TrustedForm alternatives: consent capture tools compared
4 tools comparedVendor claims read 2026-10-22
For a business that calls or texts people who signed up on a web form, its own or a lead seller's, and has to prove that sign-up later: what each tool records at the moment of consent, how long it keeps the record, and how you get it out when a complaint lands. We read four tools' own documentation on 2026-10-22; every status below names the page it came from. More side-by-sides sit in the comparisons index.
Verdict by use case
Best overall
The deepest documentation here: replay, a timestamped event log, IP and device, and Verify checks on wording, font size, contrast, opt-in type and the seller's name. Auto-Retain covers your own forms, and retained certificates last 5 years by default.
Best for a complaint file you can hand over
A Compliance Report with a Visual Playback is ready within hours of the request, and the product page says proof is kept in perpetuity. Jornaya is now part of ActiveProspect, so it is not an independent second opinion on TrustedForm.
Best outside the ActiveProspect family
Records the visit with IP, device and a replay, and its Confirm call checks consent language and the advertiser's name in one request. Claimed records are kept for up to 5 years.
Four tools, ten checks
The rows follow the FCC's definition of prior express written consent and the opt-in records CTIA asks senders to keep: the words shown, the action taken, who took it and when, then how long the proof lasts and who can see it. Scrubbing against Do Not Call and litigator lists is a separate job, covered in the DNC scrubbing comparison. "Our pick" marks the best-overall verdict.
| Requirement | Our pickTrustedForm | Jornaya TCPA Guardian | ValidRecord iClaim | Verified Consent |
|---|---|---|---|---|
| Captures the disclosure text the person saw | Yes | Yes | Yes | Check with the vendor |
| Records the consent action with a timestamp, IP and device | Yes | Check with the vendor | Yes | Yes |
| Session replay of the form visit | Yes | Yes | Yes | Yes |
| Scores how visible the disclosure was (font size, contrast) | Yes | Yes | Check with the vendor | Check with the vendor |
| Flags a pre-checked box or passive consent | Yes | Yes | Check with the vendor | Check with the vendor |
| Checks the seller's name in the disclosure | Yes | Yes | Yes | Check with the vendor |
| States how long kept records last | Yes | Yes | Yes | Check with the vendor |
| Claims and checks records by API | Yes | Yes | Yes | Check with the vendor |
| Works on your own first-party forms | Yes | Yes | Yes | Yes |
| Shares or exports a record for a dispute | Yes | Yes | Yes | Check with the vendor |
- Captures the disclosure text the person saw
- Written consent needs a clear and conspicuous disclosure, so the record should hold the exact words on screen at the moment of sign-up.47 CFR § 64.1200(f)(9)(i) (clear and conspicuous disclosure)
- Records the consent action with a timestamp, IP and device
- CTIA lists the timestamp, the consent medium, the IP address and the phone number among the opt-in records a sender should keep.CTIA Messaging Principles and Best Practices (May 2023), 5.1.2
- Session replay of the form visit
- A replay shows the page as the person met it; a screenshot of today's page shows only what the page looks like now.
- Scores how visible the disclosure was (font size, contrast)
- The disclosure must be clear and conspicuous; a font-size and contrast reading turns that test into something you can check per lead.47 CFR § 64.1200(f)(9)(i) (clear and conspicuous disclosure)
- Flags a pre-checked box or passive consent
- Written consent is an agreement the person signs; a box ticked on their behalf is weak proof that they agreed.47 CFR § 64.1200(f)(9) (prior express written consent)
- Checks the seller's name in the disclosure
- The agreement must clearly authorize the seller. The FCC's one-to-one rule is gone, but the seller calling still has to be the one named.47 CFR § 64.1200(f)(9) (prior express written consent)
- States how long kept records last
- A record has to outlive any claim against the call or text it supports, so know the default term and the deadline to keep it.
- Claims and checks records by API
- Checking every lead before the first call or text only works when your form handler or CRM can do it without a person.
- Works on your own first-party forms
- A business collecting its own sign-ups needs the same proof as a business buying leads from someone else.
- Shares or exports a record for a dispute
- Counsel, an auditor or a court has to see the record without logging in to your account.
What a record has to answer
When a claim arrives, a consent record has five questions to settle. Each tool above keeps some of the evidence; this is the checklist to hold it against.
| Question | What answers it | Field to look for |
|---|---|---|
| Who agreed? | The phone number typed into the form, matched against the lead you received, plus the IP address and device the visit came from. | Lead match, IP, device |
| What words did they see? | The disclosure text as it rendered on their screen, and whether it was large and dark enough to count as clear and conspicuous. | Consent language, font size, contrast |
| Which seller did they authorize? | The business named in that disclosure. The agreement has to clearly authorize the seller that calls or texts. | Seller or brand name |
| How did they agree? | A box they ticked themselves or a submit button under the disclosure, not a box that arrived already ticked. | Opt-in type, event log |
| When? | The time of the submit, which must come before the first call or text it covers. | Timestamp, replay |
Open one of your own records and try to answer all five from it. A gap is cheaper to find now than after a demand letter arrives. The questions come straight from the FCC's definition of prior express written consent (47 CFR § 64.1200(f)(9)) and the opt-in records CTIA asks senders to keep; the prior express written consent guide walks through the definition line by line, and the TCPA consent form builder writes a disclosure that answers the second and third questions up front.
One-to-one consent is no longer an FCC rule. The 11th Circuit vacated it on 24 January 2025, and the FCC removed it from its rules effective 29 August 2025. The seller-name checks in these tools still answer the third question, which the definition itself asks.
A certificate proves the moment of consent, not that it still holds. A STOP reply or any other reasonable revocation ends it, and the record of that has to sit beside the certificate. See TCPA rules for text messages and the records guides.
Keep it before it expires
A record lasts only if you keep it inside the tool's window, and each tool sets that window differently.
| Tool | Before you keep it | After you keep it | Read on |
|---|---|---|---|
| TrustedForm | Expires 3 days after creation, or 90 days once a submit is detected. Retain inside that window. | 5 years by default under the account's retention setting; longer or shorter on request. | ActiveProspect: Certificate expiration and retention window |
| Jornaya TCPA Guardian | The API reports a token created more than one year ago as expired. | The product page says proof is stored in perpetuity at no extra cost; reports on tokens older than 90 days take up to 24 hours. | InfutorData help: TCPA Guardian (3rd party) API |
| ValidRecord iClaim | Each record carries an expiry time; the unclaimed term is not stated in the docs read. Check with the vendor. | Up to 5 years once claimed. | ValidRecord: API documentation (Claim, Confirm, Lead Snapshot, Verify) |
| Verified Consent | Not stated. Check with the vendor. | Retained at no additional cost; no term stated. | Verified Consent: home page |
Keep the record when the lead arrives, not when the complaint does. A TrustedForm certificate nobody retained is gone after 90 days at most, and a complaint can arrive long after that. Put the retain or claim call in the same step that writes the lead to your CRM (the CRM texting comparison shows where each CRM keeps consent), and keep the record at least as long as a claim could be brought.
The two best-known names now share an owner
Jornaya is now part of ActiveProspect, the company behind TrustedForm (read 2026-10-22): jornaya.com redirects to InfutorData, which sells TCPA Guardian and LeadiD and describes itself as a division of ActiveProspect. The two products still work differently: certificate URLs on one side, LeadiD tokens on the other. If you want a second record from a separate company, ValidRecord iClaim is the documented option on this page. Our TCPA compliance software comparison covers the scrubbing and rule engines that sit after the record.
Tool by tool
Each card repeats the table's rows with the detail from the vendor's own page.
TrustedForm
activeprospect.com/trustedform
What it is
ActiveProspect's consent certificate. A script on the form records the page, every click and keystroke, and a session replay, then issues a certificate URL that a lead buyer or the site owner retains and checks by API.
Who it fits
Lead buyers who want every certificate checked before the first call, and businesses that want their own sign-up forms certified.
- Captures the disclosure text the person sawYes
Each certificate shows the consent language detected on the page; Verify compares it with the wording you approved.
- Records the consent action with a timestamp, IP and deviceYes
An event log timestamps each click and keystroke; certificate metadata includes the IP address, browser type and geolocation.
- Session replay of the form visitYes
Rebuilds the page from its captured structure and plays back clicks, typing and scrolling.
- Scores how visible the disclosure was (font size, contrast)Yes
Verify offers font-size and contrast-ratio checks on the consent language.
- Flags a pre-checked box or passive consentYes
Verify offers an opt-in type check: how the person opted in.
- Checks the seller's name in the disclosureYes
The 1:1 Consent Check matches your company's legal name and returns true, false or null; the form needs TrustedForm consent tags.
- States how long kept records lastYes
Unretained certificates expire after 3 days, or 90 days once a submit is detected. Retained copies are kept 5 years by default; longer or shorter on request.
- Claims and checks records by APIYes
Retain, Verify, Insights and match-lead operations run against each certificate URL.
- Works on your own first-party formsYes
Auto-Retain keeps a certificate for every lead generated on domains you verify with ActiveProspect.
- Shares or exports a record for a disputeYes
A view-only Share URL for counsel or auditors, live for as long as the certificate stays retained.
Jornaya TCPA Guardian
What it is
Jornaya is now part of ActiveProspect (read 2026-10-22): its consent product is sold by InfutorData, which describes itself as a division of ActiveProspect. A LeadiD script witnesses the visit and issues a token; the buyer queries each token against an audit profile of approved disclosures and flag rules.
Who it fits
Buyers whose lead sellers already pass LeadiD tokens, and who want a report they can hand over when a complaint arrives.
- Captures the disclosure text the person sawYes
Captures the disclosure inside its TCPA label as the person saw it, even when the browser translated it. Unlabelled text returns "No Label".
- Records the consent action with a timestamp, IP and deviceCheck with the vendor
The API reports how consent was given (ticked, pre-ticked, declined or by submit). The docs read list no timestamp or IP field; the Compliance Report summarises the lead event.
- Session replay of the form visitYes
A Visual Playback of the lead event, linked from the Compliance Report.
- Scores how visible the disclosure was (font size, contrast)Yes
Prominence (font size), contrast and a combined visibility score, each flagged green, yellow or red by your profile.
- Flags a pre-checked box or passive consentYes
Consent comes back as active, passive (pre-populated), passively or actively declined, or given by submit.
- Checks the seller's name in the disclosureYes
Brand Name Present and Brand Name Consent show whether a named seller appeared and what the person chose for it. Multi-seller forms need a label per brand.
- States how long kept records lastYes
The product page says proof is stored in perpetuity at no extra cost. The API reports a token created more than one year ago as expired.
- Claims and checks records by APIYes
One REST query per LeadiD token returns the flags set in your audit profile.
- Works on your own first-party formsYes
Lead creators put the LeadiD script on their own forms after a Creator Program sign-up, which support approves in 1 to 3 business days.
- Shares or exports a record for a disputeYes
A downloadable Compliance Report: within 6 hours for tokens under 90 days old, 24 hours for older ones. It leaves out the source URL.
ValidRecord iClaim
What it is
A consent recording tool from ValidRecord, which its own site says is brought to you by Phonexa. A tracking script records each form visit; you claim the records you keep, and an API confirms consent language and the advertiser's name.
Who it fits
Teams that want a consent record outside the ActiveProspect family, with IP and device detail available by API.
- Captures the disclosure text the person sawYes
A Consent Languages block shows the language submitted with the form and whether you approved it.
- Records the consent action with a timestamp, IP and deviceYes
Each record carries its creation time, IP address, browser, OS and device, plus a timeline of every action.
- Session replay of the form visitYes
Session replay and playback of each submission.
- Scores how visible the disclosure was (font size, contrast)Check with the vendor
- Flags a pre-checked box or passive consentCheck with the vendor
Every click, keystroke and checkbox selection is recorded; no pre-checked flag appears in the docs read.
- Checks the seller's name in the disclosureYes
The Confirm call takes an advertiser name and returns a one-to-one result and whether a detected consent language is approved.
- States how long kept records lastYes
Claimed records are stored for up to 5 years.
- Claims and checks records by APIYes
Claim, Confirm, Lead Snapshot (IP, approximate location, create and claim times) and Record Verification calls.
- Works on your own first-party formsYes
The claim API is described for lead buyers and lead generators alike.
- Shares or exports a record for a disputeYes
A shareable RecordURL per record, switched on record by record.
Verified Consent
What it is
A small consent-certificate service: an SDK on the form records each submission and issues a certificate. Its public site is a single page with a 2022 copyright line and no help centre, so most rows rest on that page alone.
Who it fits
A small site owner who wants a basic certificate and is willing to confirm the details with the vendor first.
- Captures the disclosure text the person sawCheck with the vendor
The site says the video replay shows exactly what the lead saw; it does not say the disclosure text is captured on its own.
- Records the consent action with a timestamp, IP and deviceYes
Visit date, form completion time, time on site, device IP address, operating system, browser and screen resolution.
- Session replay of the form visitYes
A video replay of the form submission event.
- Scores how visible the disclosure was (font size, contrast)Check with the vendor
- Flags a pre-checked box or passive consentCheck with the vendor
- Checks the seller's name in the disclosureCheck with the vendor
- States how long kept records lastCheck with the vendor
The site says certificates are retained at no additional cost but states no term.
- Claims and checks records by APICheck with the vendor
- Works on your own first-party formsYes
The SDK goes on your own website's form and certifies every submission.
- Shares or exports a record for a disputeCheck with the vendor
The site says a certificate can be requested at any time.
How we read the claims
Questions buyers ask
What is a TrustedForm certificate?
A web address that holds a record of one visit to a form: the page as it loaded, every click and keystroke with its time, the consent language detected, the visitor's IP address and browser, and a session replay. The business that receives the lead retains the certificate to keep it; an unretained certificate expires after 3 days, or 90 days once a submit is detected.
Do we need a consent certificate if we collect our own sign-ups?
No rule names a vendor. The FCC defines prior express written consent as an agreement, in writing, bearing the signature of the person called, that clearly authorizes the seller to call or text, plus a clear and conspicuous disclosure (47 CFR § 64.1200(f)(9)). Your own log can hold that if it keeps the words shown, the action taken, the time and the number. A certificate adds a replay and a record kept by someone other than you.
Is one-to-one consent still required?
Not by the FCC. The 11th Circuit vacated the one-to-one consent rule on 24 January 2025, and the FCC removed it from its rules effective 29 August 2025; the current § 64.1200(f)(9) carries no one-to-one wording. The consent still has to authorize the seller that calls, so the seller-name checks these tools offer remain useful, and some lead buyers still ask for them.
How long should we keep consent records?
The FCC's rules set no retention period for consent records; the nearest figure is that a do-not-call request must be honoured for 5 years. Keep each record at least as long as a claim could be brought over the calls or texts it covers, then check the tool keeps it that long: TrustedForm and ValidRecord keep retained records for 5 years by default.
Are TrustedForm and Jornaya the same company now?
The owner is. Jornaya is now part of ActiveProspect, the company behind TrustedForm (read 2026-10-22): jornaya.com redirects to InfutorData, which sells TCPA Guardian and LeadiD and describes itself as a division of ActiveProspect. The products are still separate: TrustedForm issues certificate URLs, Jornaya issues LeadiD tokens.
Sources
- 47 CFR § 64.1200(f)(9)(i) (clear and conspicuous disclosure)fetched 2026-10-22
- CTIA Messaging Principles and Best Practices (May 2023), 5.1.2fetched 2026-10-22
- Insurance Marketing Coalition Ltd. v. FCC, No. 24-10277 (11th Cir. Jan. 24, 2025)fetched 2026-10-22
- 90 FR 42137 (Aug. 29, 2025): one-to-one wording removedfetched 2026-10-22
- InfutorData: About usfetched 2026-10-22
- ActiveProspect: Auditing certificatesfetched 2026-10-22
- ActiveProspect: Overview of TrustedFormfetched 2026-10-22
- ActiveProspect: Session Replayfetched 2026-10-22
- ActiveProspect: TrustedForm Verifyfetched 2026-10-22
- ActiveProspect: 1:1 Consent Checkfetched 2026-10-22
- ActiveProspect: Certificate expiration and retention windowfetched 2026-10-22
- ActiveProspect developer docs: Getting started with TrustedFormfetched 2026-10-22
- ActiveProspect: TrustedForm Auto-Retainfetched 2026-10-22
- ActiveProspect: Share URLfetched 2026-10-22
- InfutorData help: TCPA Guardian FAQfetched 2026-10-22
- InfutorData help: Compliance Reports and Visual Playbacksfetched 2026-10-22
- InfutorData help: TCPA Guardian (3rd party) APIfetched 2026-10-22
- InfutorData help: How to add TCPA brand name labelsfetched 2026-10-22
- InfutorData: TCPA Guardianfetched 2026-10-22
- InfutorData help: Getting started with TCPA Guardianfetched 2026-10-22
- InfutorData help: Compliance Report FAQfetched 2026-10-22
- ValidRecord knowledge base: Recordsfetched 2026-10-22
- ValidRecord: iClaimfetched 2026-10-22
- ValidRecord: API documentation (Claim, Confirm, Lead Snapshot, Verify)fetched 2026-10-22
- Verified Consent: home pagefetched 2026-10-22