How to set up a compliant insurance call buying program

Buying calls is one of the fastest ways to scale an insurance book of business. It's also one of the fastest ways to get buried in TCPA litigation if you skip the groundwork. I've watched agencies build seven-figure call operations, and I've watched others get hit with demand letters that wiped out a quarter's profit in one bad settlement. The difference almost always comes down to what happened before the phone ever rang.

This isn't a legal document. Talk to an attorney who handles telemarketing law before you launch anything at scale. But here's what you need to understand structurally before you write a check to a call provider.

Why compliance has to come before volume

Agencies get excited about cost per call and forget to ask where the call actually came from. That order of operations is backwards. It's the biggest mistake I see in this space.

The Telephone Consumer Protection Act requires prior express written consent for any call made using an autodialer or a prerecorded message. Statutory damages run from $500 to $1,500 per violation. Per call, not per campaign. If a publisher generated 4,000 calls off a shared consent form that doesn't hold up, you're not looking at a fine. You're looking at a class action.

The buyers who survive long term treat consent documentation the way a bank treats collateral. They don't move forward without it, and they don't take a vendor's word for it. They ask for the actual form, the timestamp, and the language the consumer agreed to.

The one-to-one consent problem nobody planned for

The FCC's one-to-one consent rule changed how lead generation networks can operate, and plenty of buyers still haven't adjusted their contracts to reflect it. Consent now has to be tied to a specific seller, not shared across a marketing network of five, ten, or fifty companies that bought access to the same lead form.

Here's what that means in practice. If you're buying calls generated from a network where the consumer checked one box and got contacted by multiple unrelated companies, that consent probably doesn't protect you anymore. You need to know, specifically, whether the consent language named your business or your brand. Named a network instead? You're exposed no matter how good the call sounds on paper.

A lot of call buying programs quietly broke in the last couple of years without anyone telling the agencies buying the calls. Ask your vendor directly. If they can't answer clearly, that's your answer.

Medicare and final expense carry extra weight

Medicare Advantage and Part D marketing calls don't just live under TCPA. They also fall under CMS Marketing and Communications Guidelines, which are stricter about unsolicited outbound contact and require a documented Scope of Appointment form before a sales meeting happens, typically at least 48 hours in advance, with a handful of exceptions for walk-ins and end-of-enrollment-period situations.

If you're buying Medicare calls, you need SOA documentation as part of the delivery, not as an afterthought you chase down during an audit. Final expense calls carry similar weight because of how heavily regulated the sales process is at the state level, and because these calls often command $40 to $75 or more per qualified call given the commission structure behind the sale. Auto insurance calls, by comparison, often run $10 to $35 depending on state and intent quality. The higher the price tag, the more scrutiny the call deserves before you pay for it, not less.

State rules stack on top of federal ones

Federal law is the floor, not the ceiling. State-specific do-not-call registries and insurance licensing requirements, generally organized under the NAIC framework, can add requirements federal law doesn't touch at all.

Recording consent is a good example. Some states only require one-party consent to record a call, meaning the agent alone can consent. Others, including California and Florida, require all-party consent: the consumer has to know and agree that the call is being recorded. If your buyer requires call recordings for quality assurance (most legitimate ones do), you need a system that adjusts disclosure language based on where the consumer is calling from. A blanket script that ignores state lines will catch up with you eventually.

Licensing is the piece everyone forgets

Here's a detail that trips up otherwise careful agencies: many call buyers require proof of licensing, specifically an NPN number, for whoever is generating or receiving the call. An unlicensed person discussing plan specifics, even briefly, can create a violation even when the call itself was generated with perfect consent.

You can have a flawless TCPA trail and still have a compliance problem if the person answering the phone isn't licensed in the consumer's state. Buyers who know what they're doing check this before they check call duration. You should too. Doesn't matter if you're buying or supplying.

Duration, HIPAA, and the quality assurance layer

Most buyers use call duration as a rough proxy for lead quality before payment triggers, commonly somewhere between 60 and 90 seconds. Not a perfect measure, but it filters out obvious junk calls fast.

Health information adds another layer, particularly in the U65 and Medicare verticals. If health conditions get discussed during qualification, HIPAA considerations can apply depending on what's collected and how it's stored. Agencies that treat every recorded call like it might contain protected health information tend to avoid problems that agencies treating every call like a sales transcript run into eventually.

Contracts and indemnification

Affiliate and publisher agreements in this space almost always include indemnification clauses that shift TCPA liability downstream to whoever generated the call. Sounds like protection for the buyer, and on paper, it is. In practice, indemnification clauses are only as good as the documentation behind them. If your publisher can't produce the consent record and the recording when a demand letter shows up, that clause is just words on a page. Written consent documentation and call recordings aren't paperwork. They're your legal defense.

If you'd rather generate your own inbound calls instead of buying them from a network, that's a different setup entirely, and it's worth learning properly before you build it. I wrote The Pay Per Call Revolution specifically for that, and there's a companion workbook that walks through the setup step by step.

FAQ

Do I need an attorney to set up a call buying program? Yes, at least for contract review and consent language. The statutory damages alone justify a few hours with someone who specializes in telemarketing compliance.

Can I record calls without telling the consumer? Only in one-party consent states. In all-party consent states like California and Florida, you need clear disclosure before recording starts.

What's a reasonable price range for a qualified Medicare call? Typically $40 to $75 or more, depending on the market and how tightly qualified the call is. Auto insurance calls usually run lower, often $10 to $35.

Does the buyer or the seller carry TCPA liability? Both can, depending on the contract and the facts. Indemnification clauses shift liability contractually, but documentation is what actually protects you if a case gets filed.