FCC Third-Party Rule Compliance: The 2026 Checklist

Insurance agencies running outbound dialers in 2026 are staring at a dramatically reshaped regulatory landscape. The FCC adopted a one-to-one consent rule in December 2023, the Eleventh Circuit vacated it in January 2025, and the Commission formally abandoned it in September 2025. If all you heard was "the rule is dead" and you stopped paying attention, you still face three live compliance obligations that carry statutory damages of $500 to $1,500 per call47 USC 227. Here is the checklist.

Key Takeaways

• The FCC one-to-one consent rule was vacated by the Eleventh Circuit on January 24, 2025 in Insurance Marketing Coalition v. FCC and formally abandoned by the Commission in September 2025.
• Three live compliance obligations remain: federal prior express written consent under 47 CFR 64.1200(f)(9), the April 2025 consent revocation rules with a 10-business-day opt-out processing window, and a growing patchwork of state mini-TCPAs.
• TCPA class actions hit 1,052 filings through mid-2025, a 95.2 percent increase over the same period in 2024, and plaintiff firms are filing state-law cases where federal preemption is weak.
• The practical posture for insurance agency dialers: treat consent as one-to-one regardless of federal status, audit lead sources for named-seller documentation, and implement revocation handling that clears opt-outs within 10 business days.

TL;DR

The federal one-to-one consent rule is dead as a matter of FCC regulation. It was adopted in December 2023, delayed to January 2025, vacated by the Eleventh Circuit three days before its effective date, and formally abandoned by the Commission in September 2025. For insurance agencies buying leads and running outbound dialers, the rule's death changes nothing operationally: state mini-TCPAs in Florida, Maryland, Oklahoma, and Washington impose substantially similar requirements, the major lead-generation platforms never rolled back their one-to-one consent flows, and the April 2025 consent revocation rules are live with a 10-business-day processing deadline. The agency that relaxed its consent posture after the vacatur is the agency most exposed to the next class action.

What is the FCC third-party consent rule and why does it matter for insurance agencies?

The FCC's one-to-one consent rule was an amendment to the TCPA's prior express written consent (PEWC) definition, adopted in December 2023 as part of a broader Report and Order aimed at closing what the Commission called the "lead generator loophole"troutman-analysis. The rule would have required that:

• Consent to receive robocalls or robotexts be obtained "one seller at a time," meaning a consumer filling out a comparison-shopping form could not consent to contact from dozens of marketing partners through a single clickwiley-analysis.
• The seller contacting the consumer be "logically and topically associated" with the interaction that prompted the consenttroutman-analysis.
• Consent disclosures be "clear and conspicuous," effectively banning the hyperlink-to-a-list-of-hundreds-of-partners modelwiley-analysis.

For insurance agencies, this mattered enormously. P and C agencies buy leads from comparison-shopping websites, aggregators, and third-party marketplaces. Under the proposed rule, every lead would have needed named-seller consent specifying exactly which agency could call. The shared-consent model powering much of the insurance lead-generation economy would have been obsolete.

What happened to the one-to-one consent requirement in 2025?

The rule followed a tight timeline: adopted December 2023, with an initial effective date 12 months laterinsureleads-timeline. The Insurance Marketing Coalition filed a petition for review in the Eleventh Circuit, arguing the FCC had exceeded its statutory authority under the TCPA. The FCC briefly delayed the effective date to January 27, 2025 while litigation proceeded.

On January 24, 2025, three days before the rule was to take effect, the Eleventh Circuit issued its opinion in Insurance Marketing Coalition Ltd. v. FCC and vacated the ruletroutman-analysis. The court held that the FCC's one-to-one interpretation was inconsistent with the ordinary statutory meaning of "prior express consent" in the TCPA. The court found that "prior express consent" required only that consumers have "clear and unmistakable" information that they would receive robocalls from various possible sellers, not that the calls be limited to one named sellergoodwin-analysis.

The FCC declined to appeal. In September 2025, the Commission issued a final rule formally eliminating the one-to-one consent requirement from 47 CFR 64.1200(f), and the matter closedcfi-analysis. Pre-2023 PEWC standards are once again the governing federal standardinsureleads-timeline. For the operational playbook on building compliant consent flows, see our guide on TCPA 2026 consent rules for agent dialers.

What does the Eleventh Circuit vacatur mean for insurance agency dialers?

The vacatur means the FCC cannot enforce the one-to-one rule or the logical-and-topical-association test at the federal level. But the practical meaning is narrower than the headline suggests.

First, the major lead-generation platforms, including ActiveProspect, Jornaya, and several insurance-specific marketplaces, invested in one-to-one consent flows in 2024 and never rolled them backactiveprospect-fcc. These platforms now offer named-seller consent as a product differentiator. Leads with one-to-one documentation carry lower litigation risk and are priced accordingly.

Second, TCPA class action filings hit 1,052 cases through mid-2025, a 95.2 percent increase over the same period in 2024prospeo-tcpa. The plaintiff's bar shifted venue: state-law claims under mini-TCPAs where federal preemption is weak are now the primary vehicle.

Third, the Eleventh Circuit's reasoning signals broader judicial skepticism of FCC rulemaking that exceeds the plain text of the TCPA. This is consistent with the post-Loper Bright administrative-law landscape, where courts no longer defer to agency interpretations of ambiguous statutestroutman-analysis. Any future FCC consent rule will need a clear statutory hook, which limits the Commission's options.

What TCPA consent revocation rules took effect in April 2025?

While the one-to-one rule died, a separate set of FCC consent revocation amendments took effect on April 11, 2025 and are now live law. These rules changed three things that directly affect insurance agency dialer operationsactiveprospect-revocation:

Any reasonable method is valid. A consumer can revoke consent through any channel: SMS reply, email, voicemail, live call, or even a verbal "stop contacting me" to a producer. If the intent to revoke is clear, the revocation must be honored.

Processing window: 10 business days. The previous 30-day window is gone. Opt-out requests must be processed, and the number removed from dialing queues, within no more than 10 business daysactiveprospect-fcc.

One confirmation message, within 5 minutes. Senders may send a single confirmation text confirming the opt-out. It must be sent within 5 minutes of the revocation request, contain no marketing content, and serve only to confirm the opt-outactiveprospect-revocation.

A broader requirement that would have treated any opt-out, including from informational or transactional messages, as revocation from all future communications from the same sender has been delayed to January 2027activeprospect-fcc. This gives dialer operations additional time to build the necessary infrastructure.

What state mini-TCPA laws should insurance agencies track in 2026?

Several key jurisdictions now impose consent rules stricter than the federal standard. Agencies calling across state lines must track these states, each of which layers additional requirements on top of federal PEWCprospeo-tcpa:

Florida's FTSA covers any system that dials without human intervention, regardless of how numbers are generated, and imposes a broader definition of autodialer than the federal TCPA. The statute has been actively enforced since July 2023.

Maryland's Stop the Spam Calls Act imposes consent requirements that mirror the vacated federal one-to-one rule in effect. The law took effect January 1, 2024 and applies to any commercial telemarketing call involving a Maryland resident.

Oklahoma's Telephone Solicitation Act requires named-seller consent and limits the number of marketing partners that can be disclosed in a single consent interaction. The statute includes a private right of action, which has attracted plaintiff-side attention.

Washington State requires prior express written consent for autodialed calls and has an active enforcement posture through its Attorney General's office. Washington's law also restricts calling hours more narrowly than the federal 8am to 9pm window.

Virginia's DNC honor requirement took effect January 1, 2026 and requires honoring internal do-not-call requests for 10 years. That is not a typo. Ten yearsprospeo-tcpa.

For agencies calling into multiple states, the compliance surface is now a matrix. Federal PEWC is the floor. State-specific overlays apply for every jurisdiction in your dialer's target list.

How do state laws create a compliance matrix for multi-state agencies?

What is the practical compliance checklist for insurance agency dialers in 2026?

Here is the operational checklist for an agency dialer team as of August 2026. This is the minimum set of practices that a TCPA plaintiff's attorney will examine in discovery:

1. Audit every lead source for named-seller documentation. For each lead vendor, verify whether the consent record names your agency specifically. Leads with shared "marketing partners" consent carry a higher litigation risk profile than leads with named-seller consent, even at the federal level, and they are presumptively non-compliant under Florida and Oklahoma lawinsureleads-timeline.

2. Build for one-to-one consent regardless of federal status. Several states already impose it, the major platforms kept their one-to-one flows, and the per-call cost of building compliant consent infrastructure is small compared to defending a class actionactiveprospect-fcc.

3. Implement revocation handling that clears opt-outs within 10 business days. Audit your current process: does a verbal "stop calling me" from a producer get logged in your dialer's DNC list? If not, the 10-business-day clock starts when the consumer says it, not when someone enters it into the CRMactiveprospect-revocation.

4. Scrub against the National DNC Registry every 31 days. This federal requirement has not changed. The FTC's DNC registry remains the floor. Overlay state-specific DNC requirements for Virginia (10-year honor) and any other state with an enhanced ruleprospeo-tcpa.

What consent recordkeeping and dialer hygiene practices protect an agency?

5. Maintain consent records for the life of the dialing relationship plus at least four years. If you cannot produce a consent record for a called number in discovery, you have effectively conceded the element. Store consent records with timestamp, IP address, the specific consent language shown, and the consumer's affirmative actionactiveprospect-fcc.

6. Confirm your dialer respects calling-hour restrictions by recipient time zone. The federal window is 8am to 9pm local time at the called party's location. Several states narrow this further. Your dialer needs ZIP-code-to-time-zone mapping rather than a static offset from your office timeprospeo-tcpa.

7. Register your outbound numbers in caller-ID reputation registries. This is not strictly a TCPA requirement, but clean caller-ID reduces the likelihood that a consumer who receives your call will file a complaint, and complaint volume is a leading indicator of enforcement scrutiny. See our guide on STIR/SHAKEN attestation for insurance agents and how carriers classify your business.

Sources cited in this analysis?

1. Insurance Marketing Coalition Ltd. v. FCC, 127 F.4th 303 (11th Cir. 2025) -- Eleventh Circuit opinion vacating the FCC one-to-one consent rule.
2. Troutman Pepper -- Eleventh Circuit Re-Opens TCPA Lead Generator Loophole (Feb 2025)
3. Wiley -- 11th Circuit Vacates FCC One-to-One TCPA Consent Rule (Jan 2025)
4. Goodwin -- FCC Issues Final Rule Formally Eliminating the One-to-One Consent Requirement (Sep 2025)
5. ActiveProspect -- FCC Lead Generation Guide (Jan 2026)
6. Prospeo -- TCPA Compliance in 2026: Rules, Penalties and Checklist
7. InsureLeads -- FCC One-to-One Consent Rule Status Update 2026 (Mar 2026)

What questions do agents ask most about FCC third-party consent rules?

Is the one-to-one consent rule dead for good?

Yes, at the federal level. The Eleventh Circuit vacated it in IMC v. FCC in January 2025, the FCC declined to appeal, and the Commission formally eliminated the rule from 47 CFR 64.1200(f) in September 2025. Pre-2023 PEWC standards govern at the federal level. But several state mini-TCPAs impose substantially similar one-to-one requirements.

Is prior express written consent still required for dialer calls?

Yes. Marketing calls using an autodialer or prerecorded voice to wireless numbers require prior express written consent under 47 CFR 64.1200(f)(9). This includes a signed written agreement with clear disclosure that the consumer agrees to receive telemarketing calls. This federal requirement never changed.

What happens if I buy leads with shared marketing-partner consent?

Shared-consent leads are legal at the federal level under current PEWC standards, but they carry elevated litigation risk. Florida and Oklahoma require named-seller consent, and plaintiff firms actively file state-law class actions where federal preemption is weak. Every lead source should be audited for consent documentation.

How fast do I have to process an opt-out request?

Ten business days, under the FCC's April 2025 consent revocation rules. This applies regardless of how the revocation was communicated, including verbal requests. A single non-marketing confirmation may be sent within 5 minutes of the request.

Should I still build my consent flow for one-to-one even though the federal rule is vacated?

Yes. The major lead-generation platforms kept their one-to-one flows, state mini-TCPAs in Florida, Maryland, Oklahoma, and Washington require equivalent standards, and the per-call cost of compliant consent infrastructure is negligible compared to defending a class action. Build to one-to-one as your operational floor.