pillar

TCPA in 2026: The L&H agent's survival guide to one-to-one consent

The one-to-one consent rule is dead. But TCPA still kills books. Here's exactly what L&H agents must do in 2026 to stay compliant and keep dialing.

Ethan Grammer · Founder, AnchorLeads·July 8, 2026·18 min read

$1,500. Per call. Per text. Per violation.

That's the statutory ceiling under the Telephone Consumer Protection Act, and it's been there since 1991. What's changed is who's getting hit with it. A single campaign that violates TCPA rules can expose your agency to millions of dollars in statutory damages, and the plaintiffs' bar is more active than ever in filing class action lawsuits against insurance companies and their downstream agents. And unlike an E&O claim, most general liability policies do not cover TCPA violations, meaning the financial exposure comes directly out of your bottom line.

Here's what most articles won't tell you clearly: the FCC's one-to-one consent rule, the rule that had the entire lead-gen industry in a panic through 2024, is gone. On January 24, 2025, the Eleventh Circuit issued its decision in Insurance Marketing Coalition v. FCC, vacating the FCC's one-to-one consent rule and remanding it to the agency after finding that the rule exceeded the FCC's statutory authority under the TCPA. The rule never took effect. The FCC formally deleted it from the Code of Federal Regulations.

But if you read that and felt relieved enough to stop reading, that's exactly how agents get sued.

The core TCPA statute is unchanged. The opt-out rules that went live in April 2025 are very much active. State mini-TCPAs are multiplying. And through mid-2025, 1,052 TCPA class actions were filed, a 95.2% increase over the same period in 2024. June 2025 alone saw 257 filings, with 78.6% filed as class actions.

This guide covers what actually matters for your book in 2026.

What the One-to-One Consent Rule Was, and Why Its Death Doesn't Mean You're Safe

To understand where you stand, you need to know what happened and why the vacatur doesn't clean your slate.

In December 2023, the FCC adopted rules designed to close what it called the "lead generator loophole." The FCC had adopted its one-to-one consent rule to amend the TCPA regulation, reflecting its own interpretation of the TCPA's statutory definition of "prior express consent," to close what the agency characterized as a "lead generator loophole" in the law. Under the old system, a consumer could fill out one web form on a comparison-shopping site and, buried in the fine print, consent to calls from dozens of insurance companies at once. The FCC wanted to end that. The FCC's amendments to the TCPA regulation dictated that businesses "must obtain consumer consent to receive robocalls and robotexts one seller at a time, rather than have a single consent apply to multiple telemarketers at once."

The rule was set to take effect January 27, 2025. It never did.

A unanimous three-judge panel for the Eleventh Circuit held that "the FCC exceeded its statutory authority under the TCPA because the 2023 Order's new consent restrictions impermissibly conflict with the ordinary statutory meaning of 'prior express consent.'" The court's reasoning was straightforward: because the TCPA itself doesn't define "prior express consent," the phrase gets its plain common-law meaning. To give prior express consent to a robocall, a consumer "need only clearly and unmistakably state, before receiving the robocall, that he is willing to receive it." The FCC's one-to-one and topical-association requirements impermissibly altered that ordinary meaning.

Following the January 2025 decision by the Eleventh Circuit, the FCC has repealed its one-to-one consent rule for prior express written consent, consistent with its ongoing "Delete, Delete, Delete" deregulatory proceeding.

So the rule is gone. As of 2026, the FCC's attempt to revise the consent standard requiring a new "one-to-one" consent standard didn't survive. The Eleventh Circuit vacated the rule in January 2025, and the FCC later formally moved on from the one-to-one requirement, leaving the industry operating under the broader, pre-existing federal framework where a single lead form can, in many cases, support consent covering multiple sellers, as long as the disclosure is clear and conspicuous.

Here's the problem with celebrating that: consent quality is now the entire battleground. With the one-to-one rule gone, the fight shifts to whether your prior express written consent is genuine, documented, and provable. Plaintiffs probe the consent capture: Was the disclosure clear and conspicuous? Is there a retained record tying this specific consumer to this specific consent? Purchased leads are a particular danger zone. You inherit the consent defects of whoever captured them.

The standard reverted. It did not disappear. If you bought shared leads from EverQuote, Datalot, or any aggregator and you can't produce the actual consent form that consumer saw and clicked, you're exposed. "My lead company said they were compliant" is not a legal defense. You, the calling agent, bear the liability.

The Rules That Are Actually Live Right Now

Most TCPA articles written in early 2025 are still structured around the one-to-one rule. That's the wrong map. Here's what's actually governing your outbound activity today.

The Core TCPA Prohibitions (47 U.S.C. § 227)

These haven't changed and they're the source of most enforcement actions:

No autodialed or prerecorded calls or texts to cell phones without prior express written consent. If you're using a power dialer, a predictive dialer, or any system that dials from a list without you manually clicking each number, you need documented written consent for every mobile number you touch.
No calls to numbers on the National DNC Registry. You can download the registry monthly. The first five area codes are free; additional area codes cost $75 each. An established business relationship (EBR) exemption applies for existing clients, but only for up to 18 months after the last transaction.
No calls before 8 a.m. or after 9 p.m. in the called party's local time zone. Not your time zone. Theirs.
Caller ID must transmit accurately. Spoofed or misleading caller ID is a separate violation on top of any consent issue.

The baseline penalty is $500 per violation, trebled to $1,500 for willful or knowing violations. DNC violations can reach $43,792 per violation under FCC enforcement. Because each call or text to each number counts as a separate violation, a single campaign can generate millions in exposure.

The April 2025 Opt-Out Rules (Now Active)

This is where most solo agents have a gap right now. Key parts of the FCC's revocation rule went into effect on April 11, 2025, including the requirement to add clear opt-out instructions in all marketing texts and to honor Do Not Call requests within 10 business days.

What that means operationally:

10 business days to process any opt-out. If a prospect texts "stop" on a Monday, you have until the following Friday to have them suppressed across your systems. Consumers may revoke prior express consent to robocalls and robotexts "in any reasonable manner," which means businesses can no longer specify an exclusive means to revoke consent.
Opt-outs cross channels. When consent is revoked by a reasonable manner, "revocation extends to both robocalls and robotexts regardless of the medium used to communicate the revocation of consent." A prospect who tells you verbally on a call to stop texting them has revoked consent for both.
One confirmation text, within 5 minutes, no promotional content. That's it. You can't follow up with a "just one more thing" message.

The "Revoke-All" provision, which would have required a single opt-out to kill all automated contact across every channel and every department, has been delayed. On January 6, 2026, the FCC's Consumer and Governmental Affairs Bureau issued an order extending the effective date of the TCPA "revoke-all" requirement to January 31, 2027. That gives you runway to build the infrastructure. It doesn't give you permission to ignore opt-outs you're already receiving.

AI Voice Agents: A Trap Most Agents Don't See Coming

If you're using an AI-powered voice tool for lead follow-up or appointment setting, pay attention. The FCC has confirmed that AI-generated voice calls are "artificial" voices under the TCPA, meaning they require the same prior express consent as prerecorded calls. As businesses deploy AI calling agents, they are deploying them directly into TCPA scope, often without realizing the consent requirements attach.

Your consent form needs to specifically authorize "artificial or prerecorded voice." If it doesn't, every AI-initiated call to a cell phone is a potential $500 to $1,500 violation.

The State Mini-TCPA Patchwork That's Eating Agents Alive

Federal TCPA compliance is the floor, not the ceiling. If your compliance playbook only checks the National DNC Registry and calls it done, you're running exposed in at least 12 states.

At least 12 states have enacted their own mini-TCPA laws since 2021, and several of them carry statutory damages, call-frequency caps, and calling-hour windows that are stricter than anything in 47 CFR 64.1200. If your agency is dialing leads across state lines and your compliance playbook only checks the National DNC Registry, you are running exposed.

Florida: The One You Can't Ignore

Florida's FTSA is the most consequential mini-TCPA for insurance agencies because of its scope, active litigation environment, and the fact that it catches many agency operators by surprise.

Here's what the Florida Telephone Solicitation Act (Fla. Stat. § 501.059) actually requires, beyond federal rules:

Calling hours: 8 a.m. to 8 p.m. That's one hour tighter than the federal 9 p.m. cutoff. In March 2025, a single South Florida law firm filed over 100 TCPA lawsuits in one month. All alleged time-of-day violations from text messages sent outside permitted hours.
Three-call-per-24-hours limit. No federal equivalent exists.
Broader autodialer definition. After the 2023 FTSA amendment, Florida defines an autodialer as "an automated system for the selection and dialing of telephone numbers." Most power dialers and CRM-triggered call sequences qualify.
Damages: $500 to $1,500 per violation. FTSA allows a called party to recover $500 for each FTSA-violating call or text they receive. Like the TCPA, a court can increase that amount to $1,500 if it finds the defendant willfully or knowingly violated FTSA.

Critically: Florida "maintains this standard" even after the Eleventh Circuit vacated the FCC's federal one-to-one consent rule in January 2025. In other words, the federal rollback does not help you in Florida state court.

Texas: New Teeth as of September 2025

Texas joined the list on September 1, 2025, with Senate Bill 140, which broadened "telephone solicitation" to include text messages and images and introduced a private right of action with statutory damages up to $5,000 per violation.

If you're working final expense leads in Texas, or running any text-based follow-up sequence into Texas numbers, that's a $5,000-per-text exposure that didn't exist before September 2025.

Oregon: New in 2026

Oregon's HB 3865 took effect January 1, 2026, capping calls at three per consumer per day and restricting contact hours to 8 a.m. to 8 p.m.

The Practical State-by-State Minimum

State	Calling Hours	Call Cap/Day	Private Right of Action	Key Trap
Federal TCPA	8 a.m. to 9 p.m.	None	Yes (class action)	DNC, ATDS consent
Florida (FTSA)	8 a.m. to 8 p.m.	3	Yes	Broad ATDS definition
Texas (SB 140)	8 a.m. to 9 p.m.	None	Yes (DTPA)	Texts = solicitation; $5,000/violation
Oregon (HB 3865)	8 a.m. to 8 p.m.	3	Check state law	New as of Jan 2026
Oklahoma (OTSA)	8 a.m. to 9 p.m.	None	Yes	Written consent required

For context, 2,588 TCPA lawsuits were filed between January and November 2025, statistically flat from 2024, but the Goodwin analysis projects an uptick in state-level litigation during 2026 as more mini-TCPA statutes mature and plaintiff firms gain experience with them.

Building a Compliant Lead and Contact Workflow: The Practical Playbook

This is where most guides go vague. Here's the actual operational checklist for a solo L&H agent working IUL, term, final expense, or annuity leads in 2026.

Step 1: Audit Your Lead Sources Before You Dial Another Number

Every lead source in your stack needs to answer four questions:

Does the consent form name your agency specifically, or does it say "insurance companies" generically?
Is there a timestamp and IP record for each consent submission?
Does the vendor provide a TrustedForm certificate or equivalent session replay for each lead?
Is the lead exclusive to you, or shared across multiple buyers?

If a vendor can't answer all four, treat every number in that batch as unconsented for autodialer purposes. You can still call manually, one by one, with no automated dialing system involved. That's slower, but it's defensible.

For leads you already have in your CRM from before you read this article: if you can't produce the consent documentation, you have two choices. Run a re-consent campaign (a single manual outreach asking them to opt in), or suppress the number. Aged leads with no consent paper trail are litigation bait.

Step 2: Scrub Every List Before Every Campaign

National DNC Registry: Scrub at minimum every 31 days. Download the registry at telemarketing.donotcall.gov. The first five area codes are free.
Internal DNC list: Every opt-out you receive goes on this list immediately. It never expires.
FCC Reassigned Numbers Database: Query the FCC's Reassigned Numbers Database before every dial. A "No" response gives you a defensible safe harbor position. This matters because a number that belonged to your consenting prospect six months ago may now belong to someone who never heard of you.
State DNC lists: Florida, Indiana, and several other states maintain their own registries separate from the federal list.

Step 3: Configure Your Dialer for State-Level Calling Windows

Your dialer needs to know the called party's state, not your state. A Florida lead called at 8:15 p.m. Eastern is a violation under the FTSA regardless of where your office is. A Florida area code calling a Florida lead at 8:45 p.m. is still a violation under the FTSA, regardless of where the agent is sitting or what trunk the call goes out on.

If your current dialer can't enforce per-state calling windows by the called party's area code and known address, you need either a different platform or a pre-dial validation layer that flags out-of-window numbers before they hit the queue.

Step 4: Build Your Consent Documentation System

For every number you contact via autodialer or text:

Written consent record with the consumer's name, phone number, date, time, and the exact consent language they agreed to.
Consent language must name you (your agency, not just "insurance companies") and must disclose that calls or texts may use automated technology.
Retain records for at least 4 years. The TCPA statute of limitations is 4 years. Keep records for at least 5 years to give yourself a buffer. If you're selling Medicare products, CMS has its own retention requirements on top of that.
Opt-out log: Every revocation with the date, channel, and exact wording. Opt-outs never expire. A prospect who texted "stop" in 2022 is still opted out in 2026.

Step 5: Sync Opt-Outs Across Every Tool in Your Stack

This is the gap that kills solo agents. You might have opt-outs logged in your dialer, but if your CRM doesn't sync that suppression to your texting platform, you'll send a follow-up text on day 11 and trigger a lawsuit. If your CRM reads "STOP" but your separate marketing automation platform doesn't sync the opt-out, you send a text on day 16 and trigger the lawsuit.

Every tool in your stack, whether that's GoHighLevel, a standalone texting platform, your email system, or your dialer, needs to pull from the same suppression list. And that list needs to update in near real-time, not nightly.

Step 6: Register Your 10DLC Campaign

As of 2024, all business text messaging through standard 10-digit numbers requires 10DLC registration: register your brand, register your campaign describing what you're texting about, and get approved. Carriers assign a trust score that affects your throughput. Unregistered numbers get throttled or blocked entirely.

If your texts aren't delivering, this is likely why. Registration is not optional, and it's not expensive. It's a one-time setup that takes a few hours and protects your deliverability.

What This Means for Your Book: The Real Advisor Outcomes

Walk through the math on why getting this right is worth your time.

A solo agent working final expense leads might dial 80 to 120 numbers per day using a power dialer. Say you're buying shared leads from an aggregator, 200 leads per month at $8 each. That's $1,600 in lead spend. If even 10 of those leads have defective consent, and one of them is a serial TCPA plaintiff (they exist, and there are services that flag known litigants), you're looking at a potential $15,000 exposure from a $1,600 lead purchase. At the $1,500 willful-violation ceiling, 10 bad calls is $15,000. A class of 100 is $150,000.

A single lawsuit involving hundreds of calls can result in six or seven-figure settlements. Several agencies have been forced to close after losing TCPA cases.

The flip side: agents who build a clean consent infrastructure actually get a competitive advantage. When you're working exclusive, properly consented leads, you're calling people who specifically asked to hear from you. Contact rates go up. Conversion rates go up. And you're not burning time on re-consent campaigns or suppression list management every quarter.

Here's what a clean workflow looks like in practice for an IUL agent:

Prospect submits a web form on your site or a properly configured lead vendor's site. Consent language names your agency and discloses automated contact. TrustedForm certificate is generated.
Lead hits your CRM. DNC scrub runs automatically. State-level calling window is checked against the lead's area code and address.
You call within 5 minutes of lead submission. Contact rates on fresh, consented leads are significantly higher than on aged shared leads. You're not competing with four other agents who got the same number.
If the prospect opts out at any point, that suppression syncs across your dialer, your CRM, and your texting platform within minutes.
Consent record and opt-out log are retained for 5 years, attached to the contact record.

That workflow doesn't require a compliance team. It requires the right tools configured correctly.

Beyond the direct financial penalties, TCPA violations can result in reputational damage, loss of carrier appointments, increased E&O insurance premiums, and loss of lead vendor relationships. For agents selling Medicare products, TCPA violations can also trigger CMS enforcement actions that put your ability to sell Medicare at risk.

Losing a carrier appointment over a TCPA violation is a book-ending event. That's not recoverable in a quarter.

The agents building durable books in 2026 are the ones who treat consent documentation the same way they treat application paperwork: every field matters, every record gets retained, nothing gets assumed.

See Consent and Opt-Out Tracking in AnchorLeads Before Your Next Campaign

AnchorLeads was built specifically for solo L&H agents who are tired of stitching together a dialer, a CRM, a texting platform, and a spreadsheet to manage suppression lists, and still worrying they missed something.

The consent and opt-out tracking module inside AnchorLeads lets you attach TrustedForm certificates directly to contact records, log opt-outs across every channel in one place, and see at a glance which numbers in your pipeline are cleared to dial and which are suppressed. State-level calling window logic is built into the workflow, so you're not manually checking whether an 8 p.m. text to a Florida number is legal.

Book a personalized 20-minute demo at anchorleads.io/demo and we'll walk you through the consent documentation and opt-out sync workflow live. Bring your current lead vendor's consent language and we'll show you exactly how it maps to what you need to be defensible.

One demo. Specific to your product mix. No generic sales pitch.

Frequently Asked Questions

Is the TCPA one-to-one consent rule still in effect in 2026?

No. The Eleventh Circuit issued its decision in Insurance Marketing Coalition v. FCC on January 24, 2025, vacating the FCC's one-to-one consent rule after finding that the rule exceeded the FCC's statutory authority under the TCPA. The FCC subsequently deleted the vacated language and reinstated the prior version of the rules. As of 2026, the pre-2023 consent standard applies: prior express written consent is still required for autodialed or prerecorded calls and texts, but a single consent can cover multiple sellers if the disclosure is clear and conspicuous.

What are the current TCPA penalties for insurance agents?

The baseline is $500 per violation, trebled to $1,500 for willful or knowing violations. DNC violations can reach $43,792 per violation under FCC enforcement. Because each call or text to each number counts as a separate violation, a single campaign can generate millions in exposure. Most general liability policies do not cover TCPA violations, so the exposure comes directly out of your pocket.

How long do I have to honor an opt-out request under the current rules?

Key parts of the FCC's revocation rule went into effect on April 11, 2025, including the requirement to honor Do Not Call requests within 10 business days. That window applies to marketing and promotional calls and texts. The broader "Revoke-All" provision, which would require a single opt-out to stop all automated contact across every channel, has been delayed to January 31, 2027. Opt-outs, once logged, never expire.

Does Florida's FTSA apply to me if I'm not based in Florida?

Yes, if you're calling or texting Florida phone numbers. A Florida area code calling a Florida lead at 8:45 p.m. is still a violation under the FTSA, regardless of where the agent is sitting or what trunk the call goes out on. The FTSA applies based on the called party's location, not the caller's. Calling hours under the FTSA are 8 a.m. to 8 p.m., and the three-calls-per-24-hours limit has no federal equivalent.

Do I need TCPA consent for manual calls to cell phones?

The prior express written consent requirement under the TCPA applies specifically to calls made using an automatic telephone dialing system (ATDS) or prerecorded/artificial voice. A truly manual call, where you physically dial each number yourself with no automated system involved, does not require the same written consent for marketing purposes. However, DNC Registry compliance still applies to all telemarketing calls regardless of dialing method, and state mini-TCPAs may impose additional requirements. When in doubt, get written consent anyway. It's the only defensible position.

What records do I need to keep for TCPA compliance?

At minimum: the consent record for every number you contact via autodialer or text (with timestamp, IP, and the exact consent language), your internal DNC list with every opt-out and the date it was received, your National DNC scrub logs showing when you last scraped the registry, and call detail records showing which numbers you dialed and when. Keep records for at least 5 years. If you sell Medicare products, CMS retention requirements may extend that further. Opt-out records should be retained indefinitely.