TCPA Consent for Insurance Leads: What to Demand Before You Buy

Buying leads fills a calendar quickly. It can also buy you a lawsuit just as quickly, if the consent behind those leads is thin. The Telephone Consumer Protection Act gives the consumer a private right of action “to recover for actual monetary loss from such a violation, or to receive $500 in damages for each such violation, whichever is greater,” and a court that finds the violation willful or knowing “may, in its discretion, increase the amount of the award to an amount equal to not more than 3 times the amount available” — $1,500 a call or text (47 U.S.C. §227(b)(3)). Plaintiff firms run on volume, not on whether you closed the sale.

This is a practical operator’s walkthrough, not legal advice. We run lead programs for senior-market agents, so we read these vendor agreements for a living. Talk to a telecom attorney before you change your dialing setup.

What the TCPA actually requires

Strip away the jargon and the TCPA asks three questions every time you contact a consumer with technology:

1. Did you have consent for the method you used? Autodialed calls, prerecorded or AI voice, and SMS texts to a cell phone require prior express written consent. A manually dialed call to a number you typed yourself is a lower-risk category.
2. Did the consent name you? Consent runs to a caller, not to “the industry.” A form that says the consumer agrees to hear from “us and our marketing partners” is weaker than one that names your agency or describes the seller specifically.
3. Did you scrub the Do Not Call list? Even with consent, you document the scrub against the National Do Not Call Registry before you dial.

Prior express written consent has a specific meaning, and the FCC wrote it down. Per 47 CFR §64.1200(f)(9), it is “an agreement, in writing, bearing the signature of the person called that clearly authorizes the seller to deliver or cause to be delivered to the person called advertisements or telemarketing messages using an automatic telephone dialing system or an artificial or prerecorded voice, and the telephone number to which the signatory authorizes such advertisements or telemarketing messages to be delivered.” The agreement must carry a clear and conspicuous disclosure that signing authorizes those calls and that the consumer “is not required to sign the agreement… as a condition of purchasing any property, goods, or services.” Electronic and digital signatures count.

Two more mechanics from the same rule that catch agents out. The DNC scrub is not a one-time job: §64.1200(c)(2)(i)(D) expects a version of the national registry “obtained from the administrator of the registry no more than 31 days prior to the date any call is made,” with records documenting the process. And revocation is deliberately easy for the consumer — under §64.1200(a)(10), replying “stop,” “quit,” “end,” “revoke,” “opt out,” “cancel,” or “unsubscribe” to a text, or using any designated opt-out mechanism, “constitutes a reasonable means per se to revoke consent,” after which “the caller may not send additional robocalls and robotexts.”

Autodialer or not: what Facebook v. Duguid settled

Agents hear that the Supreme Court “gutted the TCPA” in 2021 and conclude their predictive dialer is now safe. Read the holding before you act on that.

In Facebook, Inc. v. Duguid, No. 19-511 (decided April 1, 2021), the Court’s syllabus states the holding: “To qualify as an ‘automatic telephone dialing system’ under the TCPA, a device must have the capacity either to store a telephone number using a random or sequential number generator, or to produce a telephone number using a random or sequential number generator.” (Slip opinion, Supreme Court of the United States). The regulation is written the same way: §64.1200(f)(2) defines an autodialer as “equipment which has the capacity to store or produce telephone numbers to be called using a random or sequential number generator and to dial such numbers.”

A dialer that works its way down a purchased list of real consumer numbers is not generating those numbers randomly or sequentially. That is the argument, and it has won cases. What it does not do is end the claim, because the autodialer question is only one of the theories a plaintiff can plead.

Four prohibitions in the same rule survive the autodialer argument entirely, and a single call can trigger more than one of them:

Note the “or” in the first row. Drop a prerecorded message or an AI voice onto a cell phone and the dialer’s architecture stops mattering. This is the trap in AI-voice appointment setting, and it is why we build insurance appointment setting around live conversations and documented consent rather than voice drops.

The vacated FCC one-to-one rule (January 2025)

This is the part agents get wrong in 2026, so be precise.

The FCC adopted a rule that would have required separate consent for each individual seller — the “one-to-one” rule — and banned the broad “marketing partners” consent that shared-lead vendors relied on. It was scheduled to take effect January 27, 2025.

Days before, the Eleventh Circuit vacated the rule. In Insurance Marketing Coalition Ltd. v. FCC, No. 24-10277 (11th Cir. Jan. 24, 2025), the court held that the one-to-one-consent and logically-and-topically-related restrictions conflicted with the ordinary statutory meaning of “prior express consent,” and concluded: “we grant IMC’s petition for review, vacate Part III.D of the 2023 Order, and remand for further proceedings.” So the stricter one-to-one standard is not law. The older written-consent standard still governs.

Here is the trap: the rule being vacated does not mean broad consent is safe. It means the floor didn’t rise. A consumer who agreed to hear from a list of 200 “partners” can still argue they never agreed to your call by name. The one-to-one rule going away removed a regulatory mandate; it did not remove your civil exposure.

For more on how shared sourcing changes your risk and economics, see our breakdown of exclusive versus shared final expense leads, and the same question on the property side in exclusive vs shared auto insurance leads.

The rules that bind you even when you dial by hand

Manual dialing removes the autodialer theory. It does not remove the do-not-call regime, and that regime is where a lead buyer’s ordinary week generates exposure.

Calling hours. §64.1200(c)(1) bars a telephone solicitation to “Any residential telephone subscriber before the hour of 8 a.m. or after 9 p.m. (local time at the called party’s location).” Local time at their end, not yours. An agent in Los Angeles working a Maine list at 6:30 p.m. Pacific is calling at 9:30 p.m. Eastern.

Scope. Paragraphs (c) and (d) are written for the “residential telephone subscriber.” Paragraph (e) extends them: “The rules set forth in paragraph (c) and (d) of this section are applicable to any person or entity making telephone solicitations or telemarketing calls or text messages to wireless telephone numbers to the extent described in the Commission’s Report and Order, CG Docket No. 02-278, FCC 03-153.” Cell numbers are in.

Your own list. §64.1200(d) requires procedures before you place a telemarketing call, and lists the minimum standards: a “written policy, available upon demand, for maintaining a do-not-call list” (d)(1); trained personnel (d)(2); a recorded request honored “within a reasonable time,” which “may not exceed ten (10) business days from the receipt of such request” (d)(3); caller identification — “the name of the individual caller, the name of the person or entity on whose behalf the call is being made, and a telephone number or address at which the person or entity may be contacted” (d)(4); and retention, because “A do-not-call request must be honored for 5 years from the time the request is made” (d)(6).

One sentence in (d)(3) is written for exactly your situation: “If such requests are recorded or maintained by a party other than the person or entity on whose behalf the call is made, the person or entity on whose behalf the call is made will be liable for any failures to honor the do-not-call request.” Outsourcing the list does not outsource the liability.

Established business relationship. §64.1200(f)(5) defines it for solicitation purposes as a relationship formed by voluntary two-way communication “on the basis of the subscriber’s purchase or transaction with the entity within the eighteen (18) months immediately preceding the date of the telephone call or on the basis of the subscriber’s inquiry or application regarding products or services offered by the entity within the three months immediately preceding the date of the call, which relationship has not been previously terminated by either party.” Two clocks, eighteen months and three months, and the shorter one is the one that governs a lead form.

Revocation: the ten-business-day clock and the words that start it

Opt-outs are where a compliant program leaks, because revocation is easy to give and easy to miss.

The per-se list in §64.1200(a)(10) is short — “stop,” “quit,” “end,” “revoke,” “opt out,” “cancel,” or “unsubscribe” — but the rule does not stop there. “If a reply to an incoming text message uses words other than ‘stop,’ ‘quit,’ ‘end,’ ‘revoke,’ ‘opt out,’ ‘cancel,’ or ‘unsubscribe,’ the caller must treat that reply text as a valid revocation request if a reasonable person would understand those words to have conveyed a request to revoke consent.” A reply of “please leave me alone” counts.

Three consequences a buying agent should design around:

• A deadline, not a best effort. “All requests to revoke prior express consent or prior express written consent made in any reasonable manner must be honored within a reasonable time not to exceed ten business days from receipt of such request.”
• No funnelling the opt-out. Callers “may not designate an exclusive means to request revocation of consent.” A footer that says opt-outs are only accepted through a web form does not bind the consumer.
• Other channels shift the burden. Under §64.1200(a)(11), a revocation sent by voicemail or email “creates a rebuttable presumption that the consumer has revoked consent when the called party satisfies their obligation to produce evidence that such a request has been made, absent evidence to the contrary.”

There is one narrow allowance for the confirmation text everyone sends. §64.1200(a)(12) permits a one-time message that “merely confirms the text recipient’s revocation request and does not include any marketing or promotional information,” and adds a timing rule: “If the confirmation text is sent within five minutes of receipt, it will be presumed to fall within the consumer’s prior express consent. If it takes longer, however, the sender will have to make a showing that such delay was reasonable.” Send the confirmation automatically or not at all. Automating that suppression across every channel is a build task, and it belongs in the same system as your follow-up — see insurance marketing automation for how the suppression list and the cadence share one record.

Aged and re-sold leads: the reassigned-number problem

Aged leads are cheap for a reason, and the reason is not only that the consumer has gone cold. A phone number that belonged to your consenting consumer in March may belong to somebody else by November, and the consent does not travel with the handset.

The FCC built a safe harbor for this, and its conditions are strict. §64.1200(m) says a caller is not liable for calling a reassigned number if the caller, “bearing the burden of proof and persuasion,” demonstrates two things: that it queried the Reassigned Numbers Database operated by the Administrator, “receiving a response of ‘no’,” which verified that the number had not been permanently disconnected since consent was obtained; and that the call “was the result of the database erroneously returning a response of ‘no’” to that query. Read the second condition again. The safe harbor covers a database that was wrong, not a database you never asked.

The three checks worth running before an aged file is worth dialing, and what each one costs you if you skip it:

The economics change once those checks are priced in, which is the honest argument against buying the oldest tier of a file. We work through that math in aged final expense leads and again in lead cost versus true cost per sale.

What to demand from your lead vendor

Agents routinely accept a CSV and a login. That is not enough to defend a claim. Before you wire money, get these in writing:

• The exact consent language the consumer saw — not a paraphrase, the literal text.
• A copy of the opt-in record per lead: timestamp, originating IP or device, source URL, and the checkbox/signature state.
• The seller list the consent covered, if it was a shared form.
• Their DNC scrubbing practice and who is responsible for the final scrub before you dial — you, them, or both.
• An indemnification clause that survives the contract. Read what it actually covers; many exclude TCPA or cap liability below a single judgment.

If a vendor cannot produce the consent record on demand, you are buying the lead and the liability. Walk. We screen sourcing this way inside our managed insurance lead generation service because the cheapest lead is worthless if it carries an uninsurable risk. The same questions are how we score vendors in our roundup of final expense lead generation companies.

Record-keeping: own your own paper

The failure we look for first when we audit a sourcing setup: the agent’s only proof of consent lives on the vendor’s server. When a demand letter arrives 18 months later and the vendor has churned, gone dark, or deleted the record, the agent has nothing.

Keep your own copy. For every lead you contact with technology, store:

• The consent disclosure text and the affirmative action (check/signature)
• Timestamp and source
• Your DNC scrub result, dated, before the first dial
• Your call and text logs

The federal TCPA statute of limitations is four years. That comes from the general federal catch-all at 28 U.S.C. §1658(a): “Except as otherwise provided by law, a civil action arising under an Act of Congress enacted after the date of the enactment of this section may not be commenced later than 4 years after the cause of action accrues.” Retain records at least that long. Cheap insurance against an expensive problem.

What a complete consent record contains

The FTC’s Telemarketing Sales Rule spells out the elements more precisely than the FCC rule does, and it is a useful template whether or not it reaches your agency — ask your counsel about that second question. 16 CFR §310.5(a) requires a seller or telemarketer to keep specified records “for a period of 5 years from the date the record is produced unless specified otherwise.” Paragraph (a)(8) then defines a complete consent record as six things: “The name and telephone number of the person providing Consent”; “A copy of the request for Consent in the same manner and format in which it was presented to the person providing Consent”; “The purpose for which Consent is requested and given”; “A copy of the Consent provided”; “The date Consent was given”; and the additional information required by the specific section the consent was given under.

Two more items in the same rule are worth copying into your own file. Paragraph (a)(11) expects a record of which version of the registry was used, including “The subscription account number that was used to access the registry” and the date it was accessed. And paragraph (e) addresses the arrangement where a vendor keeps the paper for you: “If by written agreement the telemarketer bears the responsibility for the recordkeeping requirements of this section, the seller must establish and implement practices and procedures to ensure the telemarketer is complying with the requirements of this section. These practices and procedures include retaining access to any record the telemarketer creates under this section on the seller’s behalf.” Retaining access. Not trusting that access exists.

What do-not-call access costs, and the safe harbor it buys

Scrubbing has a line-item price, and agents who dial a multi-state footprint should budget it.

The FTC announced the fiscal-year 2027 rates on August 26, 2026, for the year beginning October 1, 2026: $85 per area code of data, up to a maximum of $23,425 for all area codes, with the first five area codes free, and $43 per area code for a half-year subscription (FTC, “FTC Announces 2027 Telemarketer Fees to Access the National Do Not Call Registry”). A solo agent working a metro or two pays nothing. An agency dialing thirty states does not.

What that subscription buys is more than a list. §64.1200(c)(2)(i) gives a caller a defense where a registry violation “is the result of error” and the caller can show five things are part of its routine business practice: (A) “written procedures to comply with the national do-not-call rules”; (B) trained personnel, “and any entity assisting in its compliance”; (C) a recorded list of numbers “the seller may not contact”; (D) a process using a registry version no more than 31 days old, with “records documenting this process”; and (E) a process ensuring the caller purchases its own access from the administrator and “does not participate in any arrangement to share the cost of accessing the national database.”

That last clause matters for anyone told their upline or vendor “has the scrub covered.” Cost-sharing arrangements are named in the rule as something the safe harbor does not extend to. Buy your own subscription. It is the cheapest evidence you will ever own, and it is one of the first things we check before we turn on a dialing campaign — the same review that produces the sourcing map in a free marketing audit.

State telemarketing statutes the federal rule does not displace

Federal law is a floor. Several states run their own telemarketing statutes with their own consent definitions, their own damages, and their own fee-shifting. Florida is the one a nationwide lead buyer meets first, so use it as the worked example rather than a summary of fifty.

Fla. Stat. §501.059 defines a “telephonic sales call” as a call, text message, or voicemail transmission made for the purpose of soliciting a sale “or obtaining information that will or may be used for the direct solicitation of a sale of consumer goods or services or an extension of credit for such purposes.” Lead capture itself is inside the definition. Whether a given insurance product is “consumer goods or services” as the statute defines it at (1)(c) is a question for your counsel, not for a marketing article.

Four provisions change how you operate if you dial into the state:

• Area code creates a presumption. Subsection (8)(d): “There is a rebuttable presumption that a telephonic sales call made to any area code in this state is made to a Florida resident or to a person in this state at the time of the call.” You do not get to argue you thought they had moved.
• Consent is defined separately. Subsection (1)(g) requires a written agreement bearing the called party’s signature, and (1)(h)2 counts as a signature “An act that demonstrates express consent, including, but not limited to, checking a box indicating consent or responding affirmatively to receiving text messages, to an advertising campaign, or to an e-mail solicitation.”
• Damages mirror the federal number, and fees shift. Subsection (10)(a) lets an aggrieved called party “Recover actual damages or $500, whichever is greater,” with treble available for a willful or knowing violation under (10)(b). Subsection (11)(a) then awards “reasonable attorney fees and costs” to the prevailing party.
• Texts carry a pre-suit notice. Subsection (10)(c) requires the consumer to reply “STOP” first, after which “Within 15 days after receipt of such notice, the telephone solicitor shall cease sending text message solicitations to the called party.” That fifteen-day window is your chance to close the file before a claim exists — but only if the reply reaches a system that acts on it.

The practical takeaway is not “avoid Florida.” It is that a national dialing footprint needs the state of the number, not the state of your license, attached to every record, and a suppression rule that fires on the strictest applicable standard.

Who files these claims, and how they arrive

The reason a single leaked opt-out is worth taking seriously is the shape of the litigation, not the size of one statutory award.

Share of January 2026 federal filings brought as putative class actions, by statute. Source: WebRecon, January 2026 litigation statistics.

WebRecon, which tracks federal consumer-statute filings, counted 219 TCPA suits filed in January 2026 alongside 396 FDCPA and 832 FCRA suits, and reported that “putative class actions represented 10.4% of FDCPA, 77.6% of TCPA and 1.7% of FCRA lawsuits filed last month” (WebRecon, January 2026 stats). TCPA is the low-volume statute in that group and the one that arrives as a class action.

That changes the arithmetic on a purchased file. A defective consent form is not one $500 exposure; it is the same defect replicated across every record the vendor sold under that form. It is also why an indemnification clause capped at the invoice value of the leads is not indemnification in any meaningful sense.

A simple compliance routine for buying agents

You do not need a legal department. You need a repeatable checklist:

1. Confirm written consent language names you or a documented seller before purchase.
2. Pull and store the per-lead consent record on your own system.
3. Scrub against the National Do Not Call Registry; log the scrub, the registry version date, and the subscription account used.
4. Query the Reassigned Numbers Database for anything older than a fresh real-time transfer.
5. Honor every opt-out immediately and maintain an internal DNC list, retained five years.
6. Match your dialing tech to your consent — manual dial when provenance is weak.
7. Tag every record with the state of the phone number, and apply the strictest applicable standard.
8. Retain everything for four years.

This same discipline shows up across paid acquisition. If you advertise to generate your own first-party leads, note that Meta’s and platform rules add their own layer — we cover that context in our guide to Facebook ads for insurance agents and in our broader insurance marketing compliance overview. Medicare producers carry a second, separate rulebook on top of all of this; that one lives in CMS Medicare marketing rules for agents.

Why compliance is a growth lever, not a tax

Skeptical agents read all of this as friction. Flip it. Clean, named, documented consent does three things for your book:

• Connect rates rise because named consent means the consumer remembers requesting contact.
• Cancellations drop because the lead actually wanted the conversation.
• Your downside shrinks because one TCPA judgment can erase a year of margin.

Compliance is a moat. The agencies that treat consent as paperwork are the ones who get named in the class action. The ones who own their records and buy from clean sources keep dialing — and what they dial into is a documented insurance lead follow-up cadence, where every call and text on a purchased lead is timed against the consent record that permits it.

The structural fix is to stop renting consent altogether. First-party leads generated on your own forms, under your own name, with your own record of the disclosure, remove the provenance question at the source — the approach behind insurance leads without cold calling. That is what our managed programs are built to produce, and the retainers are published: Foundation at $2,500 a month, Growth at $3,500, Full-Funnel at $5,500, with ad spend billed at cost. See what sits in each tier on our pricing page.

Want a second set of eyes on where your current leads come from and how exposed your dialing setup is? Grab a free marketing audit and we’ll map your sourcing and consent trail with you. If you’d rather see how we structure compliant senior-market campaigns end to end, start with our final expense marketing programs.

This article is marketing guidance for licensed agents and is not legal advice. You are the licensed party; consult a TCPA attorney for your specific setup.