Buying Insurance Leads in 2026: The $145M FTC Warning

A federal settlement announced on August 7, 2025 put a real number on a question insurance agents have been guessing at for years: what happens when a lead vendor’s “the consumer consented” turns out not to hold up? Per the FTC’s own press release, Assurance IQ, LLC and MediaAlpha, Inc. agreed to pay a combined $145 million, $100 million and $45 million respectively, to settle charges that they misled consumers shopping for health insurance and, in the agency’s words, “flooded” people, including many already on the National Do Not Call Registry, with robocalls and telemarketing calls tied to leads MediaAlpha generated and sold. If your agency buys leads from a vendor you did not build yourself, this is the article that walks through what that settlement actually says, why the liability for a bad lead does not automatically stay with the company that sold it to you, and how to check a vendor’s consent chain before you pay for the next batch.

This is not an argument against buying leads. Plenty of vendors run a defensible, well-documented process, and third-party leads remain a normal way to fill a pipeline. It is an argument against buying leads the way most of the industry has been buying them for a decade: on trust, with no record of what the consumer actually agreed to, from a vendor who could not produce that record if you asked. The FTC’s settlement is what happens when nobody asks.

What the FTC Actually Settled, and Why the Problem Runs Wider Than MediaAlpha

Assurance IQ sold short-term medical and limited-benefit plans directly. The FTC’s complaint says the company misrepresented what those plans actually covered, capped benefits without disclosing the caps clearly, misstated provider network access, and, per the FTC’s press release, “unfairly charged consumers without first getting their express informed consent.” MediaAlpha did not sell insurance at all; it ran the lead-generation machinery that fed prospects to Assurance IQ and other partners. According to the FTC, MediaAlpha built landing pages under domains like “ObamacarePlans.com” designed to look connected to a government program, used paid actors to promote that impression, and, in 2024 alone, sold approximately 119 million consumer leads, a figure that comes directly from the FTC’s own press release describing its complaint.

Read that last number again. One lead-generation company, in one year, sold 119 million leads. That is not a rounding error in a niche industry. That is the scale at which “collect an email and a phone number on a landing page, resell it downstream” operates across the entire consumer-insurance shopping category, health insurance specifically but not exclusively. An individual agency buying 200 leads a month from a vendor is a tiny customer of a machine built to move numbers like that.

This was not an isolated incident, either, and it was not sudden. Roughly eight months before the settlement, on December 10, 2024, FTC staff sent warning letters to 21 companies that market or generate leads for health insurance plans, specifically calling out misrepresented plan benefits, false claims that a limited plan was “major or comprehensive medical health insurance,” inaccurate cost claims, and phantom incentive offers, per the FTC’s own press release announcing those letters. Samuel Levine, then Director of the FTC’s Bureau of Consumer Protection, put it plainly in that release: “It is critical for consumers’ health and financial well-being that marketers of health plans be honest about the plans they and their partners are offering.” The warning letters came during open enrollment season, the exact window when insurance agencies are buying the most volume from exactly this kind of vendor.

Why Your Purchased Lead’s Consent Might Not Survive a Lawsuit

Here’s the mechanism, and it’s worth being precise about the vocabulary because the terms get used loosely in this industry.

A lead aggregator is a company that collects consumer information, typically through an ad-driven landing page asking for a name, phone number, and a few qualifying questions, then sells that contact to one or more downstream buyers. Ping-post is the real-time version of that sale: the aggregator “pings” its network of buyers with a stripped-down version of the lead (state, product interest, maybe age range) the instant it’s captured, buyers bid or accept in a live auction that runs in a fraction of a second, and the full contact record “posts” to whichever buyer wins. A lead sold this way can hit multiple buyers’ phones within seconds of the consumer clicking submit.

Consent, in this system, usually means one checkbox on a landing page, often pre-checked or written in dense legal language nobody reads, that theoretically authorizes contact from “our partners,” a category that can include dozens or hundreds of unnamed companies the consumer has never heard of. Whether that checkbox constitutes valid prior express written consent under the TCPA for a specific business calling weeks or months later is a live legal question, not a settled one, and it is exactly the question the FTC’s complaint against MediaAlpha puts real money behind.

This is where TCPA vicarious liability comes in, and it’s the part most agents have never heard explained. On May 9, 2013, the FCC released a declaratory ruling, FCC 13-54, in a proceeding brought jointly by DISH Network, LLC, the United States, and four states, addressing exactly this question: can a business be held liable under the TCPA for calls a third party made on its behalf, even if the business itself never dialed the phone? The FCC’s answer was yes, under certain conditions. The ruling holds that while a seller of goods or services does not generally “initiate” a call placed through a third-party telemarketer within the meaning of the TCPA, that seller can still be held vicariously liable under federal common law principles of agency for the third party’s violations. The FCC was explicit that this liability follows real agency-law relationships, not simply any call made to benefit the seller, but the underlying principle, that responsibility for a bad call does not stay neatly contained to whoever dialed it, is exactly the logic that should worry an agency buying leads from a vendor whose consent practices it has never actually checked.

None of this means every purchased lead is a landmine. It means the safety of a purchased lead depends entirely on facts you usually cannot see from the buyer’s side of the transaction: what exact language the consumer saw, whether that language named your business or your category clearly, how many other buyers got the same lead, and whether the vendor can actually produce a timestamped record of any of it rather than just asserting it exists.

What It Costs When a Lead Vendor’s Consent Doesn’t Hold Up

The direct cost sits with the two companies the FTC named. But the pattern underneath it, ad-driven volume, thin consent, resale to multiple buyers, describes a meaningful share of the health-insurance lead industry, and the enforcement activity around it has been building for over a year, not appearing out of nowhere in August 2025.

Zoom out to where insurance sits in the broader robocall complaint picture and the pattern gets clearer still. The FCC’s own March 2026 consumer alert states it received more than 125,000 unwanted call complaints in 2025, and breaks out the top five scam categories by share: debt relief and loan assistance led at 27 percent, insurance and healthcare came second at 11 percent, ahead of government imposter scams (7 percent), credit and credit card scams (4 percent), and Google listing scams (2 percent).

That 11 percent figure is not proof that any specific vendor you buy from is doing anything wrong. It’s context: insurance is a category where enough of this volume is bad enough, often enough, that federal regulators track it as a distinct, named problem, second only to debt relief scams. When your agency’s outbound calling looks, from a carrier’s or a regulator’s perspective, statistically similar to the volume driving those complaints, and a purchased-lead-heavy calling pattern can look exactly like that, you inherit some of the scrutiny that comes with the category, whether or not your specific calls are the problem.

What Still Applies No Matter Where the Lead Came From

Before the vetting checklist, it’s worth separating what a vendor’s consent record can fix from what it can never fix. Buying leads from a well-documented vendor solves the evidence problem, whether you can show consent existed. It does not touch the underlying legal requirements every call carries regardless of source.

How to Vet an Insurance Lead Vendor Before You Buy

This is the part worth giving away completely, because an agency that does this work itself doesn’t need anyone’s help to keep buying leads safely.

1. Ask to see the exact consent language, not a description of it. A vendor should be able to show you the actual checkbox text or disclosure the consumer saw at the moment they opted in, not a summary like “fully TCPA compliant.” If a vendor can’t produce the literal wording, they likely can’t produce the record behind it either.
2. Ask whether the lead is exclusive or shared, and get it in writing. A shared lead sold to five buyers off one consent event is a fundamentally different risk profile than an exclusive lead sold once, and pricing alone won’t tell you which one you’re getting.
3. Ask for the timestamp and capture method. A legitimate vendor logs when consent was captured, from what page or form, and often what IP address or device signaled the submission. This is the kind of record that turns “the consumer agreed” from a claim into evidence.
4. Check whether the landing page identifies your business, or a category you fall into, by name. Consent to be contacted by “our marketing partners” in the abstract is weaker than consent to be contacted about “quotes from licensed local insurance agents,” and weakest of all when the page implies a government program the consumer never actually agreed to be marketed by.
5. Watch for domain names and branding that borrow government or nonprofit credibility. The FTC’s complaint against MediaAlpha specifically calls out domains like “ObamacarePlans.com” designed to look official. A vendor using that playbook is running exactly the model the FTC just spent $145 million signaling it will pursue.
6. Cross-check the vendor’s own compliance page against what they actually deliver. A polished “compliance” page is easy to publish. A sample consent record for an actual lead you bought, checked against the timestamp on your CRM, is much harder to fake.
7. Keep your own record of every purchased lead’s source, price, and vendor-provided consent evidence. If a complaint ever surfaces, “we bought it from a vendor who told us it was fine” is a weak defense. A dated file showing what you actually checked before dialing is a much stronger one.

If you’re already working with a vendor who checks every one of these boxes, this article shouldn’t change anything about how you buy leads. If you can’t answer most of these questions about your current vendor right now, that’s worth finding out before your next invoice, not after a complaint.

Where Your Own Database Fits Into This

Every one of the risks above shares a root cause: you’re relying on someone else’s record of someone else’s consent event. There’s an entire category of leads that doesn’t have this problem at all, the ones already sitting in your own CRM. A past client. A quote request from eight months ago that never closed. Someone who called your office directly and asked for a callback. For every one of those, you already have your own timestamped record of how that contact came to be a lead, because you were there when it happened.

That’s not a new idea; agencies have talked about “database reactivation” for years without necessarily connecting it to this specific risk. But the $145 million settlement is a concrete reason to weigh working the leads you already have, harder and more systematically, against buying fresh volume from a vendor you haven’t fully vetted.

Where a Managed AI Caller Fits, and Where It Doesn’t

To be precise about what TheAffordableAI actually is: a managed AI voice caller for insurance lead follow-up, outbound and inbound, with warm transfers, auto-booking, number warmup, and native HighLevel CRM sync. It is not a lead-generation company, does not sell consumer leads, and has no role in the consent chain behind any lead you already own or buy elsewhere. What it changes is what happens after you decide who to call.

If your agency is sitting on an aged database, past leads, expired quotes, former clients due for a policy review, working that list with your own documented consent is one of the lower-risk ways to fill calling volume, and it doesn’t require hiring a dedicated dialer team to do it at scale. Every plan includes number warmup and spam defense so those outbound calls have a better chance of landing, warm transfers so a real conversation reaches a licensed agent while the prospect is still on the line, and HighLevel sync so the call record, transcript, and disposition land on the same contact file your consent documentation already lives on.

Where this doesn’t help: if your agency’s entire pipeline depends on fresh, purchased, third-party leads and you have no meaningful database of your own to call instead, an AI caller doesn’t fix the underlying consent-chain problem, because the problem lives upstream of the call, at the point where the lead was generated and sold. In that case, the fix is vendor vetting, exactly the checklist above, not a faster or cheaper way to dial the same unverified numbers. If you want to hear what a compliant call actually sounds like before deciding anything, there’s a live demo on the homepage; putting your number in gets you one real call.

A Worked Example: Two Ways to Fill 500 Calling Slots a Month

Take an agency that wants to place roughly 500 outbound calls a month and is deciding how to fill that volume. This is illustrative arithmetic to make the tradeoff concrete, not a sourced industry benchmark, so substitute your own numbers before drawing a conclusion for your agency.

Path one: buy 500 fresh leads a month from a vendor you haven’t fully vetted. At a mid-range fresh lead price, the direct spend is real money before a single call happens, and every one of those 500 numbers carries whatever consent risk sits behind that vendor’s landing pages. If the vendor’s consent practices don’t hold up, the exposure applies across the full batch, and you have no way to know which specific leads are the problem until something goes wrong.

Path two: call 500 contacts from your own aged database instead, at TheAffordableAI’s Single Account rate of $0.20 a minute, dropping to $0.15 at bulk. On a three-minute average qualifying call, 500 calls runs roughly $300 to $400 in per-minute cost, plus the $200 monthly platform fee, against zero incremental lead-purchase spend, because the contacts were already yours. The consent question for each of those 500 contacts has one answer you can actually point to: your own CRM record of how and when they became a lead.

Neither path is free, and neither is automatically the right call for every agency; a database that’s too small or too stale to produce 500 real contacts a month still needs fresh volume from somewhere. But the comparison is worth running with your own numbers before assuming purchased volume is the only way to hit a calling target, especially for the portion of your pipeline sitting in old files nobody’s called back.

What You Actually Get

Concretely: a documented reason to trust, or not trust, every lead your agency dials, instead of a vendor’s word taken on faith. A framework for asking the four or five questions that separate a defensible lead purchase from an exposed one. And, if you choose to work it, a way to reach the leads you already own without adding a new vendor or a new consent question to the mix at all.

What you don’t get from any of this: a promise that vetting a vendor, or calling your own database, eliminates legal risk entirely. It doesn’t. Consent obligations, disclosure requirements, and opt-out rules still apply to every call regardless of where the lead came from, and using AI to place the call doesn’t shift that responsibility away from the licensed agent of record. What changes is whether you can actually show your work if someone ever asks you to.

Where This Doesn’t Apply

If your agency already runs a documented vendor-vetting process, checks consent language before buying, and knows which of its leads are exclusive versus shared, this article isn’t telling you to rip anything up. The settlement targets a specific, identifiable business model, ad-driven volume with unverifiable consent resold to many buyers, and a vendor that doesn’t operate that way isn’t the vendor the FTC is describing.

And if your bottleneck genuinely isn’t lead quality or consent risk but simple follow-up speed, how fast a fresh lead gets a real conversation, that’s a separate problem with a separate fix, and piling vendor-vetting concerns onto a speed problem won’t solve either one. Our companion piece on speed to lead covers that ground directly, and the FCC’s one-to-one consent rule guide covers the separate, and now-vacated, rulemaking fight over how many buyers one consent event could legally support.

Most agencies that buy leads have never asked a vendor to produce the actual consent record behind one. That’s not a moral failing; it’s how the industry has operated for years, and most of the time nothing goes wrong. The FTC’s $145 million settlement is a reminder that “most of the time” isn’t a compliance strategy, and that the questions in the checklist above take one phone call to a vendor to answer.