Mass Tort Marketing Compliance: What Agencies Must Get Right

The Telephone Consumer Protection Act requires prior express written consent before a marketer calls or texts a mobile phone with an autodialer, an artificial or prerecorded voice, or an AI voice. Violations carry statutory damages of $500 per call or text, and up to $1,500 when the violation is willful or knowing, which is why TCPA class actions follow bad lead lists closely.

The FCC’s “one-to-one consent” rule, which would have required each consent to name a single seller, never took effect: the Eleventh Circuit vacated it in Insurance Marketing Coalition v. FCC in January 2025. Many law firms still require single-firm consent in their contracts, because it is the cleanest proof that a claimant agreed to hear from that firm and no one else.

Consumers can revoke consent by any reasonable means, and callers must honor a revocation within 10 business days. The FCC’s separate “stop one, stop all” requirement, which makes one opt-out cover every message type, has been delayed to January 31, 2027. Calls must also respect the National Do Not Call Registry and calling hours of 8 a.m. to 9 p.m. in the recipient’s time zone.

Several states add their own rules and private rights of action on top of the TCPA. Florida’s Telephone Solicitation Act (2021, amended in 2023) is the most litigated. Oklahoma’s Telephone Solicitation Act took effect in November 2022 and requires written consent for automated calls and texts. Maryland’s Stop the Spam Calls Act took effect in January 2024. Campaigns that cross state lines need to follow the strictest rule that applies to each claimant.

Every ad, landing page, and intake script that promotes a law firm is attorney advertising. ABA Model Rule 7.1 bars false or misleading communications, which covers implied results, invented urgency, and ads that look like government or medical notices. Rule 7.3 limits live person-to-person solicitation. Each state adopts its own version of these rules, and some, including Florida and Texas, require certain ads to be filed for review.

Paying for lead generation is allowed under Rule 7.2(b)(1), which lets a lawyer “pay the reasonable costs of advertisements or communications.” The rule’s comments add three conditions: the lead generator must not recommend the lawyer, the payment must comply with the fee rules, and the lead generator’s own communications must not be misleading. Florida goes further with Rule 4-7.22, which treats lead generators as “qualifying providers” that must meet registration and reporting requirements before Florida lawyers can accept their referrals.

Rule 5.4 bars lawyers from sharing legal fees with non-lawyers, so an agency cannot be paid a percentage of a settlement or attorney fee. Compliant pay-per-case arrangements use a flat marketing fee per signed retainer. Have bar counsel review any per-case pricing, because states differ on how far a per-retainer fee can go before it looks like a referral fee. Fee models are compared in mass tort marketing costs.

Drug and device torts collect health information on the first form: diagnoses, prescriptions, and treatment dates. HIPAA usually does not apply to marketers, but state health privacy laws can, including Washington’s My Health My Data Act, along with the FTC’s rules on health data. Ad platforms add their own limits: Meta and Google restrict targeting and remarketing based on health conditions, so tort campaigns rely on broad audiences, contextual placement, and qualifying questionnaires rather than health-based targeting. Several states also regulate legal ads about prescription drugs, including requirements that the ad warn viewers not to stop taking a medication without talking to their doctor.

The FTC’s Telemarketing Sales Rule reaches lead generators that assist or facilitate illegal calls, not just the callers. The agency has acted against “consent farm” websites that collect one consent and sell it to many buyers, including a 2024 order banning Response Tree from telemarketing and a 2025 settlement with MediaAlpha. For a law firm, the practical risk is buying leads from a vendor whose consent came from a site like that.