FCC One-to-One Consent Rule Is Dead: Insurance Leads Now

The FCC’s one-to-one consent rule, the regulation that would have made it functionally illegal for a comparison-shopping site to sell one consumer’s information to more than one insurance buyer, is dead. Not delayed, not paused, dead: vacated by the Eleventh Circuit on January 24, 2025, left unappealed by the FCC, and formally stripped out of the agency’s own rulebook on August 29, 2025. If you buy shared or aggregated insurance leads and you have spent the last two years bracing for a rule that would force every lead vendor to rebuild its consent flow, that rule is not coming. What replaced it is not “anything goes.” It is the same “prior express written consent” standard that has governed telemarketing robocalls since 2012, and most agencies buying leads today have never actually checked whether their vendors meet it.

This matters because the coalition that killed the rule was, literally, an insurance industry group. Insurance Marketing Coalition Limited describes itself in its own court filing as a consortium of more than twenty entities representing insurance lead generators, the merchants who buy from them, and the consumers who use comparison tools, and it took the FCC to the Eleventh Circuit specifically because the rule would have broken the shared-lead model a large part of ACA, Medicare, life, and final expense lead generation runs on. That is the industry you are buying from. Understanding what this case actually decided, and what it left completely untouched, is the difference between reading a regulatory headline and knowing what your own lead vendor contracts should say.

What the one-to-one consent rule would have actually required

Start with the phrase everything in this story turns on: “prior express written consent.” The Telephone Consumer Protection Act says you need the called party’s “prior express consent” before dialing or texting them with an autodialer or an artificial or prerecorded voice, but Congress never defined what that consent has to look like. The FCC filled that gap in 2012, ruling that for telemarketing and advertising robocalls specifically, “prior express consent” means “prior express written consent”: a signed agreement, in writing, that clearly authorizes the seller to deliver telemarketing messages using an autodialer or prerecorded voice, names the phone number, and carries a clear and conspicuous disclosure that the person is agreeing to get those calls. That 2012 standard is not new, it is not controversial, and it is not what this article is about. It is also the standard that governs today, because everything the FCC tried to bolt onto it in 2023 has since been torn back off.

In 2023, the FCC adopted a Second Report and Order that added two new restrictions on top of the 2012 written-consent rule, both aimed squarely at lead generation and comparison-shopping websites. The first, which the Eleventh Circuit’s opinion calls the “one-to-one-consent restriction,” said a consumer could authorize no more than one identified seller at a time. Checking one box that said “I consent to calls from Bank A and Bank B” would not count as valid consent for either bank; the consumer would have to check two separate boxes, one per seller, naming each one individually. The second, the “logically-and-topically-related restriction,” said that whatever calls the consumer consented to had to be logically and topically associated with the interaction that prompted the consent. The FCC’s own example: a consumer giving consent on a car-loan comparison site does not consent to get calls about loan consolidation, even if the same consent form clearly and separately authorized exactly that.

Both restrictions applied only to telemarketing and advertising robocalls and robotexts, and both applied categorically, regardless of any other facts showing the consumer had, in plain terms, actually agreed to be called. That last part is what sank the rule in court.

Why the Eleventh Circuit vacated it

Insurance Marketing Coalition Limited challenged the 2023 rule on three grounds: that the FCC exceeded its statutory authority, that the rule violated the First Amendment, and that it was arbitrary and capricious under the Administrative Procedure Act. The court, in a January 24, 2025 opinion written by Judge Branch and joined by Judges Luck and Lagoa, ruled entirely on the first ground and did not need to reach the other two.

The court’s reasoning is worth understanding on its own terms, because it explains why this outcome is durable rather than a fluke. The TCPA requires “prior express consent,” full stop; it does not say “prior express consent, plus a one-seller limit,” and it does not say “prior express consent, plus a topical-relevance test.” The FCC’s authority under the statute is to “prescribe regulations to implement” the TCPA, and the court held that “implement” means to carry a law into effect, not to add new substantive conditions the statute itself never imposed. The court leaned on its own prior precedent, particularly Gorss Motels, Inc. v. Safemark Systems, LP, which had already held that a consumer can give one clear, unmistakable “prior express consent” that covers multiple, even loosely defined, entities at once, such as a hotel and its unnamed “affiliates.” One-to-one consent had never been part of what the TCPA, or the court’s own case law interpreting it, required.

Even the FCC’s own courtroom arguments undercut the rule. At oral argument, the FCC’s counsel was asked about a consumer who checks boxes consenting to calls from three separate mortgage companies, then checks a fourth box consenting to calls from a home-repair business. Counsel agreed the logically-and-topically-related restriction would have invalidated that fourth consent, then, separately, agreed that without the 2023 rule, the TCPA itself would allow it. That concession is a big part of why the court found the restrictions unlawful rather than merely debatable: the agency’s own lawyers admitted real, voluntary, clearly-stated consent was being invalidated by a test the statute never asked for.

The court granted the petition, vacated Part III.D of the 2023 order, and remanded to the FCC. It did not rule on the First Amendment or arbitrary-and-capricious arguments, because it did not need to once the statutory-authority argument succeeded.

The full timeline, start to finish

Read that sequence closely and one detail stands out: the rule was three days from taking effect when the court killed it. Agencies and lead vendors that had spent the prior year rebuilding consent-capture flows to comply were, in the space of a single week, told to stop.

What “prior express written consent” requires today, in plain terms

With the 2023 restrictions gone, the standard that governs telemarketing and advertising robocalls and robotexts is the one the FCC adopted in 2012 and the Eleventh Circuit’s own precedent has interpreted consistently since: the consumer has to “clearly and unmistakably” state, before the call happens, that they are willing to receive it, in a signed writing (an electronic signature and a checked box both count) that names the phone number and discloses that checking the box means agreeing to autodialed or prerecorded telemarketing calls.

Two things that standard does not require, now that the 2023 additions are gone:

• A one-seller limit. A consumer can lawfully check one box authorizing calls from multiple named sellers, or check a box that clearly identifies several sellers or affiliates, in a single form. What matters is that the authorization is clear and specific about who is being authorized, not that only one party is named.
• A topical-relevance test. Consent captured on an auto-insurance quote page can lawfully cover a call about home insurance, life insurance, or any other product, provided the consent language actually and clearly said so. There is no requirement that the subject matter match the page the consumer was on.

That distinction is the whole point of this article. Lead vendors and comparison-shopping sites are no longer required to rebuild their consent flows around a one-seller model, and most will not. But “the rule that would have forced stricter documentation is gone” is very different from “documentation no longer matters,” and a lot of agencies are going to read headlines like “one-to-one consent rule is dead” and hear the second thing when the first thing is what actually happened.

Why this is your problem, not just your lead vendor’s

Here is the scenario worth sitting with. Your agency buys 200 shared ACA or Medicare leads a month from an aggregator. The aggregator’s landing page has a consent checkbox, a privacy policy link, and a list of “marketing partners” somewhere in a scroll box. You have never read that scroll box. You have never asked the vendor for a copy of the actual consent record tied to a specific lead. You call the lead, using an autodialer or a prerecorded or AI-generated voice, because that is how outbound calling works at any real volume.

If that consent turns out to be defective, forged, expired, or never actually disclosed telemarketing calls in the first place, the person who gets sued is not usually the aggregator sitting three steps upstream. It is the business that placed the call the consumer actually received. Vicarious liability under the TCPA has been applied to the party that benefits from a call even when a third party technically dialed it, and “our lead vendor told us their leads were compliant” is a claim you can raise against your vendor in a separate contract dispute, not a defense that makes a consumer’s TCPA claim against you go away.

That gap, sixty cents to place a call against $500 to $1,500 in statutory exposure if the consent behind it does not hold up, is not a rounding error. It is per violation, meaning per call or per text, not per lawsuit, and a court can push it to the top of that range if it finds the conduct was willful or knowing. None of this depends on whether the call led to a sale.

TCPA litigation was not some rare event even before this case. WebRecon LLC, which tracks consumer-protection litigation filings, recorded 2,810 TCPA lawsuits filed in 2025, essentially flat against 2024. That volume did not depend on the one-to-one rule existing or not; it reflects ordinary TCPA enforcement against calls and texts that never had valid consent in the first place, which is exactly the exposure a sloppy lead vendor relationship creates regardless of what the FCC’s rulebook says about seller counts.

How to vet a lead vendor’s consent, step by step

None of this requires hiring counsel to review every lead source, though counsel is worth involving if your agency runs meaningful bought-lead volume. You can run every step below yourself, this week, with the vendor relationships you already have.

1. Ask for the actual consent language, not a summary of it. A reputable vendor can show you the exact checkbox text and disclosure the consumer saw at the moment they submitted their information. If a vendor cannot produce that, or resists sharing it, that is your answer.
2. Check whether the disclosure actually says “telemarketing” or “autodialed calls.” Consent to “receive information” or “get a quote” is not the same as consent to receive autodialed or prerecorded telemarketing calls. The FCC’s 2012 standard requires the written agreement to include a clear and conspicuous disclosure of exactly what the consumer is agreeing to.
3. Confirm whether the box was pre-checked. A pre-checked consent box has never satisfied “clearly and unmistakably stated” consent under the FCC’s or the courts’ reading of the TCPA, one-to-one rule or not. This is worth asking about directly, because it is a common shortcut on older or lower-quality lead-gen sites.
4. Find out how long the vendor retains the consent record, and whether you can get a copy per lead. If a lead you called eighteen months ago becomes the subject of a demand letter, “the vendor probably still has it” is not a plan. Ask what the retention window is before you buy, not after a dispute starts.
5. Read your lead-purchase agreement’s indemnification clause with a skeptical eye. Many vendor contracts include language that sounds like it shifts TCPA liability to the vendor. It may reduce your practical recovery odds in a dispute, but it does not change who a consumer can sue in the first place; that is determined by who placed the call, not by your private contract.
6. Treat multi-buyer, comparison-shopping leads differently from single-buyer, exclusive leads. A lead sold to several agencies at once is the exact model this whole legal fight was about protecting. That is not a reason to avoid it, the court just confirmed it is lawful, but it is a reason to be more, not less, careful about the consent record behind it, since more parties are relying on the same consent to make the same calls.

You can build all six of these into a one-page vendor checklist yourself, and plenty of agencies already do exactly that before they ever wire a payment to a new lead source. If part of your list is an older, previously-purchased database rather than fresh buys, the aged insurance leads guide on this site covers the separate question of what is legal to call again months or years later.

Before and after: the same agency, two ways of buying leads

Could a version of this rule come back?

Treat this as a live question, not a settled one, even though nothing currently pending would revive it. No party petitioned the Supreme Court for review of the Eleventh Circuit’s decision. The FCC itself chose not to seek further review of its own loss. A coalition of consumer advocacy groups, including the National Consumers League, tried to intervene after the fact to pursue rehearing en banc, and the court denied that motion in April 2025 because it came more than 30 days after the original petition for review, missing the deadline set by the Federal Rules of Appellate Procedure. And rather than leaving the vacated language sitting in limbo, the FCC affirmatively conformed its own codified rules in August 2025 to remove it, which is a stronger signal than silence would have been.

This is a separate question from whether a lead you already have permission to call can later have that permission withdrawn; the TCPA revoke-all rule guide on this site covers the current and upcoming rules on honoring a revocation once one arrives. None of that forecloses a future FCC writing a narrower rule aimed at the same underlying concern, lead-generation consent chains that obscure who is actually going to call a consumer, in a way built to survive the same statutory-authority challenge that sank this one. That would be a new rulemaking with its own notice-and-comment process, not a revival of the vacated 2023 order, and there is nothing on the FCC’s public docket right now suggesting one is imminent. The practical takeaway is not “this will never change again.” It is that the standard governing your lead purchases today is the 2012 written-consent rule, plainly, and building your vendor-vetting process around that rule is not wasted effort even if a future rule eventually adds new conditions on top of it.

Where TheAffordableAI fits

Vetting a lead vendor’s consent language is a procurement and legal-review decision, and no calling platform, including ours, makes that decision for you. What a managed AI caller can do is make what happens after you buy a lead more defensible. Every call TheAffordableAI places gets logged against the lead’s record automatically, including disposition and any language spoken on the call, and that log syncs natively with HighLevel instead of sitting in a separate system someone has to reconcile after the fact. If a consumer or their attorney ever challenges a call, having a complete, timestamped record of exactly what was said and when is a materially better position than a gap in your CRM. The full list of what is included on every plan is on the features page.

Pricing is published, not quoted privately: a Single Account runs $200 a month plus a $500 one-time setup fee, at $0.20 a minute, down to $0.15 a minute at bulk volume. An Agency plan, which routes to 20-plus agents at once, runs $500 a month plus a $1,000 one-time setup fee, at $0.18 a minute, down to $0.16 a minute at bulk. Both are month to month with no long-term contract, so testing whether better call documentation is worth it to your agency costs, at most, one month either way. You can also build a version of this yourself with a spreadsheet and a disciplined process, and plenty of agencies do exactly that rather than change how they operate over it. It is worth pricing both.

When this article is not enough, and when AI calling is the wrong tool

Be honest about the limits of what any of this solves. If your agency’s actual problem is that a specific lead vendor has a track record of selling low-quality or improperly consented leads, the fix is finding a better vendor or building your own lead generation, not layering more call-logging on top of a bad source. And if you are buying leads at a scale where a serious consent-compliance review makes sense, that review belongs with an attorney who has actually read your specific vendor agreements, not a blog post, however well sourced. No AI caller and no CRM feature substitutes for that judgment call, and spending money on new calling infrastructure to paper over a vendor relationship you should not be in is not a good trade.

The rule that would have forced every insurance lead vendor to rebuild its consent flow around a one-seller model is not coming back on any timeline anyone can currently point to. That is genuinely good news for the shared-lead economy a lot of agencies depend on. It is not a reason to stop asking your vendors the questions their own consent records should already answer. The standard has not gotten stricter since this case, but it has not gotten looser either: it is the same written, disclosed, specific consent requirement that has applied since 2012, and it is worth knowing whether the leads you are buying this month would actually survive someone asking to see it.