TrustedForm and Jornaya: What a Consent Certificate Proves (and Doesn't)

A buyer we will call Northgate Mutual Direct, an illustrative mid-size auto writer, pulled a random sample of 200 leads from a new publisher and asked one question: show me the certificate for each. One hundred and ninety came back with a certificate URL. Fine. Then they actually retrieved them. Thirty-one had expired. Nine pointed at a page that no longer existed. Four were reused across different leads. The publisher had a consent certificate on file for almost every lead and almost nothing in practice. That gap is the subject of this post, because consent certificate coverage and consent certificate integrity are two entirely different metrics, and most lead programs only measure the first.

What a consent certificate actually is

Both TrustedForm (an ActiveProspect product) and Jornaya LeadiD (part of Verisk) work the same way at the top level. A small script sits on the page holding your form. It observes the session. When the form is submitted, the vendor stores a record of that observation on their own infrastructure and hands back an identifier. The lead travels onward with that identifier attached.

The value is custody, not magic. The record lives with a third party rather than with the publisher who has every incentive to shade it. When a dispute lands eight months later, you are asking a neutral system what it saw, and that independence is the entire point of a consent certificate. It is chain of custody, delivered by a party with no stake in the outcome. Details of what is captured, how long it is held, and what retrieval costs differ between the two products and between plan tiers, so confirm specifics with the vendor rather than trusting a blog post, including this one.

What these certificates do record

Broadly, an independently held session record supports statements like these.

• A form submission occurred at a specific time, observed by a third party rather than self-reported
• The submission happened on a particular page, so the disclosure wording present at that moment can be tied to it
• Interaction with the page took place rather than a field-set arriving with no session behind it
• The record is retrievable later by a party other than the seller who created the lead

That last one carries more weight than people give it. Half the arguments in a return dispute are really arguments about whose spreadsheet is right. A certificate replaces two conflicting spreadsheets with one artifact both sides can pull. That alone justifies the consent certificate line item for most buyers running a serious compliance program.

What they do not establish

Now the part vendors' sales decks skate past, and the part Northgate's compliance lead put on a whiteboard before signing anything.

Read that table twice if you buy leads. A perfect certificate on a lead sourced from an incentivized sweepstakes page is a perfect record of a bad acquisition. The artifact is honest. The traffic was not. A consent certificate tells you the paperwork is intact; it says nothing about whether the person wanted your call.

The four numbers that describe your chain

Northgate replaced a vague policy with four measured metrics, checked monthly per publisher and per sub-ID.

Coverage is easy and everyone reports it. Retrieval is where publishers get exposed, because pulling a sample costs effort and almost nobody does it. Uniqueness catches the crude fraud where one session is stapled to a batch of fabricated records. Age catches aged leads being passed off as real-time, which is a quality problem before it is a compliance one.

Northgate's rule was blunt: any publisher below 98 percent retrieval on a monthly 200-lead sample goes to weekly sampling. Two consecutive misses and the source pauses. Nobody argued, because the number was defined before money changed hands.

Retention, retrieval, and the expiry trap

Here is the operational failure that catches careful teams. Certificates are held for a period, and unless you take a step to retain a specific certificate for longer, it can age out. Then a dispute arrives after the window, and the consent certificate you were counting on is gone exactly where you needed it.

There is a related failure that is purely about plumbing. Teams store the identifier as a string appended to a free-text field, then a CRM migration or a field-length truncation quietly clips the end of it. Six months later every retrieval fails and nobody can say when it started. Store it as a dedicated, validated field with a format check at ingest, and alert when the field arrives empty or malformed. That single alert catches more problems than any quarterly review, because it fires on the day the integration breaks rather than the day someone happens to look.

Sampling deserves the same discipline. A "random" sample that your ops team pulls by scrolling to the top of a list is not random, and publishers with intermittent script failures will pass it every time. Pull by row number from a seeded random selection across the full month, include weekend and overnight traffic, and log the sample set itself so a later reviewer can see what was tested. Northgate found their worst publisher through an overnight slice; daytime volume was clean, and the broken path only ran when a particular sub-publisher's media was live.

Audit questions to ask upstream

Send these to any publisher before their first dollar. Written answers, not a call.

• Which certificate product is on the page, and is the script on every path that produces a lead for us?
• Are you the origin of this traffic, or is it sourced from sub-publishers? Name them.
• What is your retention step at capture, and on what plan tier?
• Can we retrieve a certificate ourselves without going through you?
• What is the URL of the page where consent is collected, and is the disclosure copy versioned?
• How do you handle a lead where the script failed to load? Do you still sell it?

That last question is the sharpest one in the list. The honest answer is that the lead gets dropped or flagged. The answer you sometimes get instead tells you everything about their consent certificate discipline.

When the certificate is missing

Scripts fail. Ad blockers eat them, a tag manager container gets republished without the snippet, a publisher launches a new template and forgets. So a share of leads will arrive with no consent certificate at all, and the question is what your intake does about it. Most teams have never decided, which means the default is that the lead flows through untouched.

Northgate set three tiers. A lead with a retrievable consent certificate goes to full-price routing. A lead with a missing or unresolvable one gets flagged, routed to manual outbound with a slower cadence, and excluded from any automated dialing. A source running above a defined miss rate for two weeks gets paused pending a written explanation.

That middle tier is where the argument happens. Sales will point out those leads still close, which is true. Compliance will point out that they close without the evidence you would want in a dispute, which is also true. The tiering makes the trade explicit instead of leaving it to whoever touched the record last, and it puts a price on the gap: a source whose consent certificate miss rate runs high is a source you should be paying less for, and you can say that in a renewal conversation with a number behind it.

One caution. Do not let the flag become a permanent category. If a fifth of a publisher\'s volume sits in tier two every month, the integration is broken and the fix is engineering, not workflow.

Honest trade-offs

Certificates cost money, add a script to the page, and shave a little off load time. On a mobile quote form fighting for every completion, that is not free. Some publishers will price their leads higher to cover it, and a few small ones will simply refuse.

There is also a false-comfort risk. Teams that adopt certificates sometimes relax their publisher vetting, reasoning that the artifact covers them. It does not. The strongest programs run both, and treat the certificate as one input into a lead quality score rather than the answer. Get the consent certificate program right and you have removed a category of argument from your business. You have not removed the need to know where your traffic comes from.