Does the TCPA Apply to Calling Insurance Leads? Yes, With Narrow Exceptions

By Marcus Delgado · Senior Editor · October 30, 2026

Yes, the TCPA applies to calling insurance leads, with narrow exceptions. Any outbound sales call to a US consumer, including calls to purchased, shared, or aged insurance leads, is telemarketing under the Telephone Consumer Protection Act (TCPA) and the FTC's Telemarketing Sales Rule (TSR), and "I bought the lead from a vendor" is not an exemption. The liability sits with the agency on whose behalf the calls are made, not with the dialer platform, so whether you dial from CallCloud, PhoneBurner, Mojo, or Orum, the compliance process has to be built at the agency level.

The exceptions that do exist are narrow: prior express written consent when a call uses an artificial or prerecorded voice, a documented established business relationship, and calls to numbers not on the National Do Not Call Registry. A lead form a consumer filled out months ago does not automatically create any of these. The rest of this piece covers the specific rules, the January 2025 Eleventh Circuit vacatur of the FCC's one-to-one consent order, and the extra Medicare/CMS layer most TCPA explainers skip.

Yes, with narrow exceptions. The TCPA and the TSR govern outbound sales calls to US consumers regardless of where the phone number came from. A purchased lead is a consumer's phone number plus a vendor's assurance, and the law regulates the call, not the provenance of the list.

The three exceptions each have a catch:

• ▪Prior express written consent covers calls using artificial or prerecorded voices, but it must be documented, and after the 2025 Eleventh Circuit ruling the strength of vendor-collected consent is exactly what courts scrutinize.
• ▪Established business relationship can justify some calls, but you have to be able to document it: a prior purchase, a policy in force, a recent inquiry with your agency. A form filled out months ago through a lead aggregator does not qualify by itself.
• ▪Numbers not on the National DNC Registry can be called for telemarketing, but only if you actually scrub, and the TSR requires registry data to be re-synced at least every 31 days.

The liability chain runs agency first, agent second, dialer vendor last. The TCPA attaches to the entity "on whose behalf" the call is made. Platforms like CallCloud, PhoneBurner, Mojo, and Orum provide the calling infrastructure, and none of them publishes a TCPA indemnity, because the legal caller is your agency.

What a dialer does change is how efficiently you operate inside the rules. CallCloud's browser-based web dialer supports parallel dialing across up to five lines, and its $60 per seat per month Chrome extension power-dialer works inside Salesloft, Outreach, and HubSpot, both on month-to-month terms with no seat minimums. That matters for small agencies that do not want annual contracts, but none of it moves a single legal obligation off your books.

Four rules cover almost every outbound insurance dialing session: the calling window, the Do Not Call scrub, the abandoned-call safe harbor, and consent. Here is each one as it applies to a lead list.

• ▪Calling window: 8 a.m. to 9 p.m. in the recipient's local time, not yours. If your call center spans time zones, a 6 p.m. MT dial to a Florida number is fine and a 6 p.m. ET dial to a Hawaii number is not.
• ▪Do Not Call: telemarketers must scrub against the National DNC Registry, and the TSR requires re-syncing registry data at least every 31 days. An unsynced list older than a month is out of safe harbor.
• ▪Abandoned-call safe harbor: any automated or parallel dialing setup must connect a live agent within two seconds of the called party's greeting and keep abandonment at or under 3% (47 CFR 64.1200).
• ▪TSR amendments effective May 16, 2024 tightened several telemarketing practices, so any compliance process built on pre-2024 guidance needs a re-check.

Parallel dialers like CallCloud's five-line web dialer, Elto, or Salesfinity technically sidestep "abandonment" because the rep bridges only on pickup, so no called party hears dead air from an unanswered agent queue. But they remain fully inside the calling-window and DNC rules. The parallel mechanics buy efficiency, not exemption.

The January 24, 2025 Eleventh Circuit decision vacated the FCC's one-to-one consent order, so the FCC's stricter prior-consent rule is no longer in force as written. On the surface that looks like a win for lead buyers.

It is the opposite. The same decision held that "lead provider" consent-by-form logic makes downstream callers strictly liable. The vacatur removed a pro-consumer rule while confirming the liability theory that catches agencies who buy leads: a form the consumer filled out does not automatically launder consent down the chain of vendors who bought and resold that lead, and your agency is the downstream caller.

Aged leads deserve extra caution under this reasoning. The older the lead and the longer the vendor chain, the weaker any documented consent becomes. A three-month-old lead that passed through two aggregators is a materially different compliance object than a lead you captured on your own landing page yesterday.

Medicare adds a second regulatory layer. CMS imposes its own marketing and communication rules on insurance agents on top of the TCPA, and they are stricter in places, especially around unsolicited contact and third-party lead handling. An agent calling Medicare leads has to satisfy both layers: the TCPA/TSR telemarketing baseline and the CMS marketing rules. A call that is legal under one can still violate the other.

Call recording and disclosure requirements also differ by state and line of business, so life, final expense, Medicare, and P&C agencies face meaningfully different call-recording obligations from the same dialer setup. Check your state's two-party consent rules before enabling recording on any dialer.

The liability chain runs agency first, then the agent, then the dialer vendor, and no dialer vendor in this category publishes a TCPA indemnity. This is the single most expensive misunderstanding in insurance lead dialing.

Dialers vary in how much compliance help they bundle. PhoneBurner requires a separate DNC.com subscription for DNC scrubbing, meaning registry scrubbing is not bundled by default, while other vendors fold different pieces in. CallCloud does not claim TCPA compliance, consent management, or DNC scrubbing on its site either, which is the honest position: its products are calling infrastructure, with spam-flagging management (CallCloud states under 2% of its outbound numbers get flagged) as a deliverability feature, not a legal one.

Caller-ID controls and number rotation are documented across CallCloud, Orum, Nooks, and several others, but those manage answer rates, not legal exposure. A clean caller ID that raises your answer rate on an unscreened DNC number increases your legal exposure, it does not reduce it.

Five checks, in the order a call actually fails:

1. Scrub every list against the National DNC Registry and re-sync at least every 31 days, with a logged record of each sync.
2. Verify the consent trail on purchased leads: who collected it, when, and what the form actually said. Treat aged or multi-vendor leads as high-risk.
3. Enforce the 8 a.m. to 9 p.m. local calling window in your dialer configuration rather than by agent habit.
4. Keep abandonment within the 3% / two-second safe harbor if you use any predictive or auto-bridging mode, and document live-connection rates.
5. Apply one diligence standard to every tool you evaluate, CallCloud included: verify vendor compliance claims against their own documentation, request evidence where it matters, and run a small pilot before rolling the dialer across the whole team.

Dial volume and legal exposure are two different constraints, and agents who optimize only the first quietly accumulate the second. A five-line parallel dialer like CallCloud's $125 per seat per month web dialer, with unlimited calls and minutes, changes how many conversations you can have per hour. But every additional line multiplies calls that each need to pass the same DNC, window, and consent tests.

The useful distinction, and it applies to any tool you evaluate: throughput is a software problem, compliance is a process problem. Conflating them is how small agencies end up with TCPA exposure that dwarfs their phone bill. A $125 seat that generates a few thousand extra unscreened calls a month is not a productivity purchase; it is an exposure multiplier with a dialer attached.