If you buy insurance leads and dial them, the Telephone Consumer Protection Act is your problem — not just your vendor's. TCPA statutory damages run $500 per violation, up to $1,500 for willful violations, per call or text. Multiply by a dialer's daily output and it's an existential number. Here's where the law actually stands in 2026 and what to require from any lead vendor.
This article is general information, not legal advice. Talk to a TCPA attorney about your specific operation.
The one-to-one consent rule is dead — here's what happened
In late 2023 the FCC adopted the "one-to-one consent" rule, which would have required a consumer to consent to each specific company that would call them — ending the long lists of "marketing partners" behind comparison-shopping sites. It was scheduled to take effect January 27, 2025.
It never did. On January 24, 2025, the Eleventh Circuit Court of Appeals vacated the rule in *Insurance Marketing Coalition v. FCC*, holding that the FCC had exceeded its authority by redefining "prior express written consent" beyond the statute's ordinary meaning. Later in 2025 the FCC formally deleted the vacated language and reinstated the prior standard.
So in 2026, the governing standard for telemarketing calls using regulated technology is back to prior express written consent as it stood before 2023: a signed, written agreement authorizing telemarketing calls, which can cover multiple partners if the disclosure supports it.
Why "the rule died" doesn't mean "relax"
Three reasons the compliance bar hasn't actually dropped:
- Litigation never depended on the 1:1 rule. The plaintiffs' bar files TCPA suits under the rules that exist, and lead-generated calls remain a favorite target. Weak consent chains, expired consent, and mismatched entities still lose cases in 2026.
- Consent quality is still the whole defense. When you're sued, the question is: can you produce a valid consent record for this specific person, covering the entity that called, captured before the call? If your vendor can't hand you that, you don't have a defense — you have an invoice.
- The bar can rise again. The FCC's rulemaking interest in lead generation didn't vanish with the vacatur, and several states have TCPA-style statutes ("mini-TCPAs") with their own consent standards. Buying leads whose consent would satisfy the *stricter* standard is cheap insurance against the next rule change.
The practical takeaway: the one-to-one model — one consumer consenting to one identified buyer — went from "about to be mandatory" to "voluntary best practice." Leads generated that way were unaffected by the whole fight, because a lead that's exclusive to a single buyer with named-entity consent satisfies both the old standard and any future tightening.
What to require from a lead vendor in 2026
- A TrustedForm certificate (or equivalent) on every lead — an independent, third-party recording of the consent event: the page, the language, the timestamp, the device.
- The actual consent language, not a summary. Read it. Does it name or reasonably cover your entity? Does it authorize the call technology you use?
- Retention. Consent records need to exist when the lawsuit arrives, which can be years after the call. Ask how long records are retained and how you retrieve one.
- Verified phone numbers. One-time-passcode (OTP) verification proves the consenting person controls the number being dialed — which kills the "I never filled out any form" fact pattern that drives many TCPA claims.
- A clean chain of custody. Every reseller between the consent event and your dialer is a place documentation dies. The shorter the chain, the safer you are; a vendor who owns the funnel end to end *is* the chain.
How Slate handles this
Slate was built with compliance as the system of record, not a checkbox: every lead is generated on funnels we own, OTP-verified, captured with TrustedForm, delivered to exactly one buyer, and retained with its full consent trail — across life, final expense, health, home, and auto lines. When a carrier or regulator asks where a lead came from, the answer is one click.