Buying leads promises to solve the hardest part of prospecting — finding people to talk to — for a price. Building your own funnel takes longer to produce the same volume. The comparison agents usually make is speed versus effort. The comparison that actually matters, and that the marketing rarely mentions, is what consent the contact actually carries when it reaches you, and whose liability it becomes if that consent turns out to be thin.
Key takeaways
CASL prohibits sending a commercial electronic message unless the recipient has consented, expressly or by implication. CASL s.6(1) Implied consent under the Act arises from a specific, time-bound relationship — a purchase, lease or inquiry within a defined window — between the recipient and the person sending the message. CASL s.10 A vendor who sold you a list of names once had some relationship with those contacts, or claims to. That relationship, and whatever consent it produced, belongs to the vendor’s own dealings with them — it does not automatically transfer to you as the purchaser simply because you paid for the data. When you message a purchased contact, the practical question is whether you can show your own basis for consent, not the vendor’s.
The CRTC’s guidance for the real estate industry is direct about where liability actually sits: “the brokerage is liable for the actions of its agents and any lead generators used by its agents,” and the same guidance holds an agent personally responsible for a lead generator they hire directly. CRTC — Guidance for the Real Estate Industry The guidance adds a specific, easy-to-miss trap: “a person sharing their phone number on a website to sell their house does not constitute valid consent on their part to receive calls from a real estate agent offering their services.” A number scraped from a for-sale-by-owner listing, or supplied by a lead vendor who sourced it the same way, is not automatically callable just because it was public. And hiring a lead generator does not transfer the risk away from you — “even if a lead generator’s contract stipulates that it abides by the rules, this is not enough; you could still be held responsible of its actions.”
A landing page, an opt-in form, or a direct referral ask produces a consent chain you can actually document: you know the date, the exact wording the contact agreed to, and the specific action that produced it. That is the entire advantage — not that it is free (it costs your own time instead of a vendor’s invoice), and not that it is faster (it usually is not, especially at the start — building a pipeline from nothing covers building one from literally nothing). It is that when a contact from your own funnel is questioned, you can show exactly how consent arose. A contact from a purchased list gives you a name and a number, and very little else.
A purchased list arrives with volume already attached — hundreds of names at once — but every one of them needs its consent basis checked before you call or message, and the CRTC’s DNCL scrub-and-refresh duties apply to the whole list regardless of its source. CRTC — Guidance for the Real Estate Industry Your own funnel arrives one contact at a time, each with a documented opt-in, which is slower in volume but requires none of that retroactive checking, because the consent was captured correctly at the point of collection rather than inherited secondhand.
Some purchased-lead packages come bundled with an automated dialer that calls the list for you, sometimes using a synthesized or recorded voice. That is squarely an Automatic Dialing-Announcing Device under the CRTC’s rules, and the ADAD-specific consent requirement is stricter, not looser, than the ordinary telemarketing rule: a telemarketer “shall not initiate” a telemarketing call via an ADAD “unless express consent has been provided by the consumer,” and the ADAD Rules themselves state that they “apply whether or not the telemarketing telecommunication is exempt from the National DNCL Rules.” CRTC Unsolicited Telecommunications Rules, Part IV In practice, that means a purchased list’s thin implied-consent basis is not even enough to run through an autodialer — express consent, not implied, is the floor for that specific channel, regardless of whether the numbers are DNCL-registered.
CASL’s administrative monetary penalties run up to $1,000,000 for an individual and $10,000,000 for a corporation. CASL s.20(4) Those are ceiling figures for the Act’s worst violations, not a typical fine, but they set the scale of what is actually at stake in the “the vendor said it was fine” shortcut — a defence that, per the CRTC’s own guidance above, does not transfer the liability away from the agent or brokerage who made or authorised the call in the first place. Door knocking that is not a nuisance runs through the same consent question from a different starting point — a number collected in person rather than bought.
An agent buys a list of 200 “motivated seller” leads from a vendor who says the contacts “opted in on a partner site.” Before dialling, the agent asks the vendor for the actual opt-in language and the date each contact agreed to it. The vendor cannot produce either for roughly a third of the list. Those contacts are dropped rather than called, because there is no basis to show consent if a complaint ever asks. The remaining contacts are scrubbed against the National DNCL, as required regardless of source, before a single call goes out. A parallel funnel — a simple landing page offering a home-value estimate in exchange for an email — produces fewer names in the same period, but every one of them carries a timestamped, provable opt-in the agent captured directly.
No — buying a list is not itself prohibited. What matters is whether you can establish a valid basis for consent before contacting anyone on it, and whether the list has been scrubbed against the National DNCL like any other call list. The liability for getting either of those wrong sits with you, not the vendor.
No. The CRTC’s own guidance states plainly that a lead generator’s contractual promise to follow the rules is not enough — you remain responsible for their actions, and your brokerage remains responsible for yours. Diligence in selecting and monitoring a lead generator is expected, not optional.
Many agents do — a purchased list for volume alongside an owned funnel for provable-consent contacts — provided each purchased contact’s consent basis is actually checked rather than assumed. The two are not mutually exclusive; the mistake is treating a purchased list as compliance-ready by default.
A short conversation can walk through what consent basis a specific list or vendor actually offers before you commit a budget to it.
