ACA Lead Vendors: How to Vet One Before You Buy Leads

Why ACA lead vendors are a compliance decision, not just a price decision

Regulators have been looking hard at where Marketplace enrollments come from. According to KFF's review of fraud in Marketplace enrollment (opens in a new tab), fraud allegations have focused primarily not on consumers but on agents, brokers, web brokers and the third parties that help them generate business. That last group includes lead vendors.

The scale is not small. KFF reports that between January and August 2024, CMS received 183,553 complaints of unauthorized enrollments and 90,863 complaints of unauthorized plan switching on HealthCare.gov. KFF also notes CMS suspended 850 brokers between June and October 2024 for reasonable suspicion of fraudulent or abusive behavior tied to those issues.

Brokers are central to this market: KFF's analysis of CMS data found brokers assisted 55% of active plan selections in HealthCare.gov states for the 2021 plan year, rising to 78% for 2024. KFF also points out that the ACA civil penalty for knowingly and willfully providing false information can reach $250,000 and applies to any person, including an agent. A bad lead source can put your NPN in that conversation.

Types of ACA lead companies and what each one sells

Before you compare vendors, compare products. Two vendors quoting different prices may not be selling the same thing at all.

• Real-time exclusive leads: delivered seconds after the form fill and sold to you only. Highest price per lead, least competition on the phone.
• Real-time shared leads: the same consumer is sold to several agents. Cheaper, but you are racing others and the consumer may get a flood of calls.
• Aged leads: older records sold at a discount. Useful for some agents, but intent and consent quality fade fast.
• Live transfers and inbound calls: a call center or ad routes a live consumer to you. You pay for the conversation, so ask exactly how that consumer was reached.

If you are weighing the first two, our breakdown of exclusive vs shared health insurance leads walks through the true cost per enrollment. For the discount tier, see whether aged health insurance leads are worth it for ACA.

How to choose a lead vendor: questions to ask on the first call

CMS gives you the outline. In its Marketplace compliance presentation for agents and brokers (opens in a new tab), CMS strongly encourages agents to understand how a lead company generates its leads, to investigate its creative materials so they do not mislead or confuse consumers, and to understand how it prices and sells leads so you avoid buying one already sold to multiple agents. Turn that into a script:

1. Where does your traffic come from? Name the channels: search, social, display, affiliates.
2. Can I see every ad and landing page that produces my leads, including any run by subvendors?
3. Does the form name who will contact the consumer, or does it imply a government program?
4. How many times is each lead sold? Will you put that number in the contract?
5. What consent language does the consumer see, and can I get the timestamped record for each lead?
6. How old is a lead at the moment it reaches me?
7. What is your return or credit policy for disconnected numbers, fake names and duplicates?
8. Do you ever resell, share or reuse the leads I buy, or the data from my calls?

Write the answers down. A vendor that answers vaguely on questions two, four and five is telling you what you need to know.

Red flags in a lead vendor's ad creative

Ask for screenshots, then read them as a consumer would. CMS lists marketing don'ts that include claiming to represent CMS, the Marketplace, HealthCare.gov or an issuer, and promising free or low-cost plans to all consumers. If you use a third party, CMS strongly recommends confirming its advertising is not misleading or coercive. The CMS guidelines for compliant Marketplace advertising (opens in a new tab) are worth reading before you review anything.

• Government-style logos, seals or wording like "official benefits program".
• Headlines promising $0 plans or cash cards to everyone.
• Forms that ask for a ZIP code and phone number but never say an agent will call.
• Quizzes or giveaways that bury the insurance purpose.
• A vendor that refuses to show creative because it is "proprietary".

The FTC has pursued this issue too. Its write-up of a recent case, FTC guidance on deceptive health insurance lead generation (opens in a new tab), describes allegations of misleading ads and the sale of health insurance leads, and the resulting settlement. Plenty of third-party lead generation is legitimate, but the case shows why what the consumer thought they were requesting matters.

Check the consent record before you buy leads

This section is general information, not legal advice. Confirm your process with your compliance resources, your carriers and your state rules.

Buying a lead does not transfer your obligations to the vendor. Per the same CMS presentation, when you use information purchased from lead generators you must obtain and document consumer consent and keep that record for at least 10 years. Any contracted third parties must also follow the rules on use and disclosure of personal information.

CMS says consent documentation must include, at minimum, the scope, purpose and duration of the consent; the date it was given; the consumer's or authorized representative's name; the name of the agent, broker or agency receiving consent; and a process for rescinding it. The consumer must take an action to produce it.

Here is the practical point. A vendor's "agree to be contacted" checkbox is not the same as the consumer's consent for you to work on their Marketplace application. Plan to collect your own documented consent on the first call or by e-signature, and store it where you can pull it up years from now.

Calling vendor leads: Telemarketing Sales Rule and TCPA basics

Most purchased leads end in a phone call, so the calling rules apply to you. The FTC's guide to complying with the Telemarketing Sales Rule (opens in a new tab) says a business may be subject to the TSR if its campaigns involve any calls across state lines, outbound or inbound in response to advertising.

According to the FTC, key TSR provisions include required disclosures, a ban on misrepresentations, limits on calling times, Caller ID transmission, limits on abandoned calls, and keeping specific business records for two years. Calling before 8 a.m. or after 9 p.m. and interfering with a consumer's Do Not Call request are defined as abusive. The FTC lists a civil penalty of $53,088 per violation for failing to disclose required information truthfully and clearly.

The FTC also notes that the FCC enforces the TCPA, which regulates telemarketing separately, and that many states have their own laws. Build a short checklist into your dialer this week:

• Calls only between 8 a.m. and 9 p.m. in the consumer's local time, or tighter if your state requires it.
• Scrub against the national and your internal Do Not Call lists before every session.
• Log opt-out requests immediately and stop calling that number.
• Keep call records and consent records together, per lead.

Test a new vendor with your own numbers

Never commit a full season to an untested vendor. Buy a small batch, work every lead the same way, and track four numbers: contact rate, quote rate, enrollment rate and data errors.

Example with made-up inputs: you buy 100 leads at $30 each, spending $3,000. You reach 50, quote 25 and enroll 8. Your cost per enrollment is $375. A cheaper vendor at $15 per lead that produces 3 enrollments from 100 lands at $500 per enrollment, so the lower lead price actually costs you more.

Set decision rules before the test so you are not arguing with yourself later. For example: stop if more than one in five leads has bad contact data, if consumers say they never asked for insurance, or if the vendor cannot produce a consent record on request.

Buy, build or both

The cleanest way to answer every vetting question is to be the source. When the consumer fills out your form on your domain, you know the ad, the page, the consent wording and that nobody else bought the lead. Meta's lead-generation ad campaigns (opens in a new tab) are one way in, though sending traffic to a quote page usually gives you more control; our post on what makes an ACA landing page convert covers why.

Building it yourself takes time most agents do not have. FastTrack sets it up for you: a branded quote funnel on your own domain under your NPN that shows real Marketplace plans priced with the premium tax credit, contact consent and Marketplace consent signed separately and filed as PDFs, a GoHighLevel CRM configured for ACA, a prefilled HealthSherpa handoff, and Meta ads run on your own ad account. Ad spend is billed by Meta directly, and your leads are never resold or shared.

Many agents run both: an owned funnel as the base, plus one vetted vendor to fill gaps. That works as long as the vendor passes the same checklist you would apply to yourself.

Choose vendors you can defend

Run the eight questions on your current vendor this week, pull three consent records at random, and set up a small test before open enrollment pressure arrives. If you would rather own the source and skip the vetting, set up your FastTrack lead system online in a few minutes, no sales call required.