TrustedForm vs Jornaya LeadiD: How Consent Certificates Work

What Are Jornaya and TrustedForm?

If you buy final expense leads or calls, you have probably heard vendors mention "Jornaya" or "TrustedForm." Both sit on a lead generator's web form and create a record of what happened when a consumer filled it out. That record travels with the lead to the buyer as an ID or a link.

Jornaya LeadiD. Jornaya is part of Verisk Marketing Solutions, which Verisk describes as its business unit formed in 2022 through the integration of Infutor, Jornaya and Contact State. A LeadiD is a token created by Jornaya's script when a lead form page loads.
TrustedForm. TrustedForm is an ActiveProspect product. ActiveProspect's support center describes it as a record of consumer interactions on lead generation pages, issued as a certificate with its own URL.

This article explains how each works, using only each company's own documentation. It does not rank or review either product, and it does not cover pricing. For how consent records fit into your wider compliance file, see our guide to building a TCPA consent audit trail.

How Does Jornaya LeadiD Work?

A lead generator creates a campaign in the Jornaya Member Portal and installs that campaign's JavaScript snippet on its form. According to Jornaya's implementation FAQ:

When a page with the script loads, it generates a LeadiD token: a 36-character identifier in the format XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX. One token should be created per lead event, stored in a hidden form field.
The script should run on every page of the lead funnel, including the thank-you page after submission, so Jornaya can render a Visual Playback that shows the consumer clicking submit and moving to the next page.
Jornaya says it does not capture or store personal information such as name, phone or email, so consumer-entered values show as N/A in the Member Portal.

When a lead is sold, Jornaya's getting-started guide says the token goes to the buyer in the ping or post with the lead data. Jornaya also asks sellers to give buyers a list of the TCPA disclosure language used on their forms, and buyers can add approved disclosures to their audit profiles.

How Does a Buyer Verify a Jornaya LeadiD?

Jornaya's buyer guide describes these steps: sign up for a Member Portal account, create an Audit Profile, ask lead partners to include the LeadiD token in every ping or post (Jornaya describes 100% token coverage as the goal), store the token in your CRM, and call Jornaya's Intelligence API for each token.

The response includes data points such as Authenticity, Lead Age (seconds between form completion and your query), Lead Duration (seconds the consumer spent on the form), Data Integrity (whether the lead data you received matches what the script witnessed) and Total Hops (how many times the lead changed hands between the generator and you). The API documentation also lists disclosure- and consent-related response fields.

Jornaya's glossary says a token is not treated as authentic if Jornaya did not create it, if it was created more than a year ago, if it has been queried too many times through partner API calls, or if it is tied to a consumer who used a CCPA right to opt out. Its TCPA Guardian page says a TCPA Compliance Report with Visual Playback can be requested through myJornaya. The pages reviewed for this article do not state a general data retention period.

How Does TrustedForm Work?

A lead generator embeds TrustedForm's JavaScript on the lead page. ActiveProspect's documentation says the script starts capturing when the page loads and a certificate is generated when the consumer submits the form. Each certificate has a unique URL in the format https://cert.trustedform.com/ followed by a token. ActiveProspect says to accept only certificates from that address, not images or videos of them.

According to ActiveProspect's certificate documentation, a certificate contains:

The page URL (and the parent page URL if the form sits in an iframe).
The date and time the form was created.
The consumer's public IP address, browser version and operating system.
A snapshot of the form page as the consumer saw it, including its HTML, images and styling, which preserves the consent language shown.
A detailed event log of the consumer's interactions with the form, plus a session replay that recreates mouse movements, clicks, keystrokes and page changes from page and event data (ActiveProspect notes it is not a video file).

When the certificate is created, contact details such as email and phone are hashed into fingerprints so a buyer can later check that the certificate matches the lead it received.

How Does a Buyer Claim or Retain a TrustedForm Certificate?

ActiveProspect's guide for lead buyers says to require a TrustedForm certificate URL as a field with every lead, then run Retain on every lead you plan to contact and save the URL in your CRM. Retain stores the certificate in your account. The documentation describes three related operations:

Retain: stores the certificate, typically for up to 5 years; ActiveProspect says the period can vary by contract or regulatory requirement. A certificate can be retained only once.
Match Lead: compares the email and/or phone you supply with data in the certificate.
Verify: checks a certificate against requirements you select and returns success, failure or error. A separate Consent Language Manager lets you track consent language variations and mark them approved or rejected.

Timing matters. ActiveProspect's documentation says an unretained certificate is typically available for about 72 hours, or up to 90 days if a form submission is confirmed, before it expires. If you plan to keep a certificate, retain it promptly.

How Do Jornaya LeadiD and TrustedForm Compare?

This table uses only what each company's documentation states, as reviewed in November 2026. It is not a recommendation.

Feature	Jornaya LeadiD	TrustedForm
Company	Jornaya, part of Verisk Marketing Solutions, a Verisk business unit	ActiveProspect
How it is installed	Campaign JavaScript on every page of the lead funnel, including the post-submission page	JavaScript snippet on the lead page
What the buyer receives	A 36-character LeadiD token in the ping or post	A certificate URL beginning https://cert.trustedform.com/
Replay of the session	Visual Playback, available in a TCPA Compliance Report	Session replay rebuilt from page and event data
Consent language	Sellers share TCPA disclosure language; buyers add approved disclosures to audit profiles	Page snapshot preserves what was shown; a Consent Language Manager tracks approved or rejected consent language
Consumer personal data	Does not capture or store name, phone or email	Email and phone hashed into fingerprints for lead matching
Timing data	Lead age and lead duration in seconds	Date and time the form was created
How a buyer checks a lead	Intelligence API audit against an Audit Profile	Retain, Match Lead and Verify operations
Time limits	One authenticity condition: token created within the past year	Unretained certificates typically available about 72 hours (up to 90 days if a form submission is confirmed)
Storage period	Not stated in the documentation reviewed	Typically up to 5 years once retained
Call center use	Separate Call Center campaign script for agent interface pages	No agent-interface capture script described; the product page lists dialer integrations

What Does a Consent Certificate Prove, and What Doesn't It Prove?

Under the FCC's TCPA rule, an autodialed or prerecorded telemarketing call to a wireless number generally needs the called party's prior express written consent (47 CFR 64.1200(a)(2)). The rule defines that as a written agreement, signed by the person called, that clearly authorizes the seller to deliver such calls to a specific phone number. The agreement must include a clear and conspicuous disclosure that the person is authorizing those calls and is not required to sign as a condition of purchase. An electronic signature counts where federal law or state contract law recognizes it (47 CFR 64.1200(f)(9)).

When the FCC adopted that definition in 2012, it said that if any question about consent arises, "the seller will bear the burden of demonstrating that a clear and conspicuous disclosure was provided and that unambiguous consent was obtained" (FCC 12-21, 77 FR 34233, 34237, para. 16 of the Federal Register text). It also said consent obtained in compliance with the E-SIGN Act, including through a website form, satisfies the rule (para. 17, 77 FR 34237).

A certificate or LeadiD can help show what happened on a web form: the page, the language displayed, the timing and the consumer's actions. On its own, it does not show:

That the consent language met every element of 64.1200(f)(9). Someone still has to read it.
That your agency was the seller named in the consent. Check that the disclosure covers you.
That the phone number belongs to the person who filled out the form.
Anything about a later phone call, what was said on it, or how a recording was handled.

None of the federal rules cited here requires a Jornaya or TrustedForm record specifically. They are one way to document consent. For the consent standard itself, see our article on prior express written consent for life insurance leads, and for questions to ask the people you buy from, see final expense lead vendors: compliance dos and don'ts.

Where Do Inbound Calls Fit?

Certificates are built around web forms, and the consent they document is generally used to support outbound calls an agency places after the form is submitted. When the consumer dials you, the record of that contact is generally the inbound call itself: the time, the number and, if you record, the recording. If you record calls, state recording consent and disclosure laws may still apply, and if the consumer asks not to be called back, that request still needs handling. Ask counsel how your call flows are treated.

Prefer calls where the consumer dials you? CallX connects licensed final expense agents with inbound insurance calls.
Sign up as an agent →

Frequently Asked Questions

What Is TrustedForm?

TrustedForm is an ActiveProspect product. A script on a lead form records the consumer's session and issues a certificate with a unique URL that the buyer can retain, match to the lead and verify.

What Is a TrustedForm Certificate?

It is the record a buyer receives as a URL starting with https://cert.trustedform.com/, including the page URL, date and time, IP address, a page snapshot, an event log and a session replay.

What Is Jornaya LeadiD?

Jornaya is part of Verisk Marketing Solutions, a Verisk business unit. A LeadiD is a 36-character token created when a page with Jornaya's script loads; buyers audit it through Jornaya's Intelligence API.

Is "Trusted Form" the Same as TrustedForm?

Yes. ActiveProspect writes the product name as one word.

Does a Certificate Mean a Lead Is TCPA Compliant?

No. It documents what happened on a web form. Whether the consent language met the FCC's definition and named your agency is a separate question to review with counsel.

This article is general education, not legal advice. It summarizes vendor documentation as published in November 2026, 47 CFR 64.1200 as published in the 2025 edition of the Code of Federal Regulations, and the FCC's 2012 order; the CFR notes a later amendment to 64.1200 effective December 15, 2025, and state laws can add requirements. Confirm your consent and lead-buying practices with counsel or your compliance team.

Jornaya vs TrustedForm: What Lead Consent Certificates Are and How They Work