There's a sentence that lets campaign managers sleep at night, and it's a trap: "Our vendor handles compliance."
It feels like a transfer of risk. You paid a platform, the platform sends the texts, so surely the platform owns the legal exposure. When the demand letter arrives, you'll learn how wrong that felt. Because the name on the lawsuit is going to be the committee's, not the vendor's.
Who the law actually holds responsible
The TCPA and the carrier rules look through the tooling to the sender, the party on whose behalf the message went out. That's your campaign. The committee that wanted the voters contacted is the one that "made" the calls in the eyes of the law, regardless of which software pushed the button. A vendor is a tool. Liability lands on the hand that used it.
So the comforting division of labor, "we run the message, they run the compliance", is often fiction. You chose the list. You decided who to text. You benefited from the send. When a plaintiff goes looking for a defendant with a stake in the outcome and a name voters recognize, they're not suing your SaaS provider. They're suing your candidate's committee.
The contract won't save you the way you think
"But our contract says they're responsible." Read it again, with a lawyer. Most vendor agreements do the opposite of what campaigns assume: they put the duty to obtain consent and to text only lawful lists on you, the customer, and they disclaim the vendor's liability for how you use the platform. Many require you to indemnify them if your sending draws a claim. The paperwork you thought was a shield is frequently a document explaining, in advance, why the vendor walks away clean and you don't.
And even where a vendor does have some obligation, a campaign lives for months and a committee can be wound down. Chasing a contractual indemnity through litigation, while a plaintiff is already coming for you, is not a plan. It's a hope.
The false comfort is the danger
The reason this matters isn't that vendors are villains. It's that the belief itself, "compliance is handled", is what causes the corner-cutting. A campaign that thinks the vendor owns the risk stops asking whether the list was consented, stops keeping its own records, stops treating every send as its own legal act. The false sense of safety is precisely what produces the unconsented blast that draws the demand letter.
The tool doesn't absolve the sender. It never has.
Own it, so it can't own you
The campaigns that stay safe don't outsource the responsibility, they own it, and choose tools that make owning it easy. That means insisting on documented consent for every contact, keeping your own audit trail, understanding your registration, and treating the platform as an instrument you're accountable for, not an insurance policy you bought.
A good platform helps you carry that responsibility, with consent capture, enforced opt-outs, and a real record. What no platform can do is take the responsibility off your committee's name. And the demand letter isn't the only threat: regulators can act too, as the $5 million FCC political robocall fine shows. When the consequences come, they come to you. Plan like they will.
Frequently asked questions
If my vendor sent the texts, isn't the vendor liable?
Usually not the way campaigns hope. The TCPA looks to the sender, the party on whose behalf messages went out, which is your committee. The vendor is a tool; liability generally lands on the campaign that chose the list and benefited from the send.
Doesn't my vendor contract make them responsible for compliance?
Read it carefully with counsel. Most vendor agreements place the duty to obtain consent on the customer, disclaim the vendor's liability, and sometimes require the customer to indemnify the vendor. The contract often protects the vendor, not you.
Informational, not legal advice. Consult counsel and read your agreements.
Keep reading: The plaintiffs who hunt political campaigns and do campaigns need consent to text voters.