The FCC changed the rules while you were busy selling.
On April 11, 2025, new opt-out requirements took effect. And on April 11, 2026, the most complex requirement yet will take force: omni-channel opt-outs that apply across all your communication systems.
Combined with CMS's October 2024 consent rules for TPMOs, you're now operating under the strictest compliance regime in TCPA history.
The stakes: TCPA settlements average $6.6 million. Some exceed $38 million. And CMS can terminate your carrier relationships immediately for non-compliance.
Here's what changed in 2025, what's coming in 2026, and how careCycle keeps you compliant automatically.
April 2025: Three Critical Changes
1. The 10-Day Window
You have 10 business days to process opt-outs. Down from 30.
Across all channels. Phone, text, email, mail.
Industry best practice? Immediate processing. The 10-day window is a ceiling, not a target.
2. "Any Reasonable Manner" Standard
Your systems must recognize diverse opt-out expressions. Not just "STOP."
Everything counts:
- "leave me alone"
- "don't text me"
- "remove me"
- "STOP CALLING"
Real cost: One Medicare agency kept texting after "STOP CALLING" (not their standard "STOP" keyword). Class action settled for $1.4 million.
3. Universal Opt-Outs (Effective Now)
When someone opts out of appointment reminders, they've opted out of everything. Marketing calls, texts, emails. From your entire organization.
The FCC rejected channel-specific opt-outs.
Exception: You can send one clarification text within 5 minutes. No marketing. No persuasion. If they don't respond, it's a universal opt-out.
April 2026: Cross-Channel Requirement
The big one. Delayed one year to give businesses time to comply.
What It Means
A beneficiary texts "STOP" to your AEP renewal campaign.
That opt-out now applies to:
- Welcome calls from retention
- Member care texts from service
- Marketing emails from your agency
- All communications. All departments. All systems.
Even if managed by different vendors with separate platforms.
Why It Was Delayed
The FCC granted a one-year extension after industry demonstrated the challenges:
Multiple business units with separate calling systems. Third-party vendors requiring coordination. Technical complexity of real-time cross-channel propagation. Risk of blocking legitimate communications (fraud alerts, service notifications).
The Clarification Window
You can send one confirmatory text to clarify scope.
Example: "You've opted out of appointment reminders. To stop ALL communications, reply YES. To keep member care texts, do nothing."
Rules:
- Send within 5 minutes
- No marketing content
- No persuasion
- If no response: treat as universal opt-out
Get it wrong? Multi-million dollar liability.
What This Means for Your Agency
Most Medicare agencies operate with sales teams using one dialing system, member care using a different platform, marketing emails through a third vendor, and SMS campaigns through yet another service.
By April 2026, a single opt-out must update all systems within 10 business days.
CMS Layer: One-to-One Consent for TPMOs
Effective October 1, 2024.
Any organization compensated for lead generation, marketing, or enrollment must obtain express written consent before sharing beneficiary data with another TPMO.
This applies even to related entities under the same FMO.
What Changed
Consent forms must list each TPMO individually. Separate unchecked checkboxes.
Hyperlinked lists of marketing partners? No longer compliant.
If you're purchasing leads: Verify consent documentation explicitly names your organization. Inherited consent from upstream partners equals catastrophic liability.
Two Games at Once: TCPA + CMS
TCPA (FCC) governs how you can call. Technology and timing.
CMS governs who you can call. Permissions and scope.
Both apply simultaneously to every Medicare call.
Key CMS Requirements Still in Force
Permission to Contact (PTC): Valid 12 months from signature.
48-Hour Scope of Appointment: Two-day cooling-off period.
Call Recording: All sales/marketing/enrollment calls recorded, retained 10 years.
TCPA compliance alone doesn't cover you. You need both.
Recent Settlements: The Cost of Non-Compliance
National Grid: $38.5M
Citibank: $29.5M
Assurance IQ: $21.875M (shut down 2024)
Realogy/Coldwell Banker: $20M
QuoteWizard: $19M
American Income Life: $14M
Common threads across every case:
- Inadequate consent documentation
- Failed to scrub DNC registries
- Wrong number calls from poor data
- Continued calling after opt-outs
- Vicarious liability from vendors
Traditional insurance policies don't cover TCPA liabilities. You bear the risk directly.
Lead Generation: Your Biggest Exposure
The Bilek v. Federal Insurance decision: You're liable for your lead generators' TCPA violations.
You can't point to vendor contracts. The liability is yours.
Red Flags for Problematic Leads
Suspiciously low pricing ($5-10 vs. typical $50-150). Vendors refusing consent documentation. "Exclusive" leads sold to multiple buyers. Aged leads with stale consent.
If a lead seems too cheap, it's missing the consent quality that costs millions in settlements.
How careCycle Keeps You Compliant
Our platform was built with TCPA and CMS compliance as core infrastructure. More importantly, we're ready for April 2026 because it's how we designed the system from day one.
Pre-Sale Suite
Inbound Pre-Screening:
- Real-time DNC scrubbing before every call
- Automatic time zone detection (8 AM to 9 PM local)
- Natural language opt-out recognition (beyond "STOP")
- Source tracking with consent verification
Outbound Pre-Qualification:
- Consent management with timestamped records
- IP addresses and geolocation data
- Reassigned Numbers Database integration
- Immediate opt-out processing (not 10 days, immediate)
Retention Suite
Welcome Calls & Post-Enrollment:
- CMS-compliant call recording (10-year retention)
- 48-hour SOA enforcement built-in
- Two-party consent notifications for all states
- PTC tracking with 12-month expiration alerts
Always-On Member Care:
- Universal opt-outs applied across all channels instantly
- Natural language processing for any opt-out expression
- State-specific rules engine (Florida 8 PM cutoff, Texas SMS consent, etc.)
- Immutable audit logs for litigation defense
Revenue Suite
AEP Renewals & Cross-Sell:
- List upload with automatic consent verification
- DNC scrubbing on every number before dialing
- Frequency caps preventing harassment
- Real-time compliance monitoring with human escalation
AI Voice Systems Done Right
The FCC ruled (February 2024): AI-generated voices require prior express written consent.
careCycle's AI assistants include explicit AI disclosure at the beginning of every call. Transparency builds trust. Meets regulatory requirements.
The 2026 Advantage
careCycle's omni-channel compliance:
Single source of truth: All campaigns reference one unified contact preferences database.
Real-time propagation: Opt-out in any campaign instantly updates all others.
Channel-agnostic: Works across voice, SMS, and (with integrations) email.
Vendor coordination: API pushes opt-outs to your CRM, email platform, other systems automatically.
Audit trail: Immutable logs showing exactly when and how each opt-out was processed.
When April 2026 arrives, careCycle customers will already be compliant.
Your Next Steps
- Audit your opt-out processing time. If it exceeds 10 days, you're accumulating violations at $500 to $1,500 per incident.
- Review your consent forms. If they don't list each TPMO individually with separate checkboxes, they're non-compliant.
- Test your keyword recognition. If your system only recognizes "STOP," you're violating April 2025 rules.
- Conduct vendor compliance audits. Request consent documentation from all lead sources. Test sample leads.
- Implement consent management technology. Excel spreadsheets won't protect you in court.
- Establish a TCPA Compliance Officer with real authority and budget.
Before April 2026
- Map your communication infrastructure. Document every system, vendor, channel used to contact beneficiaries.
- Design cross-channel opt-out workflows. How will a text opt-out stop emails from your marketing vendor?
- Evaluate centralized consent platforms. Omni-channel requirement demands unified systems, not disconnected tools.
- Begin vendor negotiations. Third-party platforms must receive and process opt-outs from your central system.
The Bottom Line
Average TCPA settlements ($6.6M) exceed the annual revenue of many Medicare agencies. A single class action can be terminal.
The agencies dominating Medicare marketing over the next decade are building compliance infrastructure today. Not waiting for the class action complaint.
careCycle's compliance infrastructure is built, tested, and protecting agencies across all campaign types.
See It in Action
Book a 15-minute demo to see how careCycle handles:
- Natural language opt-out recognition
- Real-time DNC scrubbing
- Automated consent management
- State-specific compliance that adjusts automatically
Last Updated: October 23, 2025
This post is for informational purposes only and does not constitute legal advice. Consult with specialized TCPA counsel for guidance specific to your situation.
Simple, practical insights. Straight to your inbox.
