Is it legal to text insurance leads?
Automated SMS is now the default way agencies work new leads. The rules governing it changed meaningfully in 2025, and a lot of published guidance is out of date. Here is the current shape of it.
This is not legal advice. It is a plain-language summary of rules that carry real penalties and vary by state. Statutory damages under the TCPA run $500–$1,500 per violation, and violations are counted per message (ActiveProspect, TCPA text message rules 2026). Have your own counsel review your programme before you rely on any of this.
Consent comes first, and it has a specific meaning
Marketing texts to a mobile number generally require prior express written consent — the strictest standard in the rule. It has to be clear, unambiguous, documented, and it must state that consent is not a condition of purchase, describe the messages the person will receive, and explain how to opt out (ActiveProspect, TCPA text message rules 2026). Electronic signatures count under E-SIGN.
For agencies buying leads, this is the single biggest exposure: the consent was captured by someone else, on a form you did not write, and you are the one sending the message. Keep the record of consent — the form, the timestamp, the language shown — because you will be the one asked to produce it.
What changed recently
The window is 8am to 9pm in the RECIPIENT'S local time zone, not yours — a lead in California is unreachable at 6am Pacific even though it is 9am where you are sitting. Several states are stricter than the federal rule.
Federal TCPA window. State rules vary and some are tighter — check the states you write in. Summary only, and not legal advice. ActiveProspect, TCPA calling hours.
| Rule | Status | What it means |
|---|---|---|
| One-to-one consent | Not in effect | A lead generator may still obtain consent covering multiple sellers on one form, provided it is clear. Much guidance published while it was pending says otherwise. |
| Revocation by any reasonable method | In effect since April 2025 | Opt-outs must be honoured however they arrive — plain language, email, voicemail — not just keywords. Ten business days maximum; real-time is the practical standard. |
| Quiet hours 8am–9pm | In effect | Recipient's local time zone, stricter in some states. Consent does not currently waive it; the petition asking the FCC to allow that is unresolved. |
Summary only, and not legal advice. Penalties run $500–$1,500 per message.
The one-to-one consent rule is the one most people still have wrong. It would have required consent naming each seller individually. It is not in effect, and the pre-existing standard applies: a lead generator can obtain consent covering multiple sellers on one form, provided the consent is clear and the consumer understands what they are agreeing to (ActiveProspect, FCC one-to-one consent update). Guidance published while it was pending often still says otherwise.
The revocation change from April 2025 is the one with the most operational bite. An opt-out must be honoured when it arrives by any reasonable method — not only a keyword like STOP. "Please stop texting me", an email, a voicemail: all of it counts. Processing must happen within ten business days, and real-time is the practical standard (ActiveProspect, TCPA text message rules 2026).
That is difficult to do manually and straightforward to do systematically, which is the honest argument for automation here: a system that reads intent and stops immediately is more compliant than a human who reads the message on Monday.
Quiet hours
No solicitation texts before 8am or after 9pm in the recipient's local time zone (ActiveProspect, TCPA calling hours). Several states are stricter. Two things trip agencies up: the timezone is the lead's, not your office's, so a national book needs per-lead timezone handling; and consent does not currently buy you an exemption — an industry petition asking the FCC to let prior express written consent waive quiet hours remains unresolved (Squire Patton Boggs, quiet hours and consent).
Quiet-hours claims have become a distinct category of class action, which is worth knowing before treating the window as a soft guideline.
What this means for an AI that texts
The compliance questions are not really about the AI. They are about the system around it. An automated programme should be able to demonstrate all of the following, and if it cannot, the automation is the risk rather than the tool:
- Consent on file per number, with the source and timestamp, retrievable later.
- Opt-out on any phrasing, applied instantly and everywhere — not just on the campaign that received it.
- Quiet hours in the lead's timezone, enforced by the sender rather than by whoever scheduled the campaign.
- Identification — who is messaging, on whose behalf, under the business name you are licensed to use in that state.
- Escalation on regulated questions. Coverage, eligibility and underwriting answers should go to a licensed human. This is not a TCPA rule; it is a licensing one, and it is the one an AI is most likely to violate by being helpful.
None of that is exotic. It is the difference between automation that reduces risk and automation that industrialises it.
What "any reasonable means" actually means
The revocation rule is the one most likely to catch an automated programme out, because it moved the burden. An opt-out no longer has to arrive as a keyword. If someone replies "please stop", "take me off this", or says it on a call, that is a revocation and it must be honoured — across every channel and every campaign, not just the one it arrived on.
For a manual sender this is a non-event. For an automated one it is an architectural requirement: the system has to interpret a plain-language reply, apply the stop globally, and fail closed on every send path rather than only on the one that noticed.
Common questions
Do I need consent to text insurance leads?
For marketing messages to mobile numbers, generally yes — prior express written consent, the strictest standard in the TCPA. It must be documented, state that consent is not a condition of purchase, describe the messages, and explain how to opt out. If you buy leads, the consent was captured by someone else and you should keep the record, because you are the sender.
Is the FCC one-to-one consent rule in effect?
No. It would have required consent naming each seller individually, but it is not in force, and the pre-existing standard applies — a lead generator may obtain consent covering multiple sellers on a single form as long as the consent is clear and the consumer understands it. A lot of guidance published while the rule was pending still states the opposite.
What are TCPA quiet hours for text messages?
No solicitation messages before 8am or after 9pm in the recipient's local time zone, with some states stricter. The timezone is the lead's, not your office's. Prior express written consent does not currently waive the restriction — a petition asking the FCC to allow that remains unresolved, and quiet-hours claims have become a distinct class-action category.
Do I have to honour an opt-out that doesn't say STOP?
Yes. Since April 2025, revocation must be honoured when made by any reasonable method — plain language in a reply, an email, a voicemail — not only recognised keywords. Processing must occur within ten business days, and real-time is the practical standard.
Can AI legally text insurance leads?
There is no rule against an automated system sending the message. The obligations attach to consent, timing, identification and opt-out regardless of who or what composes the text. The separate and more commonly missed issue is licensing: coverage, eligibility and underwriting questions should be escalated to a licensed human rather than answered by the automation.
Virtual Closer enforces these in the sender rather than the campaign: opt-out on any phrasing applied everywhere instantly, quiet hours in the lead's own timezone, the licensed business name for the lead's state, and regulated questions escalated to a human every time.