TCPA 2026: What the New Consent Rules Mean for Agent Dialers
One-to-one consent, state mini-TCPAs, and the post-vacatur landscape — what 2026 consent rules actually require of insurance agent dialers.
TCPA 2026: What the New Consent Rules Mean for Agent Dialers
The federal one-to-one consent rule was vacated in January 2025 by the Eleventh Circuit in Insurance Marketing Coalition v. FCC, but for agent dialers in 2026 the operating standard is still one-to-one. Florida's FTSA, Maryland's Stop the Spam Calls Act, and Oklahoma's state TCPA impose substantially equivalent rules, major lead-gen platforms kept their one-to-one flows, and plaintiff's attorneys are filing state-law cases where preemption is weak. The per-call cost of building one-to-one consent is small. The per-case cost of defending a class action built on shared consent is not.
TL;DR
- FCC one-to-one consent rule was vacated January 24, 2025 by the Eleventh Circuit (IMC v. FCC).
- State mini-TCPAs (FL, MD, OK, WA) enforce substantively equivalent consent standards.
- PEWC under 47 CFR 64.1200(f)(9) remains federal law.
- Per-call TCPA damages remain $500–$1,500 per violation.
- Assurance IQ paid up to $21.875M in a 2023 TCPA class settlement — the market precedent for inadequate consent records.
The Short Answer
In 2026, an agent dialer should treat consent as if one-to-one is required, because:
- Several states already impose substantially equivalent rules.
- The FCC is expected to pursue alternative rulemaking within its statutory authority after the IMC v. FCC vacatur.
- Major lead-gen platforms restructured consent flows in 2024 and have not un-restructured them, per ActiveProspect analysis.
- Plaintiff-side lawyers file state-law cases where preemption is weak.
What Prior Express Written Consent Actually Requires
The federal PEWC standard under 47 CFR 64.1200(f)(9) requires:
- Clear and conspicuous disclosure that by signing the consumer agrees to telemarketing calls to the number provided, including via autodialer or pre-recorded voice.
- Identification of the seller — the party on whose behalf calls will be made.
- A statement that consent is not a condition of purchase.
- An E-SIGN Act-compliant signature.
These are minimums. State laws add more.
The One-to-One Dimension
The vacated FCC rule would have required consent captured for one seller at a time, eliminating the "click once, get called by 47 partners" model. Post-vacatur the rule is not federal law, but:
- Florida FTSA has been interpreted by plaintiffs' counsel to require near-one-to-one, and courts have been receptive — even after the 2023 amendment narrowed the autodialer definition.
- Maryland Stop the Spam Calls Act requires PEWC with seller identification.
- Industry platforms (including major lead aggregators) kept one-to-one consent flows in place because maintaining both flows is more expensive than just running the stricter one. See ActiveProspect's lead-buyer guide.
Net effect: one-to-one consent is the industry standard, even where it is not the federal standard.
Consent Record Components for 2026
| Element | Why it matters | Retention |
|---|---|---|
| Server-side timestamp | Client-side timestamps are not trusted in litigation | 5 years minimum |
| Source URL | Proves which consent flow the consumer saw | 5 years minimum |
| IP address | Ties consent to a device and location | 5 years minimum |
| User agent | Secondary device identifier | 5 years minimum |
| Full disclosure language displayed | Exact text shown to consumer at moment of consent | 5 years minimum |
| List of sellers consented to | Essential for one-to-one defense | 5 years minimum |
| Signature mechanism | Checkbox, typed name, click-through — document which | 5 years minimum |
| Screenshot or full-page HTML snapshot | Renders the entire consent experience | 5 years minimum |
| Lead provenance | If sourced, full chain of custody to original capture | 5 years minimum |
Missing any does not automatically mean losing a case. Having all usually means not being sued in the first place, because plaintiff's firms use dashboards and target the weakest records. Top Class Actions reporting illustrates the per-call exposure.
State-by-State Variation That Agents Actually Hit
Entering 2026:
- Florida FTSA — narrowed autodialer definition after 2023 amendment, but private right of action and plaintiff's bar remain active. Bradley Arant's 2024 review tracks the litigation.
- Oklahoma state TCPA — mirrors pre-vacatur FCC consent language; $500–$1,500 per violation.
- Maryland Stop the Spam Calls Act — PEWC with narrow exemptions.
- Washington RCW 80.36 — caller ID requirements, state DNC.
- California — CIPA recording claims layered on TCPA.
The defensible posture for a national dialer is not a state-matrix with different flows per state. Build one flow that satisfies the strictest and apply universally.
What Changes in Your Dialer and CRM
Operational adjustments for 2026:
- Consent storage. Move consent records out of CRM notes into a dedicated store that supports the full 9-field schema.
- Per-call consent lookup. Before each dial, the dialer must answer: does this number have valid consent for this specific seller? If yes, proceed. If no, hold.
- Revocation handling. A consumer saying "stop" on any channel propagates to every dialer, CRM, and outsourced partner within 10 business days per 47 CFR 64.1200(a)(10). Build the plumbing; do not rely on manual lists.
- RND query logging. Every call to a consumer number with consent older than a few days needs a logged RND query. See The Hidden Cost of Reassigned Phone Numbers.
- Lead-source audits. If you buy leads, audit the vendor's consent flow quarterly. Demand raw records, not summaries. ActiveProspect's guide walks through the audit framework.
The Lead-Gen Consent Problem
For agencies that buy leads, 2026 risk concentrates here. Shared-consent sources — one checkbox consenting to dozens of "marketing partners" — are operationally exposed in multiple states even after the federal vacatur.
Two viable postures:
- One-to-one only. Refuse any lead whose consent record does not specifically name your seller entity. Fewer leads, much cleaner risk.
- Lead-washing through verified callback. Accept shared-consent leads only after the consumer takes a second unambiguous action (scheduling a callback, responding to an SMS opt-in) that creates a new, seller-specific consent record.
Most compliance-serious agencies in 2026 will run some mix of both.
Consumer-Side Signal
Consumer frustration with lead-gen call volume is a plaintiff's-lawyer recruitment engine. Top Class Actions documented a Reddit report of one consumer receiving "27 calls and five text messages in just five hours" from insurance agents after submitting a health quote form. Each of those contacts, if unconsented for the specific seller, is a discrete TCPA violation in the same plaintiff-counsel ecosystem that prices class actions against insurance outbound.
The Plaintiff's Lawyer's Checklist
When a plaintiffs' firm evaluates a potential class action, they look for:
- Shared-consent lead sources without re-consent.
- Missing or fabricated IP/timestamp records.
- No RND queries on aged consent.
- Calls outside consumer calling hours (8 am – 9 pm local).
- Inadequate internal DNC propagation under 47 CFR 64.1200(d).
- Recording without two-party consent in applicable states.
Every one is fixable. Agencies that don't fix them are the ones getting named.
For broader compliance infrastructure, see Setting Up a Compliant Outbound Call Strategy for the New Year and 2026 Outlook: Telephony Regulation Changes Every Agent Should Know.
What Not to Do
- Don't wait for federal rulemaking clarity. States will move faster than the FCC.
- Don't rely on lead-vendor indemnification alone. Contractual indemnification does not stop a plaintiff from naming you.
- Don't let consent records live only in a vendor's system. If the vendor disappears or the contract ends, records go with them.
- Don't treat the vacatur as a green light. The market did not roll back to 2023 practices, and neither should you.
FAQ
Q: Is one-to-one consent required under federal law in 2026? A: Not currently. The FCC rule was vacated by the Eleventh Circuit in IMC v. FCC on January 24, 2025. However, several states impose substantially equivalent requirements, and industry best practice has converged on one-to-one consent regardless.
Q: What's the difference between prior express consent and prior express written consent? A: Prior express consent (oral or written) applies to informational, non-telemarketing calls. PEWC under 47 CFR 64.1200(f)(9) is required for telemarketing calls to wireless numbers and pre-recorded telemarketing calls to landlines. Telemarketing always requires written.
Q: How do I know if my consent records would survive litigation? A: Run a mock discovery exercise. Pick 20 random consented numbers and produce the full record for each. If you cannot produce all 9 fields for all 20, the records will not survive. The Assurance IQ settlement is the market benchmark.
Q: Can I use the same consent across multiple of my business entities? A: Only if the consent record explicitly names each entity. A consent for "Acme Insurance" does not extend to "Acme Insurance Agency LLC" or "Acme Auto Line" unless the disclosure at capture named them.
Q: What happens to consent when a phone number is reassigned? A: It's void. Consent was given by the prior subscriber. The FCC RND exists to help callers identify reassignments before calling, and to support the 47 CFR 64.1200(m) safe harbor.
Q: How long is a PEWC valid? A: Indefinitely until revoked under federal law. Several states impose time limits — Florida's FTSA has been litigated on staleness. Operationally, re-consenting every 18–24 months is a defensible practice that also refreshes the record.
Q: Is SMS consent separate from call consent? A: Yes. Consent must specify channels covered. A consent authorizing only calls does not authorize texts, and vice versa. One-to-one consent flows typically capture both explicitly. ActiveProspect documents the channel-specificity requirement.
Q: What about the FCC revocation-all rule? A: The FCC delayed full effect in some categories to January 31, 2027. However, the 10-business-day cross-channel propagation rule under 47 CFR 64.1200(a)(10) is already in force. Build revocation plumbing now.
Stop guessing. Run the audit.
LineAudit checks your first 20 DIDs free. You'll see exactly which numbers are flagged, mis-registered, or at risk — in 30 seconds.