One Year Later: CMS’s “One-to-One” Consent Rule Still Shapes Medicare Marketing
Open Enrollment runs from October 15 to December 7, and with it comes the annual flood of Medicare marketing. But here’s the catch: even though the FCC’s “one-to-one” consent rule was vacated this summer, the Centers for Medicare & Medicaid Services (CMS) version is still very much alive. If you market or sell Medicare Advantage (MA) or Part D plans, this rule governs how you collect, share, and use beneficiary data.
The Rule That Refused to Die
CMS’s Final Rule limits how third-party marketing organizations (TPMOs) handle Medicare leads by requiring clear, specific consent before any beneficiary information is shared. A TPMO may only share beneficiary data if the individual has given prior express written consent naming each company authorized to contact them. Broad consent is not allowed.
Live transfers remain permitted when the beneficiary gives verbal consent during the call. The rule applies to all Medicare-related marketing, whether calls are made manually or with an autodialer, because CMS regulates the data sharing itself, not the dialing method. These requirements took effect October 1, 2024, and remain in force.
CMS enacted the rule to protect seniors from unwanted calls and ensure they control who contacts them. Even TPMOs under the same parent or field marketing group must obtain separate consent to share or use data.
While the FCC’s “one-to-one” consent rule, designed to close the “lead generator loophole,” was vacated in July 2025, CMS’s rule wasn’t part of that case and remains fully enforceable.
What Marketers Should Be Doing Now
If you market or buy Medicare leads, make sure you’re compliant:
Each lead must include written “one-to-one” consent naming your company.
Affiliated companies need separate consent to share data.
Aged leads collected before October 2024 aren’t valid without new consent.
Live transfers require verbal consent.
All calls must still follow the TCPA, including do-not-call rules.
Even with the FCC’s “one-to-one” consent rule gone, CMS’s consent rule continues to define compliant Medicare marketing.