Multi-State AI Outreach Compliance for IMO Networks (2026)
An IMO running AI-driven outreach across a downline licensed in Florida, Oklahoma, Washington, and Texas needs a multi-state AI outreach protocol before any campaign launches. The protocol sets one national standard on the strictest state rule the downline touches, tagging every lead and producer by state so calling hours, consent, and DNC suppression apply automatically.
Which states have the most restrictive telemarketing laws for insurance outreach?
Florida and Oklahoma run the most restrictive telemarketing rules an IMO's downline is likely to hit. Both cap outbound dialer contact at three attempts per 24 hours on the same subject matter, shrink the calling window to 8 a.m. to 8 p.m., and allow a private right of action with statutory damages.
Florida's FTSA requires prior express written consent for telephonic sales calls that use automated dialing, per fexmagnet's 2026 rundown of mini-TCPA state laws, and Oklahoma mirrors that structure with a broad automated-system definition and private enforcement exposure, according to lineshield's tracking of mini-TCPA rules agencies must watch. Maryland requires similar written consent for automated or prerecorded calls, while Texas runs a narrower weekday and Saturday window with a mandatory $10,000 security deposit bond per physical dialing location, per talk-q.com's 2025 outbound call regulations guide. Washington broadened its autodialer definition and stiffened penalties in 2022, and Maryland, New York, Georgia, Arizona, and Mississippi have all expanded telemarketing statutes in recent years, per getinsureleads.com's state-by-state regulation guide.
| State | Calling window (local time) | Contact cap (per 24 hrs) | Notable exposure |
|---|---|---|---|
| Florida | 8 a.m. to 8 p.m. | 3 calls/texts, same subject | Private right of action; FTSA written consent |
| Oklahoma | 8 a.m. to 8 p.m. | 3 calls/texts, same subject | Broad automated-system definition; private enforcement |
| Maryland | 8 a.m. to 8 p.m. | Not statutorily capped | Written consent required for automated/prerecorded calls |
| Texas | 9 a.m.-9 p.m. weekdays/Sat; noon-9 p.m. Sun | Not statutorily capped | $10,000 security deposit bond per dialing location |
| Washington | Federal baseline, tightened 2022 | Not statutorily capped | Broad autodialer definition; strong penalties |
What are the key requirements of a multi-state AI outreach protocol for IMO networks?
A multi-state AI outreach protocol for IMO networks requires five controls before any AI-generated call, text, or email reaches a consumer: jurisdiction tagging, dual DNC scrubbing, a documented consent standard, state-specific script variants, and downline vendor certification. At least 40 states maintain telemarketing rules beyond the federal baseline, per Wipfli's comparison of state telemarketing laws.
Each control has to run before a message leaves the building, not after a downline agency reports a complaint. In practice that looks like:
- Every lead record carries the consumer's state so the dialer or outreach engine applies that state's calling hours, consent rules, and disclosure language automatically.
- Every campaign scrubs against the National DNC Registry plus any applicable state registry before it launches, not on a rolling basis after the fact.
- Every AI-generated script exists in state-specific variants, with prohibited phrases and required disclosures checked before send.
- Every contracted agency, call center, and lead vendor certifies compliance and supplies audit logs on request.
Kadence is AI built to grow life insurance distribution, front to back office, and IMOs use it as the shared system every contracted agency logs outreach through, which keeps jurisdiction tags, consent records, and script variants centralized instead of scattered across dozens of separate agency logins and spreadsheets.
How does a multi-state compliance protocol impact day-to-day operations for an insurance agency?
A multi-state compliance protocol turns every downline agency's outreach into a rules-checked workflow instead of a free-for-all dial list. Each lead's state determines the calling window, consent standard, and script variant before a single call, text, or email goes out, across every contracted agency the IMO oversees.
Speed still matters in that workflow: prospects tend to choose whichever company reaches them first, and Kadence's Voice AI exists to close that response gap without an agent skipping the jurisdiction check first. But an IMO cannot let a downline agency's urgency to respond override the correct state's window or contact cap. Operationally, that means the outreach system checks jurisdiction first and speed second, every time, and the same platform that tracks downline persistency and override commissions, as covered in tracking downline persistency and override commissions, gives an IMO one place to see which contracted agencies also concentrate its compliance risk.
What are the latest DNC registry statistics and enforcement trends IMOs should watch?
The National Do Not Call Registry held about 258.5 million active registrations as of September 30, 2025, with more than 4.7 million new numbers added that fiscal year, according to the FTC's 2025 Do Not Call Registry Data Book. Complaint rates are climbing fastest in exactly the states a large downline is likely to touch.
Per 100,000 people, the highest FY2025 DNC complaint rates ran in Arizona (1,028), Tennessee (1,017), Nevada (960), Illinois (943), and Florida (933), according to allaboutcookies.org's tracking of states where complaints are surging. National complaints exceeded 2.6 million in 2025, up more than 25% from 2024, per the same analysis. TCPA litigation activity moved with those complaint numbers: Henson-Legal's TCPA compliance guide for insurance agents reports a 95% year-over-year increase in TCPA filings, a trend line an IMO with hundreds of downline agents cannot treat as background noise.
How should IMOs manage consent and suppression across multiple states?
IMOs manage consent and suppression across states by scrubbing every lead against the National DNC Registry plus any state-specific list before each campaign run, then logging the exact consent standard used for that lead. Eleven states maintain independent Do Not Call registries beyond the federal list, so a single national scrub is not sufficient.
Indiana, Pennsylvania, Colorado, and Texas each run their own state DNC lists that require separate scrubbing, per enzodialer's 50-state telemarketing guide. Ritterim's TCPA guidance for insurance agents recommends rescrubbing internal lists at least every 31 days, and manual opt-out requests must be suppressed within 10 days under the federal Telemarketing Sales Rule, per badassinsuranceleads.com's guidance on calling aged leads. Kadence's outreach layer ties consent status and suppression flags to each contact record at the point of dial, so a downline agent working an aged lead sees the current opt-out state instead of relying on memory or a stale export.
What specific rules apply to automated calls and texts under state mini-TCPA laws?
State mini-TCPA laws impose stricter consent and frequency rules on automated calls and texts than the federal TCPA baseline. Florida's FTSA and Maryland both require prior express written consent for automated or prerecorded sales calls, and Arizona now extends telemarketing rules to text messages with civil penalties up to $1,000 per violation.
At least 12 states have passed mini-TCPA laws stricter than the federal standard, per fexmagnet's 2026 state law tracker. The Federal Communications Commission's one-to-one consent rule requires consent language to name the specific company calling, which bans the bundled-consent lead lists many downline agencies historically relied on, per agenttech.io's TCPA guidance for insurance call centers. New York and Florida both require written consent before a prerecorded sales call, even to a landline, which flags a common downline mistake: treating a landline number as lower-risk than a mobile number.
How does the 'most restrictive state rule' principle work in practice?
The most restrictive state rule principle means an IMO builds one downline-wide outreach policy around the toughest state law it operates under, then applies that single policy everywhere. Every contracted agency follows Florida and Oklahoma's 8 a.m. to 8 p.m. window and three-touch cap, even when calling a lead in a looser state.
This is the practical fix for a downline that spans dozens of states and hundreds of producers: writing 40-plus separate rule sets into an outreach system invites the one exception that gets missed. An IMO that standardizes on the strictest rule set it actually touches accepts a marginally narrower calling window in easier states in exchange for one policy every agent can follow without checking a lookup table mid-dial.
Is there an insurance exemption to telemarketing and DNC rules?
No universal insurance exemption protects IMOs from telemarketing or DNC rules. Some state statutes carve out narrow exemptions for specific insurance solicitations, but federal and state preemption questions vary by law and by outreach method, so an IMO should confirm the exact exemption language with counsel before relying on it for any AI-driven campaign.
The fragmentation runs deep even within insurance-specific marketing rules: as of the end of 2024, 35 states had enacted legislation or regulation covering the areas addressed in NAIC Model 570 for life insurance and annuity advertising, per saifr.ai's compliance overview for life and annuity products. That patchwork means an exemption that holds in one state may not exist in the next state a downline agent is licensed in, which is why blanket exemption assumptions are one of the more common sources of downline compliance exposure.
What operational controls are needed for compliant AI-assisted insurance marketing?
Compliant AI-assisted insurance marketing needs policy enforcement points between content generation and send, not review after the fact. Every AI-generated script, email, or text should pass an automated check against the destination state's rule set, log which model or template produced it, and record who approved the final version before it reaches a lead.
Galileo.ai's framework for multi-agent regulatory compliance describes the safer operating model for agentic AI as human-governed autonomy: narrow use cases, explicit guardrails, audit logs, and regular compliance reviews rather than an AI system generating and sending outreach unsupervised. For an IMO, that translates into a checkpoint every contracted agency's outreach passes through automatically, which is closer to how Kadence structures its Voice AI: it answers, texts, and routes leads fast, but it never replaces the licensed producer, and the licensed producer is still the first call a consumer gets.
What penalties do IMOs face for violating state telemarketing laws?
IMOs face steep, stacking penalties for telemarketing violations across a large downline: TCPA statutory damages run $500 to $1,500 per violation, and knowing or willful violations can reach $25,000 per incident, according to DNC.com's TCPA compliance guide for insurance providers. Some states add their own per-call penalties on top of federal exposure.
Enzodialer's 50-state guide notes some state per-call penalties reaching $10,000, and Arizona's texting-specific penalties run up to $1,000 per violation, per Lewis Rice's analysis of state text-message laws. Wink, Inc.'s longstanding observation that a bigger IMO carries bigger compliance risk holds mathematically: a violation multiplied across a downline of hundreds of contracted agents scales exposure the same way it scales override revenue. Experior Financial's compliance guidance for U.S. IMOs points to more than 50 producers as the rough threshold where formal, written compliance policy stops being optional.
How do you build and maintain an auditable consent ledger for a multi-state downline?
An auditable consent ledger for a multi-state downline records, per lead, the state of the consumer, the consent standard applied, the timestamp and method of consent, and which contracted agent or vendor generated the outreach. That record has to survive a regulator or plaintiff's discovery request years after the campaign ran.
- Capture the state at the moment of lead intake, before any routing decision is made.
- Log the exact consent standard used (verbal, written, or prior express written) alongside the source of the lead.
- Timestamp every consent event and every opt-out event separately, never as a single combined field.
- Attach the contracted agent or downstream vendor of record to every outreach attempt, not just the final sale.
- Retain the ledger past the campaign window, since TCPA and mini-TCPA claims can surface long after a call was placed.
Kadence keeps this ledger tied to the same pipeline where a lead first lands, so an IMO auditing a single downline agency does not have to reconcile a separate consent spreadsheet against the CRM record.
What should an IMO include in its state-by-state compliance matrix?
A state-by-state compliance matrix for an IMO's downline should track five fields for every state reached: calling-hour windows, DNC registration and scrubbing rules, the consent standard for automated contact, text-message treatment, and required disclosure language. The practical benchmark is 100 percent suppression-list scrubbing before every campaign launch, documented state by state.
| Matrix field | What it captures | Example rule |
|---|---|---|
| Calling-hour window | Local start and end time for outbound dials | Texas: 9 a.m.-9 p.m. weekdays/Sat, noon-9 p.m. Sun |
| DNC registration | National plus applicable state registry | Indiana, PA, Colorado, Texas run separate state lists |
| Consent standard | Verbal, written, or prior express written | Florida FTSA and Maryland require written consent |
| Text-message treatment | Whether SMS is regulated separately from voice | Arizona penalties up to $1,000 per text violation |
| Disclosure language | Required caller identity, purpose, licensing disclosure | Mini-TCPA states require identity disclosure on open |
Building this once at the IMO level and pushing it down to every contracted agency, rather than expecting each agency to build its own, is the difference between a downline that scales cleanly and one that accumulates compliance debt with every new state license. on rolling this protocol out across a downline without building the state matrix by hand.
FAQ
Sources
- Mini-TCPA State Laws for Insurance Agents (2026)
- Insurance Regulations by State for Lead Buyers
- Mini-TCPA State Laws Insurance Agencies Must Track in 2026
- TCPA Compliance for Insurance Call Centers - AgentTech
- Navigating Telemarketing Laws: What Insurance Agents Need to Know About Calling Aged Leads
- Do-Not-Call Laws
- Telemarketing Laws by State: 50-State Guide
- Telemarketing and Do Not Call Policy
The steps
- Tag every lead and producer by state jurisdiction. Attach the consumer's state and the licensed producer's contract state to every lead record at intake so the outreach system can apply that state's calling window, consent rule, and disclosure language automatically before any dial, text, or email goes out.
- Scrub against national and state DNC lists before every launch. Run every campaign list against the National Do Not Call Registry plus any applicable state registry (Indiana, Pennsylvania, Colorado, and Texas each maintain their own) before launch, and rescrub the active list at least every 31 days.
- Apply state-specific consent and script rules to automated outreach. Maintain separate script and consent-capture variants for states with stricter mini-TCPA rules, such as Florida, Oklahoma, and Maryland, and require prior express written consent wherever a state statute demands it for automated or prerecorded contact.
- Set AI policy enforcement checkpoints before content sends. Insert an automated check between AI content generation and delivery that verifies the destination state's rule set, logs the model or template that produced the message, and records who approved the final version.
- Certify downline agencies and vendors with audit logs. Require every contracted agency, call center, and lead vendor in the downline to sign a compliance certification and supply audit logs on request, since the weakest compliance node in the hierarchy creates liability for the whole network.
Frequently asked questions
Do IMOs need separate sign-off for texting versus calling under state rules?
Yes. Several states, including Arizona, now regulate text messages separately from voice calls, with Arizona civil penalties reaching up to $1,000 per violation. An IMO's protocol should treat SMS as its own channel with its own consent standard and disclosure language, not a variant of the calling script.
How often should an IMO refresh its DNC suppression lists?
Outbound compliance programs should rescrub internal call lists against DNC registries at least every 31 days, and immediately after processing any opt-out request. Manual opt-outs must be suppressed within 10 days under the Telemarketing Sales Rule, so a downline-wide suppression refresh cannot run on a slower cycle than that.
Can an IMO be held liable for a downline agency's TCPA violation?
An IMO's compliance exposure grows with every contracted agency and vendor it adds, since network liability is often created by the weakest compliance node in the downline. Requiring certification and audit logs from every downstream agency and lead vendor is the standard defense against that shared exposure.
Written by
Kadence Team
Kadence is AI built to grow life insurance distribution, front to back office, purpose-built for producers, agencies, and IMO networks. We write about speed to lead, AI search, back-office tracking, and the systems that help producers and agencies win more policies.
Reviewed by the Kadence Team.
Book a demo
