Insurance Leads and the Do Not Call Registry in 2026

A number on the National Do Not Call Registry is not automatically a number you can never call again. It depends on what kind of call you’re making, what relationship you have with that person, and how long ago that relationship started. Per the FTC’s own Data Book for Fiscal Year 2025, released December 11, 2025, the Registry now holds about 258.5 million active phone numbers as of September 30, 2025, and it grew by more than 4.7 million numbers in that fiscal year alone. Most agents know the Registry exists. Far fewer can explain, in one sentence, which of their own leads it actually blocks and which exemption, if any, lets them call anyway. That gap is where hesitation creeps into a process that’s supposed to run in minutes, and it’s also where real violations happen, because “probably fine” and “actually compliant” are not the same thing when a single call can carry a $53,088 civil penalty. This article walks through what the Registry does and doesn’t cover, what the established business relationship exemption actually is, what it costs to get this wrong, and how to build a fast calling process that doesn’t have to guess.

Is It Actually Legal to Call This Lead Right Now?

That’s the question underneath the hesitation, and the honest answer is: it depends on three separate things, not one. First, is the number on the National Do Not Call Registry at all. Second, if it is, does an exemption apply to your specific relationship with that person. Third, and separately, does the way you’re placing the call, live agent versus autodialer versus AI voice, require its own consent on top of whatever the Registry situation looks like. Most of the confusion in this business comes from treating those three questions as one question with one answer.

A concrete version: an agent buys a shared ACA lead on Tuesday. The lead filled out a web form Monday night asking about subsidy eligibility. Is that number on the Registry? Maybe, maybe not, roughly 258.5 million of the country’s phone numbers are, so it’s a real possibility on any list of any size. If it is, does the inquiry the lead just made create an exemption? For the National Registry piece specifically, yes, for 3 months, under the TSR’s inquiry-based EBR provision. But if the plan is to have an AI voice assistant place that outbound call, the Registry exemption doesn’t settle the question, because the TCPA’s separate consent requirement for an automated or artificial-voice call to a cell phone has no EBR carve-out at all. The agent needs actual prior express written consent for that call type, documented, regardless of what the Registry status says.

Why the Confusion Happens: Two Rules, Two Clocks, One Phone Call

The mechanism is straightforward once it’s laid out, which is exactly why it’s worth laying out. The FTC’s Telemarketing Sales Rule, at 16 CFR 310.4(b)(1)(iii)(B), defines an established business relationship two ways. A relationship based on “the consumer’s purchase, rental, or lease of the seller’s goods or services or a financial transaction between the consumer and seller” lasts 18 months from that transaction. A relationship based only on “the consumer’s inquiry or application regarding a product or service offered by the seller” lasts 3 months from that inquiry. Both versions let a seller place a live telemarketing call to a number on the National Registry without violating the Registry requirement itself, for as long as that specific window stays open.

That’s the entire scope of what EBR does. It’s a defense to one specific rule: the Do Not Call Registry provision of the TSR. It was never designed to, and does not, address a completely different question: whether an automated system, rather than a live person, is allowed to place the call at all.

That second question is governed by the TCPA, and the two rules used to line up more closely than they do now. Before 2012, the TCPA also recognized an EBR-style exemption for certain autodialed and prerecorded calls. The FCC closed that gap in its 2012 order, FCC 12-21, which eliminated the established business relationship exemption for autodialed and prerecorded telemarketing calls and required prior express written consent instead, effective October 16, 2012. From that date forward, a real, current, well-documented EBR with a customer stopped being sufficient cover for an automated or artificial-voice marketing call to a wireless number. The two rules diverged, and most of the compliance confusion in this industry traces directly back to that divergence: agents (and more than a few vendors) still talk about EBR as if it’s a blanket shield, when for over a decade it’s only ever covered the Registry piece, not the automated-calling piece.

What It Actually Costs to Get This Wrong

Put real numbers next to the confusion, because that’s what turns “we’ll figure it out later” into “we should figure this out now.” A Telemarketing Sales Rule violation currently carries a maximum civil penalty of $53,088 per violation. That figure comes from the FTC’s own inflation-adjustment notice in the Federal Register, effective January 17, 2025, and it’s still the operative number for 2026: a separate Federal Register notice confirmed no adjustment was made for the 2026 cycle, so $53,088 stands. That’s a per-violation ceiling the FTC can pursue in an enforcement action, and it scales with how many calls a pattern of noncompliance actually touched.

The TCPA runs on a different mechanism entirely: private lawsuits, brought by the person who got the call. Under 47 U.S.C. § 227(b)(3), a consumer can recover $500 per violation, or their actual damages if higher, and a court can raise that award to $1,500 per violation if the violation was willful or knowing. Neither of those figures sounds catastrophic in isolation. The exposure comes from volume and from class treatment: a calling list with a bad consent record, dialed a few thousand times, can turn a $500-per-call statute into a seven-figure problem well before anyone from the FTC gets involved.

That decline is a genuine enforcement success story, and it’s also a little misleading if you read it as “unwanted-call complaints are basically solved.” Complaints rose in FY2025 compared to FY2024, and per the FTC’s own release, “calls about reducing debt, imposters, and medical and prescription issues remained among the topics consumers most frequently reported” for the year. Medical and prescription complaints sit uncomfortably close to Medicare and health insurance marketing calls in a consumer’s mind, even when the call in question is a fully compliant, fully consented one from a licensed agent. That’s not a reason to panic. It is a reason to assume your calling program is operating in a category regulators and consumers are actively watching, not a quiet corner nobody checks.

A Worked Example: One List, Three Different Answers

Numbers make this concrete faster than another paragraph of rule text. Say an agency buys a batch of 5,000 aged ACA leads, records from 14 months ago, and wants to work the list this week with a mix of live agent calls and an AI-voice qualifying pass. Given that roughly 258.5 million of the country’s phone numbers, a large share of all working numbers, sit on the National Registry, a batch that size will almost certainly include several thousand Registry-listed numbers. That alone tells you nothing about legality; it just tells you the Registry question is going to come up for most of the list, not a handful of edge cases.

Split that list three ways. First, records with a documented purchase or bound policy from within the last 18 months: for those, the TSR’s purchase-based EBR exemption still covers a live outbound call to a Registry-listed number, full stop, no further consent needed for the Registry piece specifically. Second, records where the only prior contact was an inquiry, a quote request, a rate comparison, more than 3 months old: the inquiry-based EBR window has already closed, and a live call to a Registry-listed number in that segment is no longer covered by this exemption at all. Third, any record in either segment that the agency plans to route through an AI-voice qualifying call rather than a live agent: EBR status is irrelevant to that decision, because the call type itself, automated and artificial-voice, needs its own prior express written consent under the TCPA regardless of how recent or how strong the underlying relationship is.

Same 5,000 leads, three legally different answers, and a single “is this list clean” checkbox would have hidden all three. That’s the actual argument for tracking EBR as two dates and consent as its own field, rather than one combined status: it’s the only way a batch this size gets sorted correctly instead of averaged into a guess.

Texts Count Too, and So Does the FCC’s Next Move

Everything above covers calls, but a large share of insurance follow-up today happens by text, and the same rules largely travel with it. The FCC has long treated a text message as a “call” for TCPA purposes, which means an automated marketing text to a wireless number needs the same prior express written consent an automated voice call would, and a consumer who is on the National Registry or your internal do-not-call list can invoke the same protections against unwanted texts. Agencies that have their SMS consent locked down but treat calling consent as an afterthought, or the reverse, are usually missing half of the same underlying obligation. If your agency runs A2P 10DLC-registered texting alongside AI voice calling, the consent record behind both channels should be the same record, not two separate half-documented ones.

The regulatory picture here keeps moving, too. On September 2, 2026, per the FCC’s own press release, Chairman Brendan Carr released a Public Notice proposing a “Robocall Scorecard,” a consumer-facing tool rating voice service providers, the carriers themselves, on how well they’re fighting illegal robocalls, and seeking comment on the rating criteria before anything is finalized. It’s a proposal aimed at carriers rather than at individual callers, and it doesn’t change any of the consent or Do Not Call rules described in this article. What it signals is direction: robocall mitigation, STIR/SHAKEN attestation quality, and provider-level accountability are still very much live priorities for the Commission in 2026, not a settled issue from a few years ago. An agency whose calling and texting program is genuinely clean has nothing to fear from more scrutiny in that direction. One that’s been assuming EBR covers everything has a reason to fix that now, before the next enforcement cycle finds it instead.

How to Build a Fast Process That Doesn’t Have to Guess

None of this requires slowing down. It requires putting the check in the same step as the dial, instead of treating compliance as something you verify after the fact or, worse, never. Here’s the method, and it doesn’t require buying anything to start.

1. Register as a seller and pull the Registry data yourself. Any business placing telemarketing calls can access the National Registry directly at telemarketing.donotcall.gov. Do not rely on a lead vendor’s word that a list is “already scrubbed.”
2. Rescrub on the legally required cadence, not on a memory. Per the FTC’s own 2004 rule change, telemarketers must access the Registry and purge newly registered numbers from their call lists at least once every 31 days. A list scrubbed in June and dialed again in September is stale under the rule, not just stale in spirit.
3. Track EBR as two separate dates per contact, not one. Record the transaction date (18-month clock) separately from the inquiry date (3-month clock) for every lead. A CRM custom field that just says “has EBR: yes/no” throws away the exact information you’d need to defend a call made in month 4 of an inquiry-only relationship.
4. Get prior express written consent up front for any automated or AI-voice call to a cell number, independent of whatever the Registry or EBR status says. This is the piece the EBR exemption cannot substitute for, and it’s the piece worth double-checking in your intake form, landing page, or lead vendor’s consent language before you ever place the call.
5. Build and actually honor your own internal do-not-call list. It has no expiration date, no purchase-based override, and per the FTC’s Telemarketing Sales Rule guidance, it’s a separate legal requirement from the National Registry. A person who tells your agency to stop calling stays off your list forever, EBR or not.
6. Log every disposition, every time, including the ones that go badly. “Asked to be removed” is not a note you write down when you get around to it; it’s the record that proves your internal list actually works if anyone ever asks.
7. Treat a purchased lead’s consent chain as unverified until you’ve checked it. A vendor’s claim that a lead is “TCPA compliant” is a sales pitch, not documentation. Ask for the exact consent language the consumer saw and the timestamp, or don’t dial it through an automated system.

An agency that reads this and thinks “we can build two date fields and a scrub schedule into what we already have” is right, and for a smaller list, that’s a completely reasonable place to start. The honest tradeoff is the same one it always is here: doing all seven of these steps correctly, every time, at real volume, without anyone on the team ever skipping the scrub because a hot lead just came in, is a process discipline problem, not a one-time setup task.

Where the Internal List and the National Registry Actually Diverge

It’s worth sitting with one distinction a little longer, because it’s the one that trips up agencies that think they’ve already solved this. The National Registry is about unsolicited contact in general; your internal list is about a specific person telling your specific business to stop. Those can point in opposite directions on the same phone number. A lead can be entirely off the National Registry, never registered at all, and still be someone who told your agency directly, on a call three months ago, not to contact them again. If that request went into a notes field nobody searches instead of an actual suppression list, the Registry status is irrelevant. You already have an obligation that has nothing to do with the FTC’s national list.

The reverse is also true and just as common. A number can sit on the National Registry and still be entirely legal to call, live, because a genuine 18-month or 3-month EBR window is open, and yet still be off-limits for an automated or AI-voice call to that same number because the separate TCPA written-consent requirement was never satisfied. Two different answers, same phone number, depending entirely on which question you’re asking and how the call gets placed.

Where a Managed AI Caller Fits, and Where It Doesn’t

This is the one section making a product claim, and it’s kept to what’s actually documented. TheAffordableAI is a managed AI caller, not a compliance department, and it doesn’t create consent that wasn’t already given or scrub a National Registry file for you. What it does, per TheAffordableAI’s own published Features page, is run the same qualifying flow on every single call, and one of the disqualifiers it’s built to listen for and act on is a caller invoking do-not-call, tagging that outcome and closing the call politely instead of pushing through it. Every call, live or booked, is logged with a disposition tag, the transcript, and the recording, synced natively into HighLevel so that opt-out request lands in a searchable record instead of a note nobody reads later.

Because the system dials at whatever pace your consented, scrubbed list calls for, it doesn’t create pressure to skip the scrub step to hit a speed target: a list that’s clean and current can be worked within seconds of a lead landing, and a list that isn’t ready yet simply isn’t the one you point the dialer at. The compliance work, building the internal list, tracking EBR windows, confirming written consent for automated calls, stays exactly where the FTC and FCC put it: with the licensed agency, not with the vendor placing the call.

What it doesn’t do, and shouldn’t claim to: decide whether a specific lead’s EBR window is still open, verify a purchased list’s consent chain for you, or replace your agency’s own internal do-not-call list. Those are judgment calls and recordkeeping obligations that belong to the licensed business, and no vendor’s software transfers that responsibility away, no matter how the call was placed.

What You Get When the Process Actually Holds Together

Handled well, none of this slows a fast follow-up program down; it just removes the guessing that makes people hesitate. A lead that comes in through a fresh, well-documented web form with real written consent for an automated call can be dialed within seconds, same as today, because the consent basis is already sitting in the record instead of being assumed. A lead pulled from an 11-month-old inquiry can be flagged automatically as inside its 3-month EBR window having already closed, so nobody wastes a call, or worse, places one that shouldn’t happen. A person who asked to be left alone in March stays off every list your agency touches in September, because the internal do-not-call entry didn’t live in a note nobody searched.

The pricing is worth restating since none of this changes it: TheAffordableAI’s Single Account runs $200 a month plus a $500 one-time setup fee, at $0.20 a minute, from $0.15 a minute at bulk volume. Agency runs $500 a month plus a $1,000 one-time setup fee, at $0.18 a minute, from $0.16 a minute at bulk, and adds routing to 20-plus agents at once. Both are month to month with no long-term contract, per TheAffordableAI’s own pricing page, fetched for this article. You can build the scrubbing-and-tracking discipline described above yourself, with a spreadsheet, a calendar reminder, and real staff time; plenty of agencies do exactly that on a smaller list, and it’s worth pricing your own time against a managed setup before deciding which fits your book.

Compliance Notes That Apply No Matter Who’s Dialing

A few things stay true regardless of whether a human or an AI places the call. Automated or prerecorded calls and texts to a cell phone for marketing purposes require prior express written consent under the TCPA, codified at 47 U.S.C. § 227(b)(1)(A)(iii), and that consent is the calling business’s obligation to obtain and document; it does not transfer to a vendor or a software platform. Do Not Call obligations, both the National Registry and your own internal list, apply regardless of how fast a lead needs to be worked. For Medicare-related calling specifically, CMS’s Medicare Communications and Marketing Guidelines add the TPMO disclaimer requirement and call-recording retention rules on top of everything covered here; those are a separate layer, not a substitute for TCPA or TSR compliance. Using an AI voice agent to place or answer a call does not transfer liability for consent, disclosure, or Do Not Call compliance away from the licensed agent or agency whose name is on the sale. Nothing in this article promises a close rate, a conversion lift, or a penalty-free outcome; the rules described here reduce guesswork, not risk to zero.