TCPA Compliance for Insurance Lead Buyers: The 2026 Survival Guide

For actionable violations under 47 U.S.C. 227(b)(3), a private plaintiff may recover actual monetary loss or $500 per violation, whichever is greater. A court may increase the award up to threefold for knowing or willful violations. DNC private claims under section 227(c)(5) have a separate more-than-one-call within twelve months threshold and applicable defenses. Liability, counting and defenses depend on the provision and facts; these are not automatic government fines per dial. This guide is informational, not legal advice or a promise of protection from lawsuits. Ask qualified counsel to evaluate the actual source, disclosure, outreach technology and applicable rules.

Three requirements to assess before outreach

1. For covered advertising or telemarketing calls using a statutory automatic telephone dialing system or an artificial or prerecorded voice, assess applicable prior express written consent requirements and exceptions. A manually dialed live-agent call does not automatically require written consent solely because it is outbound; DNC, identification and state rules may still apply.
2. Honor covered FCC consent-revocation and company-specific DNC requests within a reasonable time, not exceeding 10 business days after receipt. Immediate suppression is a recommended operational standard. FTC rules, automated opt-out mechanisms and certain exempt calls can require different or immediate treatment; the FCC cap is not a universal grace period.
3. Caller ID and identification. Assess the applicable caller-identification and caller-ID transmission requirements for covered telephone solicitations; do not use misleading caller identity.

The one-to-one rule was vacated before taking effect

On January 24, 2025, the Eleventh Circuit vacated the FCC one-to-one and logically/topically related consent restrictions before their scheduled January 27 effective date. Existing prior express written consent requirements for covered telemarketing robocalls and robotexts remain. The decision does not validate every multi-seller disclosure.

• Review the actual disclosure, signature or affirmative consumer action, permitted recipients and outreach technology against applicable law.
• Multiple-seller disclosures are not automatically prohibited by the vacated rule and are not automatically valid. A generic partner list or certificate is not a legal safe harbor.
• Age alone does not establish expired consent. Review disclosure scope, revocation, reassignment, recipient identity and applicable law before using aged data.

What a compliant consent string actually contains

As recommended evidence to request where available, consider:

• The full URL the consumer visited and a snapshot of the page at time of submission.
• The exact text of the consent disclosure shown to the consumer.
• The list of sellers / agencies covered by the consent, named individually.
• Timestamp, IP address, and user agent at submission.
• The phone number consented and a checkbox or signature confirming the consent.
• Method of capture (web form, telephone signature, SMS) and the channel of marketing consented to.

Request a representative documentation sample before contracting. TrustedForm certificates, Jornaya tokens, timestamps and source details may support review but do not independently establish consent. Agree a reasonable documentation retrieval procedure; 24 hours is not a universal legal deadline.

DNC screening: federal baseline and separate exceptions

The audit trail every agency needs

Plan retrieval of relevant records under the actual request, contract and applicable legal procedure. Useful evidence may include:

1. The consent string and snapshot of the consent page at submission time.
2. Available call recordings where recording is lawful and applicable; call-detail records and audio have different roles.
3. Evidence of applicable registry screening, internal suppression and any claimed exception.
4. The lead-vendor contract that warrants the consent.
5. The CRM disposition for the call.

Contract terms that protect you

The vendor contract is the second line of defense after consent capture. Negotiate these terms before wiring a dollar:

• Counsel-reviewed allocation of responsibility and indemnification for documented consent defects; no clause guarantees protection.
• Right to audit consent records on 5 business days notice.
• An agreed procedure and realistic deadline for producing available consent evidence and call records.
• Product-specific representations about sourcing, available evidence and applicable consent requirements, not a warranty based on the vacated rule.
• Termination right with no penalty on any material compliance breach.

Common compliance failures we see

• Using aged data without reviewing original permission, revocation, reassignment, seller identity and applicable rules; age alone does not prove consent has expired.
• Single internal DNC list shared across agencies under one ownership group, without segregation by branding. Opt-out for one brand must propagate to the dialer that brand uses.
• Assuming consent alone resolves every DNC obligation. Signed seller permission or a qualifying relationship may be relevant, but company-specific requests and separate robocall consent requirements still apply.
• Trusting a vendor's verbal assurance instead of reviewing a sample consent record.
• Failing to retain records required by applicable law or contract. Call-detail records are not the same as audio, and recording requires its own legal assessment.

Actionable takeaways

1. Review every lead supplier's consent capture flow before signing.
2. Use National DNC Registry data obtained no more than 31 days before calling as part of the applicable compliance or safe-harbor procedures, alongside written procedures, training and company-specific suppression. Daily screening is an optional stricter practice. Confirm state requirements and any valid exception separately.
3. There is no universal TCPA mandate to record every outbound call or retain all consent evidence for four years. Covered sellers and telemarketers must retain the records prescribed by the amended FTC Telemarketing Sales Rule for five years; insurance applicability and exemptions require assessment. Use applicable rules, contracts, litigation holds and program requirements to set retention, and check recording-consent laws.
4. Get indemnification and a right-to-audit clause in every vendor contract.
5. Audit your own consent records quarterly. If you wouldn't show them to your lawyer, fix them today.