TCPA Rules for Insurance Agents: Consent, DNC, and Opt-Outs

The TCPA rules for insurance agents come from 47 U.S.C. 227 and the FCC's rules at 47 CFR 64.1200. You need prior express consent to call a cell phone with an autodialer or an artificial, prerecorded, or AI voice, and prior express written consent when that call is telemarketing. Telephone solicitations must also fall between 8 a.m. and 9 p.m. at the called party's location, skip numbers on the National Do Not Call Registry unless an exemption applies, and stop within 10 business days of a do-not-call request.

Texts are treated like calls for the do-not-call rules under 64.1200(e) and the revocation rules under 64.1200(a)(10). The FCC's one-to-one consent rule never took effect, and new revocation rules start November 25, 2026. This guide covers each requirement, the Medicare rules layered on top, who is liable, and what to document.

Key takeaways

• Autodialed calls and calls using an artificial, prerecorded, or AI voice need prior express consent to reach a cell phone. Telemarketing calls made that way need prior express written consent.
• The one-to-one consent rule was vacated and never took effect. The FCC reinstated the prior written consent definition effective August 29, 2025, but carriers and vendors can still require more.
• Texts are treated like calls for the do-not-call rules, which apply to telemarketing texts sent to wireless numbers under 64.1200(e), and for the revocation rules in 64.1200(a)(10). Confirm with your compliance team how texts are treated under the consent rules.
• Scrub against the National Do Not Call Registry using a version no more than 31 days old. Keep an internal do-not-call list, honor each request within 10 business days, and keep it for 5 years.
• Starting November 25, 2026, you may designate an exclusive opt-out method if you disclose it on the call or in the text. An opt-out sent in response to telemarketing ends all of your telemarketing to that person.
• For Medicare beneficiaries, CMS bans unsolicited calls, texts, and voicemails, including calls to referrals, on top of the TCPA.

What is the TCPA, and does it apply to independent agents?

The Telephone Consumer Protection Act is codified at 47 U.S.C. 227. The FCC's rules carrying it out are in 47 CFR 64.1200. The core restriction in 64.1200(a)(1) applies to any person or entity that makes an autodialed or artificial or prerecorded voice call, so it covers an independent agent working from a home office as much as a call center.

If you sell Medicare, you work under two sets of rules. CMS defines third-party marketing organizations (TPMOs) to include independent agents and brokers paid for lead generation, marketing, sales, and enrollment.

When do you need prior express consent vs. prior express written consent?

The consent you need depends on the line, the technology, and whether the call is telemarketing.

As a practical matter, if a call or text promotes coverage you sell, plan on needing written consent, and confirm how your outreach is classified with your compliance team.

What must prior express written consent contain?

Under 64.1200(f)(9) as reinstated, prior express written consent is a written agreement that:

1. Bears the signature of the person called
2. Clearly authorizes the seller to deliver telemarketing calls using an autodialer or an artificial or prerecorded voice
3. Names the phone number the calls may go to
4. Clearly and conspicuously discloses that the person authorizes those calls
5. Clearly and conspicuously discloses that the person doesn't have to sign as a condition of purchase

Electronic or digital signatures count where they are valid under federal or state law. That's why a web form with an e-signature can qualify, as long as the form also contains every element above.

Do you need written consent to dial a cell phone by hand?

The consent requirements in 64.1200(a)(1) through (a)(3) apply when a call uses an autodialer or an artificial or prerecorded voice. A live call you dial yourself still has to follow the calling hours, National Do Not Call Registry, internal do-not-call, and caller identification rules. Stricter state laws still apply too, and for Medicare beneficiaries so does CMS's ban on unsolicited contact. Ask your compliance team whether your dialing or texting tool counts as an autodialer.

Is the FCC one-to-one consent rule still in effect?

No. The Eleventh Circuit vacated the FCC's 2023 revision to 64.1200(f)(9), often called the one-to-one consent rule. The court's mandate issued April 30, 2025, and the revised rule never took effect. The FCC reinstated the prior definition in a final rule effective August 29, 2025 (DA 25-621, 90 FR 42137).

Pages saying one-to-one consent is required in 2026 are out of date. Your carriers, upline, or lead vendors can still require stricter consent by contract, so ask each one what they expect.

Do TCPA rules apply to AI voice calls and prerecorded messages?

Yes. The FCC's Declaratory Ruling FCC 24-17, adopted February 2, 2024 and released and effective February 8, 2024, confirmed that the TCPA's limits on an "artificial or prerecorded voice" cover current AI technologies that generate human voices. Those calls need prior express consent unless there's an emergency or an exemption. If they introduce an advertisement or contain telemarketing, they need prior express written consent. The TCPA allows no carve-out for technology that claims to be the equivalent of a live agent.

What every artificial or prerecorded message must include

Under 64.1200(b), and per FCC 24-17 for AI-voice calls as well:

• The identity of the business responsible for the call, stated clearly at the beginning
• A telephone number, during or after the message
• For telemarketing, an automated interactive voice or key-press opt-out offered within two seconds of the identification
• For telemarketing messages left on voicemail, a toll-free number that connects to that opt-out mechanism

The ruling addresses calls made with AI voices. If a tool only answers calls that consumers place to you, ask your compliance team how the rules apply. Our guide to AI voice agents for insurance outreach covers what these tools should and shouldn't say.

How do TCPA rules apply to text messages?

Under 64.1200(e), the do-not-call rules in (c) and (d) apply to telemarketing calls or text messages to wireless numbers, and the revocation rules in (a)(10) through (a)(12) cover both calls and texts. Confirm with your compliance team how texts are treated under the consent rules.

In practice, give texts the same consent check, registry scrub, internal list check, and time window as calls. Opt-out keywords are covered in the revocation section below. For wording, see our insurance follow-up text templates.

What are the legal calling hours for insurance agents?

Under 64.1200(c)(1), no one may make a telephone solicitation to a residential subscriber before 8 a.m. or after 9 p.m., local time at the called party's location. Section 64.1200(e) extends that to wireless numbers. What counts is the lead's local time, not yours.

States can go further. Under 47 U.S.C. 227(f), the TCPA doesn't preempt state laws that put more restrictive intrastate requirements on telephone solicitations. As advice, set your window by the lead's time zone and use whichever window is narrower, federal or state.

How do Do Not Call rules work for insurance agents?

The National Do Not Call Registry

Under 64.1200(c)(2), telephone solicitations to numbers on the National Do Not Call Registry are prohibited. A registration must be honored indefinitely, or until it's cancelled or removed. The FCC safe harbor requires:

• Written procedures
• Trained personnel
• A recorded do-not-call list
• A version of the registry obtained no more than 31 days before the call
• Access to the do-not-call data bought from the registry administrator yourself, with no cost-sharing arrangements, and used only for compliance
• Records documenting the scrub process

The safe harbor applies only if you can show the violation was the result of error and you meet every standard. If you rely on an upline's or vendor's registry access, confirm with your compliance team how your access is set up.

The FTC's Telemarketing Sales Rule guidance likewise says to delete registry numbers from call lists at least every 31 days.

Exceptions and the established business relationship

The FCC's registry rule doesn't apply in two cases:

• Written permission. The seller has the consumer's prior express invitation or permission, shown by a signed written agreement that says the consumer agrees to be contacted by this seller and includes the phone number.
• Personal relationship. The caller is a family member, friend, or acquaintance of the person called.

The FCC also defines an established business relationship (EBR) for telephone solicitations in 64.1200(f)(5). It rests on a purchase or transaction within the 18 months before the call, or an inquiry or application within the 3 months before the call. A do-not-call request made to that seller ends it.

None of these exceptions overrides CMS. A friend's referral to a Medicare beneficiary is still an unsolicited call under CMS rules.

Your internal do-not-call list

Under 64.1200(d), anyone making telemarketing calls must:

1. Keep an internal do-not-call list, with a written policy available on demand
2. Train personnel on it
3. Record each request at the time it's made
4. Honor it within a reasonable time, no more than 10 business days
5. Honor it for 5 years from the date of the request

Under 64.1200(d)(4), telemarketing callers must also give the name of the individual caller, the name of the entity on whose behalf the call is made, and a phone number or address for that entity. A simple opening (advice):

"Hi [first name], this is [your name] with [agency name], following up on the information you asked us for. If you need to reach us, our number is [number]."

How do opt-outs and revocation of consent work, and what changes November 25, 2026?

The rule today

Under the current eCFR text, consumers may revoke prior express consent or prior express written consent by any reasonable method. A reply of "stop," "quit," "end," "revoke," "opt out," "cancel," or "unsubscribe" to a text is reasonable on its face. Other words must be honored if a reasonable person would understand them as a revocation. You must honor revocations within a reasonable time, no more than ten business days.

Can you send a confirmation text after STOP?

One, under limits. Under 64.1200(a)(12), a single confirmation text after an opt-out doesn't violate the rules if it only confirms the revocation and has no marketing. If it goes out within five minutes, it's presumed to fall within the consumer's prior express consent. If it takes longer, you have to show the delay was reasonable. A template (advice):

"You're unsubscribed from texts from [agency name]. You won't receive more messages from us."

What FCC 26-67 changes

The FCC's final rule Enhancing the Ability of Consumers To Control the Robocalls (FCC 26-67, adopted September 30, 2026) was published October 26, 2026 at 91 FR 67214 and takes effect November 25, 2026.

• Exclusive opt-out methods. You may designate an exclusive way to revoke consent: an automated interactive voice or key-press opt-out on a call, a reply text using one of the standardized words, and/or a website or phone number you choose. The method must be clearly and conspicuously disclosed on the call or in the text. If you designate none, you must keep processing revocations made by any reasonable means. Designating an exclusive method doesn't change the separate opt-out required in artificial or prerecorded telemarketing calls under 64.1200(b)(3). The rule didn't amend the internal do-not-call requirements in 64.1200(d), so keep honoring do-not-call requests as described above.
• Texts. If reply texts are your exclusive method, you can meet the disclosure duty by including at least one standardized word, such as "stop," in each text. You must still honor any of the standardized words, and the ten-business-day deadline stays in place.
• Scope. You may treat a revocation of informational robocalls as covering only that category. A revocation sent in response to a call or text that contains an advertisement or is telemarketing revokes consent to all future telemarketing calls and texts from you. The rule supersedes the "revoke all" delayed effective date previously extended to January 31, 2027.

If you designate reply texts as your exclusive method after November 25, 2026, include at least one standardized word, such as "Reply STOP to opt out," in every text you send, and honor all seven standardized words. Until then, keep honoring revocations made by any reasonable method.

TCPA rule status at a glance (as of November 9, 2026)

Who is liable for a TCPA violation, and what are the penalties?

The seller. Under 64.1200(d)(3), if a party other than the entity on whose behalf calls are made records or keeps the do-not-call requests, the entity on whose behalf the call is made is liable for any failure to honor them. Handing your list to a vendor or call center doesn't hand off that liability.

Private lawsuits. Under 227(b)(3), a person can sue over autodialer and prerecorded-voice violations for actual monetary loss or $500 per violation, whichever is greater. A court can increase the award up to 3 times if the violation was willful or knowing. Under 227(c)(5), a person who gets more than one call within any 12-month period by or on behalf of the same entity in violation of the do-not-call regulations can sue for up to $500 per violation, trebled if willful or knowing.

Your defense. For do-not-call claims, it's an affirmative defense that you established and implemented, with due care, reasonable practices and procedures to prevent violations. Your written policy, training records, and scrub logs are evidence that can support that defense.

States. Under 227(g), when a state attorney general believes someone has engaged in a pattern or practice of violations, the state can sue for actual monetary loss or $500 per violation, up to triple if willful or knowing.

Whether you, your agency, or someone else is "the entity on whose behalf" a call is made depends on your contracts and the facts. Put that question to your own counsel.

How do Medicare rules add to the TCPA?

No unsolicited contact

42 CFR 422.2264(a)(2)(iv) bars Medicare Advantage organizations and their agents from unsolicited telephone solicitation (cold calling), robocalls, text messages, and voicemail messages, including calls based on referrals. A call isn't unsolicited if the beneficiary gives consent or starts the contact, for example by returning your call, or if you're calling someone who completed a business reply card asking to be contacted. Our guides to Medicare cold calling rules and scope of appointment rules go deeper.

Scope of personal marketing appointments

Under the personal marketing appointment rules in 42 CFR 422.2264(c)(3)(iii)(A), a Scope of Appointment, business reply card, or request for information is valid for 12 months after the beneficiary's signature date or first request. The rule places this 12-month validity within the personal marketing appointment requirements. Confirm with CMS, your carriers, and your upline how long a business reply card or request for information supports outreach.

Call recording and retention

Under 42 CFR 422.2274(g)(2)(ii), TPMOs must record all marketing, sales, and enrollment calls in their entirety. CMS's 2022 marketing FAQ says the requirement covers inbound and outbound calls and virtual calls such as Zoom, but not in-person meetings. If a beneficiary declines to be recorded, the call must end. The same FAQ applies a ten-year retention requirement to recorded sales and enrollment calls. CMS's CY2027 proposed rule proposed cutting retention for marketing and sales recordings to 6 years, so confirm the final status with CMS. For call flow, see how to sell Medicare over the phone.

For ACA clients, Marketplace enrollment consent is its own requirement, covered in our guide to ACA consent documentation.

Do state laws and the FTC Telemarketing Sales Rule apply?

State laws can be stricter than the TCPA, because 227(f) leaves more restrictive intrastate rules in place. The FTC's Telemarketing Sales Rule applies to insurance only to the extent the business isn't regulated by state law under the McCarran-Ferguson Act, so whether it covers your calls depends on how your state regulates insurance telemarketing. The FCC regulates both intrastate and interstate calls. The FTC sends readers to the state attorney general or a state consumer protection agency for state telemarketing laws. Check with your state insurance department as well.

Can you call or text leads you bought from a vendor?

Only with the consent your call or text requires. Before you dial, ask the vendor for (advice):

• The exact form wording the consumer saw
• The signature or e-signature, with its date and time
• The phone number the consent covers
• The seller the consent authorizes
• The "not a condition of purchase" disclosure
• For Medicare leads, proof the beneficiary asked to be contacted, and the request date. Keep that date and confirm with your carriers, upline, and CMS how long a contact request supports outreach

Scrub every purchased list against the registry and your internal list. Confirm the vendor's records with your compliance team and your carriers.

Opt-out workflow and documentation checklist

These steps are advice built on the rules above.

1. Log every opt-out, spoken or texted, at the moment it's made, with the date, time, channel, and words used.
2. Stop all calls and texts to that number in every system and campaign the same day. The outer limit is 10 business days.
3. If you send a confirmation text, send one, with no marketing, within five minutes.
4. If the opt-out answered a telemarketing message, stop all telemarketing to that person, not just one campaign.
5. Keep the request on your internal list for at least 5 years.

Records to keep:

• Each lead's consent record, for as long as your compliance team advises
• The download date of the registry version behind each calling list
• Your written do-not-call policy and staff training dates
• Script versions showing caller identification and opt-out disclosures
• Medicare permission records (SOA, business reply card, or request) and call recordings

Where LeadGPT fits

Some LeadGPT behavior lines up with this workflow. None of it establishes consent or makes your outreach compliant.

• When a lead texts STOP or a similar opt-out, LeadGPT blocks every text to that number from every part of LeadGPT, sets the lead to Dead, and stops any drip.
• AI calling campaigns, included on the Lead Hunter and Lead Master plans, skip leads marked Dead, leads who texted STOP, and leads flagged do-not-call in their name or status, and only dial between 8 AM and 9 PM in each lead's time zone. This doesn't replace a National Do Not Call Registry scrub or your internal do-not-call list. AI calling campaigns place AI-voice calls, so the consent, identification, and opt-out rules above apply, including prior express written consent and an automated opt-out for telemarketing, and CMS bans unsolicited robocalls to Medicare beneficiaries. Confirm with your compliance team how those requirements are met before launching a campaign.
• LeadGPT doesn't add "Reply STOP" wording to texts for you, so add your own opt-out wording to your texts.
• Calls are recorded with no announcement, so confirm call-recording disclosure rules with your compliance team.

See the features overview or the interactive demo.

What to do next

1. Pull your consent forms and check them against the five written-consent elements.
2. Write or update your do-not-call policy and train everyone who calls or texts.
3. Before November 25, 2026, decide whether to designate an exclusive opt-out method, and update your text and call scripts to match.
4. Ask your lead vendors for consent records on your next order.

This guide is general information, not legal or compliance advice. Confirm each rule with the FCC, CMS, your state attorney general or insurance department, your carriers or upline, and your compliance team. You'll find more guides in our compliance category, and our editorial policy explains how we research them.