Insurance Marketing Compliance for Agents: What Actually Trips People Up

Compliance is not the part of marketing agents enjoy. But it is the part that decides whether your lead flow survives an audit, a carrier review, or a plaintiff’s attorney pulling your consent records. Most penalties do not come from bad intent. They come from sloppy documentation and a vague claim nobody checked.

This is a plain-English overview, not legal advice. We run marketing, not a law firm. You are the licensed party, and a compliance attorney in your states is worth the retainer. What follows is how the rules show up in day-to-day lead generation, written by people who place ads and buy leads for a living.

The three layers you actually have to track

Insurance marketing compliance for agents stacks into three layers. They are enforced by different bodies on different clocks, which is how a campaign clears one layer and fails another.

Each row below has a different enforcer, which is why one approval never covers the whole campaign.

You need all three handled at once. A campaign can be TCPA-clean and still violate a state’s prohibition on implying government affiliation, or be perfectly worded and still miss the CMS TPMO disclaimer.

Two more layers sit underneath and catch people who only read the insurance-specific rules: the general advertising law that applies to every business (the FTC’s endorsement rules, CAN-SPAM for email), and each ad platform’s own policy. Both are covered further down.

Why federal advertising law reaches insurance at all

Agents raise a fair objection here: insurance is regulated by the states, so why does a federal agency get a vote? The answer is in the McCarran-Ferguson Act, and it is worth reading rather than paraphrasing.

15 U.S.C. §1012(a) puts the default where you expect it: “The business of insurance, and every person engaged therein, shall be subject to the laws of the several States which relate to the regulation or taxation of such business.”

Then §1012(b) sets the boundary. No Act of Congress “shall be construed to invalidate, impair, or supersede any law enacted by any State for the purpose of regulating the business of insurance… unless such Act specifically relates to the business of insurance” — with a proviso that the Sherman Act, the Clayton Act and the Federal Trade Commission Act “shall be applicable to the business of insurance to the extent that such business is not regulated by State Law.”

Read the proviso slowly. It is a partial carve-out, not a shield. The FTC Act reaches the business of insurance in whatever space state law leaves open, and the gaps are wider than agents assume for the things marketers actually do: email headers, review solicitation, paid endorsements, tracking disclosures. Meanwhile the TCPA and the CMS marketing rules are not general commercial statutes at all — they regulate calling and a federal health program directly, and agents are squarely inside both.

The operating conclusion is unglamorous. Your state department of insurance is the first authority on what your ad may say. It is not the last one, and clearing a carrier’s brand review is not the same as clearing any of them. We build that assumption into every campaign we run, including the creative side covered in our guide to insurance advertising examples that hold up.

TCPA: the layer with the lawyers

The Telephone Consumer Protection Act is where the real financial exposure lives, because it carries a private right of action and statutory damages per violation — “$500 in damages for each such violation,” which a court “may, in its discretion, increase” to “not more than 3 times” that amount, a $1,500 ceiling, where it finds the violation was willful or knowing (47 U.S.C. §227(b)(3)). That is what makes it a magnet for litigation.

The headline 2025 change: the FCC’s one-to-one consent rule was vacated before it took effect. The Eleventh Circuit granted the petition for review and vacated Part III.D of the FCC’s 2023 order on January 24, 2025 in Insurance Marketing Coalition Ltd. v. FCC, No. 24-10277. That rule would have required separate consent for each individual seller. With it gone, a single clear consent can still cover multiple sellers. That is good news for the shared-lead model, but it does not remove the core requirement.

What still holds, straight from 47 CFR §64.1200:

• You need prior express written consent — “an agreement, in writing, bearing the signature of the person called” that names the seller and the number, per §64.1200(f)(9). Electronic and digital signatures count.
• The disclosure has to be clear and conspicuous, and must tell the consumer they are “not required to sign the agreement… as a condition of purchasing any property, goods, or services.”
• The national Do Not Call registry still applies (§64.1200(c)(2)), and your scrub must use a registry version pulled no more than 31 days before the call.
• Revocation is easy on purpose: “stop,” “quit,” “end,” “revoke,” “opt out,” “cancel,” or “unsubscribe” in a reply text is a per se reasonable revocation under §64.1200(a)(10).
• You should keep the proof: the form copy the consumer saw, the source URL, IP address, and timestamp, tied to each lead.

If you buy leads, that documentation is the vendor’s job to provide and your job to verify. A lead you cannot prove consent on is a liability, not an asset. We cover the buyer side in depth in our guide to TCPA-compliant lead buying for agents, and the economics of vetting vendors in the true cost per sale of cheap leads.

A practical rule we apply to our own book: if a lead source cannot hand over the consent record per lead on request, we do not run it. That single filter removes most of the risk before a call is ever dialed.

The TCPA mechanics that decide your dialer settings

Consent gets all the attention. The paragraphs below it decide whether your outbound operation is actually configured legally, and they are specific enough to check against a CRM in an afternoon.

Every requirement in this table is a setting, a document or a retention rule — not a judgment call.

Four of those deserve a note, because they are where lead-buying operations tend to be misconfigured.

The local-time rule is the caller’s problem. A 7 p.m. dial from a Pacific-time office lands at 10 p.m. on the East Coast. If your dialer sorts by list rather than by the called party’s time zone, the rule is being broken on a schedule.

The safe harbor is conditional, and the conditions are a checklist. §64.1200(c)(2)(i) protects a caller who can demonstrate the violation “is the result of error” and that its routine business practice meets five standards: written procedures, trained personnel, a maintained internal list, the 31-day registry process with “records documenting this process,” and a purchasing process that does not share registry access costs. Miss any one and the defense is not available.

The internal do-not-call list is separate from the national registry. It is your own list, it applies to your own entity, and §64.1200(d)(5) says that absent a specific request, a subscriber’s request does not extend to affiliated entities “unless the consumer reasonably would expect them to be included given the identification of the caller and (for telemarketing calls) the product being advertised.” If you market under a DBA that sounds unrelated to the entity that called, that clause is not on your side.

Revocation is broader than the seven magic words. Under §64.1200(a)(10), if a reply text uses other words, “the caller must treat that reply text as a valid revocation request if a reasonable person would understand those words to have conveyed a request to revoke consent.” §64.1200(a)(11) goes further: a revocation sent by voicemail or email “creates a rebuttable presumption that the consumer has revoked consent.” And §64.1200(a)(12) permits exactly one confirmation text, containing no marketing content — presumed within consent if sent within five minutes of receipt, and needing a showing of reasonableness if it takes longer.

That last detail is worth wiring into the automation directly, because a “sorry to see you go, here’s one last offer” message is a violation with a timestamp attached. Our lead follow-up cadence guide sets the sequences up so an opt-out terminates every branch, not just the one the contact was in.

Florida’s mini-TCPA reaches agents who never set foot in Florida

Several states run their own telemarketing statutes on top of the federal one. Florida’s is the one that changed how national lead buyers operate, because it applies by the phone number rather than by where your office is.

Fla. Stat. §501.059 defines a “telephonic sales call” as “a telephone call, text message, or voicemail transmission to a consumer for the purpose of soliciting a sale” — texts and ringless voicemail are in scope by name, not by interpretation. Subsection (8)(a) then prohibits an unsolicited telephonic sales call involving “an automated system for the selection and dialing of telephone numbers” without the called party’s prior express written consent.

Florida defines that consent itself, at §501.059(1)(g): a written agreement bearing the called party’s signature, clearly authorizing calls, texts or voicemail delivered by an automated system, including the specific number, and carrying a clear and conspicuous disclosure that the person “is not required to directly or indirectly sign the written agreement or to agree to enter into such an agreement as a condition of purchasing any property, goods, or services.” A checked box counts as a signature under §501.059(1)(h)(2).

Two provisions decide the exposure. Subsection (8)(d) states that “There is a rebuttable presumption that a telephonic sales call made to any area code in this state is made to a Florida resident or to a person in this state at the time of the call” — so a nationally-sourced list with Florida area codes puts you inside the statute regardless of intent. And §501.059(10)(a) lets an aggrieved called party “recover actual damages or $500, whichever is greater,” with §501.059(10)(b) allowing the court to treble that where the violation was willful or knowing.

There is one defensive provision worth knowing. Since a 2023 amendment, §501.059(10)(c) requires a called party to reply “STOP” and wait before suing over text solicitations: the solicitor has 15 days to cease, may send one confirmation text, and an action lies only if texts continue after that window. That makes your STOP handling the difference between a cured complaint and a filed claim. If outbound calling is a channel for you, read this alongside our breakdown of telemarketing insurance leads.

Email is not the quiet channel: CAN-SPAM in practice

Agents move budget to email because it feels lower-risk than the phone. Per message, the stated ceiling runs the other way.

Per-violation figures as published. Sources: 47 U.S.C. §227(b)(3) for the TCPA damages, and the FTC’s CAN-SPAM compliance guide, which states “Each separate email in violation of the law is subject to penalties of up to $53,088” and notes the figure reflects the inflation-adjusted civil penalty maximums as of its January 2024 edit.

The FTC’s guide is short and worth reading in full, but four points decide most agency setups.

Scope is wider than “bulk email.” The Act covers all commercial messages, defined as “any electronic mail message the primary purpose of which is the commercial advertisement or promotion of a commercial product or service.” The FTC adds a line agents skip: “The law makes no exception for business-to-business email.” A recruiting blast to downline agents is inside the rule.

The primary-purpose test, not the mailing list, decides what applies. A message is transactional or relationship only if it consists solely of content in five narrow categories — completing an agreed transaction, warranty or safety information, notice of a change in terms or standing in an ongoing relationship, employment or benefits information, or delivery of goods or services already agreed to. The FTC warns that “the law views these categories narrowly.” Where a message mixes both, if a recipient reading the subject line “would likely conclude that the message contains an advertisement,” it is commercial.

That is the trap in a renewal or claims-status email that ends with a cross-sell block. Put the promotional paragraph at the top, or write a subject line that sells, and a message you filed as transactional becomes a commercial message that needed an opt-out link and a postal address.

The mechanics are specific. A commercial message must carry accurate header and routing information, a non-deceptive subject line, a clear and conspicuous disclosure that it is an advertisement, and “your valid physical postal address” — a street address, a registered PO box, or a registered private mailbox. The opt-out mechanism must keep working “for at least 30 days after you send your message,” you must honor a request “within 10 business days,” and you cannot charge a fee or require anything beyond an email address to process it. Once someone opts out, you “can’t sell or transfer their email addresses, even in the form of a mailing list.”

Delegation does not transfer the liability. The FTC states that “even if you hire another company to handle your email marketing, you can’t contract away your legal responsibility to comply with the law,” and that both the company whose product is promoted and the company that sent the message may be held responsible. An agency, an FMO’s shared platform, and a white-label sender are all your exposure.

None of that makes email a bad channel. It makes email a channel that needs its footer, its suppression list and its send logic built once and left alone — which is how we set up the sequences behind our email automation service, and what the campaigns in our insurance email examples are structured around.

Reviews, testimonials and paid endorsements

Social proof takes minutes to add to a site and is easy to get wrong, because the governing rules are not insurance rules at all. They are the FTC’s Endorsement Guides at 16 CFR Part 255.

Start with how broadly “endorsement” is defined. §255.0(b) covers “any advertising, marketing, or promotional message for a product that consumers are likely to believe reflects the opinions, beliefs, findings, or experiences of a party other than the sponsoring advertiser” — and it names the formats: “Verbal statements, tags in social media posts, demonstrations, depictions of the name, signature, likeness or other identifying personal characteristics of an individual, and the name or seal of an organization can be endorsements.”

Then note who the FTC thinks your audience is. §255.0(f) defines clear and conspicuous as “difficult to miss (i.e., easily noticeable) and easily understandable by ordinary consumers,” requires the disclosure to be “unavoidable” in interactive media like social platforms, and closes with a sentence written for anyone marketing Medicare or final expense: “When an endorsement targets a specific audience, such as older adults, ‘ordinary consumers’ includes members of that group.”

Use this table before a testimonial, a review widget or a paid post goes live.

Two consequences follow for a typical agent site. A testimonial that names a dollar saving is a performance claim in a consumer’s mouth, and under §255.2(a) the advertiser must hold the substantiation “in the same manner the advertiser would be required to do if it had made the representation directly.” And under §255.1(c), if the ad represents that the endorser uses your service, they must have been a bona fide user at the time, and the advertiser may keep running the ad “only so long as it has good reason to believe that the endorser remains a bona fide user” — a quote left on the homepage long after that client left is a problem created by not maintaining it.

The safe version of social proof is the boring one: real reviews, collected without incentives, quoted exactly, unedited, on a platform the reader can go check. That is how we approach getting more Google reviews for insurance agents and the review workflows inside our reputation management service.

State advertising rules: boring until they aren’t

Every state department of insurance has its own advertising rules, and they are not uniform. The common threads:

1. No misleading claims. “Free coverage,” “government-approved,” or “guaranteed acceptance” language gets scrutinized fast, especially in final expense and Medicare.
2. Display your license. Many states require your name and license number on advertising, and prohibit implying you are a government agency or affiliated with Medicare/Social Security.
3. Accurate carrier use. Using a carrier’s name or logo without authorization, or implying an endorsement you do not have, is a frequent violation.
4. Some states require ad filing or specific disclosures for certain lines.

Point two sounds soft until you read a state that wrote it out. California did. Insurance Code §1725.5 requires a licensee to print its license number on “business cards, written price quotations for insurance products, and print advertisements distributed exclusively in this state,” at a type size “at least as large as any indicated telephone number, address, or fax number or in 12-point type, or in 8-point type for business cards, whichever is larger.” Subsection (b) separately requires the word “Insurance” at a comparable size. Subsection (c) extends the license number to emails “that involve an activity for which a license is required,” sized no smaller than the largest phone number, street address or email address in the message, and placed “adjacent to or on the line below the individual’s name or title.”

Read the enforcement paragraphs too — they change how you triage a fix.

Two lessons generalize past California. First, the requirement is often a typographic specification, not a vague duty — a footer in 9-point grey may satisfy a designer and fail the statute. Second, the email clause is the one that ages badly, because signature blocks get rebuilt when a CRM changes and nobody re-reads the code afterwards — and the reasonable-cause relief in subdivision (g) is written for subdivision (a) and (b) failures, so it does not reach subdivision (c) at all.

For any specific numeric penalty or filing threshold in your own states, check the department directly; the figures vary widely. The honest move is to treat every ad as if a regulator in your strictest state will read it. We build that standard into our insurance landing page work so the same creative holds up across the states you write in, and into the claim discipline described in our guide to insurance copywriting.

CMS Medicare rules: the most specific layer

If you market Medicare Advantage or Part D, CMS adds a detailed rulebook on top of everything above. As a paid agent or broker, you are a Third-Party Marketing Organization (TPMO) in CMS’s eyes, and that triggers obligations.

The pieces that catch agents most often:

• The TPMO disclaimer. 42 CFR §422.2267(e)(41) prescribes the exact sentence for a TPMO that does not sell for all MA organizations in the area: “We do not offer every plan available in your area. Currently we represent [insert number of organizations] organizations which offer [insert number of plans] products in your area. Please contact Medicare.gov or 1-800-MEDICARE to get information on all of your options.” It must be “verbally conveyed during sales calls prior to the discussion of any benefits,” displayed prominently on your website, and included in marketing materials.
• Consent to share data. Under §422.2274(g)(4), beneficiary data collected by a TPMO “may only be shared with another TPMO when prior express written consent is given by the beneficiary,” through a clear and conspicuous disclosure that lists each receiving entity individually.
• Call recording. §422.2274(g)(2)(ii): all marketing and sales calls “must be recorded and retained in their entirety for a minimum period of 6 years.”
• No unsolicited contact. §422.2264(a) permits unsolicited mail, print, and opt-out-bearing email, and prohibits unsolicited cold calls, robocalls, texts, voicemails, social-media DMs, and door-to-door contact.

These rules tighten and shift each contract year, so AEP creative has to be re-checked annually rather than reused on autopilot. If Medicare is your line, the disclaimer and consent mechanics should be wired into your funnel from the start, which is the backbone of how we approach Medicare marketing for agents. For the rule detail itself, our breakdown of CMS Medicare marketing rules, the Scope of Appointment mechanics and AEP marketing strategy go deeper than this overview can.

ACA marketplace marketing runs on its own standards

If you enroll through a federally-facilitated Exchange, a fourth rulebook applies, and it regulates your website and your data entry rather than your disclaimers.

45 CFR §155.220(j)(2) requires an agent, broker or web-broker to give consumers “correct information, without omission of material fact,” and to “refrain from conduct that is misleading (including by having a direct enrollment website that HHS determines could mislead a consumer into believing they are visiting HealthCare.gov), coercive, or discriminates based on race, color, national origin, disability, age, or sex.” That parenthetical is a design constraint: a landing page that borrows the government site’s palette, seal-like mark or URL pattern is the named example of a violation.

The data-entry rules are just as concrete. Under §155.220(j)(2)(ii)(B), an email address entered on an Exchange application must belong to the consumer, “may not be accessible by the agent, broker, or web-broker assisting the consumer,” and “may not have domains that belong to the agent, broker, or web-broker or their business or agency.” Documentation that the consumer reviewed and confirmed their eligibility information must be kept “for a minimum of ten years” per §155.220(j)(2)(ii)(A)(3). And for plan years beginning on or after January 1, 2028, that documentation must come from an HHS-approved and -created consumer consent form. The rule adds that “A signature that is simply typed on the documentation or a filled-in check box does not clearly indicate the eligibility application information was reviewed and confirmed accurate by the consumer or the consumer’s authorized representative.”

If ACA is a meaningful share of your book, the detail lives in our guide to ACA marketing compliance and CMS rules and the enrollment-season plan in ACA agent marketing.

Platform rules are a compliance layer too

The ad platforms enforce their own version of fairness law. Meta classifies insurance under its Special Ad Category, which strips out age, gender, ZIP, and detailed targeting to prevent discrimination. You can still run insurance ads; you just qualify with creative and offer instead of granular targeting. Knowing this up front changes how you build a Facebook campaign for insurance so you do not waste budget fighting the system.

Every clock you are on, in one table

Compliance failures rarely look like a bad decision. They look like a deadline nobody owned.

These are the retention and response windows written into the sources cited above, in one place.

Put each row against a named owner and a system that enforces it. A rule you satisfy by remembering is a rule you will fail during AEP.

A short pre-launch checklist

Before any campaign goes live, run it past this:

• Is consent captured, disclosed clearly, and documented per lead?
• Does every claim tie to something true and provable?
• Is your license number present where the state requires it — including in email signatures, at the size the state specifies?
• For Medicare: is the TPMO disclaimer on the page and in the script?
• Does the targeting comply with the platform’s special-category rules?
• Does the dialer sort by the called party’s local time, and does it stop at 9 p.m. there rather than here?
• Does every commercial email carry a valid physical postal address, an ad disclosure and a working opt-out that survives your ESP migration?
• Does every testimonial have substantiation behind its numbers and a disclosed material connection where one exists?
• Does a reply of “stop” — or anything a reasonable person reads as “stop” — terminate every automation the contact is in, not just the one that sent the message?

Treat compliance as a trust signal, not a tax. Agents who can show clean consent and honest creative close better, because skeptical seniors and their families can smell a corner-cutter.

Making this survivable without a compliance department

Solo agents and small agencies do not have a review team, and the answer is not to read four regulations before every post. It is to move the decisions upstream, where they only get made once.

We run it as four artifacts rather than a process.

1. A consent record per lead, not per campaign. Form copy, source URL, IP, timestamp, and the number consented to, stored so any single lead can be produced on demand. This is the artifact that ends a TCPA dispute early, and the one lead vendors will quietly omit unless it is contractual.
2. A claims file. Every performance number, carrier reference and testimonial figure that appears anywhere on the site, with the source next to it. When a regulator or a carrier asks where a figure came from, the answer is a row, not a search.
3. Templates that carry the disclosures. The TPMO disclaimer, the license number, the postal address and the ad disclosure belong in the page template and the email footer, not in a writer’s checklist. A disclosure that a human has to remember to paste is a disclosure that will be missing from the page that converts best.
4. A dated re-read. The regulations cited here change on their own schedule — CMS annually by contract year, the FCC by order, states by session. Put one calendar entry against each rulebook you are exposed to and re-read the section, not a summary of it.

That is the whole system. It is deliberately small, because a compliance program an agent will not maintain is worth less than three habits they will. What each of our engagements covers, and what it costs, is published on our pricing page — and if you would rather talk through your specific lines and states first, get in touch.

If you want a second set of eyes on whether your current funnel holds up, that is exactly what a free marketing audit is for. We will look at your consent flow, ad claims, and disclaimers and tell you where the gaps are before a regulator or a lawyer does.

This article is general information for marketing purposes and is not legal or compliance advice. Verify all requirements with counsel and the departments of insurance in the states where you are licensed.