ACA call compliance: what marketers must disclose

So you bought a batch of ACA leads last month, ran them through your dialer, and now someone's asking for consent records from six weeks back. Can you actually produce them? If your answer is "uh, let me check," keep reading.

I've worked both sides of this business, buying calls and selling them. Compliance is where most people get sloppy. Not because they're careless. It's because the rules are scattered across four or five regulatory bodies, and nobody hands you a checklist on day one. Let's fix that.

What marketers legally have to disclose on an ACA call

Under the Telemarketing Sales Rule, sellers must state who's calling, that it's a sales call, and what's being offered, generally within the first 30 seconds. That applies whether the call is inbound or outbound, live or partially automated.

Here's the thing about that window. A lot of scripts I've reviewed bury the disclosure after the pitch, after a "how are you doing today," after some rapport-building nonsense. Backwards. The FTC doesn't care that you built rapport first. They care that the consumer knew, early, this was a sales call about health insurance, and knew who they were talking to.

A clean disclosure sounds like this: "This is Adam calling from [Agency Name], and I'm calling to talk with you about ACA health insurance plans you may qualify for." Name. Company. Product. Before a single qualifying question.

Consent isn't one-size-fits-all, and it trips up almost everyone

A consumer fills out a web form asking for a Medicare quote. Six weeks later they get a call about ACA marketplace plans. The agency assumes consent carries over because, hey, it's all "health insurance," right?

Wrong. Consent under the TCPA ties to the specific product and the context it was given in. A Medicare quote request isn't blanket permission to market ACA or under-65 plans. This matters because Medicare and ACA are regulated differently, sold differently, and often pushed through different downstream buyers. If your consent language doesn't name ACA or U65 products specifically, you're exposed.

I learned this one the expensive way, watching a client eat complaints because their lead vendor was recycling Medicare consent for ACA campaigns. The vendor swore it was fine. It was not fine. Read your consent language like a lawyer would, not like a marketer chasing a CPA target.

The TCPA basics you can't skip

The Telephone Consumer Protection Act requires prior express written consent before you place a marketing call or text using an autodialer or prerecorded voice to a cell phone. Violations run $500 to $1,500 per call. Per call, not per campaign. Run a list of 10,000 numbers without clean consent and do the math. Ugly, fast.

A few things worth knowing. Written consent needs to be specific, naming the seller or sellers who may call, plus the topic. Consent from vague or pre-checked boxes has been challenged repeatedly in court, and it's a soft spot in a lot of vendor agreements. Verbal consent recordings help, but they don't replace written consent when an autodialer or prerecorded voice is involved. And consent can be revoked anytime, by any reasonable method the consumer picks, not just the one you'd prefer.

If you're buying calls in bulk through a platform like Ringba X, ask suppliers directly how consent is captured and stored. Don't take "we're compliant" as an answer. Ask to see the actual language shown to the consumer.

CMS rules, and why they bleed into ACA work

CMS marketing rules for Medicare Advantage and Part D require agents to record calls in full, including enrollment, and keep those recordings for about 10 years. Technically that's a Medicare rule. Practically, plenty of agencies work both Medicare and ACA books, and once you've built recording infrastructure for Medicare, it's smart to apply the same standard to ACA.

Ten years is a long window. Most CRMs and dialers aren't built for that by default, so you need an actual storage plan, not a "we'll figure it out later" shrug. Carrier audits and CMS reviews commonly ask for recordings alongside consent documentation, timestamps, IP addresses, and the exact consent text a consumer saw on a web form. Can't produce all of that together, in context? You've got a gap.

The one-to-one consent rule situation

The FCC's one-to-one consent rule came out of a 2023 order aimed at lead generators letting one consumer's consent get spread across a pile of unaffiliated marketing partners. Under the rule as written, a single click of consent can't cover ten buyers who have nothing to do with each other.

Implementation has shifted thanks to ongoing litigation, so I won't give you a hard effective date, it may have moved again by the time you're reading this. What I will say: verify current enforcement status before building a lead funnel that assumes shared consent is fine. If you're sourcing traffic, ask your vendor point blank whether their consent language names your business specifically, or a whole list of "marketing partners." That second one is exactly what this rule targets.

Don't forget the Do Not Call Registry

DNC violations aren't cheap. Penalties commonly cited run $10,000 to $51,000 or more per call, enforced jointly by the FTC and FCC, adjusted periodically for inflation. Here's what people forget: being a licensed, appointed agent doesn't exempt you from honoring a DNC request or a consumer's specific consent scope. Licensing covers your ability to sell insurance. It doesn't cover your obligation to respect telemarketing law.

State laws add another layer

Florida, Oklahoma, and Washington have their own mini-TCPA statutes, sometimes with broader autodialer definitions or higher statutory damages than federal law. Running calls into these states? Federal compliance alone won't cut it. Check state-specific requirements before scaling a campaign there.

One takeaway: compliance isn't a document you file once. It's infrastructure, maintained call after call.

If you're sourcing traffic and want a platform built with call tracking and compliance documentation in mind, look at how Buy calls programs structure consent and recording requirements before committing budget. And if ACA is your focus specifically, the same diligence applies when you buy health insurance calls from any vendor, new or established.

FAQ

Does a TCPA violation require intent to be enforced? No. Strict liability generally applies. Even accidental violations, like calling a number that ported to a cell phone after consent was given for a landline, can trigger penalties.

Can I reuse consent from a Medicare campaign for ACA marketing? Generally no. Consent ties to the specific product and context. Treat ACA and Medicare consent as separate unless your language explicitly covers both.

How long should I keep call recordings for ACA leads? There's no single federal mandate specific to ACA the way CMS mandates 10 years for Medicare Advantage and Part D. Many agencies apply that same 10-year standard voluntarily anyway, since audits often ask for historical records.

What's the safest way to disclose the sales purpose on a call? State your name, your company, and the product within the first 30 seconds, before any qualifying questions. Don't bury it after small talk.

Are pre-checked consent boxes on web forms still usable? Risky. Courts and regulators have challenged vague or pre-checked consent repeatedly. Use clear, affirmative, product-specific consent language instead.