Consent for Insurance Agencies: What Actually Has to Be Captured
Insurance is one of the most-tested industries for TCPA claims. The defense isn't your intent — it's the record you kept at the moment someone opted in.
Insurance agencies get tested on outreach compliance more than almost anyone. High call volume, purchased leads, aggressive competitors and a plaintiff's bar that knows the space well.
The uncomfortable part is that most agencies are relying on being reasonable people who wouldn't spam anyone. That is not the standard. The standard is what you can produce as a record, and "we would never" is not a record.
This is not legal advice and your counsel and current FCC rules govern. But there's a practical version of what to build, and most agencies are missing pieces of it.
What a consent record has to contain
If a claim arrives, you're being asked to show that this specific person agreed to this specific kind of contact at a specific time. That means storing, on the lead record:
- The exact language they agreed to, as it was worded that day
- When, with a timestamp
- Where — which page or form, by URL
- What they checked, specifically, not "they submitted the form"
- Their IP address, for a web submission
- What it covers — calls, texts, automated dialing, marketing versus servicing
That last one catches agencies out. Consent to be contacted about a quote they requested is not the same as consent for ongoing marketing, and the two shouldn't be stored as one flag.
The critical detail: store the language, not a reference to it. If you keep "consented: yes" and the form wording changed twice since, you cannot show what they actually agreed to. Copy the text onto the record at submission.
Where agencies get caught
Pre-checked boxes. Consent has to be affirmative. A checkbox that arrives ticked isn't.
Bundled consent. One checkbox covering the privacy policy, the terms, marketing calls and automated texts. Separate the marketing and automated-contact consent from everything else.
Buried disclosure. The language has to be visible near the button, not behind a link in a footer.
Purchased leads. This is the big exposure. The seller says consent was obtained. Can they produce the record? Have you asked? Consent obtained for "insurance quotes" on a comparison site may not extend to your agency specifically, depending on how it was worded and who was named. Agencies have been on the wrong end of this repeatedly.
Consent that never expires. Someone who requested a quote three years ago and never bought is not a current relationship. Rules and reasonableness both age.
No suppression discipline. Someone opts out by text and gets called by a producer next week because the opt-out lived in the texting platform and not on the record. This is the most common failure of all, and it's the easiest to fix.
Build it into the system, not the process
The reason this fails is almost never bad intent. It's that consent lives in one system and outreach happens from another.
What has to be true:
One record per person, with consent on it. Not in your texting tool. On the contact, where the producer and the dialer both see it.
Opt-out propagates instantly, everywhere. A STOP reply, an unsubscribe click, a "don't call me again" noted on a call — all should set the same flag and suppress across every channel immediately.
Outreach checks before it sends. The system shouldn't rely on someone remembering. If consent isn't there, the message doesn't go and the producer sees why.
DNC scrubbing on a schedule against federal and state registries, with the check date recorded.
Everything logged. Calls, texts, emails, timestamped, on the record. If you have to reconstruct what happened, you want it in one place.
The A2P part
If you're texting at any volume in the US, you need A2P 10DLC registration — brand and campaign registered with the carriers.
Unregistered traffic gets filtered, and increasingly just blocked. Agencies notice this as "our texts stopped working," and the answer is usually that they were never registered properly.
Registration takes one to two weeks. The campaign registration asks how you obtain consent and what your messages say, and the answers should match what your form actually does. Carriers do check, and a mismatch means rejection.
What to review this quarter
- Open your own quote form. Is the consent checkbox visible, unchecked, and specific?
- Pull a lead from three months ago. Can you see the exact wording they agreed to?
- Text STOP to your own number. Does the producer's dialer know within a minute?
- Ask your lead vendor to produce a consent record for one purchased lead. See what arrives.
- Check whether your A2P registration is current and matches your live form language.
Most agencies fail at least two of these, and item three is worth doing today.
The honest caveat
Compliance isn't a feature you switch on. It's a set of habits the system makes easy — and the reason to build it into the platform rather than the training is that habits decay under pressure and systems don't.
None of this replaces having a lawyer who knows the space read your forms and your outreach. It just means that when they do, there's something to review.
We build A2P-registered, consent-captured outreach for US insurance agencies and mortgage brokers. See how it fits together, or tell us how you're capturing consent now.