TCPA Compliance for Insurance Agents in 2026: Where the Rules Actually Stand

The short answer

Two things changed in the last eighteen months, and neither made compliance easier. The FCC's one-to-one consent rule was vacated on 24 January 2025. The broader consent-revocation rule was delayed to 31 January 2027. What did not change is the requirement that has always driven the litigation: you need documented prior express written consent before making marketing calls or texts, you need to scrub against the Do Not Call registry, and you need to honor opt-outs.

This is not legal advice. It is an operational summary of where the rules stand, written for producers who need to know what to configure.

Where each rule actually stands

The important nuance on the vacated one-to-one rule: it removed a specific constraint on how consent is captured. It did not remove the consent requirement, and it did not stop the plaintiffs' bar. Several state legislatures have their own stricter statutes, and the practical advice from compliance practitioners has been to keep operating close to a one-to-one standard anyway — because a single named seller on a consent record is far easier to defend than a list of two hundred partners.

The four obligations, in the order they will bite you

1. Consent you can produce

Prior express written consent has to include a clear and conspicuous disclosure that the consumer agrees to receive marketing calls or texts, a statement that consent is not a condition of purchase, an E-SIGN-compliant signature, and identification of the seller.

If you buy leads, the vendor should be able to hand you: the URL and the exact disclosure language as it was displayed, the list of named sellers in the consent, a timestamp with IP address, a certificate token from a consent-verification provider, and the opt-in method. If a vendor cannot produce that on request, you are the one holding the risk, not them.

2. DNC scrubbing that runs before the send

The National Do Not Call Registry held roughly 258.5 million phone numbers as of 30 September 2025, a 1.9% increase over the prior year (FTC). Registrations are permanent and constantly accumulating, which is why a scrub has a shelf life. Thirty-one days is commonly treated as the floor, not the target.

Two practical points agents get wrong:

APEX runs a Do-Not-Call check before every outbound call and every outbound SMS, blocks the send when the number is listed, supports a whitelist for genuine existing relationships, and writes every suppression to an audit log. That log is the artifact you would want if you ever had to demonstrate what your system did and when.

3. Calling hours, in the lead's time zone

The federal window is 8:00 a.m. to 9:00 p.m. local to the person being called, and it covers text messages as well as voice. Several states are stricter:

Texas is worth a second look. Treble damages plus fee-shifting changes the economics of a claim considerably, and it applies to texts.

Verify current requirements for the states you work — this table reflects sources reviewed in 2026 and state law moves.

4. Opt-outs, honored fast and completely

Current guidance is to process opt-outs received through any reasonable means within ten business days, and to limit post-opt-out messaging to a single confirmation. Treat "stop," "unsubscribe," "remove me," and plain-English equivalents as opt-outs — a plaintiff will, and so will a court.

Build for the revocation-all rule now, before 31 January 2027. When it takes effect, an opt-out on one channel revokes consent for automated marketing across all of them. Systems that treat SMS opt-outs and call opt-outs as separate lists will need rework; systems that maintain one suppression state per contact will not.

What good practice looks like operationally

Notice that all seven are configuration, not discipline. Anything that depends on an agent remembering it at 4:45 p.m. on a Friday is not a control.

The honest limit of software

No platform can make you compliant. It can enforce the mechanical checks — registry status, hours, opt-out state — and it can log what it did. It cannot verify that the consent a lead vendor sold you was validly obtained, and that is where a large share of insurance TCPA exposure actually originates.

So the stack is: source consent you can defend, run tooling that blocks rather than warns, and keep the log. Two out of three is where agents get hurt.

Related reading

FAQ

Is the one-to-one consent rule coming back?

It was vacated by the Eleventh Circuit on 24 January 2025 on the grounds that the FCC exceeded its statutory authority. There is no current rule in force. Practitioners generally advise operating close to the standard anyway, because reinstatement risk exists, some states are stricter, and single-seller consent records are simply easier to defend in litigation.

What are TCPA penalties in 2026?

Statutory damages are $500 per violation, rising to $1,500 for willful or knowing violations. The real exposure is aggregation: class actions across a campaign of thousands of messages. Texas SB 140, effective 1 September 2025, additionally allows treble damages and mandatory attorney's fees for texting violations under state law.

Does the TCPA apply to text messages?

Yes. Marketing texts are treated substantially like calls, including the 8:00 a.m. – 9:00 p.m. local-time restriction and the consent requirement. Agents who assume SMS is a lighter-touch channel are the ones who get caught.

How often do I need to scrub against the DNC registry?

Thirty-one days is widely treated as the floor for list-level scrubbing, but list-level scrubbing alone is not the protective control. Checking at the moment of send is. Registrations are permanent and grow continuously — the registry added roughly 1.9% in fiscal 2025 alone.

When does the consent revocation rule take effect?

The FCC postponed implementation in January 2026, moving it to 31 January 2027. Until then, the operative obligation is to honor opt-outs received by any reasonable means within ten business days. Building one-suppression-state-per-contact now means no rework later.

Can I text a lead who filled out a web form?

Only if the form captured prior express written consent meeting the regulatory elements — clear disclosure, not conditioned on purchase, E-SIGN signature, seller identified — and only if the number is not on the registry at the time you send. A web form by itself is not consent; the disclosure language on it is what matters, which is why you should hold a copy of that language as displayed.