead generation this month, because it names the actual asset. Not the lead. The proof.
What a defensible lead record contains
Ask your operations person to pull the twenty oldest open leads in your CRM and produce, for each one, the page URL where the form sat, the submission timestamp, the IP address, the user agent, and the verbatim disclosure language displayed on the screen at the moment of submission. Most teams cannot do it. What they have instead is a field that says Source: Facebook Lead Ad, which in a formation dispute is indistinguishable from a shrug.
Lead consent records are not a compliance chore filed away in case of audit. They are the difference between a two hundred dollar arbitration filing and a class action with discovery. The cost of building them is close to zero if you do it at capture. The cost of reconstructing them eighteen months later, from a landing page you have since redesigned twice, is unbounded.
Pennsylvania lands October 18
The second development is legislative and has a date on it. Pennsylvania's SB 992 passed both chambers unanimously in July and takes effect on October 18, 2026, giving teams a ninety day runway that is now down to about nine weeks.
The Pennsylvania telemarketing law is broader than the robocall framing suggests. It expands the definition of telephone solicitation to explicitly include text messages, voicemails, and ringless voicemails. It restricts contact to 9:00 a.m. through 7:00 p.m., with nothing on Sundays or legal holidays. It requires prior express written consent for robocalls to all line types, and that consent has to identify the specific number being contacted and state plainly that agreeing is not a condition of purchase. It extends do not call protections to business and wireless subscribers, with quarterly list updates. It bans caller ID spoofing and bans AI generated messages designed to mislead. Penalties run to $1,000 per violation, or $3,000 where the person contacted is 60 or older, and violations also count as violations of Pennsylvania's Unfair Trade Practices and Consumer Protection Law.
Read that business and wireless line twice. Plenty of B2B teams have operated for years on the belief that do not call is a consumer problem and a direct dial to a VP is fair game. In Pennsylvania, after October 18, that belief is expensive.
There is a safe harbor, and it is a real one: documented prior express written consent, or an established business relationship formed by a transaction or inquiry within the previous twelve months. Which brings the story back to records. The safe harbor is only as good as your ability to produce the document that proves it.
The deregulation that was not
It is worth naming the misreading that got the industry here. When the Eleventh Circuit vacated the FCC's one to one consent rule in January 2025, and the FCC formally removed the requirement that September, a lot of teams read the outcome as the regulatory tide going out. Lead buying got easier. Shared consent came back.
The tide did not go out. It moved. Enforcement migrated to state legislatures, which now include Texas, Florida, Oklahoma, Maryland, and as of October, Pennsylvania, and to evidentiary standards inside courtrooms. The federal rule that would have forced one to one consent is gone. The practical burden of proving consent in front of a judge is heavier than it was.
A third data point from the same week reinforces the direction. On August 7, the Third Circuit revived a TCPA class action against Johnson & Johnson Health Care Systems, holding that a two page fax describing a patient assistance and savings program was plausibly an unsolicited advertisement despite its soft, helpful framing. Every SDR in America has been trained to lead with value and avoid the pitch. That training does not change how a message gets classified if it steers toward a purchase.
Nine moves, in order
First, audit your last two hundred leads against the five field standard above. Anything that fails is a lead you cannot defend, and that number is your real risk exposure.
Second, screenshot and version every lead form and landing page, with dates. When a dispute surfaces in 2028, an image of what the page said in August 2026 is the entire case. Lead capture documentation is cheap right up until the moment you need it.
Third, add a required consent proof field to your CRM that holds a link to the stored capture record, and gate dialing on it. No proof, no dial. This is unpopular for about two weeks and then it becomes invisible.
Fourth, if you buy leads, change what you are buying. Contract for the capture record, not the contact. Require certificates of provenance with every record and require indemnification. Lead vendor due diligence means rejecting anyone who ships a CSV with no history attached, however good the price looks. We have made the case before that buying leads your pipeline cannot absorb is a way to lose money faster, and buying leads you cannot document is the same mistake with a legal bill attached.
Fifth, configure outbound calling windows in your dialer and SMS platform now, by contact state, not by your own office hours. Pennsylvania: 9 to 7 local, no Sundays, no legal holidays.
Sixth, expand your suppression keyword list beyond STOP. SB 992 names QUIT, END, REVOKE, OPT OUT, CANCEL, and UNSUBSCRIBE. Test each one and confirm it actually suppresses rather than routing to a queue somebody reads on Thursdays. Getting SMS opt out keywords wrong is the most avoidable violation on this list.
Seventh, scrub business and wireless numbers against do not call registries and update quarterly.
Eighth, build a twelve month clock into the CRM so records aging out of the established business relationship window get flagged and routed to email or re-consent instead of the dialer.
Ninth, reread your warmest templates through the Johnson & Johnson lens. If the message points toward a quote, a saving, or a purchase, treat it as a solicitation no matter how gently it is worded.
Who can ignore this
Email only teams, largely. SB 992 and the TCPA govern calls and texts; email lives under CAN-SPAM and whatever the mailbox providers decide, which is its own moving target and one reason inbound flow has gotten less predictable as search results answer questions without sending the click. Referral driven businesses with no outbound dialing are unaffected. Teams already running documented double opt in with full capture logs need to verify, not rebuild, and that verification is a morning of work.
Everyone else is looking at a nine week runway and a district court order that reads like a preview. TCPA compliance for small sales teams has historically meant buying a scrubbing service and hoping. What both of these developments reward is something duller and more durable: writing down what happened, when it happened, and what the person actually saw. Volume was never the risk on its own. Volume without a record is.
The last piece of this connects to something we argued when AI SDRs made 7,400 monthly touches possible. Capacity outran accountability. Now the courts and a handful of state legislatures are pulling accountability back into line, and the teams that already log everything are about to look prescient rather than fussy.
