TCPA Rules for Insurance Agents in 2026

Right now, in 2026, you still need prior express written consent before texting or robocalling a lead about a specific plan, you still cannot call or text before 8 a.m. or after 9 p.m. in the recipient’s own time zone, and you still have to honor a revocation the moment it comes in. What you do not need anymore is one separate consent per seller for every unrelated topic, because the rule that would have required that was thrown out by a federal appeals court, in a case an insurance industry group brought and won (Insurance Marketing Coalition Ltd. v. FCC, No. 24-10277, 11th Cir., Jan. 24, 2025). A second, separate rule change, one that would make a single revocation cancel consent for every unrelated message from you, was supposed to arrive this year. It didn’t. The FCC pushed it back again, to January 31, 2027, in an order it released on January 6, 2026 (FCC, DA 26-12). This article walks through what’s actually in force, what’s still pending, what it costs to get wrong, and how to build a compliant follow-up sequence by hand before touching any software.

The pain: the rule keeps moving and nobody told you which version is live

If you run any kind of text or call follow-up sequence, you’ve probably heard three contradictory things in the last eighteen months: that you now need separate consent for every single topic you text someone about, that a single “stop texting me” cancels everything you’re allowed to send that person forever, and that none of it matters because “the TCPA thing got struck down.” All three are half-true, which is worse than being wrong, because half-true compliance advice is the kind agents actually act on.

Here’s why this particular rule is so easy to get wrong: it changed twice in one direction and then reversed, on two different tracks, inside of about eighteen months. One track (one-to-one consent) got fully vacated by a court. The other track (revoke-all) is still technically coming, just not yet, and its start date has been pushed back twice already. An agent skimming a single article from mid-2025 could easily walk away thinking either track is settled law today. Neither summary holds up if you only read it once and never go back to check the date.

Why this keeps happening: the actual timeline

Start with what the TCPA itself says, because everything else is built on top of it. The Telephone Consumer Protection Act requires anyone making a robocall, a term the FCC has long interpreted by regulation to include text messages, to get the called party’s “prior express consent” before making it, and prior express written consent specifically when the message is telemarketing or advertising (47 U.S.C. § 227(b)(1)(A)–(B); 47 CFR 64.1200(a)(2)–(3)). That part hasn’t moved in this whole saga and isn’t going anywhere.

What has moved is a second layer the FCC tried to add on top of it. Here’s the sequence, each step sourced to the actual order or opinion:

February 16, 2024. The FCC releases what the industry calls the TCPA Consent Order, adopting new interpretations of “prior express consent.” Two pieces of it matter here: a requirement that consent be obtained one seller at a time rather than covering multiple telemarketers under one blanket consent (the “one-to-one” rule), and a requirement that any call or text be “logically and topically associated” with whatever prompted the original consent. The same order also adopts section 64.1200(a)(10), the “revoke-all” provision, which would treat a revocation made in response to one type of message as applying to all future unrelated messages from that caller.

October 11, 2024. The FCC publishes notice in the Federal Register that the new rules take effect April 11, 2025.

January 24, 2025. The Eleventh Circuit rules on a petition filed by the Insurance Marketing Coalition, an insurance lead-generation industry group, challenging the one-to-one and logically-and-topically-related restrictions. The court’s holding is direct: the FCC “exceeded its statutory authority in redefining ‘prior express consent’ to include the additional ‘prior express consent’ restrictions,” and the court finds vacatur, not remand without vacatur, the appropriate remedy (opinion, pp. 23–25). Those two restrictions are gone. They never took effect.

April 7, 2025. Separately from the court case, the FCC’s Consumer and Governmental Affairs Bureau grants a one-year waiver of the revoke-all rule’s effective date, pushing section 64.1200(a)(10) compliance from April 11, 2025 to April 11, 2026, after financial-industry trade groups argued they needed more time to build systems that could process a revocation received on one topic and apply it across unrelated business lines (FCC Order DA 25-312).

January 6, 2026. The FCC extends that waiver again, this time to January 31, 2027, citing an open rulemaking proceeding it wants to finish reviewing before the rule locks in, and the desire to avoid forcing “potentially unnecessary compliance costs” on affected parties while that review is pending (FCC Order DA 26-12).

So as of today, one track is permanently dead (one-to-one consent, logically-and-topically-related) and the other is alive but not yet in force (revoke-all, now targeting January 31, 2027). Everything else, written consent, the calling-hours window, per-topic revocation, was never part of either fight and has been sitting there unchanged the whole time.

What’s actually in force right now, piece by piece

Strip away the two moving pieces and here’s the TCPA framework that governs your follow-up texts and calls today, unchanged by anything in the last two years:

Consent. For any call or text that constitutes telemarketing or advertising, you need the called party’s prior express written consent before you send it (47 CFR 64.1200(a)(2)–(3)). A lead who fills out a quote request form and checks a consent box has given you consent to be contacted about that request. It does not, by itself, license you to add them to an unrelated newsletter or a different product line’s drip campaign, not because of the vacated one-to-one rule, but because ordinary consent scope was never that broad to begin with. Write down what a given consent actually covers, in your own CRM notes, at the moment you capture it.

Calling and texting hours. No telephone solicitation before 8 a.m. or after 9 p.m., “local time at the called party’s location” (47 CFR 64.1200(c)(1)). That’s the recipient’s clock, not yours. If you work from a home office in the Eastern time zone and a lead from a lead-buy list lives in Arizona, a text that goes out at 8:30 a.m. Eastern is 5:30 a.m. Mountain Standard, well outside the window, on autopilot, unless your system checks the lead’s area code or address against a time zone before it fires.

Revocation. A called party can revoke consent by any reasonable method: replying STOP, saying so on a call, using an opt-out link, or another clear method that expresses they don’t want further contact (47 CFR 64.1200(a)(10)). Once revoked, you cannot send further robocalls or robotexts to that person on that topic, and the rule requires honoring the request “within a reasonable time,” not to exceed ten business days. Right now, that revocation obligation is still scoped to the topic it was made about, not automatically to every unrelated thing you might otherwise contact them about. That’s the piece the revoke-all rule would change, once it actually takes effect.

Consent is per-seller in ordinary practice, just not by the vacated FCC restriction. This is the nuance worth sitting with. The Eleventh Circuit didn’t rule that one consent can cover unlimited unrelated sellers and topics forever; it ruled the FCC lacked authority to write a specific, additional regulatory requirement forcing that scope narrowly. Ordinary contract and consent principles, the same ones the court said should govern instead, still mean a consent means what it says it means. If your consent language says “to receive calls and texts from [Agency Name] about health insurance options,” that’s the scope you actually have, vacatur or no vacatur.

What it actually costs to get this wrong

The TCPA gives a called party a private right of action: recover actual monetary loss, or $500 per violation, whichever is greater, and a court may increase that award to as much as three times that amount, up to $1,500 per violation, if the violation was willful or knowing (47 U.S.C. § 227(b)(3)). Those numbers are per call or per text, not per lawsuit. A single automated sequence that sends five out-of-window texts to a hundred people who never gave written consent is, on paper, five hundred separate violations before anyone even gets to whether it was willful.

This isn’t a hypothetical rulebook nobody actually uses. WebRecon, which tracks consumer-litigation filings monthly with a published, consistent methodology, counted 2,810 TCPA lawsuits filed in federal court over the complete 2025 calendar year, up 0.8% from 2024’s total (WebRecon, Dec. 2025 stats & year in review). That figure comes from a single tracker; we found no independent second count of the same period to corroborate it against, so treat it as directionally solid rather than independently confirmed twice. It’s still roughly 234 new TCPA suits filed every month, in a year when one of the FCC’s own restrictions had just been struck down. The plaintiffs’ bar didn’t go quiet because one rule got vacated; the base statute and its statutory-damages structure are exactly what keeps this area litigated regardless of which regulatory layer is currently in force.

There’s a second cost that’s harder to put a number on but just as real: overcorrecting. An agent who read one alarming article about revoke-all in early 2025 and quietly stopped texting leads altogether, or cut a working five-touch sequence down to one message out of caution, gave up real production against a rule that still isn’t even in effect. Reading the primary source instead of the panic costs you twenty minutes. Overcorrecting against a rule two years before it applies costs you every lead who would have converted on touch three.

State law can go further than the TCPA does

Everything above is federal law, and federal law is a floor, not a ceiling. Several states run their own telemarketing statutes on top of the TCPA, and at least one of them is stricter and more heavily litigated than the federal version. Florida’s Telephone Solicitation Act, codified at Fla. Stat. § 501.059 and commonly called Florida’s “mini-TCPA,” requires prior express written consent for an automated telephonic sales call, text message, or voicemail, defined the same way the TCPA does: a signed authorization, which can be an affirmative act like checking a box, that names the specific phone number and discloses that consent isn’t a condition of purchase (Fla. Stat. § 501.059). Damages run the same way as the federal statute: actual damages or $500 per violation, whichever is greater, with courts able to treble that to $1,500 for a willful or knowing violation.

The reason this matters beyond Florida specifically is the pattern, not just the one state. A rule change at the federal level, like the one-to-one consent vacatur this article opens with, doesn’t touch a state’s own statute at all. If your lead list includes Florida residents, or residents of any other state running a comparable law, you have two separate compliance obligations to satisfy, and being clean under the federal TCPA doesn’t automatically clear you under a state’s own version. This article isn’t a 50-state survey, and it would be dishonest to pretend otherwise: check whether your own state runs a telemarketing statute with a private right of action before assuming federal compliance is the whole picture, the same way a Texas or California agent has to check their own state insurance regulator’s rules on top of federal Medicare marketing law.

The manual method: build a TCPA-safe follow-up sequence by hand

None of what follows requires any software beyond whatever CRM or spreadsheet you already have. Here’s how to build a defensible, compliant text and call follow-up process this week.

A worked example: one lead, one week

Say a lead fills out a quote form for Medicare Advantage plans on a Tuesday and checks a box consenting to be texted “about Medicare plan options in my area.” Here’s what a TCPA-defensible sequence looks like against everything above.

You log the exact consent text, the timestamp, and the source URL of the form in the lead’s CRM record. Your first text goes out that same day, scoped to Medicare, nothing else. Before it sends, your workflow checks the lead’s area code against a time zone table, confirming the send falls inside 8 a.m. to 9 p.m. in that zone rather than yours. Over the next week you run three more touches, an SMS, a call attempt, another SMS, each still scoped to the Medicare quote, each still checked against the recipient’s local window.

On Thursday, the lead replies “stop texting me.” Your workflow suppresses that number immediately, same day, well inside the ten-business-day ceiling the rule allows, and logs the date and the exact reply. Three weeks later, someone on your team imports a fresh list for an ACA open-enrollment push. Before it goes out, that list runs against your suppression file, and the Tuesday lead’s number gets excluded automatically, because the ACA campaign was never inside the scope of a consent that was specific to Medicare in the first place, and the person also separately opted out.

That’s the entire mechanism this article describes, applied to one real lead. Nothing in it requires the revoke-all rule to be in effect, and nothing in it depends on whether one-to-one consent ever existed. It’s just consent, scope, timing, and a suppression list that actually gets checked.

Where Ambrose fits, and where it honestly doesn’t

Everything above works with a spreadsheet and a CRM you already have. Where a platform actually helps is once your sequence gets shorter and more deliberate, because a scoped, opt-out-respecting sequence sends fewer messages than “blast every channel at everyone,” which means you need to know which of the touches you kept are actually the ones producing a booked call.

That’s what Ambrose’s campaign-metrics spoke is built for. Per its own documentation, it tracks funnel performance across email, SMS, and social, “opens, clicks, replies, booked-call rates,” with three tools: metrics_campaign_summary for a single campaign’s topline numbers, metrics_recipient_engagement for engagement at the individual-recipient level, and metrics_funnel_breakdown for a stage-by-stage view of where a sequence gains or loses people (Ambrose docs, spoke-campaign-metrics). Per-recipient identifiers are stripped before any model sees them; the model works from aggregates, and identifiers only re-enter for an action list you specifically approve. Ask it, in plain English, which touch in your four-message Medicare sequence is producing the booked calls, and which one is dead weight you’re sending out of habit, and you get a stage-by-stage answer instead of a guess.

Ambrose’s channel-bridge spoke is what actually sends the message, dispatching email through Gmail, a GHL conversation, or direct SMTP, and SMS through Twilio or a GHL conversation (Ambrose docs, spoke-channel-bridge). Its reply-bot spoke can draft a reply or an appointment-booking response, with a confidence score and a reasoning trace, by default requiring your review before anything sends (Ambrose docs, spoke-reply-bot).

Here’s the part worth being straight about: neither spoke’s documentation describes built-in TCPA consent tracking, time-zone-aware send windows, or STOP-keyword suppression logic. That layer, the actual compliance mechanism this article walks through, still lives in your CRM workflow rules or dialer settings, and it’s still your job to build and maintain it, Ambrose seat or not. What Ambrose adds isn’t a compliance shortcut. It’s visibility into which of the fewer, better-scoped messages you’re now sending is actually working, and a drafting and dispatch layer you still review before it goes out.

What you get by joining

One Ambrose seat, including the campaign-metrics, channel-bridge, and reply-bot spokes referenced above, comes included with a Tech Savvy Insurance membership: $97 a month, billed monthly, cancel anytime, with the founding rate locked in while the membership stays active. Ambrose usage runs through its own credit ledger with spend caps, so cost stays visible instead of showing up as a surprise later. Alongside the seat: weekly Zoom calls with open Q&A and build-with-you sessions, more than 30 hours of recorded training, Meta Ads and marketing training built for this industry, pre-built AI templates and bot deployments, and a free annual in-person member workshop. It’s also an explicit no-recruiting zone, you can ask a real compliance question without ending up on someone’s downline pitch an hour later, which isn’t true of most agent Facebook groups.

Close

The rule everyone’s been arguing about, one consent per seller, is dead, vacated by a federal court in a case an insurance industry group actually won. The rule some agents are bracing for, revoke-all, isn’t here yet and won’t be until at least January 31, 2027, and that date has already moved twice. What’s actually governing your texts today is the same thing that’s governed them for years: written consent scoped to what it says, an 8 a.m.–9 p.m. window measured on the recipient’s clock, and an immediate stop the moment someone opts out. Build that by hand this week using the method above, whether or not you ever join anything. If you’d rather see how campaign-metrics shows you which touch in a shorter sequence is actually working, with people building the same suppression list alongside you on a Tuesday call, one Ambrose seat comes with a Tech Savvy membership: https://techsavvyinsurance.com/. See also our guide on the AI follow-up system that replaces your lead chase and our broader look at AI compliance for insurance agents in 2026.