Medicare supplement outbound calling TCPA consent requirements

Last updated 2026-07-11

What does TCPA actually require for Medicare supplement outbound calls?

The TCPA (47 U.S.C. § 227) splits your calls into two buckets, and a Medicare supplement agent needs to know which one applies before dialing a single number. ^[1]

Use an autodialer or play a prerecorded message and you need prior express written consent from the person you're calling. No exceptions. That holds for cell phones and landlines alike. The FCC set this standard in its 2012 amendments to 47 C.F.R. § 64.1200, which took effect October 16, 2013. ^[2]

Manually dial a residential landline for a commercial, non-telemarketing purpose and the bar drops. You need an established business relationship, or you give the consumer a chance to opt out. But Medicare supplement sales are telemarketing, plain and simple. So if you drop a prerecorded message on a landline, you're back to needing written consent.

Here's the short version. Almost every modern Medicare supplement call runs through an autodialer, a prerecorded message, or both. Written consent is your baseline, not your edge case.

The word "written" trips up new agents constantly. Under FCC rules, "written" covers electronic consent captured on a web form, a signed paper document, an email, or a text reply. The consent has to be a clear and conspicuous authorization, signed by the consumer, that names your company (or whichever entity places the call) and authorizes automated or prerecorded dialing to a specific number. ^[2]

What counts as prior express written consent for Medicare supplement leads?

Prior express written consent is a signed agreement, naming the seller, that authorizes autodialed or prerecorded telemarketing calls to a specific number and states the consumer doesn't have to agree to buy anything. Buy a lead list and assume someone upstream got that right, and you've inherited their legal risk without their evidence.

The FCC's 2012 Order (FCC 12-21) spells out the four parts. The agreement must (1) be signed by the consumer, (2) clearly authorize the seller to deliver telemarketing calls using an autodialer or prerecorded voice, (3) disclose that agreeing is not a condition of buying anything, and (4) include the phone number consent applies to. ^[2]

For Medicare supplement, you cannot bury consent inside a generic insurance quote form that never names the calling company. The FCC has said consent must authorize a specific seller. When a consumer signs up on an aggregator site and agrees to calls from "insurance partners," that language gets attacked in litigation, and it doesn't always survive. Courts have split, but the trend since 2021 runs toward making the consumer know exactly who will call. ^[3]

The FCC's one-to-one consent rule (adopted December 2023, effective date set for January 27, 2025) pushed harder. It required lead generation forms to collect consent for one company at a time instead of a blanket buyer list. ^[4] The Eleventh Circuit vacated that rule before it took effect, but the reasoning behind it still shapes how judges read shared-lead consent.

What this means for your team:

• Your web form names your company specifically.
• The disclosure says the consumer agrees to calls using automated technology or prerecorded messages.
• You state clearly that consent is not required to get a quote or service.
• You capture a timestamp and IP address for every online consent.

Keep those records. TCPA cases usually turn on one question: can you prove consent existed at the moment you called?

Does Medicare supplement calling have any TCPA exemptions?

No exemption covers Medicare supplement sales calls. You'll hear that "healthcare calls" are exempt from TCPA. That's a half-truth that gets twisted into bad advice.

The FCC does keep a healthcare exemption for autodialed calls to cell phones when the caller is a HIPAA-covered entity and the purpose is purely informational, like appointment reminders or refill notices. ^[5] The conditions are strict: the call has to be free to the recipient, run under one minute, and carry no marketing.

Medicare supplement sales don't fit. You're selling a commercial insurance product. The moment a call aims at a sale or a quote, the exemption is gone. CMS marketing rules stack another layer on top: CMS bars unsolicited outbound calls to Medicare beneficiaries unless the beneficiary already agreed to be called. ^[6] The CMS rule and the TCPA consent requirement stand on their own. You can break both with one call.

Age buys you nothing either. There's no exemption for calling people 65 and older as a group. Age doesn't touch the consent analysis.

One real carve-out is worth knowing. If someone already holds a policy with you, calls about that policy, renewals, or service issues may count as non-telemarketing calls with a lower consent bar. But pivot the call to a new plan or a different product and you're back inside full telemarketing consent.

What are the TCPA penalties for improper Medicare supplement calls?

TCPA statutory damages are $500 per call for negligent violations and $1,500 per call for willful or knowing ones. ^[1] Each call and each text is a separate violation. There's no cap on total damages in a class action.

Put it in real numbers. One autodial campaign of 10,000 calls without valid consent exposes you to $5 million at the floor, $15 million if a court finds willfulness. TCPA class actions certify easily because the common-question element is nearly automatic. Damages are statutory, so plaintiffs never have to prove they were harmed.

Recent settlements show the real cost. The Cash App TCPA class action settlement and the Credit One TCPA settlement both show how fast these cases climb into eight-figure exposure for defendants who dialed without solid consent records.

Medicare supplement draws regulator attention specifically. The FTC and FCC have jointly gone after health insurance robocall operations, and CMS separately audits plan-sponsored marketing calls. ^[6]

The $1,500 willful figure is the one that bites. Courts find willfulness when a company kept calling after a complaint, after an opt-out, or when internal records showed the company knew its consent practices were shaky. Not knowing the law is not a defense that works in TCPA cases.

How do the National Do Not Call Registry rules interact with TCPA for Medicare supplement?

TCPA consent and the National Do Not Call (DNC) Registry are two separate obligations, and both apply to Medicare supplement outbound calling. Comply with each. ^[7]

The DNC Registry, run by the FTC under 16 C.F.R. § 310 (the Telemarketing Sales Rule), bars telemarketing calls to registered numbers unless you have an established business relationship or an express written agreement to call. You scrub your list against the registry before you dial. ^[7]

For Medicare supplement, the established business relationship exception runs 18 months after a purchase and three months after an inquiry. Even inside that window, if the consumer asks you to stop, you stop, and you honor the request for at least five years.

State registries add their own rules. Indiana, Texas, and Wyoming keep separate lists, some with stricter opt-out windows or shorter relationship periods. Check federal and relevant state lists before dialing.

Check numbers against the do not call list before you run a campaign. Skipping the DNC scrub is its own FTC violation, and it can run up to $51,744 per call as of 2023 under the FTC's civil penalty authority. ^[7] That sits on top of any TCPA exposure.

If you also market by text, DNC and TCPA rules cover SMS too. See text message marketing for how SMS consent maps onto the same framework.

Can you cold call Medicare supplement prospects without consent?

It depends on how you dial and whether you leave a prerecorded message. A live agent, manually dialing, no autodialer or prerecorded voice, calling a landline that isn't on the DNC list, for someone with no prior relationship, can technically place that call under TCPA as a commercial call. You still owe DNC compliance, calling hours (8 a.m. to 9 p.m. local time), and CMS marketing rules. ^[8]

Cell phones flip the analysis. Under TCPA, calling a cell with an autodialer without prior express written consent is a violation whether the call is live or prerecorded. What counts as an "autodialer" has been contested ground since the Supreme Court's April 2021 decision in Facebook v. Duguid, which narrowed the definition to systems that use a random or sequential number generator to store or produce numbers. ^[3] That gave some relief to companies running predictive dialers, but the fight over what counts as an ATDS (automatic telephone dialing system) is still live.

Most Medicare supplement lists you buy are packed with cell numbers. Most calling platforms use some form of automated dialing. Put those two together and prior express written consent is a practical requirement for any Medicare supplement program with real volume.

Manual cold calling to verified landlines can happen without written consent. But landline-only campaigns barely exist in 2025. Cell phone ownership among adults 65 and older tops 85%. ^[9] Call a list of seniors and you're almost certainly calling cell phones. A true cold call to a landline is the exception now, not the rule.

What did the FCC's 2024 one-to-one consent rule change for insurance lead generation?

The FCC adopted its one-to-one consent order in December 2023, with an original effective date of January 27, 2025. ^[4] The rule required that when a consumer gives consent on a lead generation website, that consent covers one seller at a time, and the seller has to be logically and topically related to the site's content.

For Medicare supplement lead gen, that was a big deal. The industry had run for years on shared-lead models: a consumer fills out one form, and 10 to 20 agents receive the lead with the same claimed consent. Under the one-to-one rule, each of those agents would need to be individually named in a separate consent action by the consumer.

Lead generation groups sued, and the Eleventh Circuit vacated the rule in January 2025, before its effective date. ^[10] As of mid-2025 the FCC hasn't re-adopted it, and the legal status stays open. Watch it. If the FCC reissues the rule or other courts pick up its reasoning in TCPA litigation, shared-lead models face serious consent-validity challenges.

Even with the rule gone, plaintiffs' attorneys keep arguing that vague aggregator consent never names a specific seller and so fails the existing standard. Multiple district courts have let those arguments survive motions to dismiss. ^[3] Operating as if the one-to-one standard applied is safer than betting shared-lead consent holds up in court.

How should you document and store Medicare supplement consent records?

Consent documentation is your main defense in a TCPA lawsuit. Produce a complete, timestamped record showing what the consumer saw, when they agreed, and which company they agreed to, and you have a strong affirmative defense. Come up empty and you're stuck arguing against the plaintiff's version of events.

Here's what a complete consent record holds:

Element	Why it matters
Timestamp (date, time, timezone)	Proves consent predated the call
IP address	Ties consent to a specific device/location
Form URL or screenshot	Shows the exact disclosure language the consumer saw
Caller/company name	Confirms consent was specific to your company
Phone number consented to	Matches what you actually dialed
Opt-in method (click, signature, reply)	Documents the affirmative act
Revocation log (if applicable)	Shows you honored any opt-out request

Store records for at least four years. The TCPA carries a four-year federal statute of limitations under 28 U.S.C. § 1658, and most state-level TCPA claim periods run two to four years. Five years of records gives you a reasonable buffer.

For purchased leads, demand a consent record package from your vendor before you call anyone. At minimum you need the timestamp, IP, and form screenshot. A vendor who can't hand that over is selling you a lead that isn't worth the legal risk.

LeadCompliant's compliance kit includes a consent record checklist and a sample disclosure template you can hand to your web team or lead vendor. A documented process like that is exactly what courts look for when they decide whether a violation was negligent or willful.

What calling hours and other operational rules apply to Medicare supplement calls?

TCPA and the Telemarketing Sales Rule both hold telemarketing calls to 8 a.m. through 9 p.m. in the called party's local time zone. ^[8] Not your office's zone. The recipient's. A Chicago call center dialing Phoenix has to use Arizona time, which doesn't observe daylight saving, so it lands sometimes on Mountain and sometimes on Pacific relative to Chicago.

CMS marketing rules for Medicare Advantage and Prescription Drug Plans run stricter: CMS bars calling a Medicare beneficiary about a Medicare plan unless the beneficiary started the contact or gave permission to be called. ^[6] That's a prior-contact requirement that mirrors TCPA consent but comes from a separate authority with separate enforcement.

CMS rules govern calls about Medicare Advantage, Part D, and related products. Medicare supplement (Medigap) plans are sold by private insurers and fall under state insurance law, not CMS marketing rules in the same way. But TCPA consent applies fully whether the product is Medicare Advantage or Medigap.

Other operational requirements:

• Identify yourself, your company, and a callback number at the start of every call.
• Prerecorded messages must include an automated opt-out that works during the call. ^[2]
• Maintain a company-specific internal DNC list and honor opt-out requests within 30 days.
• Train your sales agents on all of it. The company is liable for calls made by agents, even independent ones, when the company directed the calling activity.

The do not call telemarketer list and mobile phone do not call list pages cover how to get and scrub against DNC data, the parallel compliance step you run alongside consent verification.

How do you get a valid DNC-scrubbed Medicare supplement call list?

Starting with clean data is cheaper than defending a lawsuit. Here's the workflow most compliant Medicare supplement operations use.

First, source your list from a vendor who can document where the numbers came from. Ask straight: Are these cell or landline numbers? What consent, if any, was collected? When was it collected? A vendor who can't answer is a liability.

Second, scrub against the National DNC Registry. You need an SAN (Subscription Account Number) from the FTC to access it. As of 2024, a five-area-code subscription costs about $100 per year; a national subscription for all area codes runs roughly $17,000 per year. ^[12] Most mid-size call centers subscribe nationally. Smaller teams use third-party scrubbing services that hold the subscription and charge per record.

For how to obtain DNC data, see how do I get the do not call list.

Third, run your own internal DNC scrub. Any number that previously opted out of your calls comes off the list before you ever touch the federal or state step.

Fourth, for cell numbers you plan to autodial, confirm you hold prior express written consent for each one before it enters the dialing queue. No consent record, no dial. Period.

Fifth, re-scrub on a schedule. The DNC Registry updates monthly, and numbers keep getting added. A list you scrubbed 90 days ago may now include registered numbers. Most compliance teams re-scrub every 30 days at minimum.

LeadCompliant offers a free phone number checker and a one-time compliance kit covering the full pre-call checklist. A documented pre-call process protects you on the willfulness question if a violation slips through despite your efforts.

What happens if a Medicare supplement lead revokes consent?

Consent revocation is its own piece of TCPA compliance, and plenty of teams underestimate it. A consumer can revoke consent at any time, through any reasonable means, under longstanding FCC guidance and a stack of court decisions. ^[11] That covers saying "stop calling me" on a live call, replying STOP to a text, clicking unsubscribe, or sending a written request. Once they do, you honor it.

The FCC clarified in its 2015 Order (FCC 15-72) that consumers don't need a specific magic phrase to revoke. Any clear signal that they no longer want calls is enough. ^[11] So your agents need to recognize revocation, log it right away, and move the number to your internal DNC list inside your required window. Federal rules require honoring DNC requests within 30 days; many companies do it same-day to cut risk.

Call someone after they revoked consent and that call is almost certainly a willful violation at $1,500. Courts have awarded treble damages when companies kept dialing after documented opt-outs. This is the fact pattern that produces the most sympathetic plaintiffs and the biggest verdicts.

For purchased leads, revocation gets messy. If a consumer revoked with the lead generator but that revocation never reached you, you may still be on the hook. Some courts have accepted good-faith reliance on a vendor's consent representation as a defense; others haven't. The safest practice is to run your own separate opt-out system and check incoming leads against your internal DNC list before every call.

Frequently asked questions

Do I need written consent to call Medicare supplement prospects on landlines?

If you use a prerecorded voice message, yes, prior express written consent is required even for landlines under 47 C.F.R. § 64.1200. If a live agent manually dials a landline and the number isn't on the DNC Registry, the consent bar is lower, but you still have to comply with DNC rules and provide an opt-out mechanism. For any call using an autodialer, written consent is required regardless of whether it's a cell or landline.

Does an existing client relationship let me skip TCPA consent for Medicare supplement?

An established business relationship (EBR) can satisfy the DNC Registry's telemarketing restriction for up to 18 months after a transaction and three months after an inquiry. But EBR does not substitute for prior express written consent if you're using an autodialer or prerecorded message to call a cell phone. For those calls, you need written consent regardless of your existing relationship with the customer.

Are Medicare supplement calls exempt from TCPA because they're healthcare related?

No. The FCC's healthcare exemption applies only to calls from HIPAA-covered entities for purely informational, non-marketing purposes such as appointment reminders, and only when the call is free to the recipient. Medicare supplement sales calls are telemarketing and receive no exemption. CMS marketing rules also independently restrict unsolicited calls to Medicare beneficiaries.

How does the FCC's one-to-one consent rule affect Medicare supplement lead buying?

The FCC adopted a rule in December 2023 requiring consumer consent for one seller at a time on lead generation forms, eliminating shared-consent models. The Eleventh Circuit vacated the rule in January 2025, so it's not currently in effect. But courts have been skeptical of vague multi-seller consent disclosures even under existing rules, so treating each lead as needing company-specific consent is the safer posture regardless of the rule's legal status.

What is the TCPA penalty per call for Medicare supplement violations?

TCPA statutory damages are $500 per call for negligent violations and $1,500 per call for willful or knowing violations under 47 U.S.C. § 227(b)(3). There is no aggregate cap, so a class action covering thousands of calls can produce seven- or eight-figure exposure. Courts have found willfulness when companies kept calling after receiving opt-out requests or when internal records showed awareness of consent problems.

Can I use a predictive dialer for Medicare supplement outbound calls?

After Facebook v. Duguid (2021), predictive dialers that dial from a fixed, pre-set list rather than randomly or sequentially generated numbers may not qualify as ATDSs under TCPA. That said, litigation over this is still active in multiple circuits. Until appellate courts settle the question, calling cell phones with any form of automated dialing without prior express written consent carries real legal risk. Many compliance attorneys recommend getting written consent anyway.

What calling hours apply to Medicare supplement outbound calls?

Federal rules under TCPA and the Telemarketing Sales Rule restrict telemarketing calls to between 8 a.m. and 9 p.m. in the called party's local time zone. You must use the recipient's time zone, not the caller's. Several states have stricter windows; Florida, for example, restricts calls to between 8 a.m. and 9 p.m. but enforces this independently under state law. CMS rules additionally restrict when Medicare plan calls can be made.

How long do I need to keep Medicare supplement consent records?

Keep consent records for at least five years. The federal TCPA statute of limitations is four years under 28 U.S.C. § 1658, and many state TCPA-equivalent claims have two- to four-year periods. A five-year retention window gives you coverage across most potential claims. Records should include the timestamp, IP address, form URL or screenshot, company name, and the specific phone number that was consented to.

Do state laws add consent requirements on top of federal TCPA for Medicare supplement calls?

Yes. Several states have TCPA-like statutes stricter than federal law. Florida's FTSA (enacted 2021, amended 2023) creates a private right of action for calls using an autodialer to a Florida cell phone without consent, with damages similar to federal TCPA. States including Oklahoma, Washington, and Maryland also have consumer protection statutes that can produce separate liability. Always check the states where your prospects are located.

What should a Medicare supplement consent disclosure on a web form say?

The disclosure should state: (1) the consumer agrees to receive calls and texts using automated dialing or prerecorded voice from [Your Company Name]; (2) the specific phone number consented to; (3) consent is not required to purchase any product or service; and (4) the consumer can revoke consent at any time. The FCC requires the consent to be clear and conspicuous, meaning it can't be buried in a terms-of-service page the consumer never reads.

Can I buy Medicare supplement leads and call them without getting my own consent?

You can call leads where the vendor collected valid, company-specific consent on your behalf, but you bear the risk if that consent is invalid. Courts have split on good-faith reliance defenses. At minimum, demand the full consent record (timestamp, IP, form screenshot) for every lead before dialing. If the vendor can't produce it, don't call the number. Lead cost savings disappear fast against a $1,500-per-call statutory damage exposure.

How do CMS Medicare marketing rules interact with TCPA for supplement calls?

They're separate obligations enforced by different agencies. CMS (Centers for Medicare and Medicaid Services) restricts marketing calls to Medicare Advantage and Part D plan enrollees and prohibits unsolicited outbound calls to beneficiaries without prior contact. Medicare supplement (Medigap) products fall under state insurance regulation, not the same CMS marketing rules, but TCPA applies fully to all Medicare supplement sales calls regardless. Violating CMS rules can cost a plan its contract; violating TCPA costs $500 to $1,500 per call.

What's the difference between prior express consent and prior express written consent for Medicare calls?

Prior express consent (oral or written) historically sufficed for non-telemarketing informational calls to cell phones. Prior express written consent is the higher bar required for telemarketing calls using an autodialer or prerecorded voice, which is the category Medicare supplement sales calls fall into. Written consent must be a signed agreement (digital signatures count) that specifically names the calling company and discloses the use of automated technology.

If a prospect texts me first asking about Medicare supplement plans, do I have consent to call them back?

An inbound text expressing interest can count as prior express consent for a callback, because the consumer initiated contact on that phone number. But it likely does not rise to prior express written consent for future automated or prerecorded calls, and it doesn't cover future marketing campaigns. Use that inbound interaction to get explicit written consent during your first conversation if you want to call that number in future automated campaigns.

Sources

1. Cornell Law School LII, 47 U.S.C. § 227 (TCPA statute text): TCPA statutory damages are $500 per violation, trebled to $1,500 for willful or knowing violations
2. Cornell Law School LII, 47 C.F.R. § 64.1200 (FCC TCPA rules, written consent standard): Prior express written consent is required for telemarketing autodialer and prerecorded calls; consent must name the specific seller and state it is not a condition of purchase
3. U.S. Supreme Court, Facebook Inc. v. Duguid, No. 19-511 (2021): Supreme Court narrowed ATDS definition to systems using random or sequential number generators; litigation over what qualifies as an autodialer continues
4. CMS, Medicare Communications and Marketing Guidelines: CMS prohibits unsolicited outbound calls to Medicare beneficiaries about Medicare plans unless beneficiary has initiated contact or consented to receive calls
5. FTC, Telemarketing Sales Rule (16 C.F.R. § 310) and National Do Not Call Registry: FTC TSR prohibits telemarketing calls to DNC-registered numbers; civil penalties up to $51,744 per violation
6. Pew Research Center, Mobile Technology and Home Broadband 2021: Cell phone ownership among U.S. adults 65 and older exceeds 85 percent, meaning Medicare supplement calling lists overwhelmingly include cell phone numbers
7. U.S. Court of Appeals, Eleventh Circuit, Insurance Marketing Coalition v. FCC, No. 24-10277 (2025): Eleventh Circuit vacated FCC one-to-one consent rule in January 2025; rule not currently in effect as of mid-2025
8. FTC, National Do Not Call Registry information for sellers and telemarketers: Five-area-code DNC subscription costs approximately $100 per year; national all-area-code subscription approximately $17,000 per year as of 2024