Who We Insure
TCPA Insurance for Lead Generation Companies: Class Actions, Consent Rules and Policy Exclusions
TCPA insurance is the policy lead generation companies ask about first and find hardest to buy. The Telephone Consumer Protection Act sets statutory damages per call or text, multiplies them across a campaign, and does not require the consumer to prove any harm, which makes a lead generator's dialer logs a class-action complaint waiting to be formatted. Most general liability, cyber, and media forms exclude it. The rest of the program — E&O for lead-quality disputes, media liability for advertising, cyber for consumer data, D&O — is conventional, but it is built around the exposure the market least wants to insure.
Why lead generation & performance marketing companies carry specialized insurance
The legal environment moved in 2025 without getting easier. A federal appeals court vacated the FCC's one-to-one consent rule before it took effect, but the underlying consent requirements remain, state mini-TCPA statutes add their own private rights of action, and plaintiffs increasingly sue lead buyers, who then pursue the generator under the purchase agreement's indemnity. The exposure is both direct and contractual. This guide covers TCPA coverage and the exclusions around it, professional and media liability for lead quality and advertising claims, cyber for consent records and consumer data, D&O, and crime, plus what lead buyers and carriers require and what underwriters ask about consent capture and affiliate oversight.
Who this guide is for
Written for founders, compliance officers, and general counsel at lead generation companies, performance marketing networks, comparison and quote sites, and call-transfer and appointment-setting operations. Lead generators in insurance, home services, education, solar, and financial products selling leads to buyers under purchase agreements; Performance marketing networks managing affiliate publishers who capture consent on the company's behalf; Comparison sites and pay-per-call operations transferring consumers to buyers' sales teams; Not for brand and creative agencies without outbound contact — the marketing agency guide covers them.
The risk profile of a lead generation company
Lead generation claims are statutory, contractual, and reputational. The statutory ones are the largest, and the contractual ones arrive from the company's own customers. Key exposures: TCPA and state mini-TCPA class actions over calls, texts, and prerecorded messages without the consent the statute requires, including claims that consent captured by an affiliate was invalid; Indemnity claims from lead buyers sued over leads the company supplied, under purchase agreements that pass TCPA liability back to the generator; E&O disputes over lead quality, exclusivity, duplicate or recycled leads, and fraudulent leads from affiliate traffic, with chargebacks escalating to litigation; False advertising and consumer-protection actions over landing-page claims, comparison methodology, and disclosures, and intellectual property claims over creative; Breaches of consumer applications, consent records, and call recordings, which are regulated as personal information and in some verticals as financial or health data; Regulatory investigations by the FTC and state attorneys general into consent practices, data sales, and affiliate conduct.
TCPA Coverage for lead generation & performance marketing companies
Standard general liability forms exclude distribution of material in violation of statutes, which removes TCPA claims, and most cyber and media forms carry similar exclusions. TCPA coverage is available from a small number of specialty markets as a standalone policy or as a sublimited endorsement to an E&O or media policy, usually on a defense-focused basis with a high retention and conditions on consent capture and scrubbing. It is the single most important placement for the category and the one that requires the most documentation.
Professional and Media Liability (E&O) for lead generation & performance marketing companies
Lead buyers sue over leads that were not what the contract promised — not exclusive, not consented, not real — and competitors and regulators challenge advertising. Combined professional and media liability covers the lead-quality dispute, the false-advertising and comparison claims, copyright and trademark issues in creative, and defamation. It is also the policy to which TCPA coverage is most often endorsed.
Cyber Liability for lead generation & performance marketing companies
Consumer applications, quote requests, and call recordings contain names, contact details, financial and health information depending on the vertical, and the consent records that are the company's legal defense. Cyber covers breach response, regulatory defense, and liability, and underwriters will ask how long consent evidence is retained and how it is protected, because losing it is both a breach and the loss of the TCPA defense.
Directors & Officers Liability for lead generation & performance marketing companies
Regulatory investigations into lead generation practices name officers, and investors in the sector have sued when enforcement or platform policy changes collapsed a business. D&O covers investigations within its terms and defends the company and individuals against investor and creditor claims.
Crime & Social-Engineering for lead generation & performance marketing companies
Affiliate payouts, buyer payments, and refunds move through accounts attackers watch. Crime with funds-transfer fraud and social-engineering coverage protects the payment flows; affiliate fraud itself — fabricated leads, bot traffic — is managed through verification and clawback terms rather than insurance.
Contract and certificate requirements
Lead purchase agreements are where the exposure is created. Buyers require the generator to represent that every lead was captured with TCPA-compliant consent, to indemnify the buyer against claims arising from the leads, and increasingly to carry TCPA coverage and E&O at stated limits with the buyer as additional insured. Carriers and large buyers in regulated verticals add audit rights and consent-record retention requirements. Affiliate and publisher agreements must flow the same obligations downstream — consent language, disclosure requirements, prohibited traffic sources, record retention, and indemnities — because the generator is liable for consent its affiliates captured. Underwriters read the affiliate agreement and the monitoring program as closely as the company's own landing pages.
What coverage costs
TCPA coverage pricing follows call and text volume, the use of prerecorded or automated dialing, the verticals served, the consent-capture method and the evidence retained, scrubbing practices against do-not-call and known-litigator lists, the share of leads from affiliates and the oversight of them, and the litigation history. Retentions are high and sublimits are common; the premium is secondary to whether the coverage can be bound at all. E&O and media pricing follows revenue, verticals, and dispute history. Cyber pricing turns on data sensitivity and retention. D&O reflects ownership and regulatory contact. Companies with first-party consent capture, documented compliance programs, and clean litigation records occupy a different market from affiliate-heavy operations.
What underwriters will ask for
TCPA underwriters want the consent trail from the consumer's click to the buyer's call. The application is a compliance audit in disguise. Have ready: Contact volumes by channel — calls, texts, prerecorded messages — and the dialing technology and vendors used; Consent capture: landing-page language, disclosures, timestamp and session evidence, retention period, and the share of leads from first-party versus affiliate sources; Scrubbing against national and state do-not-call lists, reassigned-number databases, and known-litigator lists, with frequency; Affiliate and publisher agreements, onboarding, monitoring, and termination history; Lead purchase agreements and the representations, indemnities, and insurance requirements they contain; TCPA and state telemarketing demands, suits, and settlements, and any regulatory contact.
Illustrative example: The affiliate's consent language
An affiliate publisher captures leads on a landing page whose consent disclosure omits the partner list required for the calls that follow. The leads are called by several buyers. A class action names the buyers and the generator, and the buyers tender their defense to the generator under the purchase agreements. TCPA coverage, if in force and if its conditions on consent capture were met, funds the defense within its sublimit and may extend to the buyers' indemnity claims. The affiliate agreement's indemnity runs the other way but is only as good as the affiliate's solvency. The consent records are the entire case.
Illustrative example: The leads that were sold three times
A buyer paying for exclusive leads discovers through consumer complaints that the same leads were sold to competitors. The buyer stops paying, demands a refund of a year's purchases, and sues for breach and fraud. Professional liability defends the breach and negligence allegations and may fund a settlement; fraud allegations, if proven, are excluded. The lead-delivery logs and the company's deduplication controls decide whether the exclusivity failure was error or practice.
Illustrative example: The breach of the consent database
A misconfigured storage bucket exposes two years of consumer applications and consent records, including financial details collected for a lending vertical. Consumers sue, a state attorney general opens an inquiry, and the company can no longer produce clean consent evidence for pending TCPA matters. Cyber funds the forensic response, notification, and regulatory defense, and responds to the consumer privacy claims. The lost consent evidence weakens the TCPA defenses in other matters, a cost no policy reimburses.
Is TCPA insurance available, and what does it cost?
It is available from a small number of specialty markets, usually as a sublimited endorsement to E&O or media liability or as a standalone policy, with high retentions and conditions on consent and scrubbing practices. Pricing follows contact volume, dialing methods, verticals, consent evidence, affiliate oversight, and litigation history. As of 2026, documented first-party consent capture is the main factor in whether it can be bound.
Why do most policies exclude TCPA claims?
Because statutory damages per contact, multiplied across campaigns, produce losses with no relationship to the premium a general liability or media policy charges. Most forms carry an exclusion for distribution of material in violation of statutes or a specific TCPA exclusion. Coverage has to be bought deliberately.
Are we liable for calls our lead buyers make?
Often, through the purchase agreement. Buyers require the generator to warrant consent and to indemnify them for claims arising from the leads, and plaintiffs name generators directly when the consent was captured on the generator's page. The indemnity and the consent record together decide how much of a buyer's claim lands on the generator.
Did the FCC's one-to-one consent rule change our exposure?
The rule was vacated by a federal appeals court in early 2025 before taking effect, so the single-seller consent requirement it would have imposed is not in force. The pre-existing consent requirements, the state statutes, and the buyers' contractual demands remain, and many buyers kept the one-to-one standard in their agreements anyway.
Does cyber insurance cover the consumer data we collect?
Yes, for breach response and liability, subject to the form's terms for regulated data and wrongful collection. Some cyber forms exclude claims arising from the intended sale or sharing of data, which describes the lead business, so the exclusion should be read before binding.
Caveats and common gaps
TCPA coverage is sublimited, defense-focused, and conditional in most forms; a failure to follow the consent and scrubbing practices represented in the application can void it. General liability, cyber, and media policies commonly exclude statutory telemarketing claims. Fraud and intentional acts are excluded everywhere. The legal environment for consent continues to change at the federal and state level.
Related guides
Insurance for Marketing Agencies — brand and creative agencies without outbound contact · Insurance for Call Center Companies — the outbound operations that place the calls · Insurance for AI Voice Agent Companies — automated outbound voice and its consent rules · Insurance for Adtech Companies · Insurance for Data Brokers — the data-sale side of the same compliance picture · Professional liability (E&O) coverage · Cyber liability coverage
Frequently asked questions
Is TCPA insurance available, and what does it cost?
It is available from a small number of specialty markets, usually as a sublimited endorsement to E&O or media liability or as a standalone policy, with high retentions and conditions on consent and scrubbing practices. Pricing follows contact volume, dialing methods, verticals, consent evidence, affiliate oversight, and litigation history. As of 2026, documented first-party consent capture is the main factor in whether it can be bound.
Why do most policies exclude TCPA claims?
Because statutory damages per contact, multiplied across campaigns, produce losses with no relationship to the premium a general liability or media policy charges. Most forms carry an exclusion for distribution of material in violation of statutes or a specific TCPA exclusion. Coverage has to be bought deliberately.
Are we liable for calls our lead buyers make?
Often, through the purchase agreement. Buyers require the generator to warrant consent and to indemnify them for claims arising from the leads, and plaintiffs name generators directly when the consent was captured on the generator's page. The indemnity and the consent record together decide how much of a buyer's claim lands on the generator.
Did the FCC's one-to-one consent rule change our exposure?
The rule was vacated by a federal appeals court in early 2025 before taking effect, so the single-seller consent requirement it would have imposed is not in force. The pre-existing consent requirements, the state statutes, and the buyers' contractual demands remain, and many buyers kept the one-to-one standard in their agreements anyway.
Does cyber insurance cover the consumer data we collect?
Yes, for breach response and liability, subject to the form's terms for regulated data and wrongful collection. Some cyber forms exclude claims arising from the intended sale or sharing of data, which describes the lead business, so the exclusion should be read before binding.
This material is general educational information, not legal, tax, or insurance advice. Coverage availability, policy terms, and regulatory requirements vary by state, carrier, and applicant.