The Telephone Consumer Protection Act (TCPA) is the single biggest legal risk facing insurance agents who buy leads. One violation can cost $500-$1,500 per call or text. Class action lawsuits have bankrupted agencies. And the rules got significantly stricter in January 2025.

This guide explains exactly what changed, what you need to do to stay compliant, and how to verify that your lead vendors are protecting you.

What Is the TCPA?

The TCPA is a federal law (passed in 1991, updated regularly) that regulates telemarketing calls, auto-dialed calls, pre-recorded messages, and text messages. It's enforced by the FCC and through private lawsuits.

Key provisions agents must know:

• Prior Express Written Consent (PEWC) — required before making marketing calls/texts using an autodialer or prerecorded voice
• Do Not Call (DNC) compliance — must scrub against the National DNC Registry
• Time restrictions — no calls before 8 AM or after 9 PM in the consumer's time zone
• Caller ID — must transmit accurate caller ID information
• Opt-out — must honor opt-out requests immediately

The 2025 One-to-One Consent Rule (Game Changer)

Effective January 2025, the FCC's new rule requires one-to-one consent. This is the biggest change in TCPA history and directly affects how you buy and work leads.

What Changed

What This Means for You

If you're buying shared leads from a vendor that uses a single consent form for multiple buyers, you may not have valid consent. This exposes you to TCPA liability even if the lead vendor told you the leads are "compliant."

How to Verify Your Leads Are Compliant

1. Check the Consent Language

Ask your lead vendor to show you the exact form the consumer fills out. The consent language must:

• Name your company (or your agency) specifically
• Clearly state the consumer agrees to receive calls/texts
• Not be buried in fine print or hidden behind links
• Be a separate, clear disclosure — not part of a Terms of Service

2. Require TrustedForm Certificates

TrustedForm (by ActiveProspect) is the gold standard for TCPA documentation. Each lead comes with a certificate that includes:

• Session replay — video recording of exactly what the consumer saw and clicked
• Consent language capture — screenshot of the consent text at time of submission
• Timestamp — exact date and time of consent
• IP and browser data — verifies the consumer's identity and location

If your lead vendor can't provide TrustedForm (or equivalent) certificates, that's a red flag.

3. Scrub Against the DNC Registry

Before calling any lead, verify the number isn't on the National Do Not Call Registry. You can access it at telemarketing.donotcall.gov. Key rules:

• Download the registry monthly (costs $75/area code, first 5 free)
• You have 31 days to scrub new numbers
• Maintain your own internal DNC list for anyone who asks to stop receiving calls
• Exception: Established business relationship (EBR) — if they're your existing client, you can call for up to 18 months after the last transaction

4. Maintain Your Own Records

Keep records of every lead you buy, including:

• Source (which vendor, which campaign)
• Date and time of consumer consent
• TrustedForm certificate URL
• Your call/text log with timestamps
• Any opt-out requests and when you honored them

Keep these records for at least 5 years (statute of limitations for TCPA claims is 4 years).

Text Message (SMS) Compliance

Texting leads is even more strictly regulated than calling. Every text you send must comply with:

• TCPA — need prior express written consent for marketing texts
• CTIA guidelines — carrier-level compliance (affects deliverability)
• 10DLC registration — your business must register its brand and campaigns with carriers

10DLC: What You Need

As of 2024, all business text messaging through standard 10-digit numbers requires 10DLC registration:

1. Register your brand — company name, EIN, address, website
2. Register your campaign — describe what you're texting about (e.g., "insurance lead follow-up")
3. Get approved — carriers assign a trust score that affects your throughput
4. Include opt-out — every text must include "Reply STOP to opt out" or equivalent

Unregistered numbers get throttled or blocked entirely. If your texts aren't delivering, this is likely why.

Compliant Lead Buying Checklist

ClosrLeads provides OTP-verified, one-to-one consent leads with TrustedForm certificates on every lead. Each lead is exclusive to the purchasing agent.

What Happens If You Violate TCPA?

The penalties are severe:

• $500 per violation — each call or text is a separate violation
• $1,500 per willful violation — triple damages if you knew you were non-compliant
• Class action exposure — if you called 1,000 numbers without consent, that's $500K-$1.5M in potential liability
• State AG actions — state attorneys general can bring additional claims
• License risk — repeated violations can trigger insurance license review

TCPA lawsuits have exploded in recent years. In 2024, over 4,000 TCPA cases were filed. Don't become a statistic.

How ClosrLeads Keeps You Compliant

We built our lead generation with TCPA compliance as the foundation:

• One-to-one consent — each lead consents to YOUR company specifically
• OTP verification — confirms the phone number belongs to the person who filled out the form
• TrustedForm certificates — session replay and consent documentation on every lead
• Exclusive delivery — leads are sold to one agent, not shared across a call center
• Real-time delivery — leads are delivered within seconds, so you're calling people who just expressed interest

Read more: How to Work OTP Verified Leads | Best Insurance Lead Companies: 2026 Comparison

Frequently Asked Questions

Do I need consent to call someone who filled out a form?

Yes. Under the 2025 one-to-one consent rule, the consumer must specifically consent to receive calls from YOUR company. A generic "I agree to be contacted by partners" is no longer sufficient. The consent must name your company and be clear and conspicuous.

Can I text insurance leads without their permission?

No. Marketing text messages require prior express written consent under the TCPA. Additionally, your texting number must be registered under the 10DLC system, and every message must include an opt-out mechanism like "Reply STOP to unsubscribe."

What is TrustedForm and do I need it?

TrustedForm is a third-party service that creates an independent certificate documenting consumer consent. It includes a session replay, timestamp, and consent language capture. While not legally required, it's the strongest evidence you can have if challenged. We strongly recommend only buying leads that include TrustedForm or equivalent documentation.