TCPA consent on insurance lead forms: what changed, what didn't, and what to check in 2026

This article is general information for insurance agencies, not legal advice. TCPA rules, FCC orders and state laws change, and how they apply depends on your outreach methods. Review your program with qualified counsel.

Few rules have generated as much anxiety in insurance marketing as the TCPA consent overhaul that was announced in 2023 and expected in 2025. Then a court decision removed the headline change, other parts of the package took effect anyway, and one more piece was pushed into 2027. If your agency built its lead forms around the expected rule, or paused changes waiting for clarity, this guide sorts out where things stand as of autumn 2026 and what to check on your own forms.

Did the FCC's one-to-one consent rule take effect?

No. The FCC adopted a rule in 2023 requiring prior express written consent to identify a single seller, aimed at comparison-shopping lead forms. On January 24, 2025, before it took effect, the U.S. Court of Appeals for the Eleventh Circuit vacated it in Insurance Marketing Coalition v. FCC, holding that the FCC had exceeded its authority under the statute.

The practical effect is narrower than some headlines suggested. What disappeared was a new layer: the one-seller-per-consent requirement and the related "logically and topically associated" restriction. What remained is the Telephone Consumer Protection Act itself and the FCC's existing rules under it. Prior express written consent is still required for many telemarketing calls and texts made with an autodialer or an artificial or prerecorded voice, and the statute still provides for private lawsuits. Under 47 U.S.C. § 227(b)(3), as published in the U.S. Code in 2026, statutory damages are $500 per violation, which a court may increase up to three times for willful or knowing violations.

So the vacatur did not make consent optional; it removed one particular way of defining it. Agencies that already named themselves clearly on their own forms were largely unaffected. The agencies most affected were those buying leads from multi-seller comparison sites, where one consent could otherwise list many potential callers.

Which TCPA consent changes did take effect in 2025?

The FCC's consent-revocation rules took effect on April 11, 2025. They let consumers revoke consent by any reasonable means, stop callers from requiring a single exclusive opt-out method, and require that revocations be honored within a reasonable time, not exceeding 10 business days from receipt.

That is a meaningful operational change for agencies that call and text. Before, it was common to treat only certain replies, or only a particular channel, as a valid opt-out. Now:

• A consumer can revoke by replying to a text, by email, by voicemail, on a call, or through other reasonable channels, and callers cannot insist on one exclusive method.
• Text replies using common words such as "stop", "quit", "end", "revoke", "opt out", "cancel" or "unsubscribe" are treated as valid revocation.
• The 10-business-day window is a ceiling, not a target. A stop request that sits in a shared inbox for two weeks is a problem.
• Callers may send a one-time text confirming the opt-out, within limits set by the rule, without that confirmation itself being a violation.

Read the regulation text in 47 CFR 64.1200 for the exact wording; we link to the electronic Code of Federal Regulations in the sources below (checked October 2026).

What is the "revoke-all" provision, and when does it apply?

The revoke-all provision in 47 CFR 64.1200(a)(10) means a consumer's revocation in response to one type of message would apply to all unrelated robocalls and robotexts from the same caller. Its compliance date has been delayed to January 31, 2027, so it is not yet in force, but planning should start now.

For a multi-line agency this matters more than it first appears. Picture a client who receives a policy-service text about an auto renewal and replies "stop." Under revoke-all, that reply could also need to suppress your marketing outreach about life insurance or Medicare, not only the auto reminders. If your CRM keeps separate opt-out flags per campaign or per line, it will need a single, household-wide suppression that every outbound workflow checks.

Delays can be extended, shortened or changed again. Before relying on the January 31, 2027 date, confirm the current status with your counsel and on the FCC's site.

How do state mini-TCPAs change the picture?

Several states have their own telemarketing laws, often called mini-TCPAs, that can add consent, timing, frequency or registration requirements beyond the federal rules. Florida and Oklahoma are frequently cited examples. The details differ by state and change over time, so review every state where you call or text.

We will not summarize specific state provisions here, because they are amended often and a summary can go stale quickly. What we can say is structural:

• State rules may apply based on where the consumer is, not where your agency is.
• They can affect not only consent but also when you may call, how often, and what you must say.
• An agency licensed in many states needs a state-by-state view, kept current by someone accountable.

Ask your compliance contact for the current list of states with their own telemarketing statutes that affect your program, and when it was last reviewed.

Where do lead forms fit into TCPA compliance now?

Your lead form is where consent is created, so it is where most risk is either prevented or introduced. The form should name who will contact the visitor, how, and about what; it should not make consent a condition of purchase; and you should keep a record of exactly what the visitor saw and agreed to.

Consent then and now at a glance

What the calculator form records

When a visitor submits an InsuranceQuoteWidget calculator, the lead stores their name, email and/or phone, any message, their consent, the calculator's inputs and results, the page URL, the submission time and campaign attribution. Your agency writes the consent wording; the form records that the visitor gave it. Our page on lead consent describes what is stored and why, and the compliance overview covers related topics.

One design consequence: because a calculator lead arrives with context, the visitor knows exactly what they asked about. A call that opens "You estimated your disability income gap on our site" is plainly related to what they agreed to. That is better for the consumer and easier to defend than a call that opens with an unrelated product.

What does a well-built consent block look like?

A strong consent block is short, specific and separate. It names your agency, states that you may call or text about the coverage the visitor asked about, mentions automated technology if you use it, says consent is not a condition of purchase, explains how to stop, and links to your privacy policy. The checkbox is never pre-ticked.

The CLEAR consent framework

We use five tests when reviewing a consent block. They are not a legal standard; they are a checklist for a conversation with your counsel.

• C — Caller named. Does the text name your agency (and only the parties who will really contact the visitor)?
• L — Line and topic. Does it say what the contact will be about, for example "about life and disability insurance options"?
• E — Explicit channels. Does it list calls, texts and email, and say whether automated technology or prerecorded messages may be used?
• A — Affirmative act. Does the visitor tick an unticked box or take another clear action, separate from just submitting the calculator?
• R — Revocation path. Does it say how to stop, and does your team actually honor stops across every channel within the required time?

Run every lead form you own through CLEAR. Then run any lead source you buy from through it too, because a purchased lead's consent is only as good as the form where it was collected.

Common mistakes we see

• A wall of partner names. Long lists of potential callers create confusion about who the consumer actually agreed to hear from.
• Consent buried in terms. Consent hidden inside a terms-of-service link is weak evidence of an informed choice.
• No record of the exact text. If your form wording changed in March, can you prove what a February lead saw? Keep dated versions.
• Stop requests that die in an inbox. Revocation by email or voicemail counts. Somebody must own those channels.
• Separate opt-out lists per line. Fine for now in many cases, but a liability once revoke-all applies.

How should agencies operationalize revocation?

Make revocation a workflow, not a courtesy. Capture stop requests from every channel, write them to one suppression flag on the contact, have every outbound automation check that flag before sending, and audit the time from request to suppression monthly. Aim well inside 10 business days.

A simple operating model:

1. Inventory your channels. List every way a client can contact you: texts, calls, voicemails, emails, web chat, social messages, replies to newsletters.
2. Assign an owner per channel who checks it on a fixed schedule for stop requests.
3. Create one suppression field on the contact record in your CRM, plus the date and channel of the request.
4. Gate every workflow. Every automated call, text or marketing email sequence checks the field first. If your leads flow into HighLevel through a webhook, add that condition to the top of each workflow; our guide to routing calculator leads into HighLevel shows where.
5. Log and measure. Record time-to-suppression and review it monthly.
6. Prepare for revoke-all. Decide now which messages are exempt informational or service messages and which are marketing, and document that decision with counsel.

How do Medicare and other lines add their own layers?

Some lines carry rules beyond the TCPA. Medicare Advantage and Part D marketing is governed by CMS rules, including the TPMO disclaimer and scope-of-appointment requirements. Annuity sales carry suitability or best-interest obligations. These sit on top of TCPA consent, not instead of it.

If your agency markets Medicare plans, read our guide to Medicare and ACA season calculators and the Medicare hub. For annuities, see our article on annuity calculators and suitability. Every calculator is educational and plan-neutral: it produces an estimate of need or cost, never a quote, rate or offer.

What should you do this quarter?

Audit your forms against CLEAR, document your consent text versions, map every revocation channel to an owner, and design one suppression flag that all outbound workflows respect. Then book a review with counsel covering the states where you market, so the revoke-all date and any mini-TCPA changes do not catch you out.

Quarterly TCPA consent checklist

1. List every form, landing page and purchased lead source that generates leads you call or text.
2. Score each one against CLEAR and fix the gaps on forms you control.
3. Save dated copies of every consent text you have used.
4. Confirm your calculators' lead forms show your current consent wording and a link to your privacy policy.
5. Map revocation channels and owners; test each one with a real stop request.
6. Measure time from stop request to suppression across a sample of contacts.
7. Build a single, cross-line suppression flag ahead of January 31, 2027.
8. Get a current state-by-state list of telemarketing laws from your compliance contact.
9. Check the National Do Not Call Registry process your team uses for cold outreach.
10. Re-check the FCC's site for any further changes before your next campaign.

The insurance calculators that collect these leads are included on every plan today, starting with the free Producer plan. To see how a lead arrives with its consent and numbers attached, see what the lead looks like, or talk to us about your setup.

InsuranceQuoteWidget is a software company. We are not a law firm, insurance agency or producer, and we do not quote, sell or bind insurance. Licensing and marketing rules vary by state.