Defenses / Vendor and agency liability

"Our vendor made the calls": when that is a defense and when it is not

Updated 2026-11-037 minute read

"We did not make the calls" is the first thing an owner says when the calls were outsourced, and it is the defense that most often fails. The statute and the FCC both reach calls made on a seller’s behalf. Whether the vendor was acting on your behalf is a question of agency, decided on facts you created when you set up the relationship. Sometimes those facts help you. Often they do not.

The law

Section 227(c)(5) gives a private right of action for calls made "by or on behalf of" the same entity. For § 227(b) claims, the FCC's 2013 declaratory ruling on petitions by Dish Network and others held that a seller does not "make" a call placed by a third party, but can be held vicariously liable for it under federal common law principles of agency. Courts have followed that framework since. Three doctrines do the work.

Actual authority

You told the vendor to make the calls, or the vendor reasonably understood from your instructions that it should. A contract to run an outbound campaign for your product is actual authority for the calls in that campaign. Whether you also told them to break the law is irrelevant; a principal is liable for the agent's conduct within the scope of the work.

Apparent authority

You held the vendor out as acting for you, and the consumer reasonably believed it. The facts courts look at: the vendor used your name or brand on the call, had access to your systems or customer data, could enter information into your sales pipeline, used your approved scripts, or was identified to consumers as "calling from" your company. The more the vendor looked like you from the outside, the more apparent authority you gave it.

Ratification

You learned how the calls were being made and kept accepting the leads, the sales or the appointments. Knowledge plus benefit equals ratification. This is the doctrine that catches businesses that bought leads from a generator, received complaints or a first letter, and kept buying. The date you learned is the date ratification starts, and the leads you accepted after it are yours.

When it is a real defense

The vendor was a stranger to you: you never engaged them, never received leads from them, and they used your name without permission. Or the vendor acted outside the scope you gave it: you prohibited the method in writing, you had no knowledge, and when you found out you stopped and said so. Or the lead generator sold the same lead to many buyers, you bought it once with no control over how it was produced, and you did not know. Each of these is a fact pattern, and each one turns on documents.

When it is not

• Your contract specified the campaign, the lists, the script or the volume.
• Your staff reviewed call recordings, dashboards or dialer reports.
• The vendor had logins to your CRM or used your caller ID.
• You received complaints or an earlier letter and continued.
• You paid per call or per contact rather than per qualified lead.

What to do with the vendor

Tender the claim to them in writing. Invoke the indemnity clause if there is one. Ask for their consent records, their scrub logs and their dialer configuration; you will need them for consent and autodialer defenses regardless of who is liable. Do not delete the relationship history in the hope it makes you look less involved; a missing file is worse than a damaging one. An indemnity gives you a claim against the vendor. It does not stop the plaintiff from claiming against you.