TCPA One-to-One Consent: What Medicare Agents Need to Know

AI Overview

The FCC’s one-to-one consent rule would have required telemarketing calls and texts covered by the rule to identify a single seller and relate to the interaction that generated consent. The Eleventh Circuit vacated the rule in January 2025, and the FCC subsequently removed the vacated language from its regulations. That does not eliminate all consent requirements. The TCPA, FCC rules, state laws, carrier policies, and Medicare regulations may impose separate obligations. Medicare Advantage TPMOs also face specific requirements for sharing beneficiary information with other TPMOs. Agents should document consent, its scope, the disclosure presented, and any revocation before relying on an automated follow-up workflow. This article provides general educational information, not legal advice.

TL;DR

• The FCC’s one-to-one consent rule was vacated before it took effect.
• That decision did not remove every TCPA consent requirement for calls and texts.
• In Bradford v. Sovereign Pest Control, the Fifth Circuit addressed prior express consent for prerecorded calls. Do not treat the decision as a blanket exemption for all marketing texts or automated communications.
• Medicare Advantage TPMO data-sharing rules are separate from the FCC’s one-to-one rule.
• Consumers’ revocation requests must be handled under the applicable FCC rules. The delay of a specific cross-topic revocation provision does not suspend all opt-out obligations.
• A lead form, phone number, or CRM record alone does not establish that every proposed contact is permitted.
• Record who consented, when and how consent was obtained, what was disclosed, which communications it covers, and any opt-outs.
• Review requirements with your compliance team or legal counsel, especially when contacting consumers across state lines.

TCPA One-to-One Consent: What Happened and What It Means for Medicare Follow-Up

If you have read several articles about one-to-one consent, you may have seen conflicting claims about whether the rule is in effect, was delayed, or was overturned.

The confusion comes from several separate developments: the FCC adopted the rule, a federal appeals court vacated it, the FCC later revised its regulations, and courts have continued to interpret the TCPA.

For Medicare agents, the practical question is not simply whether one-to-one consent survived. It is whether the particular call, text, data-sharing activity, or automated sequence is permitted under the requirements that apply to that activity.

That distinction matters when managing leads, setting up follow-up sequences, or evaluating Medicare lead management software.

This article summarizes federal court decisions, FCC actions, and Medicare Advantage regulations. It is general educational information, not legal advice. Rules and interpretations can change, and requirements may differ by state, carrier, communication method, and activity. Confirm your process with your compliance team or legal counsel before relying on it.

The One-to-One Consent Timeline

The key takeaway is that the one-to-one rule did not take effect. However, other federal, state, Medicare, and contractual requirements may still apply to your outreach.

What the One-to-One Rule Would Have Required

The FCC’s 2023 rule was designed to limit how lead generators collected and passed along consent for certain telemarketing robocalls and robotexts.

Under that rule, the consumer’s consent would have been limited to one identified seller at a time. The calls or texts also would have needed to be logically and topically related to the interaction that prompted the consent.

This would have affected lead-generation forms that presented a long list of potential sellers or partners under a single consent request.

The Eleventh Circuit vacated those restrictions in Insurance Marketing Coalition v. FCC. The FCC subsequently removed the vacated language from its rules.

What this does not mean: businesses can ignore consent, contact restrictions, or the terms under which a consumer supplied their information.

What the FCC Rules Mean Now

The FCC restored the earlier regulatory definition of prior express written consent after the court’s decision.

For covered telemarketing calls and texts to wireless numbers using an automatic telephone dialing system or an artificial or prerecorded voice, the FCC’s rules generally require prior express written consent. The applicable requirements depend on the communication, technology, exemptions, and legal interpretation.

A signed electronic agreement may qualify when it meets applicable requirements. The consent process should clearly explain what the consumer is authorizing and identify the relevant seller and telephone number as required by the applicable rule.

The important distinction is this:

• The FCC’s one-to-one and logical-and-topical restrictions were vacated.
• Other TCPA consent requirements were not automatically eliminated.
• The applicable consent standard can depend on the communication and the law governing it.

Review the FCC’s regulations implementing the TCPA before changing your consent process.

What the Fifth Circuit’s Bradford Decision Changes

In Bradford v. Sovereign Pest Control, the Fifth Circuit held that the TCPA’s statutory language required prior express consent, which can be oral or written, for the prerecorded calls at issue in that case. The court rejected the argument that the statute itself required prior express written consent for those calls.

The decision is important, but it needs to be read in context.

First, the case concerned prerecorded calls. It should not be described as a universal ruling that written consent is unnecessary for every automated text, marketing campaign, or contact method.

Second, the decision is from the Fifth Circuit. It is relevant in Texas, Louisiana, and Mississippi, but agents reaching consumers elsewhere should not assume that the same interpretation controls every situation.

Third, other requirements remain relevant. State telemarketing laws, Do-Not-Call requirements, Medicare regulations, and carrier or FMO policies may impose additional obligations.

For agents operating across multiple states, the safest approach is to evaluate the intended communication under the rules that actually apply rather than relying on the broadest possible interpretation of one court decision.

The Medicare Layer: CMS Rules Are Separate

The FCC’s one-to-one rule and CMS’s Medicare Advantage lead-sharing requirements address different issues.

Under 42 CFR § 422.2274(g)(4), personal beneficiary data collected by a third-party marketing organization (TPMO) for Medicare Advantage marketing or enrollment may be shared with another TPMO only when the beneficiary provides the required prior express written consent.

The disclosure must be clear and conspicuous, identify each entity receiving the data, and allow the beneficiary to accept or reject sharing with each individual TPMO.

CMS also has lead-generation disclosure requirements. Under 42 CFR § 422.2274(g)(3), applicable TPMO lead-generation activities must disclose that the beneficiary’s information will be provided to a licensed agent for future contact, using the format required for the communication.

These requirements are not the FCC’s one-to-one consent rule. The vacatur of that FCC rule does not itself remove CMS’s separate data-sharing obligations.

For Medicare Advantage marketing, review the current 42 CFR Part 422 regulations. Confirm the applicable Part D requirements separately under Part 423, as well as any carrier-specific procedures.

Who Sets Which Requirements?

These requirements may overlap. Satisfying one does not automatically satisfy the others.

Revocation Still Matters

Consumers may revoke consent using reasonable methods under the applicable FCC rules. Businesses should not assume that a revocation is invalid merely because the consumer did not use a preferred keyword or channel.

The FCC’s January 2026 order extended the delay for a specific provision that would apply certain revocations across unrelated robocalls and robotexts from the same caller. That delay should not be read as a general suspension of revocation requirements.

For day-to-day operations, your agency should have a clear process to:

• Identify and record revocation requests.
• Stop communications covered by the request.
• Route opt-outs to the systems and teams responsible for outreach.
• Retain a record of when the request was received and processed.
• Check the applicable deadline and scope under current rules.

Common text replies such as “STOP,” “CANCEL,” or “UNSUBSCRIBE” should be handled according to the applicable rules and your approved procedures. Do not rely on a narrowly configured keyword list without reviewing whether it recognizes the reasonable methods consumers may use.

The FCC has continued reviewing aspects of revocation requirements. Verify the current rule status before changing your procedures, and have counsel review how any new FCC action affects your workflow.

What This Means for Automated Medicare Follow-Up

Automation can help agents organize tasks and respond consistently. It should not decide that a lead can be contacted simply because a phone number is present in the CRM.

Before a call or text is sent, the workflow should account for the permission and restrictions that apply to the intended communication.

A practical process is:

1. Record the lead source. Keep information about where the lead came from and the form, advertisement, or interaction that generated it.
2. Preserve the consent evidence. Store the relevant disclosure, consent response, date, method, and other records needed to substantiate permission.
3. Identify the authorized party. Record the seller or entity covered by the consent where relevant, including the details required for any Medicare Advantage TPMO data sharing.
4. Record the communication scope. Document which telephone number, channels, and types of communications the consent covers, as supported by the actual disclosure and applicable law.
5. Check for restrictions. Review revocations, Do-Not-Call status, state requirements, carrier rules, and applicable CMS restrictions.
6. Gate the sequence. Configure the workflow so that a communication is not sent when required permission or other prerequisites are missing.
7. Retain evidence. Make the records retrievable for internal review, carrier inquiries, or an audit.

This is where Medicare follow-up automation can support an agency’s process. The system should help enforce documented procedures, not replace the legal review needed to establish whether a communication is permitted.

Consent Is Not the Same as a Scope of Appointment

A Scope of Appointment (SOA) documents the products a beneficiary has agreed to discuss at an applicable Medicare marketing appointment. It does not automatically authorize calls, texts, or other outreach.

Likewise, consent to receive a call or text does not automatically satisfy SOA requirements or authorize the discussion of products outside the agreed scope.

Keep these records distinct and make sure your team understands their separate purposes. For a broader overview, read Medicare compliance requirements for agents.

Common Consent and Follow-Up Mistakes

Treating a Lead Form as Universal Permission

A form submission does not necessarily authorize every entity, channel, or type of communication. Review the disclosure and evidence of consent before using the lead.

Assuming the One-to-One Rule’s Vacatur Eliminated Consent Requirements

The court vacated specific FCC restrictions. Other consent rules and separate CMS requirements may still apply.

Treating Bradford as a Universal Exemption

The Fifth Circuit decision concerned prerecorded calls. Do not extend it automatically to every text message, dialing method, state, or Medicare marketing scenario.

Ignoring CMS Data-Sharing Requirements

Permission to contact a beneficiary and permission to share personal beneficiary data with another TPMO are distinct questions. Review the CMS requirements that apply to each activity.

Processing Opt-Outs in Only One System

If multiple tools or teams handle communications, make sure revocation requests are recorded and routed appropriately. Review the applicable rules for scope and timing.

Assuming a CRM Makes the Campaign Compliant

A CRM may help store evidence, track restrictions, and control workflows when configured to do so. It does not independently establish valid consent or guarantee compliance.

What Should You Document?

A useful consent record should help an agency reconstruct what happened, rather than merely show a checkbox marked “consent.”

Consider documenting:

• Lead source and the relevant form or interaction.
• The consent disclosure and version presented.
• The consumer’s response and the date and method of collection.
• The entity or entities identified in the consent, where applicable.
• The telephone number and communication methods covered by the record.
• Any restrictions or limitations recorded.
• Revocation or opt-out requests, including when and how they were received.
• The date the restriction was applied to relevant communication workflows.
• The location of supporting evidence and the applicable retention procedure.

The exact required fields depend on the law, carrier, and activity. Treat this list as a practical documentation framework, not a claim that every field is independently mandated in every situation.

How a CRM Can Support the Process

A CRM can help organize lead information, communication history, follow-up tasks, consent records, and opt-out status. Depending on the platform and configuration, it may also support workflow rules that prevent a sequence from proceeding until required information is present.

When evaluating CRM software for Medicare agents, ask to see how the system handles:

• Consent evidence and lead-source information.
• Communication history and opt-out records.
• Restrictions on automated follow-up.
• User access and audit history.
• Exporting records for internal or carrier review.
• Updates to procedures when rules or carrier requirements change.

OmniReach CRM describes Medicare-focused workflows, automated follow-up, communication management, and related CRM capabilities. Confirm the specific features, permissions, integrations, and workflow controls available in your account before relying on them for a compliance process.

A CRM can support compliance operations, but the agent and agency remain responsible for the legality of their outreach and the accuracy of their records.

Conclusion

The FCC’s one-to-one consent rule was vacated, but that does not mean Medicare agents can contact every lead without reviewing consent.

The TCPA and FCC rules may still govern calls, texts, and revocations. The Fifth Circuit’s Bradford decision should be applied within its proper context. CMS has separate requirements for Medicare Advantage lead generation and sharing beneficiary data with other TPMOs. State laws and carrier or FMO policies can add further requirements.

The practical approach is to document permission carefully, retain the evidence, track revocations, and make the communication workflow check the applicable restrictions before a message is sent.

The goal is not simply to collect more data. It is to make sure your team can explain why a communication was sent and produce the supporting record when asked.

Make Consent Part of the Workflow

When evaluating a CRM with Medicare automation, ask how consent evidence, opt-outs, communication history, and sequence controls work together—and what records you can retrieve during a review.

You can review OmniReach pricing, explore its HIPAA and security information, or book a demo to discuss your workflow.

Automation should follow documented permission—not assume it exists.

Frequently Asked Questions