Aged Insurance Leads in 2026: What's Legal to Call

Yes, you can legally call your aged insurance leads again in 2026, under the same prior express written consent standard that applied before 2023. The rule that was supposed to make that harder, the FCC’s one-to-one consent requirement, never actually took effect. It got postponed twice, then a federal appeals court threw out the part of it that mattered, and the FCC has since deleted the rule text from its own books. That does not mean an aged database is a free pass. It means the compliance question that matters now is the same one that always mattered: what consent do you actually have, and does the phone number on file still belong to the person who gave it.

Most agencies never got the news that the rule died. They heard, sometime in 2023 or 2024, that a stricter consent standard was coming for anyone who bought leads through a comparison-shopping site or a shared lead generator, and a lot of agencies quietly stopped touching their older lead lists rather than risk it. That caution turned out to be aimed at a rule that a federal court struck down before it ever applied to a single phone call. Meanwhile, the database of leads sitting untouched in a CRM somewhere, the ones from six months ago, a year ago, longer, kept aging without anyone revisiting whether they were actually still off-limits.

What the FCC’s one-to-one consent rule actually was, and why it’s dead

The rule came out of the FCC’s Second Text Blocking Report and Order, adopted in December 2023, which revised 47 CFR § 64.1200(f)(9), the section of the TCPA rules defining prior express written consent. The revision added two new conditions: consent had to be given to one identified seller at a time, not a group of unnamed marketing partners, and the resulting calls or texts had to be logically and topically associated with whatever interaction prompted the consent in the first place. The target was the comparison-shopping and lead-generator business model, where a single consent checkbox on one website could get resold to dozens of buyers under a broad, vague authorization.

The Insurance Marketing Coalition, an industry group representing insurance lead generators and marketers, petitioned the Eleventh Circuit for review, arguing the FCC had exceeded its authority by redefining what “prior express consent” means under the plain text of the statute. While that case was pending, the FCC itself got cold feet about the compliance timeline. On January 24, 2025, the agency’s Consumer and Governmental Affairs Bureau issued Order DA 25-90, postponing the rule’s effective date by 12 months, to January 26, 2026, citing serious concerns raised by commenters about their ability to comply and the fact that oral argument before the Eleventh Circuit had already happened. The order noted, explicitly, that the previous, pre-2023 prior express written consent requirements would remain in effect in the meantime.

That same day, the Eleventh Circuit ruled. In Insurance Marketing Coalition Limited v. FCC, No. 24-10277, the court granted the petition for review and vacated the one-to-one and logically-and-topically-associated provisions, holding that the FCC’s interpretation went beyond the ordinary meaning of “prior express consent” under the statute, and remanded the matter back to the agency. With the rule vacated, the FCC’s own postponed effective date became moot. The agency later made the removal official: a final order, adopted July 14, 2025 and published in the Federal Register on August 29, 2025, formally deleted the vacated language from the Commission’s rules.

The practical upshot: the stricter standard that made a lot of agencies nervous about their older lead lists was never actually in force for a single day. The consent standard that applies to an aged lead in 2026 is the same one that applied in 2022, before any of this started.

So is it legal to call your old leads again? What “prior express consent” requires now

Prior express written consent, under the surviving version of 47 CFR § 64.1200(f)(9), still requires a clear, written agreement, which can be an electronic signature or an equivalent action like checking a box, authorizing automated or prerecorded calls or texts to a specific number, with a clear disclosure that the agreement is not a condition of any purchase. What went away is the extra layer that would have required that agreement to name one specific seller and restrict the topic of the resulting calls to whatever prompted the consent. A consent record that would have failed the 2023 rule, because it was given to a lead-generation site rather than to your agency by name, is not automatically invalid now. It just has to meet the standard that existed before the 2023 revision, which is a lower bar than agencies spent the last two years bracing for.

That is good news for a database of leads that already has decent consent documentation attached to it. It is not a reason to skip checking. Two things are worth verifying on any batch of aged leads before an automated outreach campaign touches them:

1. Does a real consent record exist, and what does it actually say? A vague note like “opted in” with no timestamp, no disclosure language, and no record of what number was authorized is not the same as a signed or checkbox-confirmed agreement naming a specific number.
2. Is the underlying phone number still assigned to the person who gave that consent? This is the part the one-to-one consent debate mostly distracted from, and it is the part that actually creates risk in an aged database.

The bigger risk in an aged database: the person on the other end may not be who you think

Phone numbers get recycled. A carrier disconnects a number when a subscriber cancels service or stops paying, holds it for a minimum period, and then reissues it to a new customer. That is completely ordinary telecom housekeeping, and it has nothing to do with insurance leads specifically, but it creates a real problem for anyone sitting on a list of numbers that are a year or two old: some meaningful share of those numbers no longer belong to the person who originally gave consent.

The FCC built the Reassigned Numbers Database to solve exactly this. Carriers report permanently disconnected numbers to the database, and a caller can query it to check whether a specific number has been reassigned since a date they specify, typically the date consent was captured. As of this writing, the database’s own published FAQ states it contains more than 361 million geographic and toll-free numbers, a figure that grows every month as carriers file their required reports. The same FAQ confirms that a disconnected number generally has to sit unused for at least 45 days before a carrier can reassign it to a new subscriber, which is the minimum aging window built into the system to reduce accidental collisions.

Here is why that matters legally, not just operationally. Consent under the TCPA attaches to the person who gave it, not to the ten digits they gave it from. If a number has been reassigned since your lead gave consent, the current subscriber never agreed to anything, and a call to that number is a call to someone with zero relationship to your agency. The Reassigned Numbers Database gives you a safe harbor specifically for this: if you had consent, checked the database before calling, and it returned a “no” indicating the number had not been reassigned since the date you specified, you have a documented defense if that determination later turns out to be wrong through no fault of your own. Skip the check, and an aged database with even a modest churn rate on its phone numbers is a database with an unknown number of calls waiting to happen to strangers.

The same logic extends to the National Do Not Call Registry. Under the Telemarketing Sales Rule, telemarketers have to access the registry and purge newly registered numbers from their call lists no more than 31 days before they call, a requirement the FTC put in place effective January 1, 2005 specifically because a number can join the registry at any time, including after your last scrub. A lead who did not mind marketing calls a year ago may have registered their number on the DNC list six months ago. An aged database that has not been re-scrubbed recently is a database that may include numbers you no longer have a clear right to cold-call, separate entirely from whatever original consent you have on file.

What one mistake actually costs

None of the FCC’s rulemaking history changes the penalty structure for getting a call wrong. Under 47 U.S.C. § 227(b)(3), a person who receives a call that violates the TCPA can sue for actual monetary loss or $500 in statutory damages, whichever is greater, and a court has discretion to treble that amount, up to $1,500 per violation, if it finds the violation was willful or knowing. That is per call, not per campaign, and it is not tied to whether the call led to a sale.

Put next to each other, the math is not subtle. A single reactivation call, priced at TheAffordableAI’s published Single Account rate of $0.20 a minute, costs about sixty cents for a typical three-minute conversation. A single call made without valid consent to a reassigned or DNC-registered number carries a statutory floor more than 800 times that cost, before anyone even calculates actual damages or attorney’s fees. The rule change did not touch this number. It never applied to it in the first place.

How to reactivate an aged database correctly, step by step

None of this requires buying anything. You can run this entire process with a spreadsheet, a phone, and staff you already have.

1. Pull the original consent record for every lead, not just the phone number. If your CRM cannot produce a timestamp, a disclosure, and the specific number authorized for each lead, that lead does not have a documented consent record, whatever your intake form says now.
2. Check every number against the Reassigned Numbers Database before an automated call touches it. This is a per-number query, not a one-time database purchase, and it needs to happen close to your calling date, not months in advance.
3. Re-scrub the whole list against the National Do Not Call Registry, no more than 31 days before you call. A lead who was fine with marketing calls a year ago may have registered since then, and the registry does not notify you when that happens.
4. Segment out anything with missing or weak consent documentation, and route it differently. A live agent placing a manual, non-autodialed call to a number without a strong autodialed-consent record carries a different legal posture than an automated campaign does. When in doubt, route the lead to the channel with the lower compliance bar rather than assuming the automated one is fine.
5. Segment Medicare Advantage and Part D leads separately, and layer CMS’s rules on top. These leads need everything above, plus the Medicare-specific requirements covered next.
6. Log every check. The Reassigned Numbers Database safe harbor and the DNC scrub requirement both depend on being able to show you checked, not just that you happened to be right.

You can build all six of these steps yourself with a compliance checklist and a disciplined process, and plenty of agencies do exactly that before every reactivation push.

The Medicare-specific layer: TPMOs, recorded calls, and unsolicited contact

If your aged database includes Medicare Advantage or Part D prospects, CMS layers its own marketing rules on top of everything above, and they apply whether the call is made by an employed agent, an independent broker, or a third-party marketing organization working on a plan’s behalf.

CMS’s 2026 Agent and Broker Training & Testing Guidelines require organizations to ensure that any TPMO operating on their behalf “record all marketing, sales, and enrollment calls, including the audio portion of calls via web-based technology, in their entirety,” under 42 CFR §§ 422.2274(g) and 423.2274(g). Calls that are not related to marketing, sales, or enrollment do not need to be recorded, but a reactivation call to a dormant Medicare lead, if it discusses plan benefits or moves toward enrollment, falls squarely inside that requirement. The same guidelines separately list “unsolicited contact with beneficiaries,” outside of an advertised sales or educational event or mailing, as a prohibited or restricted marketing and communications activity, and they specifically address referrals and lead solicitation as an area with its own requirements and restrictions.

None of this is a reason to avoid Medicare leads in an aged database. It is a reason to route them through their own workflow, with call recording enabled by default and a documented basis for the contact, rather than folding them into a general reactivation campaign built around a lighter compliance bar.

The economics: what a reactivation pass actually costs

The lead acquisition cost on an aged database is sunk. You already paid for those names and numbers months or years ago. The only new cost in reactivating them is the cost of the calling capacity to work through the list, plus whatever time it takes to run the consent and reassignment checks above.

Those figures are arithmetic, not a promise of a contact rate or a conversion rate. Not every lead answers, and not every call runs exactly three minutes. What the table is useful for is a floor: the calling cost of reactivating a few thousand dormant leads is a few hundred to a few thousand dollars, against a lead-acquisition cost that was already spent regardless of what you do next. The bigger cost driver, by a wide margin, is the compliance work described above, checking consent, checking reassignment, re-scrubbing the DNC list, which takes staff time whether you run the calls yourself or route them through a managed caller.

Before and after: the same 2,000 leads, worked two different ways

Where TheAffordableAI fits

Running the consent and reassignment checks is a process problem, not a calling-capacity problem, and no vendor, including us, changes that part for you. Where a managed AI caller helps is on the other side of that checklist: once a lead is cleared to call, TheAffordableAI can work through a segmented reactivation list at volume, log every disposition against the CRM automatically, and route anyone who reactivates straight to a warm transfer with a licensed agent rather than a note that sits until someone gets to it. The full list of what is included on every plan is on the features page.

Pricing is published, not quoted privately: a Single Account runs $200 a month plus a $500 one-time setup fee, at $0.20 a minute, down to $0.15 a minute at bulk volume. An Agency plan runs $500 a month plus a $1,000 one-time setup fee, at $0.18 a minute, down to $0.16 a minute at bulk. Both are month to month with no long-term contract, so testing a reactivation pass against your own database costs, at most, one month either way. If you are already on HighLevel, the CRM sync is usually the first thing agencies ask about, and it is covered on the how it works page.

When aged leads aren’t worth calling at all

It would be dishonest to end this without saying it plainly: not every aged database is worth reactivating, and no amount of calling capacity fixes a list that was low quality the day it was purchased. Agents in insurance forums are genuinely split on this. Some describe year-old leads as underworked, lower-competition inventory that converts fine once someone actually calls them with a real script and enough attempts. Others describe old, cold leads as a poor use of dial time compared to fresher volume, and at least one experienced agent’s advice was blunt: for some verticals, the leads that actually pay off from an aged list are the ones you go see in person, not the ones you call.

Both views can be right at once, because “aged lead” covers a wide range of quality, from a database of people who filled out a detailed quote form eighteen months ago to a list of names that were never a particularly good match for what you sell in the first place. The way to find out which one you have is a small test pass, measured against your own contact rate and your own conversion rate, not an assumption borrowed from a forum post or a vendor’s sales page. If a test batch of 200 leads produces almost no live contacts and zero interest after a real, compliant attempt, that is useful information. It means the money is better spent on fresher volume, and continuing to grind through the rest of the list is not going to change that math.

The compliance layer, one more time

The FCC’s one-to-one consent rule is gone, and it was never actually in force. That is a genuinely good piece of news for anyone sitting on an aged database they were too nervous to touch. It is not a green light to skip the parts of TCPA and CMS compliance that were never in question: valid, documented consent, a recent Reassigned Numbers Database check, a current National Do Not Call Registry scrub, and, for Medicare leads specifically, recorded calls and a real basis for the contact. Automated or prerecorded calls to a wireless number still need prior express written consent under 47 CFR § 64.1200, and the caller must disclose it is an AI where required, and every call needs a working opt-out honored immediately. Get those pieces right, and the database sitting untouched in your CRM is not dead weight. It is inventory you already paid for, waiting on a compliance checklist rather than a marketing decision.

You can run that checklist yourself with a spreadsheet, a phone, and a disciplined process, and plenty of agencies do. The question worth asking is whether the hours it takes to check every number, re-scrub the list, and keep the documentation straight cost more than the per-minute rate of a managed caller built to do it at volume. Either way, the leads are legal to call again. Whether they are worth calling is the more interesting question, and it is one you can only answer by actually testing your own list.