New York Telemarketing Law: What It Costs Insurance Agents

Is cold-calling an insurance lead legal in New York? Mostly, if the number isn’t on the National Do Not Call Registry, or if you have a documented basis that exempts it, and if your opening disclosure covers who you are and who you’re calling for within the first 30 seconds. New York General Business Law §399-z doesn’t ban telemarketing to insurance shoppers. It regulates how that call has to happen, and the New York Department of State has shown it will enforce §399-z directly against insurance sellers by name: Choice Health Insurance LLC, a subsidiary of Alight Solutions LLC, settled for $257,400 in 2024; SelectQuote Insurance Services settled for $132,000 in March 2025; and Odyssey Insurance Agency LLC settled for $44,000 in a 2025 consent order. All three cases cite the identical underlying conduct, calling numbers that had been sitting on the National Do Not Call Registry for more than 31 days, with no documented exemption on file. This article works through exactly what GBL §399-z and its companion statute, §399-p, require, how New York’s one-party consent rule for call recording differs from states most agencies already know about, how the state law stacks with the federal TCPA, and what the real enforcement record shows it costs to get this wrong, all verified against New York’s and the federal government’s own text and filings this session, on October 24, 2026.

What New York’s Telemarketing Law Actually Regulates

What does GBL §399-z actually cover, in terms an agent dialing a Tuesday afternoon list would recognize? The statute, administered by the New York Department of State, defines “telemarketing” as more than one call or text in a single campaign made to induce a payment for goods or services. That’s broad enough to cover an insurance agent’s outbound campaign without any special insurance carve-out, and broad enough that a single call to a single lead generally isn’t itself “telemarketing” under this definition, though it can still trigger other provisions, including the recording-disclosure and caller-ID rules discussed below.

The statute excludes two categories from its restricted “unsolicited telemarketing sales call” definition, and both matter to an agency’s day-to-day list management. First, a call made in response to the customer’s own express request isn’t unsolicited; a lead who filled out a quote-request form asking to be called falls here. Second, a call made within an established business relationship that the customer hasn’t terminated isn’t unsolicited either; a current client calling in, or one you’re calling about their own existing policy, generally falls here, up until the point they tell you to stop. Neither exclusion covers a name someone else gave you. A client who hands you their neighbor’s number hasn’t created an established business relationship between you and the neighbor, and the neighbor hasn’t requested anything from you directly.

Three operational requirements fall directly out of the statute’s text, and each one is a place agencies actually get caught. Calling hours are limited to 8:00 a.m. to 9:00 p.m. at the customer’s location, not the caller’s, which matters for an agency calling a New York list from a different time zone. The opening disclosure has to happen within 30 seconds of the call starting: the caller’s name, the name of any seller on whose behalf the call is placed, and the customer’s option to be added to that seller’s own entity-specific do-not-call list, all up front, followed by disclosure of whether the call is recorded and the purpose of the call before any sales pitch proceeds. Caller ID cannot be knowingly manipulated to show false or misleading information, though displaying the seller’s own accurate name or number is fine. None of these three requirements has anything to do with whether the lead is on the national registry; they apply to every covered call, registry status aside.

The Three New York Consent Orders Against Insurance Sellers

Here’s what actually happens when an insurance seller gets this wrong in New York, drawn from three real, signed Department of State consent orders, not a hypothetical.

Choice Health Insurance, LLC, a subsidiary of Alight Solutions LLC, settled an enforcement action, case 2024-C-032100, for a civil penalty of $257,400. The order states the Department’s allegation plainly: Choice Health Insurance “utilizes telemarketing and ha[s] made or caused to be made unsolicited telemarketing sales calls to customers when said customer’s telephone numbers were on the national do-not-call registry,” for a documented 31-day-plus period before the calls. The company didn’t contest the violations and agreed to the penalty within ten business days of the order’s execution. The order also notes Choice Health Insurance had already stopped telemarketing in New York State by the time the matter settled.

SelectQuote Insurance Services settled a separate matter in March 2025 for a civil penalty of $132,000, again under GBL §399-z, again for unsolicited telemarketing sales calls to registered numbers. The order required payment by April 7, 2025, and closed the Department’s investigation into any violations predating the order, with prejudice, contingent on SelectQuote’s compliance going forward.

Odyssey Insurance Agency LLC settled case 2024-C-093001 for $44,000, structured as five monthly installments of $7,333.33 running from July through November 2025, rather than a lump sum. The underlying allegation is the same pattern again: unsolicited telemarketing sales calls to customers whose numbers were on the national registry. The order adds a condition the other two don’t spell out as explicitly: Odyssey has to register as a telemarketer in New York under GBL §399-p before conducting any future telemarketing activity, and can’t be found in violation of §399-z again for three years without the settlement’s protections lapsing.

Read those three cases side by side and a pattern emerges that has nothing to do with lead quality or sales technique. Every one of them traces back to the same mechanical failure: a number stayed on a call list past the point where the National Do Not Call Registry made it off-limits, and nothing in the company’s process caught it before the call went out. None of the orders allege a defective product, a misleading quote, or a bad-faith sales tactic. They allege a list hygiene failure, repeated at volume, across a customer base large enough to generate a six-figure settlement in two of the three cases.

How New York’s Penalty Compares to the Federal Floor

New York’s $20,000-per-violation ceiling under §399-z, and the related $2,000-per-call cap under §399-p (itself capped at $20,000 within any 72-hour period), sit below the federal maximum for the same underlying conduct. The FTC’s Telemarketing Sales Rule, 16 CFR Part 310, carries a civil penalty of up to $53,088 per violation under the FTC’s current inflation-adjusted penalty schedule, with each individual call potentially counted as a separate violation. On top of the regulatory penalty, a consumer who receives a call in violation of the TCPA can bring a private lawsuit and recover $500 in statutory damages per violation, or up to $1,500 per violation if a court finds the violation was willful or knowing, under 47 U.S.C. §227(b)(3). That last number is deceptively small-sounding until it’s multiplied by a call list; a 2,000-number list dialed once without a valid exemption is $1,000,000 in potential exposure at the willful rate, before a regulator even opens a file.

The practical read isn’t “New York is lenient.” It’s that New York is simply one of several agencies and private plaintiffs with independent authority to act on the same call, each applying a different test and a different penalty structure. A call can clear GBL §399-z’s documented-exemption standard and still trigger TCPA exposure if it was autodialed to a wireless number without the TCPA’s own written consent. The three consent orders above are New York’s enforcement record specifically; none of them says anything about whether the same conduct also drew FTC or private TCPA action, which is a separate question an agency in this position would still need to answer.

If you want to hear what a compliant, fast first call actually sounds like before deciding anything about your own process, there’s a demo call on the homepage: theaffordableai.com.

New York’s One-Party Consent Rule for Recording Calls

Agencies that already script around California, Florida, or Illinois, all two-party consent states, sometimes assume New York works the same way. It doesn’t. New York Penal Law §250.00 defines wiretapping as the unlawful overhearing or recording of a telephonic communication “without the consent of either the sender or receiver,” meaning the conduct is only covered when neither party consents, which makes one party’s consent sufficient as a matter of statutory text. The companion provision, covering “mechanical overhearing of a conversation,” states its own consent threshold directly: it applies “without the consent of at least one party thereto.” Either way the statute is read, an agent who is a participant on the call can lawfully record it under New York law without separately notifying or obtaining the other party’s consent. Recording a call you aren’t a party to, without any party’s consent, is eavesdropping under Penal Law §250.05, a class E felony.

Building the Consent-Basis Check Into Your Own Process

None of the compliance work here requires buying a platform. It requires tagging every lead with a documented basis for the call, before volume makes manual judgment unreliable, and routing the channel off that tag rather than off list source or lead cost.

1. Timestamp a National DNC Registry check against every number before the first call, and re-check every 31 days for any number still in an active campaign. A check from 40 days ago doesn’t satisfy either New York’s or the FTC’s safe harbor, regardless of how recently you dialed the number before that.
2. Log the specific exemption basis for any registered number you still call: an established business relationship not yet terminated by the customer, or the customer’s own documented request for contact. “I think this is an existing client” is not a logged basis; a CRM field with a date and a source is.
3. Build the 30-second opening disclosure into your script itself, not into agent training alone: your name, the entity you’re calling for, the entity-specific opt-out offer, whether the call is recorded, and the call’s purpose, in that order, before any sales content.
4. Exclude referral names from any automated or bulk-dialed campaign. A referral doesn’t create an established business relationship with the person referred, and it isn’t that person’s own request for contact, so it doesn’t clear the unsolicited-call exemption on its own.
5. Separate your GBL §399-z documentation from your TCPA consent documentation. They’re different legal tests answering different questions; a lead cleared under one framework can still be unresolved under the other, especially for any autodialed or AI-placed call to a wireless number.
6. Keep telemarketing records for the full 24 months GBL §399-z requires, not just whatever your CRM retains by default, since that’s the specific retention window New York’s own statute sets.
7. Register as a telemarketer under GBL §399-p before conducting covered telemarketing activity in New York, a requirement the Odyssey consent order calls out explicitly as a forward-looking condition, and one worth confirming your agency already satisfies rather than assuming.

You can build this yourself with a CRM custom field, a recurring calendar reminder to re-pull the registry, and a disciplined intake habit. Plenty of agencies do exactly that, and it costs nothing but staff time disciplined enough to do it every 31 days without fail, which is the part that tends to slip once volume climbs.

A Worked Example: One List, Two Outcomes

An agency buys a shared list of 1,200 New York prospects in January and checks it against the National Do Not Call Registry once, at purchase. By March, roughly nine weeks later, the agency is still dialing the same list without a second scrub. Some unknown share of those 1,200 numbers has since joined the registry, or had been on it longer than 31 days at the original check and gotten missed. Every one of those calls, made without a current scrub or a documented exemption, is a separate potential violation under GBL §399-z, a separate potential violation under the FTC’s TSR, and, if any of the calls were autodialed or AI-placed to a wireless number without TCPA consent, separate exposure to a $500-to-$1,500 private claim per call on top of the regulatory penalties. The three consent orders cited earlier didn’t arise from one bad call each; they arose from exactly this pattern, repeated across a large enough customer base to draw a formal investigation.

Run the same list with a 31-day re-scrub built into the calendar, and the math changes completely. Say 80 of the original 1,200 numbers have joined the registry by March. A re-scrub removes those 80 before the next calling cycle, or routes them to a documented-exemption check if the agency believes an established business relationship still applies. The agency loses access to 80 numbers it was never safely entitled to call in the first place, not 80 numbers it’s “giving up.” Everything else proceeds exactly as before, at the cost of one recurring calendar task, not a six-figure settlement five states don’t want to find out about the hard way.

How We Solve It

TheAffordableAI is a managed AI caller, not a compliance platform, and it doesn’t replace the work of scrubbing a list against the National Do Not Call Registry or logging a lead’s documented exemption basis. What it does, per TheAffordableAI’s own Features page: it fires outbound within seconds of a lead landing in your CRM, so a fresh, freshly-scrubbed New York lead who just requested a quote, the cleanest kind of GBL §399-z-exempt contact, gets reached while that request is still current rather than two days later. It syncs two-way with HighLevel, which is exactly where a DNC-check date, an exemption basis, and a TCPA consent flag all belong if you’re building the tagging system described above into a single system of record instead of a spreadsheet nobody checks. And every call’s recording and transcript write back automatically, supporting the 24-month record-retention requirement GBL §399-z sets, without a separate manual export step.

Pricing, since the comparisons above lean on it: Single Account runs $200 a month plus a $500 one-time setup fee, at $0.20 a minute, dropping toward $0.15 at bulk volume. Agency runs $500 a month plus a $1,000 one-time setup fee, at $0.18 a minute, dropping toward $0.16 at bulk volume, and adds routing across 20-plus agents, useful if your New York book is large enough that one person checking exemption tags by hand has become the bottleneck. Both run month to month with no long-term contract, per TheAffordableAI’s pricing page, fetched for this article on October 24, 2026. The math above uses $0.20 a minute because that’s what a Single Account costs; run it against your own New York call volume at theaffordableai.com/pricing before deciding anything, since the live page is the source of truth, not this article.

Where This Doesn’t Fix Anything

Say it plainly: no calling platform, AI or human, turns an unsolicited call into a solicited one, and no amount of speed helps a number that was never safely callable in the first place. If your list hasn’t been scrubbed against the registry in the last 31 days, the fix is scrubbing it, not calling it faster or with better software. A speed advantage only matters once a lead has already cleared the exemption bar; it does nothing for the ones that haven’t, and routing an unscrubbed list through an automated AI caller multiplies the exposure described above rather than reducing it, since every one of those calls becomes an AI-placed call to a number that may also trigger separate TCPA consent requirements. And if your New York volume is small enough that one person can run a monthly DNC recheck and log exemptions by hand in under an hour, the economics in this article may not move the needle for your agency specifically. Run your own list size and calling volume against the numbers above before assuming otherwise.

What You Get When the List Hygiene Is Right

A documented DNC check date and a logged exemption basis decide what you’re allowed to do with a New York number before lead cost, lead source, or calling speed enters the picture at all. Get that backwards, and an agency can run a fast, well-funded, technically impressive calling operation that’s still generating unsolicited contacts by the hundreds every quarter, invisible until a complaint or an investigation surfaces the pattern, the way it apparently did for three different insurance sellers in New York over the past two years. Get it right, and speed stops competing with compliance: a lead with a current scrub and a logged exemption is exactly the lead worth calling fastest, and it’s also the one New York’s statute never restricted in the first place. The three consent orders above didn’t cost those companies speed. They cost them a combined $433,400, over a failure that a recurring 31-day calendar reminder would have caught before a single dollar of it came due.

No contracts either way, so the risk of testing any of this against one month of New York volume is one month’s subscription, not a multi-year commitment.