TCPA Consent Rules for Insurance Agencies: 2026 Update

If your agency runs a dialer, you spent two years bracing for the FCC one-to-one consent rule. It would have required every lead to carry named-seller consent, obtained one seller at a time. The industry rewrote consent flows and renegotiated vendor contracts for a rule that never took effect.

TL;DR

The FCC one-to-one consent rule is dead, vacated by the Eleventh Circuit on January 24, 2025. Pre-2023 prior express written consent governs lead-bought calls and texts. The revocation-all requirement is delayed to January 31, 2027.

But TCPA litigation operates on the core statute, not the newest regulation. The FTC Telemarketing Sales Rule independently requires specific-seller written consent for prerecorded calls to DNC-registered numbers. Statutory damages remain 500 to 1,500 dollars per violation with no cap.

Key Takeaways

• The FCC one-to-one consent rule was vacated on January 24, 2025, and the pre-2023 prior express written consent standard governs today.
• The revocation-all requirement is delayed to January 31, 2027, but all other consent revocation rules are already in effect.
• TCPA statutory damages are 500 to 1,500 dollars per violation with no cap, and the FTC Telemarketing Sales Rule independently requires specific-seller consent for prerecorded DNC calls.
• Agency owners should audit consent records, build revocation-all suppression now, and verify their carrier partners are current on RMD filings.

What was the FCC one-to-one consent rule?

In December 2023, the FCC adopted a rule that would have rewritten 47 CFR 64.1200(f)(9) to require prior express written consent to be obtained from a single identified seller at a time. The goal was to close the lead generator loophole: a consumer filling out one web form and consenting to contact from dozens of undisclosed marketing partners.

For insurance agencies that buy leads, shared-consent inventory would have been non-compliant overnight. The FCC originally set the effective date for January 27, 2025, then postponed it to January 26, 2026 while the Eleventh Circuit heard the challenge. The court issued its opinion three days before that date arrived.

Why was the rule vacated?

On January 24, 2025, the Eleventh Circuit vacated the rule in Insurance Marketing Coalition Ltd. v. FCC. The court held that the FCC exceeded its statutory authority because "prior express consent" carries its ordinary common-law meaning.

A consumer need only clearly state they are willing to receive the call. The one-to-one and topical-association requirements went beyond that. This was consistent with the post-Loper Bright shift: courts defer less to agency interpretations without a clear statutory hook. The FCC subsequently deleted the vacated language. Nothing in federal TCPA regulations compels named-seller consent today.

Does this mean consent compliance got easier?

No. The vacatur removed one obligation, but the underlying exposure is fully intact. TCPA class actions turn on core prohibitions: calling DNC-registered numbers, using an ATDS or prerecorded voice without consent, and calling numbers that revoked consent.

Why is consent quality the entire battleground now?

With the one-to-one rule gone, plaintiffs probe whether your consent is genuine, documented, and provable. They examine disclosure text, web form design, click paths, and timestamped records. Purchased leads inherit every consent defect of the generator that captured them. The FTC Telemarketing Sales Rule independently requires specific-seller written consent for prerecorded calls to DNC-registered numbers. A lead that passes TCPA consent can still fail TSR prerecorded-call standards.

Why do carrier requirements often exceed federal law?

Many large carriers, particularly in Medicare Advantage and final expense, imposed contractual one-to-one-equivalent consent requirements on downline agents regardless of the vacatur. Your lead may be federally compliant but still violate your carrier appointment agreement, triggering termination and chargeback risks.

How do state mini-TCPA laws affect compliance?

Florida, Oklahoma, Washington, and other states have enacted telemarketing statutes with consent requirements stricter than federal TCPA. If your agency dials into any of these states, compliance is a patchwork, not a single federal standard.

What is the status of the revocation-all rule?

The consent revocation rule at 47 CFR 64.1200(a)(10) requires honoring opt-out requests through any reasonable means. Most of it took effect April 11, 2025, including honoring keywords like "stop" and "unsubscribe" and processing opt-outs within 10 business days.

The "revocation-all" portion, which would treat an opt-out on one message type as revoking consent for all calls and texts from that sender across all channels, has been delayed twice. The FCC extended the waiver to January 31, 2027. This is a delay, not a repeal. Build suppression systems now that propagate a single opt-out across all campaigns.

What should insurance agency owners do right now?

How should I audit consent records?

For every number your dialer calls, produce a dated, specific consent record. If consent came through a lead vendor, retain the vendor's consent certificate, not just the phone number. Audit your vendor lineup annually and retain certificates for at least five years per lead.

Why are purchased leads inherited liability?

Diligence every lead source's consent capture. Secure contractual indemnities. A generator's consent defect becomes your TCPA exposure the moment your dialer connects.

How do I handle DNC Registry scrubbing?

Scrub every number against the National DNC Registry at least every 31 days and maintain an internal DNC list. The defense of "my vendor said they scrubbed" does not hold. See our DNC scrubbing compliance guide for insurance dialers for the full workflow.

When should I build revocation-all suppression?

Now, not January 2027. Engineer suppression so an opt-out on any channel propagates across all marketing purposes. Honor opt-outs within 10 business days and limit post-opt-out messaging to a single confirmation.

Why does the Robocall Mitigation Database matter?

If your agency operates as a voice service provider, you must file RMD certifications. New rules effective February 5, 2026, established penalties of ten thousand dollars per violation for false information and one thousand dollars for failure to update within ten days. Even if you are not a provider, verify your carrier partners are current.

Should I monitor state-level telemarketing laws?

Yes. The federal vacatur does not preempt state mini-TCPA statutes. Track activity in Florida, Oklahoma, Washington, New Jersey, New York, and California. The burden is highest for agencies dialing across state lines.

How does this connect to STIR/SHAKEN and caller ID?

Consent compliance and caller ID reputation share a dialer. Flagged numbers reduce answer rates, driving more attempts and more DNC exposure per booked appointment. June 2026 saw just over 4.25 billion robocalls, down roughly 13 percent year over year. Volume is declining, but enforcement is not. Read our caller ID reputation guide for insurance agencies for the remediation workflow.

Sources cited in this analysis?

1. FCC - Postpones Effective Date of One-to-One Consent Rule (Wiley Law summary)
2. Troutman Pepper - Eleventh Circuit Re-Opens TCPA Lead Generator Loophole
3. FTC - Complying with the Telemarketing Sales Rule
4. Wiley Law - FCC Extends Limited Waiver for TCPA Consent Revocation Rule
5. JSI - FCC Requires Annual Robocall Mitigation Database Recertification
6. InsureLeads - FCC One-to-One Consent Rule Status Update 2026
7. YouMail Robocall Index - June 2026 Data

Frequently Asked Questions

What is the FCC one-to-one consent rule status in 2026?

The Eleventh Circuit vacated the rule on January 24, 2025, in Insurance Marketing Coalition v. FCC. The FCC subsequently deleted the vacated language and reinstated the pre-2023 prior express written consent standard. No federal TCPA regulation currently compels named-seller consent for lead-generated calls.

Can I legally buy shared-consent leads today?

Yes, under the federal TCPA standard governed by pre-2023 prior express written consent rules. However, the FTC Telemarketing Sales Rule requires specific-seller consent for prerecorded calls to DNC-registered numbers, and your carrier contracts may impose their own named-seller requirements regardless of federal law.

What is the deadline for the revocation-all rule?

January 31, 2027. The FCC extended the waiver of the cross-channel consent revocation requirement to that date. All other revocation provisions, including honoring text keyword opt-outs within 10 business days and processing opt-out requests within a reasonable time, are already in effect and enforced.

What are TCPA statutory damages per violation?

Five hundred dollars per violation, increasing to one thousand five hundred dollars per willful or knowing violation, with no statutory cap. A single non-compliant campaign sent to thousands of numbers can produce class-action exposure in the millions of dollars, making consent provability the single most important operational discipline for any dialer-driven agency.

How does the vacatur affect AI voice calling?

The FCC has confirmed that AI-generated voice calls are "artificial" voices under the TCPA, requiring the same prior express consent as prerecorded calls. The vacatur did not change this classification. Any AI-driven outbound channel needs the same consent foundation as a prerecorded campaign. See our guide on AI voice calls and TCPA compliance.