Your Website Checkbox Does Not Meet the TCPA Consent Rule

The checkbox on your quote form, and what it is missing

Open your own quote form right now. Somewhere near the submit button there is a line of small gray text, something like "By clicking Get My Quote, I agree to be contacted about insurance products and services." Maybe it is a box the visitor has to tick. Maybe it is just a sentence that sits there whether anyone reads it or not, inherited from whatever template the site started on three or four redesigns ago.

That sentence feels like consent. It reads like consent. For the autodialed calls and automated texts most agency follow-up sequences actually run on, it is often not the consent the TCPA requires, and the FCC has described the underlying pattern in its own words, not kindly. In a December 2023 order, the Commission wrote that it was acting to close "the lead generator loophole," a single, generic consent checkbox on a comparison site treated as permission for every seller who might later buy that lead¹.

For an independent agency's own quote form, the issue is rarely resale to strangers. It is a disclosure that does not say enough, is not presented the way the rule requires, and in a lot of cases was copied years ago from a form builder's default text and never looked at again since.

The way this usually surfaces is not a regulator showing up. It is a demand letter, often from a plaintiff's firm that specializes in TCPA claims and found the number through a lead list, asking for the exact consent record behind one specific text message sent eight months ago. At that point, "we have a checkbox on the form" is not an answer. The answer has to be the precise words that were on the page the day that specific visitor submitted it, when they submitted it, and proof the box was actually ticked rather than defaulted on. An agency that has never logged any of that is negotiating from a position of not knowing what it can prove, which is a worse spot than knowing the form has a real gap and fixing it before anyone asks.

Why one-to-one consent advice is already out of date

A lot of what agents have read about TCPA consent in the last two years is already wrong, through no fault of the person reading it. The FCC adopted a one-to-one consent rule in December 2023, set it to take effect January 27, 2025, postponed that effective date itself three days before it hit, and then the Eleventh Circuit vacated the rule entirely on January 24, 2025, the same week it was supposed to start. Three major developments in thirteen months is a hard thing for any industry blog post to keep current, which is exactly why search results and marketing advice from that window are a coin flip on accuracy today.

There is also a simpler, more ordinary mechanism at work underneath the regulatory whiplash. A lead form plugin or a GoHighLevel funnel template ships with a default consent line written once, by someone who was thinking about getting the form to submit, not about which exact words a specific federal rule requires. Agents copy that default, change the business name, and never revisit it, because nothing about the form breaks if the consent language is wrong. It just sits there, working fine, until a demand letter arrives.

It is also worth separating the TCPA from a rule agents sometimes confuse it with: the National Do Not Call Registry, enforced through the FCC's rules and the FTC's parallel Telemarketing Sales Rule. The DNC Registry governs live telemarketing calls regardless of dialing technology, and it currently protects more than 249 million numbers from telephone solicitations¹. A quote form's consent checkbox is a different protection, aimed specifically at autodialed and prerecorded calls and texts. An agency can honor the DNC Registry perfectly, never calling a listed number, and still run afoul of the TCPA's written-consent requirement if its follow-up texts are automated and its checkbox does not hold up. The two rules overlap in effect, discouraging unwanted contact, but they are enforced on different terms and a fix for one does not automatically cover the other.

What the TCPA still requires: prior express written consent

Strip away the parts that got vacated and one rule remains standing underneath all of it, in force since 2012: for an autodialed or prerecorded-voice call or text that constitutes telemarketing or advertising to a wireless number, the caller needs prior express written consent, not just verbal permission or an existing relationship². That is 47 CFR 64.1200(a)(2), and the FCC's 2012 order defines what "written" actually means in practice.

The Eleventh Circuit's own 2025 opinion, deciding a completely different question about the 2023 rule, restates the 2012 standard plainly in its background section: prior express consent must be written when the call is telemarketing, and the seller carries the burden of showing a clear and conspicuous disclosure was given and unambiguous consent was obtained². Three things have to be true at once for a consent to count: an actual agreement, something that functions as the consumer's signature, and a disclosure presented clearly enough that an ordinary person would notice and understand it, not buried in a tooltip or a footer link nobody clicks.

A checkbox click can satisfy the signature element under the federal E-SIGN Act, as long as the visitor took an affirmative action they understood as agreeing, not a box that started pre-checked. What usually fails is the disclosure itself: vague about who will call, vague about how (a live call reads differently under this rule than an autodialed one), and silent on the fact that agreeing is not a condition of getting a quote.

One more piece of older advice worth retiring: the established business relationship exemption that used to let a company skip written consent for calls to an existing customer. That exemption still exists for live telemarketing calls to landlines, but the FCC closed it for autodialed and prerecorded calls and texts to wireless numbers back in the 2012 order, the same order that created the written consent standard this section describes². An agency cannot skip the checkbox for an existing client's phone number on the theory that a prior relationship covers it, if the follow-up text or call to that number is automated.

The rule that got vacated, and why it still gets repeated

The part everyone half-remembers is the one-to-one consent rule, and it is worth being precise about what it actually said and what happened to it, since outdated versions of this advice are still circulating. In its December 2023 order, the FCC targeted "comparison shopping" websites, the kind that collect one consent and resell the resulting lead to dozens of sellers over time. The rule made it "unequivocally clear" that consent under the TCPA has to run to a single seller at a time, and that any consent collected on a comparison site had to be "logically and topically associated" with the website where it was given¹, so a consumer consenting on a car-loan comparison site could not have that consent used to sell them a Medicare plan.

The FCC's own order explains the mechanism it was worried about in plain terms: without a one-to-one requirement, "a seller on the initial list would then resell or otherwise share their consent to another lead buyer and so on potentially hundreds of times," a daisy chain of resold consent running off a single checkbox the consumer ticked once¹. That is the practice an independent agency buying leads from a shared comparison site should still worry about today, vacated rule or not, since the underlying fact pattern is exactly what draws plaintiffs' attention.

That rule was challenged by the Insurance Marketing Coalition, a trade group representing insurance lead generators, and the Eleventh Circuit sided with it. In Insurance Marketing Coalition Limited v. FCC, decided January 24, 2025, the court held the FCC exceeded its statutory authority by redefining what "prior express consent" means under the TCPA, three days before the one-to-one requirement was set to take effect². The court's own closing line is unambiguous: "we grant IMC's petition for review, vacate Part III.D of the 2023 Order, and remand for further proceedings"². Part III.D was the section titled "Closing the Lead Generator Loophole," the exact provision this section describes.

Vacated means exactly what it sounds like: the one-to-one requirement is not current law, and the FCC has not re-adopted it or anything equivalent in its place as of this writing. That does not make one-to-one consent a bad practice, it is still the cleanest way to keep a record that would survive a challenge, and it is the posture most compliance counsel still recommend given how quickly this area moves. It just is not something a plaintiff's lawyer can currently cite as a binding legal requirement the way a lot of 2024 marketing advice still implies.

Does this cover Medicare and ACA leads the same way?

Yes, and it is worth saying plainly because the two compliance layers get blended together in practice. The TCPA's written consent rule applies to the method of contact, autodialed calls and texts, and it does not care whether the product being sold is a car warranty or a Medicare Advantage plan. CMS's own TPMO disclosure requirements, the rules this site has covered on their own, govern something different: what a third-party marketing organization has to say about which carriers it represents once a conversation with a Medicare beneficiary is underway. An agency can run a fully CMS-compliant TPMO disclaimer on every call and still be the defendant in a TCPA suit if the automated text that generated the call never collected a valid written consent in the first place. The two rules are enforced by different agencies, under different statutes, and fixing one does not fix the other.

The practical takeaway for a Medicare or ACA-focused agency is that a quote form's consent checkbox and a call script's TPMO disclaimer are two separate line items on the same compliance checklist, not one item wearing two names. Both need to be right, and neither substitutes for the other.

What changes November 25, 2026: the FCC's revocation rule

A separate piece of the TCPA is changing on a hard date that is now only days away. The FCC adopted a new order on consent revocation, published in the Federal Register on October 26, 2026, with the amendments taking effect November 25, 2026⁴. Under the rule it replaces, a single revocation request was generally read as revoking all consent from that caller across every topic. The new order lets a caller designate one exclusive method for revoking consent instead, and narrows the revoke-all default so a consumer who opts out of one category, a payment reminder text, say, does not automatically lose time-sensitive messages like fraud alerts⁴. The order also keeps a cap of no more than ten business days to honor a revocation request once it is received⁴.

This is a different moment in the relationship than the consent question the rest of this guide covers. Getting valid consent in the first place is what your quote form has to do; revocation is what happens after someone who already consented wants to stop. We cover the revocation rule's mechanics in full, including how it interacts with AI-driven follow-up sequences, in a separate guide on the November 25 deadline⁶, and this section exists here only so the two rule changes are not confused with each other.

What a non-compliant form actually costs

The TCPA carries its own private right of action, which most FTC and state insurance rules do not. Under 47 U.S.C. 227(b)(3), a consumer can sue directly and recover $500 per violation, or actual losses if greater, and a court can increase that to as much as three times the base amount, up to $1,500 per violation, if the violation was willful or knowing³. "Per violation" means per call or per text, not per lawsuit, which is the same structure that makes small per-item penalties add up fast once a campaign has gone out to a real list.

The aggregate exposure is not hypothetical. In 2026, Farmers Insurance Exchange agreed to pay $2,875,000 to settle a class action brought on behalf of 8,039 people whose numbers were on the National Do Not Call Registry and who received telemarketing texts sent by an independent agent, Todd Henderson, and his agency⁵. Farmers denied liability throughout the case and disputed that it bears responsibility for an independent contractor's conduct, and still paid millions to close the case rather than litigate it to a verdict⁵. For any FMO, IMO, or agency network whose downline producers run their own lead forms and their own follow-up texts, that case is the practical argument for why consent capture cannot be left to each individual agent's judgment.

Settlement figures like that one also show why a single weak checkbox is a bigger problem than it looks on paper. $500 per text sounds manageable against any one complaint, but a per-violation statute paired with a class action turns a single automated campaign into thousands of violations at once, since every text to every number on a list is its own violation under 227(b)(3)³. A text series that went out to a few thousand numbers is not a few-thousand-dollar problem if the underlying consent does not hold up; it is the Farmers-sized problem, because the statute multiplies by the text, not by the complaint.

A worked example: one checkbox, before and after

Here is a version of the checkbox most agency quote forms actually ship, next to one built around the elements 47 CFR 64.1200(a)(2) actually asks for.

Before, the typical stock line: "By submitting this form, you agree to be contacted about insurance products and services." No name, no method, pre-checked more often than not.

After, built around the rule's elements: an unchecked box next to the text "I agree that [the agency's real, licensed name] may call or text me, including by autodialer or prerecorded voice, at the number provided, to discuss insurance products. Agreeing is not required to get a quote." The submission then stores that exact sentence, the timestamp, and the visitor's IP alongside the lead itself.

None of the "after" column requires new legal language nobody has seen before. It requires naming the actual parties and the actual method instead of using the vaguest words that still technically mention contact, and it requires keeping the kind of record that turns "we think we had consent" into "here is the exact text this specific person agreed to, and when."

Building a form that actually clears the bar

Six changes cover almost every gap we find on agency quote forms during an Audit, and none of them require rebuilding the form from scratch.

On how long to keep the log: the TCPA itself does not set a retention period the way California's insurance testimonial rule sets a four-year window, but the private right of action under 227(b)(3) runs on its own statute of limitations, and a class action can reach back across however many years a plaintiff's counsel can show a pattern of the same unlawful practice. Keeping consent records for as long as you keep the lead itself in your CRM, not deleting the disclosure log the moment a lead goes cold, is the practical minimum.

Where agency quote forms usually fail this

In order of how often we see each one during an Audit: a consent line that never names the agency, borrowed word for word from whatever template the site started on. A checkbox that arrives pre-checked, so the visitor never took an affirmative action at all. A disclosure that mentions being "contacted" with no method named, leaving it unclear whether autodialed texts were covered. A quote form with no logging beyond the lead itself landing in the CRM, so there is no record of what consent text a given lead actually saw six months ago when the copy has since changed. And leads bought from a third-party aggregator with no record at all of the original disclosure, inheriting someone else's consent gap without knowing it.

Every one of these is fixable without touching the rest of the form's design. The harder part on a hand-maintained site is simply knowing to check, since nothing in a typical page builder flags a consent checkbox as outdated or under-specified.

How we build this into every quote form we ship

This is one of those problems that is nearly free to build in from day one and expensive to retrofit after the fact, which argues for treating it as part of the build rather than a separate compliance pass later. Every quote form on a site we build names the agency, specifies the method, and logs the exact disclosure text, timestamp, and IP with the submission, not just the lead itself, so there is an actual record to point to if a lead ever claims they never agreed⁷.

That is the same philosophy behind every build we ship: compliant by default, not bolted on after a problem shows up. The free Audit checks your current site's forms and overall AEO and compliance posture in about a minute, with a fuller report following after⁸.

What changes once it's handled

A quote form built this way does not get longer or harder to fill out. The visible part, the checkbox and one clear sentence, barely changes. What changes is everything behind it: a specific record for every submission instead of a vague sentence nobody can point to later, and a form that names its own terms instead of borrowing the vaguest version that still technically functions.

This is not a project that gets finished once and forgotten, the same way none of the other compliance layers on this site are. The FCC has adopted, postponed, and had a major TCPA rule vacated inside thirteen months, and the revocation rule taking effect November 25, 2026 is proof the ground keeps moving. Building a short review of your own consent language into whatever cadence you already use for the rest of the site, tied to a license renewal or a plan-year update, is what keeps this from quietly drifting back out of date the way it probably did the first time.

Questions agents ask