Insurance lead generation compliance rests on a stack of federal rules (telemarketing, email, privacy, and credit-data laws) with state licensing, anti-rebating, and disclosure requirements layered on top. The exposure is not theoretical. A single unwanted robocall can trigger $500 in statutory damages under the TCPA, tripled to $1,500 if a court finds the violation willful,1Office of the Law Revision Counsel. 47 US Code 227 – Restrictions on Use of Telephone Equipment and the FTC’s Telemarketing Sales Rule carries civil penalties of up to $53,088 per violation.2Federal Trade Commission. Complying with the Telemarketing Sales Rule Multiply either number by a campaign list and the math gets ugly fast.
The rules below cover the frameworks that apply to most agents and brokers. Your state adds its own requirements on top of every one of them.
Calls, Texts, and the Do Not Call Registry
The Telephone Consumer Protection Act is the biggest source of financial risk in lead generation. Before using an autodialer or sending a prerecorded voice message, you need prior express written consent from the person you’re contacting.3Federal Communications Commission. One-to-One Consent Rule for TCPA Prior Express Written Consent Frequently Asked Questions A verbal “sure, call me” isn’t enough for automated calls. Live manual dialing has more flexibility, but the Do Not Call rules still apply.
You cannot call numbers on the National Do Not Call Registry unless the consumer has an existing business relationship with you within 18 months of their last transaction, or has given you written permission.4Federal Trade Commission. Q&A for Telemarketers and Sellers About DNC Provisions in TSR You also have to maintain your own internal do-not-call list. If someone tells you to stop calling, honor it regardless of whether they appear on the national registry.5Federal Trade Commission. National Do Not Call Registry FAQs
TCPA damages have no cap, so a noncompliant campaign hitting thousands of people can produce multimillion-dollar liability. States pile on further: many limit calling hours, require specific opening disclosures, or impose separate telemarketer licensing. Check the rules in every state you’re calling into, not only your home state.
The One-to-One Consent Rule
The FCC adopted a rule that changes how consent works when leads come from comparison-shopping sites and aggregators. Under the one-to-one requirement, written consent to marketing calls or texts must be given to each individual seller separately rather than as a blanket opt-in shared across dozens of companies. In practice, a lead form would need a separate checkbox for each insurer, and each company could only contact the consumer about topics logically related to the site where consent was collected.3Federal Communications Commission. One-to-One Consent Rule for TCPA Prior Express Written Consent Frequently Asked Questions
The rule was set for a January 27, 2025 effective date, then postponed by the FCC pending judicial review.6Federal Communications Commission. FCC Postpones Effective Date of One-to-One Consent Rule It is not currently enforceable, but leads acquired now under a single blanket consent form won’t carry legal protection if the rule takes effect later. Ask any lead vendor you use what their plan is.
Email Marketing Under CAN-SPAM
Every commercial email must include an accurate subject line, your valid physical mailing address, and a clear unsubscribe mechanism. When someone opts out, you have ten business days to stop emailing them, and you can’t charge a fee, require personal information, or make them do more than click a link or send a reply.7Federal Trade Commission. CAN-SPAM Act – A Compliance Guide for Business
Insurance adds layers. Many states require licensing information in emails about insurance products. Any email that quotes rates or compares policies needs clear disclaimers about the conditions behind the numbers. An email advertising “life insurance for $20 a month” without disclosing that the rate applies only to a healthy 25-year-old at a specific coverage amount is the kind of message that draws regulatory attention.
Drip campaigns fed by purchased lists deserve extra scrutiny. If a vendor scraped addresses or collected them without proper consent, “I bought the list” is not a defense. Keep records of how every list was built and review them regularly.
Social Media and Paid Promotion
Social lead generation follows the same advertising rules as any other channel, with a few platform-specific quirks. The FTC’s endorsement guides require anyone with a material connection to an advertiser to disclose that relationship clearly.8eCFR. 16 CFR Part 255 – Guides Concerning Use of Endorsements and Testimonials in Advertising If you pay someone to promote your services, or an influencer receives anything of value in exchange for a post, the ad must say so conspicuously. A hashtag buried at the end of a long caption doesn’t meet the standard.
Testimonials must reflect real experiences from actual clients, and you can’t present an outlier result as typical. State insurance departments often require agents to display their license number in social media bios or ad copy; omitting it is a violation in those states even if nothing else about the post looks problematic.
The line between general information and a regulated solicitation gets blurry in DMs and comment threads. Once you’re discussing specific policy recommendations tailored to someone’s situation, many states treat the conversation as a solicitation, which triggers disclosure and possibly recordkeeping obligations. Have a clear rule about when to move a discussion into a documented channel.
Privacy Rules for Prospect Data
The Gramm-Leach-Bliley Act requires insurance companies and agents to tell consumers how their personal information is collected, shared, and protected. You must send a privacy notice at the start of a customer relationship and update it at least once every twelve months for the life of the relationship.9Federal Trade Commission. How To Comply with the Privacy of Consumer Financial Information Rule Gramm-Leach-Bliley Act The notice must describe what you collect, who you share it with, and how consumers can opt out of sharing with unaffiliated third parties.10Federal Trade Commission. Gramm-Leach-Bliley Act
States enforce these privacy provisions for insurers directly, and many go further. Some require secure disposal of personal information after a set retention period. Most have data breach notification laws requiring alerts to affected consumers when data is compromised, with roughly 20 states setting a hard deadline between 30 and 60 days and the rest using “without unreasonable delay.” Encryption and secure storage are compliance requirements in most jurisdictions, not optional add-ons.
For lead generation, the sensitive point is that prospect data is regulated from the moment you collect it, not only after someone buys a policy. Names, phone numbers, email addresses, and health information gathered through online forms sit under these rules even if the prospect never converts.
Prescreened Offers and the FCRA
If you use consumer credit data to identify prospects, the Fair Credit Reporting Act applies. You can access prescreening data only if the transaction involves a firm offer of insurance, meaning you must actually honor the offer for everyone who meets the criteria you used.11Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports Prescreening cannot be used to pull a list, cherry-pick the most profitable prospects, and ignore the rest.
The data itself is limited. You can receive names, addresses, and non-unique identifiers, but not specific credit history or relationships with other financial institutions. Consumers under 21 cannot be included on prescreening lists without specific consent, and any consumer can opt out of prescreened offers through the credit reporting agencies, with the election taking effect within five business days. If a vendor sells you “pre-qualified” leads based on credit data, verify they followed FCRA rules; noncompliant sourcing exposes you to liability too.
Medicare Marketing Rules
If you sell Medicare Advantage, Part D, or Medigap, the Centers for Medicare and Medicaid Services impose marketing rules that go well beyond general insurance regulation. Before any personal marketing appointment, you need a completed Scope of Appointment form documenting which products the beneficiary agreed to discuss, and that form must be completed at least 48 actual hours before the appointment.12Centers for Medicare and Medicaid Services. 2026 Agent and Broker Training and Testing Guidelines Narrow exceptions apply for inbound calls, walk-ins, and appointments within four days of an enrollment deadline. Returning a voicemail still counts as outbound contact and triggers the waiting period.
CMS also prohibits several common lead-generation tactics in Medicare:
- Unsolicited contact outside of advertised events or requested mailings.
- Cash, gift cards, or monetary rebates offered to secure appointments.
- Health screenings used to draw people into a sales presentation.
- Meals at events where plan-specific benefits are discussed. Light snacks are allowed.
All sales and enrollment calls involving third-party marketing organizations must be recorded in full, including the audio portion of web-based interactions.12Centers for Medicare and Medicaid Services. 2026 Agent and Broker Training and Testing Guidelines Failures can produce sanctions against both the agent and the plan sponsor. If you don’t sell Medicare products, these rules don’t reach you, but they do apply the moment you start.
Anti-Rebating and Inducement Limits
Offering gifts, prizes, or other incentives to generate leads is one of the fastest ways to violate state insurance law. Anti-rebating statutes, adopted in some form by every state, prohibit giving anything of value as an inducement to purchase insurance unless the item is explicitly described in the policy itself.13National Association of Insurance Commissioners. Unfair Trade Practices Act Model Law 880 You also cannot advertise insurance as “free” or “no cost” in connection with another purchase.
About half the states have updated their laws under the 2021 NAIC model revisions, which allow limited non-cash gifts of reasonable value. Under those updated laws, small items like branded merchandise or modest gift cards are allowed if the value stays within the state’s threshold, the gift isn’t conditioned on buying a policy, and it’s offered to everyone equally. Raffle prizes at public events are often permitted when entry is free and doesn’t require a purchase.
Thresholds vary widely. Some states cap gifts at nominal amounts, some allow several hundred dollars in non-cash items, and a few maintain near-total prohibitions. Check your state’s specific statute before running any promotion involving giveaways or drawings.
Buying Leads From Vendors
Purchasing leads doesn’t transfer compliance risk to the vendor. If the leads were obtained through illegal robocalls, misleading ads, or without proper consent, you can face enforcement actions and lawsuits even though you didn’t originate the contact. Regulators look at who benefits from the noncompliant marketing.
Before signing with a lead provider, get contractual commitments on compliance. The agreement should specify that the vendor follows TCPA consent rules, CAN-SPAM requirements, and applicable state regulations, and it should address how consumer information is collected, stored, and transferred to you. Require documentation of consent, including opt-in timestamps, the specific language the consumer saw, and which companies the consumer agreed to hear from.
Audit vendors regularly. A provider that was compliant when you signed may have changed practices since. Request sample consent records periodically, watch for complaint patterns, and treat prospects who don’t remember requesting information as a red flag. Some states require you to keep records of lead acquisition sources for a set period, so build the documentation into your workflow from the beginning.
Disclosure Requirements Across Channels
Across phone, email, social media, and in-person contact, you have to be upfront about who you are and what you’re selling. Most states require you to disclose licensing status early in any interaction, whether through a license number in an email signature, a social bio, or a verbal introduction. Independent brokers representing multiple carriers often need to clarify which insurer underwrites the product being discussed.
Marketing materials must include disclaimers about policy terms, limitations, and eligibility. If you advertise a “low monthly premium,” specify the conditions (age, health, coverage amount) that produce it. Implying guaranteed approval when underwriting criteria actually apply is a common violation. Some states require advertising materials to be submitted for regulatory approval before use, so build lead time into your campaign planning.
These rules apply equally to content produced on your behalf by vendors or agencies. If a lead vendor runs ads that misrepresent your products, you share responsibility. Review any marketing materials a vendor produces before they go live, and reserve the right to approve or reject ad copy in your service agreement.
Matching Your Licensing Footprint to Your Marketing Footprint
If your lead generation attracts prospects in states where you aren’t licensed, you cannot legally sell to them. Every state requires either a resident or nonresident license before soliciting, negotiating, or selling insurance to consumers there. Fees and requirements for nonresident licenses vary, with costs typically running between $50 and $500 depending on the state.
This matters most for agents running online ads or social campaigns with broad geographic reach. A national Facebook ad can generate leads in states where you have no authority to sell. At best those leads are wasted spend. At worst, contacting those prospects about specific policy options may be treated as unlicensed solicitation, which can bring fines and jeopardize your license in your home state. Before launching any campaign with national reach, confirm that your licensing footprint matches where you’re marketing.