Article

State Mini-TCPA Laws Insurance Agents Must Track

State mini-TCPA statutes for insurance agents: Florida, Oklahoma, Maryland and Washington, and the posture that covers most of them at once.

August 5, 2026 · 6 min read · InsuraCentral Team

InsuraBot AI summary

Agents who track compliance track the federal TCPA, because that is what the industry talks about. Meanwhile a growing share of demand letters cite a state statute, for a straightforward reason: after the Supreme Court narrowed the federal definition of an autodialer in Facebook v. Duguid, plaintiffs’ firms needed a theory that did not depend on it. State statutes supplied one.

Several mini-TCPAs define “automated system” far more broadly than the federal ATDS test, or dispense with the equipment question entirely by regulating all solicitation calls regardless of how they were dialed. Against those, a Duguid argument does nothing.

Nothing here is legal advice, and we are not a law firm. Jurisdiction is stated throughout because it genuinely determines the answer.

Why federal law stopped being the whole story

Facebook v. Duguid (2021) held that an ATDS must have the capacity to store or produce numbers using a random or sequential number generator. Most modern dialers, which call from uploaded lists, are outside that definition. The opinion is on the Supreme Court’s site.

Two consequences. Federal ATDS claims got harder. And state legislatures — several of them explicitly responding to the gap — passed or amended statutes with broader definitions and their own damages.

Two more recent shifts matter for how confidently anyone can state federal law:

***Loper Bright* (2024)** ended Chevron deference, so courts no longer defer to the FCC’s interpretation of ambiguous TCPA provisions.
***McLaughlin Chiropractic v. McKesson* (2025)** held that district courts are not bound by FCC interpretive orders in private litigation.

Together those mean federal TCPA law now genuinely varies by circuit on questions that used to have one answer. State statutes, by contrast, say what they say.

Florida — the FTSA

The Florida Telephone Solicitation Act was amended in 2021 to create a private right of action with statutory damages, and it produced an immediate wave of filings. A 2023 amendment narrowed it — adding a 15-day pre-suit cure notice requirement and tightening the definition of the covered technology.

What still matters for insurance agents:

The covered equipment definition reaches an ”automated system for the selection or dialing of telephone numbers” — broader than the federal ATDS test, and not answered by Duguid.
Consent requirements are their own analysis, not satisfied merely by federal compliance.
Florida is a major final expense market, so exposure here is not theoretical for most agents in this vertical.
The 2023 cure period is a real procedural protection, and it only helps you if you respond inside it — see what to do when a demand letter arrives.

Oklahoma — the broadest definition

Oklahoma’s Telephone Solicitation Act of 2022 is the one most often described as the broadest in the country. It regulates calls made using an automated system for the selection or dialing of telephone numbers and carries statutory damages with a private right of action.

For a multi-line power dialer operator, this is the statute to read first. The equipment question that protects you federally does not protect you here.

Maryland’s Telephone Solicitations Act, as amended by the Stop the Spam Calls Act of 2023, requires prior express written consent for telephonic sales calls made using an automated system — and its consent standard is generally regarded as the most demanding in the country.

Notably, Maryland took the one-to-one consent concept that the Eleventh Circuit vacated federally in Insurance Marketing Coalition v. FCC and put substantively similar requirements into state law. A federal court’s view of FCC authority does not touch a state statute, so the lead-generation practices that survived federally may not survive in Maryland.

If your leads come from multi-seller consent forms — which most bought leads do — Maryland is where that model is most exposed. The record you would need is in do bought leads count as TCPA consent.

Washington — CEMA

Washington’s Commercial Electronic Mail Act reaches commercial text messages and carries per-violation damages, and it has been applied aggressively. For agents running SMS follow-up at volume, Washington is the jurisdiction where text-message practice most often becomes a claim. The registration side of texting is in A2P 10DLC for insurance agents.

The pattern across all of them

Rather than memorise fifty statutes, note what the aggressive ones share. Every one of these is a question you can answer about your own operation today:

1. Broader equipment definitions. “Automated system for the selection or dialing” catches list-based dialers that fall outside the federal ATDS test. Assume your dialer is covered.

2. Their own consent standards. Federal compliance is not a defence to a state consent requirement.

3. Private rights of action with statutory damages. This is what makes them commercially significant — it creates a plaintiff’s bar.

4. Their own calling windows. Frequently narrower than federal, plus Sunday and state-holiday bans. Twenty-three of fifty-one jurisdictions are stricter than federal on at least one dimension; the full table is in calling hours by state.

5. Licensing and registration. Several states require telemarketer registration or licensing that applies extraterritorially — you can be required to register in a state you have never set foot in, because you called someone there. Being unregistered is often an independent violation on top of whatever else is alleged.

6. Per-call disclosure timers. Some states require you to identify yourself and your company within a specified number of seconds — as few as ten in some jurisdictions. A script that opens with rapport before identification can violate this even on a fully consented call to a willing prospect.

Point six is the one that surprises agents most. It is not about consent, not about equipment, and not about timing — it is about the first ten seconds of your script, and it is trivially provable from a recording you made yourself.

The compliance posture that covers most of it

You cannot run fifty-one rule sets. You can run one conservative posture that sits inside nearly all of them.

Calling window: 9am–8pm in the recipient’s confirmed local time. Inside every state window except Rhode Island’s 6pm end and Kentucky’s 10am start. Handle those two by exception.

No Sunday calls. Seven states ban them outright, one restricts, and the operational cost of getting per-state Sunday logic wrong exceeds the value of Sunday dialing.

Suppress state holidays, using each state’s own holiday list rather than the federal set.

Identify yourself in the first ten seconds. Name, company, and the purpose of the call, before anything else. Make it the literal first line of every script and audit recordings for it.

Hold the six-part consent record yourself, not at the vendor. Detailed in do bought leads count as TCPA consent.

Confirm the recipient’s state on the call and log it. One sentence, and it converts an area-code inference into evidence.

Check registration requirements for every state you write in, before you write in it. This is the one that requires an actual lawyer, once, and then a diary entry for renewals.

Retain everything for four years — recordings, consent records, call logs with UTC timestamps and determined local time. Several states have shorter limitations periods; four years covers the federal one and therefore covers all of them.