TCPA rules for aged insurance leads (2026)

By Joseph Citrola, licensed insurance agent · Updated October 14, 2026 · 10 min read

You can text and call aged insurance leads, as long as the person gave consent that covers you, you contact them at the right hours, and you stop the moment they ask. Most TCPA trouble with aged leads comes from three places: consent that never named the agent, numbers on the Do Not Call list without that consent, and opt-outs that weren’t honored.

The short version

• Marketing texts and calls made with automated technology need the person’s prior express written consent.
• That consent has to clearly cover you, the agent or agency doing the contacting.
• Keep the consent record: date, source, the exact consent language, and a certificate if one exists.
• Scrub against the National Do Not Call Registry, state lists, and your internal list.
• Contact people only between 8 am and 9 pm their time, or a narrower state window.
• Honor every opt-out, by any reasonable means, right away. The legal maximum is 10 business days.
• AI-voice calls count as artificial-voice calls and need the same consent.

What the TCPA actually covers

The Telephone Consumer Protection Act restricts calls to cell phones made with an autodialer or with an artificial or prerecorded voice. The FCC treats text messages as calls. For telemarketing, which includes a text or call offering an insurance quote, the standard is prior express written consent: a signed agreement, electronic signatures included, that authorizes the specific seller to contact that number with automated technology, and that makes clear consent isn’t required to buy anything.

Penalties are $500 per call or text, and up to $1,500 if the violation was willful or knowing. Most suits are class actions, so a single bad campaign can mean thousands of violations at once.

Consent on aged leads: the part that matters most

An aged lead’s consent was given on a web form, often to a lead generator, sometimes months ago. Before you text it, check three things:

1. Does the consent language cover you? It should name you, your agency, or the marketing partners the lead was sold to in a way that clearly includes you. A vague “and our partners” with no list is weak protection.
2. Is there proof? A TrustedForm or Jornaya certificate, or the form submission with a timestamp, IP address, and the consent text shown at the time. If a vendor can’t produce it, don’t text the lead.
3. Was the lead resold past what the consent covers? Consent given to one company doesn’t follow the lead through every resale.

You may have heard about the FCC’s “one-to-one consent” rule, which would have required a separate consent for each seller. The Eleventh Circuit struck it down in January 2025 in Insurance Marketing Coalition v. FCC, so it never took effect. A single form can still cover more than one seller. It just has to clearly cover each of them.

Does consent expire?

The TCPA doesn’t put an expiration date on written consent. Two things do wear off, though:

• The inquiry exemption for Do Not Call. Under the FTC’s Telemarketing Sales Rule and the FCC’s rules, a consumer’s inquiry creates an established business relationship for only three months. After that, if the number is on the National Do Not Call Registry, you need written consent to call it. Purchased leads usually don’t qualify for the exemption at all, because the inquiry wasn’t made to you.
• Memory and goodwill. A person who filled out a form two years ago may not remember doing it. Old consent is legally valid but more likely to produce complaints. Identify yourself and the original request in every first message.

Do Not Call scrubbing

• Scrub against the National Do Not Call Registry. The Telemarketing Sales Rule requires using a version of the registry no more than 31 days old.
• Scrub against the state lists in states that keep their own.
• Keep an internal do-not-contact list, and add every opt-out to it across every channel.

Link Leads explains how to scrub an aged lead list and how to check for reassigned numbers, which matters more the older the file is.

Calling hours and frequency

• Federal: 8 am to 9 pm in the recipient’s local time.
• Florida: 8 am to 8 pm, and no more than three telephone solicitations in 24 hours on the same subject, under the Florida Telephone Solicitation Act. Link Leads covers the Florida act for insurance leads.
• Other states set their own windows and limits, including Oklahoma and Maryland. Here’s a state-by-state list of calling hours.

A safe default is to contact people only between 9 am and 8 pm in their own time zone, which fits inside most state windows. That’s the window Resurge uses unless you change it. A few states also restrict or ban solicitation calls on Sundays and certain holidays, so check the state list before you run a weekend campaign.

Opt-outs

• People can revoke consent by any reasonable means: replying STOP, “don’t text me,” “remove me,” or telling you on a call. Since April 2025, FCC rules require honoring the request within 10 business days. Do it immediately.
• You may send one confirmation text saying they’re unsubscribed. It can’t include any marketing.
• A related FCC rule that would make one opt-out cover every type of message from you has been delayed to January 31, 2027. Treat an opt-out as covering everything anyway. It’s simpler and it’s what people mean.
• In Florida, a consumer has to reply STOP and then give you 15 days before suing over texts, but don’t lean on that. Stop right away.

AI voice calls

In February 2024 the FCC ruled that AI-generated voices are “artificial” voices under the TCPA. An AI call to a cell phone needs the same consent as a prerecorded call, which for marketing means prior express written consent. Good practice on top of the law:

• Have the AI identify who it’s calling for in its first sentence.
• Have it say plainly that it’s an automated assistant if asked.
• Never let it quote prices or give advice. Hand off to a licensed person.
• If calls are recorded, follow recording-consent law. Florida and several other states require every party’s consent. Recording consent by state.

Calling someone who just replied YES to a text that said “reply YES and I’ll call you” is the cleanest consent you can have for that call: it’s recent, specific, and in writing.

Carrier rules aren’t law, but they’ll stop you first

Mobile carriers require business texting to run on registered 10DLC numbers with an approved campaign. They filter messages that look like spam, including links, prices, “free” offers, and texts with no opt-out language. Read Link Leads on 10DLC registration for insurance agents.

A checklist before you text an aged file

1. Consent language covers you, and the vendor gave you proof for every lead.
2. File scrubbed for National DNC, state DNC, your internal list, and reassigned numbers.
3. Landlines removed from the texting list.
4. Texts sent only 9 am to 8 pm in each lead’s time zone.
5. First text names you and the original request, and includes STOP language.
6. Opt-outs honored instantly and suppressed across every channel.
7. Texting from a registered 10DLC campaign.
8. AI calls only to people who asked to be called, with the AI identifying itself.

Resurge handles much of this list for you: the consent date on every lead, quiet hours in each lead’s time zone, instant STOP handling across text and email, and an AI caller that says what it is. Having the consent is still on you, the same as with any dialer. For the day-to-day side, see how to work aged insurance leads.