How Jornaya and TrustedForm certificates protect teams calling purchased leads

Sources: each vendor's own pages, listed at the end, checked October 20, 2026.

A lead certificate is made by a script on the lead seller's form. When the consumer visits the page, the script watches the session and the vendor keeps the record. The buyer gets a reference to that record with the lead: a URL for TrustedForm, a LeadiD for Jornaya.

A certificate is strong evidence about one event on one page. Read it for what it shows:

• It shows the page the consumer was on, what that page displayed, what they did on it and when.
• It shows whether the record is genuine. Jornaya's "Authentic" check says "whether or not the LeadiD token was issued by Jornaya." ActiveProspect says to open certificates only from a URL that starts with https://cert.trustedform.com/ and not to accept images or videos of one, which "may be altered."
• It does not show on its own that the lead data you bought matches what was typed. That is a separate check: Jornaya's "Data Integrity" result, or TrustedForm's fingerprinting of the phone and email.
• It does not show on its own that the disclosure named your business. Jornaya's "Brand Name Present" check exists for that question.
• It does not decide whether the consent meets the legal standard for your call. That depends on the wording, the kind of call and the rules that apply, which is your counsel's call.

1. Open the original. Use the vendor's own record: a cert.trustedform.com URL, or the LeadiD in your Jornaya account. Never rely on a screenshot from the seller.
2. Match the lead. The phone number and name on the lead should match what the consumer entered. Use TrustedForm fingerprinting or Jornaya's Data Integrity result.
3. Read the disclosure. It should be on the page, readable and next to the action the consumer took. Jornaya scores its contrast, prominence and visibility; on a TrustedForm certificate, read it in the snapshot.
4. Find your name. Check that the disclosure names your business or the seller you call for.
5. Check the action. A checkbox, a radio button or a submit button. Jornaya reports this as the consent "Type."
6. Check the date. The certificate time should fit when the seller says the lead was made. A lead resold weeks later carries an older consent.
7. Claim or retain it. Do this in your own TrustedForm or Jornaya account before its window closes.
8. Scrub as usual. A certificate does not replace Do Not Call checks, calling hours or state attempt limits.

Two clocks matter: the vendor's window and your own records policy.

• TrustedForm. The standard claim period is "approximately 72 hours (3 days)," and missing it "will result in the irretrievable deletion of the certificate." The window grows to about 90 days when TrustedForm detects the form's submission. After that, certificates are "only accessible by the TrustedForm account holders that claimed them." TrustedForm Retain stores retained certificates "for up to 5 years" by default (check-in docs, Retain).
• Jornaya. Confirm with Jornaya how long the LeadiD record and its Visual Playback stay available under your account, and request the TCPA Compliance Report while it is.
• Your records. Where the FTC's Telemarketing Sales Rule requires a consent record, 16 CFR 310.5(a)(8) lists what it holds (the person's name and number, a copy of the request as shown, the purpose, a copy of the consent and its date), and 310.5(a) sets a general retention period of 5 years (eCFR). Ask counsel what period fits your campaigns.

Store the LeadiD or URL with the lead in your dialer or CRM, too. Without it, finding the certificate for a disputed call later is slow or impossible.

Federal rules require prior express written consent for telemarketing calls to cell phones made with an autodialer or an artificial or prerecorded voice (47 CFR 64.1200(a)(2)). The definition in 64.1200(f)(9) asks for a signed written agreement that "clearly authorizes the seller" to make those calls to a stated number, with a clear and conspicuous disclosure that signing is not a condition of purchase. An electronic signature counts where federal or state law recognizes it.

A certificate is how a buyer of web leads shows what that agreement looked like and when it was given. The FCC's one-to-one consent rule, which would have limited each consent to one seller, was vacated by the Eleventh Circuit on January 24, 2025 (IMC v. FCC), and the current rule text does not include it.

Whether your dialer is an autodialer under federal law is a separate question, and some state laws use broader wording. EmberDial's reading is on our ATDS page, and the tools we provide are on our compliance page. See also the glossary entry on consent certificates.

Any team that buys web leads and calls them has the same need: insurance, home services, solar, education, debt relief and more. Final expense telesales is a common example. An agency buys same-day web leads from a vendor, each with a LeadiD or TrustedForm URL, and calls them within minutes. Fresh leads arrive fast enough that the claim window is easy to miss, so the claim step belongs in the buying workflow, not in a monthly cleanup. Aged leads raise the opposite question: is a consent from months ago still the one you want to rely on? More on dialing both lead types is in our final expense dialer overview.