TCPA Rules for Insurance Agents and Purchased Leads

TL;DR: TCPA rules for insurance agents stopped being a question about your dialer and became a question about your lead file. The FCC wrote a one-to-one consent rule in 2023 that would have killed the shared insurance lead as a callable asset, set compliance for January 27, 2025, and the Eleventh Circuit vacated it on January 24, 2025 in a case brought by the Insurance Marketing Coalition, three days before agencies had to comply. The Commission conformed its rules in August 2025 and confirmed the revised rule never took effect at all. What is left is the older definition, and it is still a five-part document: an agreement in writing, bearing the signature of the person called, that clearly authorizes the seller to deliver telemarketing messages using an autodialer or a prerecorded voice, naming the telephone number, with a clear and conspicuous disclosure that also states the person is not required to sign as a condition of buying anything. The do not call registry runs a separate test that still asks for a signed written agreement naming this seller and that number. An established business relationship runs 18 months from a purchase and 3 months from an inquiry, and it does not travel to your affiliates unless the consumer would reasonably expect it to. Buying a lead does not buy the record.

An agency buys 400 shared leads on Monday. By Tuesday afternoon a rep has worked 300 of them and booked four appointments. Now ask the question that matters. What did those 400 consumers actually agree to? Nobody in the building can tell you. That is the real compliance posture of most insurance agencies, and it has almost nothing to do with the phone system.

The last two years have been loud. Most of the noise was about a rule that never went into effect. So let’s be specific about what TCPA rules for insurance agents actually ask of you.

What TCPA rules for insurance agents actually turn on

What does the federal statute actually require? It does one simple thing and one hard thing. The simple thing first. If you call or text a wireless number using an autodialer or an artificial or prerecorded voice, you need the called party’s prior express consent. Now the hard part. When that call is telemarketing or advertising, the FCC’s rule upgrades that to prior express written consent. Is insurance sales telemarketing? Yes, and there is no version of selling a policy to a stranger that sits outside that word, however the agency describes the call internally.

Now layer the second regime on top. The national do not call registry is a different rule in the same section, and it restricts telephone solicitations regardless of how you dial. Does switching to manual dialing get you out of it? No. A rep tapping a number by hand is not using an autodialer and is still squarely inside the registry rule. Two tests, two sets of evidence, and because they sit in different paragraphs of the same rule with different exemptions attached, they fail independently of each other.

So which one should an agency fix first? Neither, until you know what is in the lead file, because that is the input both tests read. Your dialing method decides which test applies. Your records decide whether you pass it.

The consent rule insurance agents were told to rebuild for

What was the rule everyone spent 2024 preparing for? In December 2023 the FCC adopted a Second Report and Order that rewrote the definition of prior express written consent. Published at 89 FR 5098 on January 26, 2024, it added two restrictions that applied no matter what the facts of a particular consent looked like. First, a consumer could consent to telemarketing robocalls from only one entity at a time. Second, the robocall’s subject matter had to be logically and topically associated with the interaction that prompted the consent.

Read the first one again with an insurance lead form in front of you. A comparison site collects a name and a number, the fine print lists sixty marketing partners, and the consumer checks one box. Under the one-to-one rule, that box produced consent for nobody. The Eleventh Circuit read the order the same way, describing it as holding that a consumer can never provide prior express consent for robocalls by checking one box consenting to a list of thousands of marketing partners. The shared lead, as an instrument, was going to stop working, because the entire economics of a shared lead depend on one consent event being sold to several buyers at once.

The FCC announced the compliance date in November 2024. Compliance with the revised rule was required as of January 27, 2025. So agencies spent most of 2024 rebuilding intake forms, renegotiating vendor contracts, and arguing about whether aged leads were worth anything after January. That work was real. The deadline was not.

What the Eleventh Circuit vacated, and what it left standing for agents

Then the industry sued. The Insurance Marketing Coalition, a consortium of more than twenty insurance industry stakeholders, petitioned for review, and the case was argued on the narrow ground that an agency cannot rewrite what a statutory term has always meant. On January 24, 2025, three days before the compliance date, the Eleventh Circuit granted the petition and vacated Part III.D of the 2023 Order. The court held that the FCC exceeded its statutory authority because the new consent restrictions conflict with the ordinary statutory meaning of prior express consent.

Why does the reasoning matter more than the result? Because it tells you what consent still is, and that is the standard your lead file has to meet tomorrow morning. The court said that to give prior express consent to receive a robocall, a person need only clearly and unmistakably state, before receiving the robocall, that they are willing to receive it. One-to-one consent is not required. The court also noted the FCC had all but conceded the point in its own brief, acknowledging there may be instances where a consumer provides willing, informed agreement to receive robocall marketing from multiple named intermediaries.

What happened next, and when? The mandate issued April 30, 2025. In August 2025 the Commission conformed its rules and reinstated the prior version of the definition. That document carries the sentence most agencies never heard. Prior to the court’s mandate, the Commission had postponed the effective date of the revised rule, and the revised rule had not gone into effect. It never applied to a single call.

Here is the part that gets misread. A vacated rule is not a deregulation. The court struck down the FCC’s attempt to narrow what consent can mean. It did not touch the floor underneath. Everything required before 2023 is required now, and the pre-2023 definition is what sits in the regulation today.

The five things a purchased insurance lead has to prove

Pull the current definition apart and treat each clause as a field your lead vendor either delivers or does not. The text reads this way. Prior express written consent means an agreement, in writing, bearing the signature of the person called, that clearly authorizes the seller to deliver or cause to be delivered advertisements or telemarketing messages using an automatic telephone dialing system or an artificial or prerecorded voice, and the telephone number to which the signatory authorizes those messages to be delivered. Five separate things sit inside that sentence, and a lead file can satisfy four of them and still be worthless to you. Count them.

1. An agreement in writing. Not a call recording, not a verbal yes on a transfer, and not a vendor attestation that consent exists somewhere in a system you cannot query.
2. The signature of the person called. Electronic and digital signatures count to the extent they are valid under federal law or state contract law, so a timestamped web form submission is usually fine. A list with no signature artifact at all is not.
3. Language that clearly authorizes the seller. That is your agency, named.
4. The specific telephone number the signer authorized. A consent record that does not carry the number it belongs to cannot be matched to the call you made.
5. A clear and conspicuous disclosure, which must say both that signing authorizes telemarketing calls using an autodialer or prerecorded voice, and that the person is not required to sign as a condition of purchasing anything.

Most TCPA compliant badges on a lead invoice address none of those five. So stop asking for the badge. Ask for the artifact: the form copy as rendered on the day of capture, the timestamp, the IP, the number, and the disclosure text. Can the vendor produce that on an ordinary Tuesday for a lead you bought in March, without a support ticket and without a call to an account manager who has since left? If not, your defense is somebody else’s filing system.

And one more that agencies still miss. The record has to outlive your relationship with the vendor. Export it when you buy it.

Do not call rules for insurance agents work on a different test

Does the vacatur help you with the do not call registry? No, and this is where the shared lead gets interesting again, because the court was never asked about that rule and did not touch it. The registry provision prohibits telephone solicitations to a registered residential number, and its exemption for prior express invitation or permission has its own wording: the permission must be evidenced by a signed, written agreement between the consumer and seller which states that the consumer agrees to be contacted by this seller and includes the telephone number to which the calls may be placed.

This seller. Singular, in the text of the rule. The Eleventh Circuit was deciding a case about the consent standard under a different subsection, so it left that wording alone. What does that mean on the floor? A sixty-partner checkbox may survive the robocall consent analysis after the vacatur and still leave you calling a registered number with no usable exemption. Two separate findings in two separate rules. Plaintiff firms plead both.

The registry rule also carries a safe harbor. Read it as an evidence record, not a good-faith argument. It requires written procedures, trained personnel, a maintained internal list of numbers you may not contact, and a scrubbing process using a version of the registry obtained no more than 31 days before the call, with records documenting that process. Note the shape of that list. Four of the five are things a calling system either produces automatically, every day, without a rep remembering, or does not produce at all, and the fifth is a document somebody has to write once.

That is the practical reason to run the scrub inside the calling system rather than beside it. Kixie’s do not call compliance workflows support checks against the National Do Not Call Registry and your internal suppression lists, and the page is blunt that customers remain responsible for their calling practices and legal review. That division is correct and worth repeating to your own team: the platform produces the record, your agency still owns the decision to dial.

State registries are a separate scrub again, and a national scrub does not catch them. We covered which states run their own lists in a separate breakdown.

Where agency, carrier, and affiliate lines bind insurance agents

Agencies assume relationships travel. They do not. The established business relationship exemption turns on a prior or existing relationship formed by a voluntary two-way communication. The clock is a purchase or transaction within the 18 months before the call, or an inquiry or application within the 3 months before it. Either party can terminate it.

Two limits matter for how insurance is actually sold, and both of them cut against the way most agencies build a cross-sell list. A consumer’s seller-specific do not call request kills the relationship for solicitation purposes even if they keep doing business with you. And the relationship with one business entity does not extend to affiliated entities unless the consumer would reasonably expect it to, given the type of goods or services the affiliate offers and the identity of that affiliate.

Apply that to an agency structure. Your carrier’s customer is not your prospect. Your health agency’s client is not automatically your Medicare division’s client. The affiliate test asks what the consumer would reasonably expect, not what your org chart says. Cross-sell lists built by joining entities together are where this breaks most often, and nobody notices until a complaint names both. The clocks are the same ones that govern any licensed professional calling past clients, and the real estate version of this analysis walks them in more detail.

Who the TCPA rules treat as the seller

A lead vendor runs a live transfer. An offshore call center dials and warm-transfers to a licensed agent. Agencies assume the dialing party owns the exposure. Read the definitions. The regulation calls the seller the person or entity on whose behalf a call is initiated to encourage the purchase of property, goods, or services, and the telemarketer the entity that initiates the call. Two different roles. The seller never has to touch the keypad.

So the operating question is not who dialed. It is on whose behalf the call was made, and whether you can produce consent for that number. What about the indemnity clause in the vendor contract? That is a commercial arrangement with a company that may not exist in three years. It is not a defense to a claim.

So how do you oversee a vendor that dials on your behalf? Treat it the way you treat a carrier appointment. Named entity, documented process, retained artifacts, and periodic sampling of the actual consent records rather than the summary report the vendor sends you at month end.

Texting insurance leads runs on the same consent rules

Texts are calls. The FCC has read the statutory word call to include text messages since 2003, and the Eleventh Circuit restated that in the same opinion that vacated the one-to-one rule. So every element above applies to an SMS campaign aimed at a purchased lead. That includes written consent when the message is marketing.

Revocation is the piece that trips agencies up operationally, because it is cheap to honor and expensive to miss, and the rules are specific about reasonable methods and the deadline to process a stop request. That spine is covered in our breakdown of consent and texting, so the short version here is the one that affects system design: an opt-out received on any channel has to suppress every channel, and it has to do it without a human remembering.

State rules sit on top of federal TCPA rules

Several states now run their own telephone solicitation statutes. Broader equipment triggers, their own consent definitions, private rights of action with per-call damages. Some reach a caller dialing in from another state, so the location of your office decides nothing. Insurance is also a state-regulated business in its own right. A department of insurance advertising rule can bind you where the TCPA does not.

So is federal compliance the finish line? It is the floor. Clear it before anyone asks the harder question about where the consumer was sitting when the phone rang.

What insurance agents should be able to produce on demand

Strip away the law for a second. A claim arrives naming a number and a date. What can your agency produce in an hour?

• The consent artifact for that number, with the form language, the signature evidence, the timestamp, and the source.
• The call and text history for that number, with outcomes, across every rep who touched it.
• The suppression state of that number and the time it entered suppression.
• The registry scrub record covering the date the call was placed.
• The recording, if one exists, and the consent posture of the state it was made in.

If any of those five lives in a rep’s inbox, a spreadsheet, or a vendor portal you no longer pay for, it does not exist. That is the whole argument for keeping outreach inside one system. Kixie logs calls, texts, outcomes, and recordings into the CRM automatically, which turns the second and fifth questions from a search into a lookup.

What about the recording itself? It adds its own state test. Kixie’s two-party consent compliance settings automatically disables call recordings for regions that require consent from both parties and notifies callers with a customizable greeting, which is the kind of control you want set once at the account level rather than remembered per call. Is a rep deciding state by state a policy? No, it is a failure mode with a training deck attached to it.

A working checklist for TCPA rules in an insurance agency

1. Write down which of your campaigns are telemarketing. All outbound sales campaigns are.
2. For each lead source, name the five consent elements and confirm the vendor delivers the artifact, not a badge.
3. Export and retain consent artifacts at purchase. Do not rely on vendor retention.
4. Scrub against the national registry with a version no older than 31 days, and keep the documentation of the process.
5. Maintain the internal do not call list as a system object that every channel reads, not a shared document.
6. Set the 18 month and 3 month relationship clocks as dated fields, and stop treating affiliates as one entity.
7. Confirm opt-outs suppress calls and texts together, immediately, without human steps.
8. Set recording behavior by state at the account level.
9. Sample ten consent records a month and try to defend them. The ones you cannot are your real exposure.

TCPA questions insurance agents ask

Is the one-to-one consent rule dead for good?

The Eleventh Circuit vacated it and the FCC conformed its rules to that decision, which reinstated the earlier definition. The court remanded for further proceedings, so the Commission could in principle act again within its authority. Build for the rule that exists today and keep the consent artifact good enough that a stricter rule would not break you.

Can an insurance agent text a prospect who filled out a web form?

It depends on what the form said and whether the message is marketing. A marketing text to a wireless number sent with equipment covered by the rule needs prior express written consent carrying the disclosure and the number. A form that only collects a quote request without that disclosure does not get you there.

Does a past policyholder count as consent?

Not as consent. A prior purchase can support the established business relationship exemption to the do not call registry for 18 months, which is a different thing. It does not authorize an autodialed or prerecorded marketing call, and it ends the moment the person asks your agency to stop.

Does using a manual dialer solve this?

It removes one test and leaves the other. Manual dialing can take you outside the autodialer consent requirement, and it does nothing about the registry, your internal list, calling hours, or state statutes. Agencies that switch to manual dialing and relax their scrubbing have traded one exposure for a bigger one.

Who is liable when a lead vendor makes the call?

The rule defines the seller as the entity on whose behalf the call is made, separately from the telemarketer that initiates it. Your agency can be the seller on a call it never dialed, which is why vendor oversight and retained consent records matter more than an indemnity clause.

What to check in your insurance agency this week

Pick ten numbers your reps called last week from purchased leads. For each one, try to produce the consent artifact, the scrub record, and the suppression state, using only systems your agency controls today. Count how many you finish in an hour. That number is your actual compliance posture under TCPA rules for insurance agents, and it is the only one worth reporting to whoever signs the lead invoices.

Sources

• United States Court of Appeals for the Eleventh Circuit, Insurance Marketing Coalition Limited v. Federal Communications Commission, No. 24-10277, decided January 24, 2025, granting the petition for review and vacating Part III.D of the 2023 Order, and holding that one-to-one consent is not required under the ordinary meaning of prior express consent. https://media.ca11.uscourts.gov/opinions/pub/files/202410277.pdf. Reviewed November 12, 2026.
• Electronic Code of Federal Regulations, 47 CFR 64.1200, delivery restrictions, for the current prior express written consent definition at paragraph (f)(9) including the signature, named seller, telephone number and clear and conspicuous disclosure elements, the national do-not-call registry provisions and safe harbor at paragraph (c)(2) including the signed written agreement naming this seller and the 31-day registry version requirement, the established business relationship definition and affiliate limit at paragraph (f)(5), and the seller and telemarketer definitions at paragraphs (f)(10) and (f)(12). https://www.ecfr.gov/current/title-47/chapter-I/subchapter-B/part-64/subpart-L/section-64.1200. Reviewed November 12, 2026.
• Federal Register, 90 FR 42137, Federal Communications Commission final rule published August 29, 2025, conforming the rules to the Eleventh Circuit decision, recording that the mandate issued April 30, 2025, reinstating the prior version of the definition, and stating that the revised rule had not gone into effect. https://www.federalregister.gov/documents/2025/08/29/2025-16641/delete-delete-delete-targeting-and-eliminating-unlawful-text-messages-rules-and-regulations. Reviewed November 12, 2026.
• Federal Register, 89 FR 5098, Federal Communications Commission Second Report and Order published January 26, 2024, for the text of the one-to-one consent and logically and topically associated restrictions as adopted. https://www.federalregister.gov/documents/2024/01/26/2023-28832/targeting-and-eliminating-unlawful-text-messages-implementation-of-the-telephone-consumer-protection. Reviewed November 12, 2026.
• Federal Register, 89 FR 87982, Federal Communications Commission announcement published November 6, 2024, stating that compliance with the revised rule section was required as of January 27, 2025. https://www.federalregister.gov/documents/2024/11/06/2024-24908/rules-and-regulations-implementing-the-telephone-consumer-protection-act-of-1991. Reviewed November 12, 2026.
• Kixie, National DNC Compliance feature page, for the National Do Not Call Registry check, the internal suppression list support, and the customer responsibility statement. https://www.kixie.com/features/national-dnc-compliance/. Reviewed November 12, 2026.
• Kixie, Two-Party Consent Compliance feature page, for the automatic disabling of call recordings in regions requiring consent from both parties, the customizable notification greeting, and the automatic logging of calls, texts, outcomes and recordings into the CRM. https://www.kixie.com/features/two-party-consent-compliance/. Reviewed November 12, 2026.

Sources verified and content reviewed by the Kixie Research Team on November 12, 2026.