Mini-TCPA State Laws Insurance Agencies Must Track in 2026
State-by-state mini-TCPA guide for insurance agency dialers covering Florida FTSA, Oklahoma OTSA, Texas SB 140, plus calling hours, consent rules, and penalties.
Most insurance agency owners know the federal TCPA cold: prior express written consent, no auto-dialed calls without it, $500 to $1,500 per violation. What too many miss is that federal is now the floor, not the ceiling. At least 12 states have enacted their own mini-TCPA laws since 2021, and several of them carry statutory damages, call-frequency caps, and calling-hour windows that are stricter than anything in 47 CFR 64.1200. If your agency is dialing leads across state lines and your compliance playbook only checks the National DNC Registry, you are running exposed.
Which states have passed mini-TCPA laws since 2021?
The wave started after the U.S. Supreme Court's 2021 decision in Facebook v. Duguid narrowed the federal definition of an automatic telephone dialing system (ATDS). States reacted by writing their own broader statutes. Florida got the ball rolling with the Florida Telephone Solicitation Act (FTSA) in 2021. Oklahoma, Washington, New York, and Maryland followed with their own statutes.
Texas joined the list on September 1, 2025, with Senate Bill 140, which broadened "telephone solicitation" to include text messages and images and introduced a private right of action with statutory damages up to $5,000 per violation. Oregon's HB 3865 took effect January 1, 2026, capping calls at three per consumer per day and restricting contact hours to 8 am to 8 pm. South Carolina, Michigan, North Carolina, and Georgia have bills at various stages of the legislative process.
The Goodwin law firm's 2026 TCPA Year in Review expects even more states to introduce or pass legislation in 2026, and projects that "state-level enforcement actions and private lawsuits will increase" as a result.
How do state calling-hour restrictions differ from federal TCPA rules?
The federal TCPA restricts telemarketing calls to between 8 am and 9 pm in the called party's local time zone. State mini-TCPA laws have tightened that window in several jurisdictions:
- Florida: 8 am to 8 pm
- Oklahoma: 8 am to 8 pm
- Washington: 8 am to 8 pm
- Maryland: 9 am to 8 pm
- Oregon: 8 am to 8 pm (effective 2026)
The CompliancePoint state comparison shows that Florida, Oklahoma, and Maryland all cap daily call attempts at three per consumer within any 24-hour period. Federal TCPA has no per-consumer daily attempt ceiling, so an agency dialer set to retry a lead five or six times in a day is lawful under 47 CFR but unlawful under state statute the moment that lead lives in Orlando or Tulsa.
The practical takeaway: your dialer needs per-state logic. If your platform scrubs against the federal DNC but applies uniform calling windows and retry schedules, you need a rules layer that reads the called party's state and applies the tighter window and attempt cap before placing the call.
What are the penalties for violating state mini-TCPA laws?
State mini-TCPA penalties are layered on top of federal TCPA damages, and in several states they exceed the federal $500/$1,500 per-violation structure:
| State | Penalty per Violation | Private Right of Action? |
|---|---|---|
| Florida FTSA | $500 / $1,500 willful | Yes |
| Oklahoma OTSA | $500 / $1,500 willful | Yes |
| Washington | $100 plus attorneys' fees | Yes |
| Maryland | Up to $1,000 ($5,000 subsequent) | Criminal possible |
| Texas SB 140 | Up to $5,000 per violation | Yes |
| New York | $11,000 per violation (state enforcement) | No private right |
CompliancePoint's comparison table confirms that Florida, Oklahoma, Washington, and Texas all include a private right of action, meaning individual consumers or class-action firms can sue directly. The Gryphon AI state compliance guide notes that per-call damages compound fast: "a single campaign violating Florida's FTSA could result in millions in penalties."
For context, 2,588 TCPA lawsuits were filed between January and November 2025, statistically flat from 2024, but the Goodwin analysis projects an uptick in state-level litigation during 2026 as more mini-TCPA statutes mature and plaintiff firms gain experience with them.
How does Florida's Telephone Solicitation Act differ from the federal TCPA?
Florida's FTSA is the most consequential mini-TCPA for insurance agencies because of its scope, active litigation environment, and the fact that it catches many agency operators by surprise.
The key differences:
The FTSA defines an autodialer more broadly than the federal TCPA post-Duguid. Where federal law now requires a system to use a "random or sequential number generator" to qualify as an ATDS, the FTSA applies to any dialing platform that has the ability to "automatically dial or select records to be dialed." That definition captures virtually every power dialer, preview dialer, and CRM click-to-call tool used in insurance sales, as CompliancePoint documents.
Calling hours under the FTSA are 8 am to 8 pm, one hour earlier than the federal 9 pm cutoff. The three-call-per-24-hours limit has no federal equivalent. And Florida mandates express written consent for all marketing calls and texts, with no exemption for established business relationships unless the consent documentation is explicit and current.
The CallerConsent analysis emphasizes that Florida "maintains this standard" even after the Eleventh Circuit vacated the FCC's federal one-to-one consent rule in January 2025. In other words, the federal rollback does not help you in Florida state court.
What compliance steps should an insurance agency dialer operation take today?
If your agency dials across multiple states, a five-step operational hardening is the minimum viable posture:
1. Add per-state calling-window logic to your dialer. If your platform cannot restrict calling hours by the called party's state, switch platforms or add a pre-dial validation layer. Florida, Oklahoma, Washington, Maryland, and Oregon all use 8 pm as the cutoff. Maryland starts at 9 am instead of 8 am. Texas has nuanced weekend rules. Your dialer should know the difference.
2. Enforce a three-call-per-day ceiling. Florida, Oklahoma, and Maryland all cap attempts at three per consumer per 24 hours. The simplest approach is to adopt three as your global cap, which keeps you compliant everywhere without per-state branching. It also happens to be a healthier dialing pattern for caller-ID reputation, as the SalesHive dialing guide notes, capping at 100 to 200 dials per DID per day with good answer rates.
3. Audit your consent records by lead source and state. Does your lead vendor's consent form name your agency specifically? Is the consent language broad enough to cover auto-dialed calls and prerecorded messages? Does it survive Florida's requirement that consent be "clearly affirmative" (a checked box or a typed reply, not a pre-checked default)? The LeadCompliant mini-TCPA glossary advises maintaining "thorough records of all compliance-related activities" because documentation is the primary defense in litigation.
4. Cross-reference federal and state DNC registries. Eleven states maintain their own Do Not Call lists beyond the National DNC Registry. Your scrubbing pipeline needs to check both. A lead that passes federal DNC but lives on a state registry in Louisiana, Missouri, or Pennsylvania still exposes you to state-level enforcement.
5. Monitor the legislative pipeline. South Carolina's Telephone Solicitation Act, North Carolina's HB 936, and Michigan's HB 6307 are all in progress. New Jersey and Massachusetts are reportedly considering new statutes, per the Gryphon AI roundup. The state-level compliance map is expanding, not contracting.
The multi-state Anti-Robocall Litigation Task Force, comprised of 51 state attorneys general, issued new warning letters to carriers and lead-generation firms in August 2025 for failing to filter spoofed traffic. A second phase targeting voice service providers was announced in December 2025. Enforcement is bipartisan and accelerating.
What questions do agents ask most about state mini-TCPA compliance?
Is the FTC Telemarketing Sales Rule different from state mini-TCPA laws?
Yes. The FTC's Telemarketing Sales Rule (TSR) at 16 CFR Part 310 is a separate federal regulation that covers telemarketing practices including calling-time restrictions, DNC provisions, and abandoned-call limits. However, the TSR includes a specific exemption for the business of insurance when insurance is regulated by state law, which is true in every state. This means state insurance telemarketing is primarily governed by the TCPA and state mini-TCPAs, not the TSR. But the exemption is not absolute: it applies to insurance companies and their agents selling insurance products, not to third-party telemarketers hired by insurers. Know your role in the chain.
Do mini-TCPA laws apply to business-to-business calls?
Generally, no. Most state mini-TCPA statutes, including Florida, Oklahoma, and Washington, exempt B2B non-telemarketing calls. Maryland and Georgia similarly exempt business-to-business communications. However, the definition of "telemarketing" in these statutes sometimes captures B2B sales calls that involve nondurable office supplies or specific solicited products. If your agency's outbound includes cold-calling other businesses (wholesale brokers, MGAs, and carrier reps), check the state-specific definition. When in doubt, treat it as covered.
Does the FCC one-to-one consent rollback affect state laws?
No. The Eleventh Circuit vacated the FCC's one-to-one consent rule in January 2025, and the FCC paused its enforcement. But Florida and Oklahoma continue to enforce similar one-to-one consent standards under their own state statutes. The CallerConsent analysis frames this precisely: "the federal rollback does not help you in Florida state court." State courts interpret state statutes, not FCC rules.
How do I handle consent revocation under state mini-TCPA laws?
State mini-TCPA statutes generally require that opt-out requests be honored immediately and that the revocation apply across all numbers associated with that consumer. Washington's statute requires the caller to end the call within 10 seconds of a DNC request and to advise the consumer that calls will stop for at least one year. The FCC granted a second one-year waiver on the cross-channel revocation requirement under federal TCPA (now extended to April 2026), but this waiver does not insulate you from state enforcement if Washington or Florida law imposes a tighter timeline.
Should insurance agencies use different DIDs for different states?
From a caller-ID reputation perspective, probably yes. A DID with a Florida area code calling into Florida carries stronger local-presence signals than a generic toll-free number. But from a compliance perspective, the key operational question is whether your dialer's state-routing logic correctly maps each DID to its target state's calling rules. A Florida area code calling a Florida lead at 8:45 pm is still a violation under the FTSA, regardless of where the agent is sitting or what trunk the call goes out on.
If your agency is dialing leads in Florida, Oklahoma, Washington, Maryland, Texas, or Oregon, the compliance burden is heavier than the federal baseline. The cheapest fix is to adopt the tightest rule set across all states: 8 am to 8 pm calling, three attempts per day per lead, express written consent with clear opt-out language, and dual federal-plus-state DNC scrubbing. Per-state routing logic in your dialer handles the rest. The alternative is rolling the dice on a private right of action where statutory damages start at $500 per call and in some states reach $5,000. That math gets ugly fast.