TCPA Rules for Insurance Agents in 2026

Right now, in 2026, you still need prior express written consent before texting or robocalling a lead about a specific plan, you still cannot call or text before 8 a.m. or after 9 p.m. in the recipient’s own time zone, and you still have to honor a revocation the moment it comes in. What you do not need anymore is one separate consent per seller for every unrelated topic, because the rule that would have required that was thrown out by a federal appeals court, in a case an insurance industry group brought and won (Insurance Marketing Coalition Ltd. v. FCC, No. 24-10277, 11th Cir., Jan. 24, 2025). A second, separate rule change, one that would make a single revocation cancel consent for every unrelated message from you, was supposed to arrive this year. It didn’t arrive as planned, and it is not going to arrive in the form agents were bracing for either: on September 30, 2026 the FCC adopted a new Report and Order, FCC 26-67, that rewrites the whole revocation framework before its last delayed date, January 31, 2027, ever gets here (FCC 26-67, CG Docket No. 02-278). This article walks through what’s actually in force, what’s new and still pending, what it costs to get wrong, and how to build a compliant follow-up sequence by hand before touching any software.

The pain: the rule keeps moving and nobody told you which version is live

If you run any kind of text or call follow-up sequence, you’ve probably heard three contradictory things in the last eighteen months: that you now need separate consent for every single topic you text someone about, that a single “stop texting me” cancels everything you’re allowed to send that person forever, and that none of it matters because “the TCPA thing got struck down.” All three are half-true, which is worse than being wrong, because half-true compliance advice is the kind agents actually act on.

Here’s why this particular rule is so easy to get wrong: it changed twice in one direction and then reversed, on two different tracks, inside of about eighteen months. One track (one-to-one consent) got fully vacated by a court. The other track (revoke-all) is still technically coming, just not yet, and its start date has been pushed back twice already. An agent skimming a single article from mid-2025 could easily walk away thinking either track is settled law today. Neither summary holds up if you only read it once and never go back to check the date.

Why this keeps happening: the actual timeline

Start with what the TCPA itself says, because everything else is built on top of it. The Telephone Consumer Protection Act requires anyone making a robocall, a term the FCC has long interpreted by regulation to include text messages, to get the called party’s “prior express consent” before making it, and prior express written consent specifically when the message is telemarketing or advertising (47 U.S.C. § 227(b)(1)(A)–(B); 47 CFR 64.1200(a)(2)–(3)). That part hasn’t moved in this whole saga and isn’t going anywhere.

What has moved is a second layer the FCC tried to add on top of it. Here’s the sequence, each step sourced to the actual order or opinion:

February 16, 2024. The FCC releases what the industry calls the TCPA Consent Order, adopting new interpretations of “prior express consent.” Two pieces of it matter here: a requirement that consent be obtained one seller at a time rather than covering multiple telemarketers under one blanket consent (the “one-to-one” rule), and a requirement that any call or text be “logically and topically associated” with whatever prompted the original consent. The same order also adopts section 64.1200(a)(10), the “revoke-all” provision, which would treat a revocation made in response to one type of message as applying to all future unrelated messages from that caller.

October 11, 2024. The FCC publishes notice in the Federal Register that the new rules take effect April 11, 2025.

January 24, 2025. The Eleventh Circuit rules on a petition filed by the Insurance Marketing Coalition, an insurance lead-generation industry group, challenging the one-to-one and logically-and-topically-related restrictions. The court’s holding is direct: the FCC “exceeded its statutory authority in redefining ‘prior express consent’ to include the additional ‘prior express consent’ restrictions,” and the court finds vacatur, not remand without vacatur, the appropriate remedy (opinion, pp. 23–25). Those two restrictions are gone. They never took effect.

April 7, 2025. Separately from the court case, the FCC’s Consumer and Governmental Affairs Bureau grants a one-year waiver of the revoke-all rule’s effective date, pushing section 64.1200(a)(10) compliance from April 11, 2025 to April 11, 2026, after financial-industry trade groups argued they needed more time to build systems that could process a revocation received on one topic and apply it across unrelated business lines (FCC Order DA 25-312).

January 6, 2026. The FCC extends that waiver again, this time to January 31, 2027, citing an open rulemaking proceeding it wants to finish reviewing before the rule locks in, and the desire to avoid forcing “potentially unnecessary compliance costs” on affected parties while that review is pending (FCC Order DA 26-12).

So as of today, one track is permanently dead (one-to-one consent, logically-and-topically-related) and the other is alive but not yet in force (revoke-all, now targeting January 31, 2027). Everything else, written consent, the calling-hours window, per-topic revocation, was never part of either fight and has been sitting there unchanged the whole time.

What FCC 26-67 actually changes, and when it takes effect

Here is what answers the question in the headline above, directly: the flat revoke-all rule agents have been warned about since 2024 is not going to take effect as originally written, even on its latest delayed date. On September 30, 2026, the Commission adopted a Report and Order in the same docket, CG Docket No. 02-278, that rewrites 47 CFR 64.1200(a)(10) through (12) before January 31, 2027 arrives (FCC 26-67, Appendix A). The Commission’s own summary states it plainly: “we modify our rules to allow callers to interpret a revocation request as applying only to the specific category of informational robocalls to which the revocation was directed, to allow callers to designate an exclusive means to revoke consent” (FCC 26-67, para. 2).

Three things change, each sourced to a specific paragraph of the order:

1. Revocation scope now splits into two tracks, not one. For an informational robocall, meaning one that is not an advertisement and does not constitute telemarketing, a caller may treat a revocation as applying only to the specific category of informational robocall the consumer revoked, not to every unrelated message (FCC 26-67, para. 10). But for a robocall that does contain an advertisement or constitute telemarketing, the rule runs the other way: a revocation made in response to one such call revokes consent to all future telemarketing or advertising robocalls from that same caller, and the consumer only has to say it once (FCC 26-67, para. 14; Appendix A, amended 47 CFR 64.1200(a)(10)). For an insurance agent, nearly everything you send a lead who hasn’t bought yet is advertising or telemarketing under the FCC’s own definition, so this is the track that applies to you: one STOP on one marketing text ends your ability to send that person any other marketing text or robocall, full stop, not just that specific campaign.

2. Callers may designate one exclusive revocation channel. Instead of being required to honor a revocation made by any reasonable method, a caller can now pick one of three listed methods as the only one it is required to process: an automated interactive-voice or key-press opt-out on a call, a reply to a text using one of seven standardized words (“stop,” “quit,” “end,” “revoke,” “opt out,” “cancel,” or “unsubscribe”), or a designated website or phone number for opt-out requests (FCC 26-67, paras. 15-18; Appendix A, amended 47 CFR 64.1200(a)(10)(i)-(iii)). The catch, and it is a real compliance obligation, not an option: you have to “clearly and conspicuously disclose” whichever method you designate, on the call or in the text itself. If you never designate one, you are back to the old standard and still have to process a revocation made by any reasonable method, the same as today (FCC 26-67, para. 16; Appendix A, amended 47 CFR 64.1200(a)(11)).

3. A quick, content-limited confirmation text is now expressly allowed. A text confirming that you received and are honoring a revocation request does not violate the rules, as long as it only confirms the opt-out and includes no marketing or promotional content. Send it within five minutes of the revocation and it is presumed reasonable; take longer and you would need to show the delay itself was reasonable (FCC 26-67, Appendix A, amended 47 CFR 64.1200(a)(12)).

As of this update, it’s live on the calendar even though it isn’t live yet. The order was adopted September 30, 2026 and released October 1, 2026, and its own ordering clause set the effective date at 30 days after Federal Register publication. That publication has now happened: the rule ran in the Federal Register on October 26, 2026 at 91 FR 67214 (FR Doc. 2026-21821), and under the order’s own Section E, “the revised rule amendments contained herein become effective November 25, 2026,” a date that “supersede[s] the delayed effective date of the relevant portion of that rule that was previously extended to January 31, 2027” (Federal Register, 91 FR 67214, Section E). So mark November 25, 2026, not January 31, 2027, as the date the two-track revocation rule and the exclusive-channel option actually bind.

What the FCC is considering next, and how to comment

The same order also opens a Further Notice of Proposed Rulemaking (FNPRM) asking whether to go further still. The FNPRM itself was published in the Federal Register on October 26, 2026 as its own separate document, “Modernizing the Ability of Consumers To Control Robocalls,” FR Doc. 2026-21820, in the same docket, CG Docket No. 02-278 (Federal Register, FR Doc. 2026-21820). Four proposals are on the table, each sourced to its own paragraph of FCC 26-67:

1. A shorter revocation deadline. The Commission is asking whether to cut the current ten-business-day maximum for honoring a revocation down to seven business days, “unless the caller demonstrates that processing a revocation beyond seven business days is reasonable,” a number pulled directly from a June 30, 2026 joint letter filed by the American Bankers Association, the National Consumer Law Center, and ACA International (FCC 26-67, paras. 30-31).

2. Mandatory two-way texting. Right now, a text sender can use a one-way texting protocol, one that does not accept a reply, as long as it discloses that limitation and gives an alternate opt-out method such as a phone number or website (47 CFR 64.1200(a)(10)). The FNPRM asks whether to eliminate that option and require every text sender to accept reply-text revocation instead (FCC 26-67, paras. 32-34).

3. A mandatory one-step “revoke all” method. The Commission is asking whether every caller should have to offer a single method that revokes consent to all future robocalls, not just the category a consumer initially revoked, and whether that method should have to be automated (FCC 26-67, paras. 35-36).

4. Affiliates and separate lines of business. The FNPRM asks whether to write a more specific rule on how a revocation to one business applies to its affiliates or separate divisions, building on the existing do-not-call standard that a revocation binds only “the particular entity making the call… and will not apply to affiliated entities unless the consumer reasonably would expect them to be included” (FCC 26-67, paras. 37-38).

None of these four proposals is a rule yet, and none of them changes anything about how you run a follow-up sequence today. Comments on the FNPRM are due November 25, 2026, and reply comments are due December 28, 2026 (Federal Register, FR Doc. 2026-21820). If your agency, your FMO, or a trade group you belong to wants to file a comment, filings go into CG Docket No. 02-278. If any of these four proposals becomes a rule, it will be in a later order, not this one, and this article will get another update when that happens.

What’s actually in force right now, piece by piece

Strip away the two moving pieces and here’s the TCPA framework that governs your follow-up texts and calls today, unchanged by anything in the last two years:

Consent. For any call or text that constitutes telemarketing or advertising, you need the called party’s prior express written consent before you send it (47 CFR 64.1200(a)(2)–(3)). A lead who fills out a quote request form and checks a consent box has given you consent to be contacted about that request. It does not, by itself, license you to add them to an unrelated newsletter or a different product line’s drip campaign, not because of the vacated one-to-one rule, but because ordinary consent scope was never that broad to begin with. Write down what a given consent actually covers, in your own CRM notes, at the moment you capture it.

Calling and texting hours. No telephone solicitation before 8 a.m. or after 9 p.m., “local time at the called party’s location” (47 CFR 64.1200(c)(1)). That’s the recipient’s clock, not yours. If you work from a home office in the Eastern time zone and a lead from a lead-buy list lives in Arizona, a text that goes out at 8:30 a.m. Eastern is 5:30 a.m. Mountain Standard, well outside the window, on autopilot, unless your system checks the lead’s area code or address against a time zone before it fires.

Revocation. A called party can revoke consent by any reasonable method: replying STOP, saying so on a call, using an opt-out link, or another clear method that expresses they don’t want further contact (47 CFR 64.1200(a)(10)). Once revoked, you cannot send further robocalls or robotexts to that person on that topic, and the rule requires honoring the request “within a reasonable time,” not to exceed ten business days. Right now, that revocation obligation is still scoped to the topic it was made about, not automatically to every unrelated thing you might otherwise contact them about, regardless of whether the message was informational or promotional. Starting November 25, 2026, when FCC 26-67 takes effect (published Oct. 26, 2026, 91 FR 67214), that single scope splits in two: informational revocations stay narrow, but a revocation on a telemarketing or advertising message, which is what nearly all agent follow-up falls under, cancels consent for every future telemarketing or advertising message from you, not just the one campaign it was sent about. See the “What FCC 26-67 actually changes” section above for the full breakdown.

Consent is per-seller in ordinary practice, just not by the vacated FCC restriction. This is the nuance worth sitting with. The Eleventh Circuit didn’t rule that one consent can cover unlimited unrelated sellers and topics forever; it ruled the FCC lacked authority to write a specific, additional regulatory requirement forcing that scope narrowly. Ordinary contract and consent principles, the same ones the court said should govern instead, still mean a consent means what it says it means. If your consent language says “to receive calls and texts from [Agency Name] about health insurance options,” that’s the scope you actually have, vacatur or no vacatur.

What it actually costs to get this wrong

The TCPA gives a called party a private right of action: recover actual monetary loss, or $500 per violation, whichever is greater, and a court may increase that award to as much as three times that amount, up to $1,500 per violation, if the violation was willful or knowing (47 U.S.C. § 227(b)(3)). Those numbers are per call or per text, not per lawsuit. A single automated sequence that sends five out-of-window texts to a hundred people who never gave written consent is, on paper, five hundred separate violations before anyone even gets to whether it was willful.

This isn’t a hypothetical rulebook nobody actually uses. WebRecon, which tracks consumer-litigation filings monthly with a published, consistent methodology, counted 2,810 TCPA lawsuits filed in federal court over the complete 2025 calendar year, up 0.8% from 2024’s total (WebRecon, Dec. 2025 stats & year in review). That figure comes from a single tracker; we found no independent second count of the same period to corroborate it against, so treat it as directionally solid rather than independently confirmed twice. It’s still roughly 234 new TCPA suits filed every month, in a year when one of the FCC’s own restrictions had just been struck down. The plaintiffs’ bar didn’t go quiet because one rule got vacated; the base statute and its statutory-damages structure are exactly what keeps this area litigated regardless of which regulatory layer is currently in force.

There’s a second cost that’s harder to put a number on but just as real: overcorrecting. An agent who read one alarming article about revoke-all in early 2025 and quietly stopped texting leads altogether, or cut a working five-touch sequence down to one message out of caution, gave up real production against a rule that still isn’t even in effect. Reading the primary source instead of the panic costs you twenty minutes. Overcorrecting against a rule two years before it applies costs you every lead who would have converted on touch three.

State law can go further than the TCPA does

Everything above is federal law, and federal law is a floor, not a ceiling. Several states run their own telemarketing statutes on top of the TCPA, and at least one of them is stricter and more heavily litigated than the federal version. Florida’s Telephone Solicitation Act, codified at Fla. Stat. § 501.059 and commonly called Florida’s “mini-TCPA,” requires prior express written consent for an automated telephonic sales call, text message, or voicemail, defined the same way the TCPA does: a signed authorization, which can be an affirmative act like checking a box, that names the specific phone number and discloses that consent isn’t a condition of purchase (Fla. Stat. § 501.059). Damages run the same way as the federal statute: actual damages or $500 per violation, whichever is greater, with courts able to treble that to $1,500 for a willful or knowing violation.

The reason this matters beyond Florida specifically is the pattern, not just the one state. A rule change at the federal level, like the one-to-one consent vacatur this article opens with, doesn’t touch a state’s own statute at all. If your lead list includes Florida residents, or residents of any other state running a comparable law, you have two separate compliance obligations to satisfy, and being clean under the federal TCPA doesn’t automatically clear you under a state’s own version. This article isn’t a 50-state survey, and it would be dishonest to pretend otherwise: check whether your own state runs a telemarketing statute with a private right of action before assuming federal compliance is the whole picture, the same way a Texas or California agent has to check their own state insurance regulator’s rules on top of federal Medicare marketing law.

The manual method: build a TCPA-safe follow-up sequence by hand

None of what follows requires any software beyond whatever CRM or spreadsheet you already have. Here’s how to build a defensible, compliant text and call follow-up process this week.

A worked example: one lead, one week

Say a lead fills out a quote form for Medicare Advantage plans on a Tuesday and checks a box consenting to be texted “about Medicare plan options in my area.” Here’s what a TCPA-defensible sequence looks like against everything above.

You log the exact consent text, the timestamp, and the source URL of the form in the lead’s CRM record. Your first text goes out that same day, scoped to Medicare, nothing else. Before it sends, your workflow checks the lead’s area code against a time zone table, confirming the send falls inside 8 a.m. to 9 p.m. in that zone rather than yours. Over the next week you run three more touches, an SMS, a call attempt, another SMS, each still scoped to the Medicare quote, each still checked against the recipient’s local window.

On Thursday, the lead replies “stop texting me.” Your workflow suppresses that number immediately, same day, well inside the ten-business-day ceiling the rule allows, and logs the date and the exact reply. Three weeks later, someone on your team imports a fresh list for an ACA open-enrollment push. Before it goes out, that list runs against your suppression file, and the Tuesday lead’s number gets excluded automatically, because the ACA campaign was never inside the scope of a consent that was specific to Medicare in the first place, and the person also separately opted out.

That’s the entire mechanism this article describes, applied to one real lead. Nothing in it requires the revoke-all rule to be in effect, and nothing in it depends on whether one-to-one consent ever existed. It’s just consent, scope, timing, and a suppression list that actually gets checked.

Where Ambrose fits, and where it honestly doesn’t

Everything above works with a spreadsheet and a CRM you already have. Where a platform actually helps is once your sequence gets shorter and more deliberate, because a scoped, opt-out-respecting sequence sends fewer messages than “blast every channel at everyone,” which means you need to know which of the touches you kept are actually the ones producing a booked call.

That’s what Ambrose’s campaign-metrics spoke is built for. Per its own documentation, it tracks funnel performance across email, SMS, and social, “opens, clicks, replies, booked-call rates,” with three tools: metrics_campaign_summary for a single campaign’s topline numbers, metrics_recipient_engagement for engagement at the individual-recipient level, and metrics_funnel_breakdown for a stage-by-stage view of where a sequence gains or loses people (Ambrose docs, spoke-campaign-metrics). Per-recipient identifiers are stripped before any model sees them; the model works from aggregates, and identifiers only re-enter for an action list you specifically approve. Ask it, in plain English, which touch in your four-message Medicare sequence is producing the booked calls, and which one is dead weight you’re sending out of habit, and you get a stage-by-stage answer instead of a guess.

Ambrose’s channel-bridge spoke is what actually sends the message, dispatching email through Gmail, a GHL conversation, or direct SMTP, and SMS through Twilio or a GHL conversation (Ambrose docs, spoke-channel-bridge). Its reply-bot spoke can draft a reply or an appointment-booking response, with a confidence score and a reasoning trace, by default requiring your review before anything sends (Ambrose docs, spoke-reply-bot).

Here’s the part worth being straight about: neither spoke’s documentation describes built-in TCPA consent tracking, time-zone-aware send windows, or STOP-keyword suppression logic. That layer, the actual compliance mechanism this article walks through, still lives in your CRM workflow rules or dialer settings, and it’s still your job to build and maintain it, Ambrose seat or not. What Ambrose adds isn’t a compliance shortcut. It’s visibility into which of the fewer, better-scoped messages you’re now sending is actually working, and a drafting and dispatch layer you still review before it goes out.

What you get by joining

One Ambrose seat, including the campaign-metrics, channel-bridge, and reply-bot spokes referenced above, comes included with a Tech Savvy Insurance membership: $97 a month, billed monthly, cancel anytime, with the founding rate locked in while the membership stays active. Ambrose usage runs through its own credit ledger with spend caps, so cost stays visible instead of showing up as a surprise later. Alongside the seat: weekly Zoom calls with open Q&A and build-with-you sessions, more than 30 hours of recorded training, Meta Ads and marketing training built for this industry, pre-built AI templates and bot deployments, and a free annual in-person member workshop. It’s also an explicit no-recruiting zone, you can ask a real compliance question without ending up on someone’s downline pitch an hour later, which isn’t true of most agent Facebook groups.

Close

The rule everyone’s been arguing about, one consent per seller, is dead, vacated by a federal court in a case an insurance industry group actually won. The rule some agents were bracing for, a flat revoke-all, isn’t coming either, not in the form it was announced: the FCC’s own September 30, 2026 order, FCC 26-67, replaces it with a two-track rule, and that rule now has a confirmed start date. Published in the Federal Register October 26, 2026 (91 FR 67214), it takes effect November 25, 2026, officially superseding its last delayed date of January 31, 2027. What’s actually governing your texts today, and what keeps governing them after November 25, is the same base framework that’s governed them for years: written consent scoped to what it says, an 8 a.m.–9 p.m. window measured on the recipient’s clock, and an immediate stop the moment someone opts out, now with the option to designate one exclusive revocation channel if you disclose it clearly. Build that by hand this week using the method above, whether or not you ever join anything. If you’d rather see how campaign-metrics shows you which touch in a shorter sequence is actually working, with people building the same suppression list alongside you on a Tuesday call, one Ambrose seat comes with a Tech Savvy membership: https://techsavvyinsurance.com/. See also our guide on the AI follow-up system that replaces your lead chase and our broader look at AI compliance for insurance agents in 2026.