Yes, you can still follow up an aged insurance lead, as long as the original consent actually covers what you’re about to send, nobody revoked it, and your state doesn’t have a stricter rule that says otherwise, and the honest answer for most agents is that nobody has actually checked any of those three things on the list sitting in their CRM right now. This article is the check. It’s not a general TCPA primer; if you want the full rundown of what’s in force federally and what the FCC changed this fall, read TCPA Rules for Insurance Agents in 2026 first. This one assumes you already know that baseline and answers a narrower, more specific question: you have a list of real people who already gave you some kind of consent, months or years ago, and you want to know if touching them again is still safe.
Key takeaways
- Consent doesn't have a federal expiration date. Age alone doesn't kill it, but a revocation, a mismatched scope, or a stricter state law can, and none of those three things show up just by looking at how old the lead is.
- The real risk with an aged list isn't usually "no consent ever existed." It's a revocation that happened on a channel your CRM doesn't track, or a consent that was scoped to a product or purpose you're no longer sending about.
- TCPA statutory damages are $500 per violation, or actual damages if greater, with up to $1,500 per violation for a willful or knowing one, under 47 U.S.C. § 227(b)(3). Those are per-text, per-call numbers.
- WebRecon counted 2,810 TCPA lawsuits filed in federal court in 2025, and the FTC's Do Not Call Registry took in more than 2.6 million complaints that same fiscal year against 258 million active registrations.
- Starting November 25, 2026, under FCC 26-67, a revocation on a telemarketing or advertising message cancels consent for all future marketing messages from you, not just the campaign it was made about. That changes how you should treat any revocation you find while auditing an aged list going forward.
- A manual audit: original consent language, revocation/DNC status, time elapsed, and your state's own telemarketing law, done by hand, is the whole method, and it's free.
- Ambrose's lead-memory spoke lets you log a do-not-contact event on a lead's timeline and search for it before a campaign goes out, but it only knows what you tell it. It doesn't invent a consent record that was never logged.
The pain: 400 names, one open question nobody answered
Picture the list. It’s sitting in a CRM view, filtered to “no sale,” sorted by lead-create date, and it goes back to last year’s AEP, maybe the one before that. Some of these people asked for a Medicare quote and ghosted after the first call. Some requested an ACA rate and never responded to the follow-up text. A handful opted in for a final expense guide on a Facebook lead form eighteen months ago and have been sitting untouched since. You paid for every one of them, original cost per lead somewhere between a few dollars and fifty, and right now they’re worth exactly nothing, because nobody is talking to them.
The instinct is obvious: re-run the sequence. Fire a “checking back in” text to the whole segment, see who responds, work the ones who do. It’s the cheapest lead source you have, because you already own it. And then the second thought shows up, the one that stops most agents cold: is this even legal anymore? You’ve heard the TCPA horror stories. You’ve heard the FCC changed something about consent. You don’t actually know whether the box that person checked fourteen months ago still means anything today, and nobody on your team can tell you with a straight face either. So the list sits there, untouched, not because anyone decided it was unsafe, but because nobody decided it was safe, and inaction felt like the lower-risk option.
That’s the actual cost of this uncertainty: it’s not that agents are recklessly blasting old leads and getting sued. It’s that a genuinely valuable, already-paid-for asset sits dormant because checking it correctly looked like more work than it actually is.
This is guidance about federal and state rules, not legal advice
Tech Savvy Insurance is a training and software community, not a law firm or an insurance agency. This article describes what public FCC orders, the federal statute, and state statutes say as of the dates cited. It is not legal advice about your specific book of business or your state's own telemarketing law. Read the primary sources linked throughout, and talk to your own counsel or your carrier's compliance department before changing your workflow based on this article.
Why it happens: consent doesn’t expire, but your certainty about it does
Start with what the law actually says, because the mental model most agents are working from is wrong in a specific, fixable way. The TCPA requires prior express written consent before you send a robocall or robotext that constitutes telemarketing or advertising (47 CFR 64.1200(a)(2)-(3)). Nothing in that rule, or anywhere else in the statute, sets a universal clock on how long that consent stays valid. A consent given in January doesn’t automatically expire in July. There’s no federal rule that says a lead older than 90 days reverts to “no consent.” If that were true, the compliance question here would be trivial: check a date field, done.
It isn’t trivial, because three other things degrade with time in a way that has nothing to do with the legal validity of the original consent:
The scope of what was agreed to gets forgotten, by you, not by the law. If a lead checked a box agreeing to be texted “about Medicare plan options in my area,” that consent is scoped to that purpose. It was never, at any point, a blanket license to text them about final expense, or add them to a general newsletter, or fold them into next AEP’s campaign for a different carrier’s plan. The scope hasn’t changed since the day they signed. What’s changed is that eight months later, the record in your CRM just says “lead,” and nobody remembers or wrote down what the original consent language actually covered. The failure here isn’t a consent that expired. It’s a record-keeping gap that makes an unchanged consent look uncertain.
Revocations get lost between the channel they happened on and the channel you’re checking. A called party can revoke consent “by any reasonable method:” replying STOP, saying so on a call, using an opt-out link, or another clear statement that they don’t want further contact (47 CFR 64.1200(a)(10)). The rule is intentionally broad about what counts as a valid revocation. The problem is operational: if someone revoked consent by telling a different agent on your team over the phone, or by replying “please stop” to a text thread that lived in a dialer your CRM doesn’t sync with, that revocation is legally real and effective the moment it happened, whether or not it ever made it into your master suppression list. An aged lead that looks untouched in your CRM might actually be a lead that already told you no, through a channel that didn’t report back.
Contact data itself goes stale, independent of consent entirely. Even where consent is airtight and nothing was ever revoked, the phone number or email on file may no longer reach the person who gave it. Industry data on this is consistent across years: ZeroBounce, which processed more than 11 billion email addresses across 2025 in both bulk and real-time verification, found that at least 23% of a contact list decays within a single year, meaning the addresses go invalid, get abandoned, or stop being monitored (ZeroBounce, The Email List Decay Report for 2026). That figure tracks email specifically, not phone numbers, and the two channels decay differently, but the underlying mechanism (people change jobs, switch carriers, abandon old inboxes) applies to any contact channel sitting untouched for a year or more. A number or address can be perfectly consented and still be dead weight.
And then there’s the piece that actually changes in 2026. On top of all of this, the FCC adopted a new rule on September 30, 2026, FCC 26-67, that rewrites how a revocation applies going forward. We covered the full timeline, what got vacated in 2025, and what’s still just proposed in our dedicated TCPA rules article, so this won’t re-walk all of it. The one piece that matters specifically for an aged list: once FCC 26-67 takes effect on November 25, 2026, confirmed directly in the Federal Register’s full text of 91 FR 67214, published October 26, 2026, a revocation made in response to a telemarketing or advertising robocall or robotext cancels consent for all future telemarketing or advertising messages from that same caller, not just the specific campaign it was sent about (FCC 26-67, Appendix A, amended 47 CFR 64.1200(a)(10)). If you’re auditing an aged list and you find a revocation that happened after that date, on any marketing message, from any campaign, treat the whole lead as suppressed going forward, not just suppressed on that one topic.
Medicare-specific aged leads carry an extra layer
If any of your aged list came in through a Medicare-related quote request or plan comparison, remember that CMS's TPMO (Third-Party Marketing Organization) disclaimer and the Medicare Communications and Marketing Guidelines govern what you can say and when, on top of TCPA consent rules. Re-engaging a stale Medicare lead isn't just a consent question, it's also a "does this message count as marketing, and did I disclose correctly" question. That's a separate compliance layer from everything in this article, and it doesn't go away just because the lead is old.
What it costs to get this wrong
The TCPA gives a called party a private right of action: they can recover actual monetary loss, or $500 in damages per violation, whichever is greater, and a court may increase that award to as much as three times that amount, up to $1,500 per violation, if the violation was willful or knowing (47 U.S.C. § 227(b)(3)). That’s not per lawsuit. It’s per text, per call. A re-engagement sequence sent to a few hundred aged leads without checking consent, revocation status, and scope first is, on paper, a few hundred separate violations before anyone even gets to whether it was willful, and texting someone you already know revoked consent is about as close to “willful” as this area of law gets.
This isn’t a rulebook nobody enforces. WebRecon, which tracks consumer-litigation filings monthly with a published, consistent methodology, counted 2,810 TCPA lawsuits filed in federal court over the full 2025 calendar year (WebRecon, Dec. 2025 stats & year in review). Separately, the FTC’s National Do Not Call Registry took in more than 2.6 million complaints during fiscal year 2025, against a registry of more than 258 million active registrations (FTC, National Do Not Call Registry Data Book for Fiscal Year 2025). Both of those numbers describe the same underlying reality: a large and active population of consumers who notice, complain about, and sue over unwanted contact, and an aged lead who already told you to stop once is exactly the kind of person who notices a second time.
| Figure | What it means | Source |
|---|---|---|
| $500 per violation | Base TCPA statutory damages, or actual loss if greater | 47 U.S.C. § 227(b)(3) |
| Up to $1,500 per violation | Treble damages for a willful or knowing violation | 47 U.S.C. § 227(b)(3) |
| 2,810 lawsuits | TCPA suits filed in federal court, full year 2025 | WebRecon, Dec. 2025 stats & year in review |
| 2.6M+ complaints | Do Not Call complaints received, FY2025 | FTC, DNC Registry Data Book FY2025 |
| 258M+ registrations | Active numbers on the national Do Not Call Registry, FY2025 | FTC, DNC Registry Data Book FY2025 |
| November 25, 2026 | FCC 26-67's confirmed effective date for the new revocation rule | 91 FR 67214, Federal Register |
| 23% per year | Share of a contact list that decays (goes invalid or abandoned) annually | ZeroBounce, Email List Decay Report for 2026 |
Contact list decay rate, 2021 to 2025
Annual share of an email list going invalid or abandoned, per year of data analyzed.
Source: ZeroBounce, The Email List Decay Report for 2026, analyzing more than 11 billion email addresses verified January-December 2025. The rate moves year to year but has stayed above one-fifth every year shown — a list that's sat untouched for twelve months has real decay in it before consent is even part of the conversation.
The age of the lead isn't the risk. Not knowing what you actually have on file is the risk. Those are different problems with different fixes.
Mike MooreThe manual method: audit an aged list by hand before you touch it
None of this requires software you don’t already have. Here’s how to go through an aged lead list and sort it into safe-to-contact and do-not-contact, using your CRM or a spreadsheet.
Pull the original consent language, not just a "consented: yes" flag
Go back to the actual form, landing page, or call script that generated the lead. Find the exact sentence they agreed to and what it says they're being contacted about. If you can't find it, treat the consent as unverified, not as valid by default.
Match the consent scope to what you're about to send
If the original consent covered a Medicare quote and you're about to send a final expense campaign, that's outside scope. You need a separate basis to contact them about the new topic, not a reuse of the old one.
Cross-check every channel for a revocation, not just your main CRM
Check the dialer, the texting platform, the CRM notes field, and any call recordings or transcripts for "stop," "remove me," "don't contact," or a hang-up after being asked not to call again. A revocation that lives in a transcript nobody re-read is still a revocation.
Check the time elapsed against your own retention and re-verification policy
Pick a threshold, 90 days, six months, a year, after which you require a fresh look before any lead gets touched again, even if nothing specifically flagged it. This isn't a legal requirement; it's a discipline that catches gaps the law doesn't force you to catch.
Check your state's own telemarketing law, not just federal TCPA
Several states run stricter rules on top of the federal floor. Florida's Telephone Solicitation Act (Fla. Stat. § 501.059), for example, carries the same $500-to-$1,500 private right of action as the federal statute, on top of its own consent requirements. Confirm whether your state runs a comparable law before assuming federal compliance covers you.
Decide whether re-consent is worth asking for
For a lead whose scope has genuinely expired or whose original consent you can't verify, the safest move is a single, clearly-labeled re-opt-in message: "Can we text you updates about X? Reply YES to confirm." That's not a workaround, it's a clean new consent that replaces an uncertain old one.
Log the audit result on the lead record itself
Whatever you decide, write it down: consent verified, scope confirmed, no revocation found, cleared for contact on this date, by this person. If this lead ever gets questioned, that note is the difference between "we checked" and "we assumed."
The common, unaudited version
- The whole segment gets the same "checking back in" message, regardless of original topic
- Nobody checks whether any lead revoked consent on a different channel
- "Old" and "unsafe" get treated as the same thing, so the list just doesn't get worked
- No record of why a given lead was, or wasn't, re-contacted
What the same list looks like done right
- Each lead's message matches what their original consent actually scoped
- Every channel gets checked for a revocation before anyone gets re-touched
- Leads split into cleared, needs re-consent, and do-not-contact, not one undifferentiated pile
- Every decision is logged on the lead record with a date and a reason
This is the whole method
Pull the original consent language, match it to what you're about to send, check every channel for a revocation, apply your own re-verification threshold, check your state's law, ask for re-consent where the scope is genuinely stale, and log the decision. Nothing in it costs anything but the time to do it once per lead.
What not to paste into a general AI tool while you're doing this
It's tempting to export the whole aged list and paste it into a general-purpose AI chat tool and ask it to help sort and draft messages. Don't, not with names, phone numbers, emails, or any health or coverage detail attached. That data leaves your control the moment you paste it, with no BAA, no audit trail, and no guarantee about retention. Ambrose's own documentation states plainly that Ambrose is HIPAA compliant as a platform — not "HIPAA certified," a distinction worth holding onto, since no such certification exists for general-purpose AI products either. If you want AI help sorting a list like this, it needs to run through a tool built to keep that data inside your own environment, scrubbed before it ever reaches a model, which is exactly the problem the next section covers.
How Ambrose solves it
Everything above works with a spreadsheet and the patience to go through it. Where a platform helps is turning that one-time manual audit into something that stays current without you re-running it by hand every time you want to touch the list again.
Ambrose’s lead-memory spoke is a per-lead dossier store, “historical context across campaigns and conversations,” and it runs with a “safe” HIPAA posture, meaning the data stays local to your tenant rather than leaving it (Ambrose docs, Spokes; spoke-lead-memory). It exposes three tools: lead_get_dossier, which returns a lead’s full history, events, and context; lead_log_event, which appends an event to that lead’s timeline; and lead_search, which searches across all leads by tag, channel, or status. Here’s the honest version of what that gets you: when a lead revokes consent, replies STOP, or tells an agent on a call not to contact them again, you log it as an event on that lead’s timeline the moment it happens, tagged clearly, through lead_log_event. Before any future campaign or routine goes out, lead_search filters the list by that tag and excludes anyone carrying it. That’s the manual audit’s revocation-check step, done as a standing filter instead of a one-time pull.
Say that out loud so it’s not oversold: lead-memory doesn’t have a dedicated “consent field” and it doesn’t automatically know a lead revoked consent if nobody told it. It’s a dossier, an event log, and a search index, not an automatic compliance engine. The mechanism only works if you actually log the opt-out or revocation the moment it happens, the same discipline the manual method requires. What changes is that once it’s logged, it’s checkable instantly and consistently, instead of living in a call transcript nobody re-reads before the next campaign fires.
Once a segment of the list clears that check, dispatch runs through channel-bridge, Ambrose’s outbound email, SMS, and Telegram dispatcher, which runs with a “scrubbed” HIPAA posture, meaning identifying data is stripped before anything leaves the tenant and restored on the way back (Ambrose docs, Spokes). If your CRM is GoHighLevel specifically, the ghl spoke gives the same scrubbed access to your full GoHighLevel surface, so a campaign dispatch or a tag check can happen inside the system you already run leads through.
The piece that actually replaces the manual “go through the list by hand” step is a routine: a scheduled prompt attached to an agent or team, defined by a five-field cron expression, a target, and a prompt body, with an optional output sink like Slack and an optional PHI-mode override (Ambrose docs, Routines). A routine set to run monthly can be written in plain English: search lead-memory for leads older than 90 days with no do-not-contact tag, check for a matching consent-scope tag, and hand the cleared names to channel-bridge (or ghl) for that month’s re-engagement send, posting the result to Slack. One real limit worth knowing before you build on it: a routine only runs while its agent is set to Live. If that agent gets switched back to draft, every routine attached to it pauses automatically, and setting the agent live again does not turn them back on, you have to re-enable each routine yourself. Teams don’t have this limit; their routines always run.
Name the mechanism, not just "AI"
The specific thing worth naming here is lead_log_event and lead_search on the lead-memory spoke, channel-bridge or ghl for the actual send, and a routine for the schedule, not a general claim that "AI keeps your aged list compliant." None of it invents a consent record. It only checks what you've actually logged, which means the discipline from the manual method above doesn't go away once you're using it, it becomes the input the automation runs on.
What you get by joining
One Ambrose seat, including the lead-memory, channel-bridge, ghl, and phi-gateway spokes referenced above, comes included with a Tech Savvy Insurance membership: $97 a month, billed monthly, cancel anytime, with the founding rate locked in while the membership stays continuously active. Ambrose usage runs on its own credit ledger, separate from the membership fee, so cost stays visible instead of becoming a surprise. Alongside the seat: weekly Zoom calls with open Q&A and build-with-you sessions, more than 30 hours of recorded training updated monthly, Meta Ads and AI marketing training built for health and life agents specifically, pre-built AI templates and bot deployments, and a free annual in-person member workshop. It’s also an explicit no-recruiting zone, so you can ask a real compliance question about your own aged list without getting DM’d about a downline an hour later.
Everything above works whether you join anything or not. Go run the manual audit on your own list this week, by hand, with the method in this article. Or, if you’d rather have lead_log_event and a scheduled routine doing the filtering while people who’ve built this exact thing are on screen-share with you, that’s what the membership is for.
Stop guessing about your aged list
Pull the consent language, check every channel for a revocation, match scope, check your state's law, and log the result. The manual version above is the whole method, free, no membership required. If you'd rather watch lead-memory and a routine do the ongoing version of the same check, one Ambrose seat comes with the Tech Savvy membership.
Join Tech Savvy — $97/monthRelated reading: the full rundown of what’s actually in force and what just changed in TCPA Rules for Insurance Agents in 2026, our broader look at building an AI lead follow-up system for leads that are still fresh, and vetting insurance lead vendors before you buy the next batch that will eventually age into this same question.
Close
An old lead isn’t automatically a legal problem, and it isn’t automatically safe either. Age is the thing that’s easy to see in a CRM filter, and it’s the wrong thing to decide on. What actually matters is whether the consent you have on file still scopes to what you’re sending, whether anyone revoked it on a channel you forgot to check, and whether your own state adds a rule the federal floor doesn’t. Run that check by hand, the way this article walks through, before you touch a list that’s been sitting untouched for the wrong reason, which is usually that nobody was sure, not that anyone found a real problem.
Before you act on any of this
Tech Savvy Insurance is a training and software community, not an insurance company, agency, or law firm, and does not provide insurance, legal, tax, or compliance advice. You are responsible for your own licensure and for complying with the TCPA, FCC rules, state telemarketing law, CMS Medicare marketing and TPMO requirements, the NAIC's AI Model Bulletin expectations where automation is involved, and your carriers' own rules. AI-generated outputs may contain errors: always verify against the current primary source, including the statutes and FCC orders cited above, before changing anything based on this article. Results may vary.
Frequently asked questions
Sources
- Cornell Law School, Legal Information Institute — 47 U.S.C. § 227 (current text, Private right of action at (b)(3)) — law.cornell.edu
- Cornell Law School, Legal Information Institute — 47 CFR § 64.1200 (current text) — law.cornell.edu
- Federal Register — Final rule, 'Enhancing the Ability of Consumers To Control the Robocalls,' 91 FR 67214, FR Doc. 2026-21821 (published Oct. 26, 2026; effective Nov. 25, 2026) — federalregister.gov
- FCC, Report and Order and Further Notice of Proposed Rulemaking, FCC 26-67, CG Docket No. 02-278 (adopted Sept. 30, 2026; released Oct. 1, 2026) — docs.fcc.gov
- WebRecon — December 2025 litigation stats and year in review — webrecon.com
- FTC — National Do Not Call Registry Data Book for Fiscal Year 2025 (dated December 2025) — ftc.gov
- ZeroBounce — The Email List Decay Report for 2026 (data covering January-December 2025) — zerobounce.net
- Florida Statute 501.059 — Florida Telephone Solicitation Act (FTSA) — codes.findlaw.com
- Ambrose docs — Spokes (catalog, HIPAA postures) — app.hiambrose.com
- Ambrose docs — spoke-lead-memory — app.hiambrose.com
- Ambrose docs — Routines — app.hiambrose.com
- Ambrose docs — How client data is protected (PHI Rail) — app.hiambrose.com
Ready to put this into practice?
Join a private community of Health & Life insurance professionals using AI, Meta Ads, and automation to grow — without draining their bank account.
Join Tech Savvy — $97/month