For insurance agencies
TCPA Compliance Center
The TCPA and AI rules for texting and calling leads, what changed this year, and how to tell a safe vendor from a lawsuit.
Mav is a proud member of REACH
Last reviewed
What changed this fall
FCC and TCPA rules are ever-changing. Here’s the latest, and what we’d do about it.
Walking the regulatory tightrope
Compliance is a core issue in this industry, and it’s more complex than ever. Insurance sits at the intersection of two areas regulators are watching closely.
TCPA compliance
The Telephone Consumer Protection Act has governed calls and texts since 1991. Texts count as calls.
- Marketing texts, and calls that use an autodialer or an artificial voice, need prior express written consent.
- Federal quiet hours are 8 a.m. to 9 p.m. in the lead’s time zone. Some states are stricter: Florida stops at 8 p.m. Know your state’s rules.
- Scrub the National Do Not Call Registry and your own internal DNC list.
- Honor opt-outs made in any reasonable way within 10 business days.
- Damages are $500 per violation, and up to $1,500 if willful. Every message counts as a separate violation.
- Business texting needs A2P 10DLC registration. Carriers block unregistered traffic.
AI regulations
AI rules are arriving at the federal and state level at the same time. Here’s what already applies.
- Since February 2024, the FCC treats AI-generated voices as “artificial” voices under the TCPA. AI voice calls need the same consent as a robocall.
- Our rule of thumb: never let an AI pretend to be a person, and always say it’s automated when asked.
The biggest misconception about texting
A lot of people believe that texting, especially AI-based texting, is inherently riskier than phone calls. That is wrong.
Texting leads is riskier than calling for TCPA compliance.
Many people think phone calls are the “safe play,” and that AI-based texting is a compliance minefield.
Texting with AI is actually safer than phone calls.
When you call, especially with any auto-dialer, you’re subject to the same TCPA rules. Dialing is not a loophole. It never was.
Why AI-based text messaging is actually safer
-
1
Text creates a paper trail
Every message sent, every opt-in captured, every opt-out honored is logged, timestamped, and auditable. If a regulator or plaintiff’s attorney comes knocking, you have a complete record of exactly what was said and when. Unless every phone call is recorded and properly disclosed, calls have far less documentation.
-
2
AI systems have built-in compliance guardrails
A well-built AI messaging system automatically handles STOP requests, respects quiet hours, manages consent records, and prevents messages from going out to contacts who haven’t opted in. These aren’t afterthoughts. They’re infrastructure.
-
3
Human error is the biggest compliance risk
Human error is the single biggest source of compliance violations. A person on the phone can forget to check consent, call outside business hours, miss a STOP request, or fail to document the interaction. AI systems don’t have bad days, don’t get distracted, and don’t forget the rules.
The key takeaway
The channel doesn’t determine your risk. Your process does.
Whether you’re texting, calling, or emailing, the question is the same: are you following the rules?
If your compliance posture is strong, text messaging, including AI-based messaging, is not only safe. It’s one of the most defensible channels you can use.
Evaluating vendors: what to look for
Whether you’re building technology yourself or hiring a vendor, an AI provider, a lead source, or a call center, here’s what separates the safe ones.
Red flags
-
They let you contact leads without express written consent.
If a vendor doesn’t ask where your leads came from or what consent was captured, run. That’s not flexibility. That’s liability.
-
They can’t show you their compliance documentation.
If you ask how they handle consent, opt-outs, or regulatory changes and get a vague answer, that tells you everything.
-
They can’t pull up consent and opt-out history for a single contact.
If they can’t show you when someone opted in and when they opted out, they can’t show a court either.
-
They don’t adapt when regulations change.
Compliance isn’t a one-time setup. Your partners should be evolving as the rules evolve.
-
They position their product as a “workaround.”
Any vendor that sells you on “we found a workaround” is selling you a lawsuit.
Green flags
-
They capture and store opt-ins cleanly.
You should be able to see exactly when a consumer opted in, what language they consented to, and through what form or interaction.
-
They check consent before the first message.
Consent certificates are validated and stored before any texts are sent.
-
They handle STOP, HELP, and natural language automatically.
Beyond standard keywords, modern AI should understand intent from ambiguous requests like “please don’t text me” and respond appropriately. This is table stakes.
-
They talk about compliance openly.
They’re members of organizations like REACH. Compliance is on their website and in their sales process, not something they bring up only when asked.
-
They operate within reasonable contact hours.
They’re not blasting messages at 6 AM or 10 PM. They know the rules and follow them.
Frequently asked questions
Answers to the questions agencies ask us most. Not legal advice.
Still have questions?
Talk to usDo I need consent to text insurance leads?
Yes. Marketing texts need prior express written consent: a signed agreement, electronic signatures included, that names your business and says the lead agrees to marketing messages. Buying a lead doesn’t transfer consent to you unless the consent language covers you. Keep the record of when, where and what they agreed to.
Is texting leads riskier than calling?
No. The TCPA treats texts as calls, so the same consent, quiet hours and DNC rules apply to both. Texting leaves a timestamped record of every opt-in and opt-out, which makes it easier to prove you followed the rules.
What hours can I text or call leads?
Federal rules allow 8 a.m. to 9 p.m. in the lead’s local time. Some states are stricter: Florida stops at 8 p.m. If you work leads in several states, follow the tightest window.
How fast do I have to honor an opt-out?
Within 10 business days under current FCC rules, and opt-outs count in any reasonable form, including “stop texting me.” The FCC has proposed a shorter window, so the safe move is to stop right away.
Does the TCPA apply to AI voice calls?
Yes. Since February 2024 the FCC has treated AI-generated voices as artificial voices under the TCPA, so AI calls need the same prior express consent as prerecorded calls.
What is 10DLC and do I need it?
A2P 10DLC is carrier registration for business texting from regular 10-digit numbers. Since February 2025, carriers block unregistered business texts. You can follow the TCPA perfectly and still have every message blocked if you skip it.
What happens if I violate the TCPA?
Damages run $500 per call or text, and up to $1,500 if willful, with no cap. Most cases are class actions, so one bad list can mean thousands of violations.
How does Mav handle compliance?
Each state’s contact windows, dial caps and recording-consent rules apply automatically across text and voice. DNC scrubs, phone validation and consent checks run before the first message. Every message carries a clear opt-out. Calls are transcribed with PII redacted. Mav is SOC 2 Type 1 certified, and Type 2 is currently in progress.
Expert compliance resources
Staying on top of compliance requires ongoing education. These are the best resources in the industry.
REACH
The industry’s leading compliance organization for responsible consumer engagement. Certification programs, best practices, and ongoing education.
Eric Troutman
America’s foremost TCPA attorney. Follow him for real-time updates on regulatory changes, court decisions, and what they mean for your business.
Deserve to Win
Mav founder Matthew Black joins renowned TCPA defense attorney Eric Troutman on Deserve to Win to talk about building AI for the insurance industry, where AI helps, and where using it doesn’t make sense.
Mav is a proud member of REACH
Committed to responsible consumer engagement since 2023
Compliance built in, not bolted on.
See how Mav handles consent, quiet hours, and opt-outs on every conversation.
Last reviewed October 26, 2026. The information on this page is educational and does not constitute legal advice. Consult qualified legal counsel for guidance specific to your situation.