Is Skip Tracing Legal? What Investors Must Know Before They Call or Text

Esteban Andrade

November 1, 2026

•

12 Min

Skip tracing rarely gets an investor sued. The text message sent five minutes later does. Most operators ask whether they can buy an owner's phone number, when the expensive question is what they are allowed to do with it.

This is general information, not legal advice. Laws change and differ by state. Talk to your attorney before you launch outbound calling or texting, and use this page to make that conversation shorter.

Key points

Is skip tracing legal? In general, yes: looking up a property owner's contact details from public records and licensed commercial data is legal in the US. The legal risk sits in restricted data and in how you contact people.
Getting the data is governed by the FCRA, the Gramm-Leach-Bliley Act and the Driver's Privacy Protection Act, which limit certain data to certain purposes. Marketing to buy a house is not a listed purpose under any of them.
Using the data is governed by the TCPA, the Do Not Call rules, calling-hour limits, state laws and carrier rules. A text message counts as a call under the TCPA.
Private TCPA suits carry $500 per violation, up to three times that if willful, so one bad texting campaign can cost more than a year of marketing.
Florida and Texas add their own rules on calling hours, call limits, automated systems and texts.

Is skip tracing legal? The short answer

In general, yes: buying and using skip-traced data is lawful for a permissible purpose, meaning one the law and your data vendor's terms allow, while how you contact those numbers is regulated. The FCRA, GLBA and DPPA limit what some data may be used for. The TCPA, FCC calling rules and state laws govern the calls and texts.

Searching public records for an owner's phone number is not a crime. Lying to a bank or lender to get an owner's account details is, under the GLBA pretexting ban.

The search results for this question are written for process servers and debt collectors, who work under different rules. An investor's risk is narrower and more expensive: buying data you cannot use for marketing, and contacting owners in ways the TCPA, Do Not Call rules or your state prohibit.

Getting the data vs using it: the laws that apply

Two sets of laws apply to skip tracing, one for where the data comes from and one for how you contact people. Here they are side by side, with the primary source for each, as of November 2026.

Law or rule	What it covers	What it means for an investor	Primary source
Fair Credit Reporting Act (FCRA)	Consumer reports from consumer reporting agencies	Reports may be furnished only for listed purposes such as credit, employment and insurance. Do not use skip trace data to screen tenants or buyers.	15 U.S.C. 1681b
Gramm-Leach-Bliley Act (GLBA)	Nonpublic personal information held by financial institutions	Sharing is limited to listed exceptions; marketing to consumers is not one of them.	15 U.S.C. 6802
GLBA pretexting ban	Getting a financial institution's customer data by false statements	Never pose as an owner, heir or lender to get loan or account details.	15 U.S.C. 6821
Driver's Privacy Protection Act (DPPA)	Personal information from state motor vehicle records	Bulk use for marketing or solicitations is allowed only with the person's express consent to the state.	18 U.S.C. 2721
Telephone Consumer Protection Act (TCPA)	Autodialed, prerecorded and telemarketing calls and texts	Consent before automated calls or texts to cell phones; written consent for telemarketing; $500 per violation in private suits.	47 U.S.C. 227
FCC rules	Calling hours, Do Not Call, consent revocation	No telephone solicitations before 8 a.m. or after 9 p.m.; honor opt-outs within 10 business days.	47 CFR 64.1200
Telemarketing Sales Rule and National DNC Registry	Telemarketing calls to registered numbers	Sync your lists with the registry at least every 31 days; fines up to $53,088 per violation.	FTC DNC Q&A
CAN-SPAM Act	Commercial email	Accurate headers and subject lines, a postal address and an opt-out honored within 10 business days.	FTC CAN-SPAM guide
Florida Telephone Solicitation Act and 501.616	Telephonic sales calls, texts and voicemails in Florida	Written consent for automated systems; calls only 8 a.m. to 8 p.m.; no more than 3 calls in 24 hours on the same subject.	Fla. Stat. 501.059
Texas SB 140	Texas telephone solicitation law, Chapter 302	From September 1, 2025, "telephone call" in Chapter 302 includes text messages.	Texas SB 140 bill analysis

Getting the data: FCRA, GLBA and the DPPA

The data side is mostly about using information only for the purpose it was released for. Three federal laws do most of the work.

FCRA: do not turn contact data into a screening tool

The FCRA limits consumer reports to listed purposes such as credit, employment, insurance and certain business transactions the consumer started. Calling an owner to buy their house is not on that list. Some data vendors say plainly that they are not consumer reporting agencies; Thomson Reuters, for example, bars using its data as a factor in credit, insurance, employment or housing decisions.

For an investor, the practical rule is simple. Use skip trace data to find and contact owners. Do not use it to decide whether to rent to a tenant, sell to a buyer on terms, or approve anyone for credit.

GLBA: financial data and the pretexting ban

The Gramm-Leach-Bliley Act limits how banks and other financial institutions share customers' nonpublic personal information, and its general exceptions cover things like fraud prevention and legal compliance, not marketing. It also bars sharing account numbers for telemarketing, direct mail or email marketing.

The part that catches investors is the pretexting ban in 15 U.S.C. 6821. It is illegal to get a financial institution's customer information by making false statements. Calling a seller's lender and pretending to be the seller to learn a payoff is exactly that. Get a signed authorization instead.

DPPA: motor vehicle records are not a marketing list

The Driver's Privacy Protection Act bars states from releasing personal information from motor vehicle records except for listed uses. Bulk distribution for marketing or solicitations is allowed only if the state has the person's express consent. If a data source draws on DMV records, it was not built for cold outreach to homeowners.

If a vendor asks you to choose a GLBA or DPPA "permissible purpose" before searching, read the list carefully. Picking a purpose that does not match what you are doing is the violation.

Using the data: TCPA, Do Not Call and calling hours

The contact side is where investor lawsuits come from, because the TCPA gives private plaintiffs statutory damages for every call or text. Here is what the federal rules say.

Texts are calls. In Campbell-Ewald v. Gomez (2016), the Supreme Court said a text message to a cell phone "qualifies as a 'call'" under the TCPA.
Consent before automation. Under 47 CFR 64.1200, calls to cell phones using an autodialer or an artificial or prerecorded voice need prior express consent. Telemarketing calls of that kind need prior express written consent.
The autodialer definition is narrow, the rest is not. In Facebook v. Duguid (2021), the Court held an autodialer must use a random or sequential number generator. Prerecorded voice rules, Do Not Call rules and state laws still apply.
Damages add up. 47 U.S.C. 227 lets people sue for $500 per violation, and a court can triple it for willful or knowing violations. Do Not Call suits require more than one call in 12 months.
Calling hours. No telephone solicitations to residential numbers before 8 a.m. or after 9 p.m. at the called party's location.
Opt-outs. People can revoke consent by any reasonable method, and you must honor it within 10 business days.

AI calling agents sit inside the same consent rules, and the vendors know it. Jordan Fleming, founder of smrtPhone, which sells AI calling agents, told a July 2026 Office Hours session on Esteban's channel that "outbound carries compliance risk." His rule for skip-traced and purchased data: "if you buy a list, do not put them into an AI caller."

Even on opted-in contacts, his agents check the area code before dialing, cap how often they reach out and honor "don't call me again." He also called verbal consent the lowest bar: it only holds up if the call was recorded lawfully, which in two-party consent states means telling the person first.

One open question matters for investors. The FCC defines telephone solicitation and telemarketing around encouraging a purchase, rental or investment in property, goods or services. The FTC's Do Not Call guidance is written for calls that sell something and does not address calls where you want to buy. Do not treat that silence as permission. Ask your attorney how your state and your scripts are treated.

The safe operating rule is the same either way: scrub against the National Do Not Call Registry at least every 31 days, keep an internal do-not-call list, scrub known litigators, and check the FCC's Reassigned Numbers Database before you call old numbers. From October 1, 2026, registry data costs $85 per area code after the first five, capped at $23,425 a year.

State rules: Florida and Texas

State laws can be stricter than federal rules, and two of the biggest investor markets have their own. These are examples, not a full list; check every state you call into.

Florida. Section 501.059 covers calls, texts and voicemails, and requires prior express written consent for unsolicited sales calls using an automated system. Before suing over texts, a person must first reply "STOP," and the sender has 15 days to stop. Section 501.616 limits commercial solicitation calls to 8 a.m. to 8 p.m. and to three calls in 24 hours on the same subject.
Texas. SB 140, effective September 1, 2025, defines "telephone call" in Chapter 302 of the Business and Commerce Code to include text messages. Chapter 302 is Texas's telephone solicitation law. Ask your attorney whether your texting needs registration or fits an exemption.

Texting a skip-traced list: the carrier layer

Texting skip-traced numbers carries more risk than calling them, because a cold number comes with no consent and carriers enforce their own rules on top of the law. Even if a lawsuit never comes, carriers can block your messages.

The wireless industry's CTIA Messaging Principles (May 2023) call for express written consent before marketing texts, standard "STOP" opt-out wording, and consent that is not transferable to another sender. They also advise against texting rented, sold or shared opt-in lists.

A skip-traced number fails that test by definition. That is why many operators use mail and manual calls for cold records and save texting for people who opted in. One federal change cut the other way: in January 2025 the Eleventh Circuit vacated the FCC's one-to-one consent rule. That did not make cold texting legal; it only changed how consent forms may be written.

Carriers tightened their side too. Esteban explained in a May 2025 video that investors now have to register every sending number under A2P 10DLC, because so many were spamming homeowners that wholesaling became a high-risk, closely watched category for carriers.

Operators are adjusting. Brandy Pollock, a Hesel client who runs a nationwide Google PPC business, said on an August 2026 Office Hours session that in 2024 he stopped bulk texting sellers over TCPA liability and moved to inbound. His team still texts sellers, but only inside follow-up sequences for owners who reached out first.

Email and mail

Email to owners falls under CAN-SPAM, and mail is the lowest-risk channel for cold records. The FTC's CAN-SPAM rules require honest headers and subject lines, a valid postal address, a clear opt-out, and opt-outs honored within 10 business days. Each violating email can cost up to $53,088.

Mail is not covered by the TCPA or the Do Not Call Registry, which is one reason many investors mail stacked lists before they call them. Keep the letter honest: no fake government seals, no "final notice" language, no promises you cannot keep. Our guide to direct mail for real estate investors covers cost and response math.

A compliance checklist before you dial or text

Run this checklist before every outbound campaign on skip-traced data. It does not replace an attorney; it gives your attorney less to fix.

Confirm your data vendor's terms allow marketing use.
Never use skip trace data for tenant, buyer or credit decisions.
Scrub against the National Do Not Call Registry within the last 31 days.
Scrub your internal do-not-call list and known litigators.
Check reassigned numbers on old data.
No autodialer, prerecorded voice or automated texting to cell numbers without the required consent.
Call only within federal hours and stricter state hours, and respect state call limits.
Honor every opt-out, by any reasonable method, within 10 business days or sooner.
Check state registration rules, including Texas Chapter 302 for texts.
Keep records: data source, scrub dates, consent proof and opt-out logs.

For the operating side, our guide to skip tracing for real estate investors covers workflow and cost, and our skip tracing vendor comparison notes which vendors include DNC and litigator scrubbing.

How Hesel handles consent on inbound

Hesel Media runs inbound motivated seller campaigns, so our ISAs call people who asked to be contacted. Our form standard builds consent in from the start instead of bolting it on after. Esteban's rule is plain: capture consent before any text or email goes out.

Our copy standard for seller forms calls for a separate SMS consent checkbox, STOP and HELP language, and a privacy link. Consent is never a condition of getting an offer. Calls are recorded only with the disclosures two-party consent states require. We build Hesel seller forms and call setups to that standard.

The same care applies to ad data. Our Meta conversion tracking SOP calls for sending only neutral pipeline stages and never fields that describe a seller's hardship, such as foreclosure, divorce, probate or health.

Talk to us about calling sellers who asked

If your team spends more time scrubbing lists than talking to sellers, the problem may be the source, not the scrub. Inbound sellers fill out a form, give consent and expect your call.

See how our ISAs handle speed to lead and appointment setting, and how our Facebook ads for investors bring in sellers with consent captured at the form. Then book a strategy call. Bring your current outbound numbers, and your attorney's notes if you have them.

Frequently asked questions

Is skip tracing illegal?

Skip tracing is not illegal in the US when you use public records and licensed data for a permitted purpose. It becomes illegal when someone uses false statements to get financial information, uses restricted data for marketing, or contacts people in violation of the TCPA, Do Not Call rules or state law.

Can anyone run a skip trace?

Anyone can search public records and people-search sites to run a basic skip trace. Some data sources carry federal limits on who may use them and why, such as DMV records under the DPPA and financial institution data under the GLBA, so read your vendor's terms before you search or market.

Can I text skip-traced phone numbers?

Texting skip-traced phone numbers is high risk. A text counts as a call under the TCPA, texts to numbers on the Do Not Call Registry raise the same issues as calls, and some states, such as Florida, cover texts in their own laws. Carriers also want consent for marketing texts. Confirm any texting plan with an attorney.

Do I need to scrub skip-traced numbers against the Do Not Call Registry?

Yes, scrub skip-traced numbers against the National Do Not Call Registry before calling, and sync at least every 31 days under the FTC's rules. Also keep an internal do-not-call list, scrub known litigators and check reassigned numbers. Treat the scrub as required even if you believe an exemption applies.

Is it legal to cold call homeowners to buy their house?

Cold calling homeowners to buy their house is regulated, not banned. Federal rules cover calling hours, Do Not Call scrubbing and opt-outs, and states such as Florida add call limits and hours. How the rules treat calls to buy property is unsettled, so confirm your program with an attorney.

What is non-FCRA data?

Non-FCRA data is information sold by vendors that say they are not consumer reporting agencies, so the data may not be used for credit, employment, insurance or housing eligibility decisions. Investors can use it to find and contact owners, but not to screen tenants, buyers or borrowers.

What happens if I violate the TCPA?

If you violate the TCPA, the person you called or texted can sue for $500 per violation, and a court can triple that for willful or knowing violations. Do Not Call claims apply after more than one call in 12 months. Each call or text can count separately, so damages grow fast.

Sources

Share this post

Hesel Media

November 1, 2026

•

12 Min

🚀BE OUR NEXT ‍SUCCESS STORY

🚀BE OUR NEXT
‍SUCCESS STORY