State-Specific Medicare Marketing Compliance Guide

Running a Medicare marketing campaign in Texas is not the same as running one in California, and treating them as identical is one of the fastest ways to attract a compliance review. The Centers for Medicare and Medicaid Services (CMS) sets a national floor for marketing conduct, but states layer on their own insurance regulations, licensing rules, and consumer protection statutes. For agents and agencies building state-specific campaigns, the practical challenge is not memorizing every rule. It is building a repeatable process that catches the state-level differences before a single ad goes live. This guide breaks down the federal guardrails, the state-level wrinkles that matter most, compliant language for local ads, and the recordkeeping habits that keep your campaigns defensible in any market.

The Federal Floor: CMS Marketing Rules That Apply Everywhere

Before you think about state variations, you need a firm grasp of the federal baseline. CMS regulates how Medicare Advantage and Part D plans are marketed through the Medicare Communications and Marketing Guidelines (MCMG), and those rules apply in every state, territory, and ZIP code. The MCMG is updated annually, and the 2026 version continues the aggressive enforcement posture of recent years, with civil money penalties and enrollment suspensions on the table for repeat offenders.

Several federal requirements hit state-specific campaigns directly. First, all marketing materials for Medicare Advantage and Part D plans must be submitted to CMS or the plan sponsor for review before use, and that review includes materials that reference a specific state, city, or region. Second, the prohibition on unsolicited contact means you cannot cold-call, text, or email Medicare beneficiaries without prior express written consent, regardless of how local your campaign is. Third, the 48-hour scope of appointment (SOA) rule requires a documented conversation about which plan types will be discussed before any personal marketing appointment. Fourth, all advertisements must include the required disclaimers, including the statement that the entity is not connected with or endorsed by the federal government, and must avoid misleading language about plan benefits, networks, or costs.

For agents buying leads, the federal rules also govern how lead data can be used. A lead generated for a Medicare Advantage plan in Ohio cannot be repurposed for a Medigap pitch in Florida without a new consent and a new SOA. That single rule trips up more multi-state campaigns than any other. If you are working through a lead marketplace, confirm that the consent language captured at the point of generation matches the plan types and states you intend to market. Our guide on Medicare marketing compliance for agents covers the 2026 CMS rules in more detail, including the updated call recording requirements and the expanded definition of marketing.

The federal floor is necessary but not sufficient. States add requirements that can change everything from the wording on a direct mail piece to the retention period for call recordings. The rest of this article focuses on those state-level additions and how to operationalize them.

Where State Rules Add Requirements for Medicare Agents

State insurance departments regulate the business of insurance, and that includes how Medicare-related products are advertised, sold, and serviced. The scope of state authority varies, but four categories of state rules consistently affect Medicare marketing campaigns.

Licensing and appointment rules. Every state requires producers to hold a valid license for the lines of authority they sell, and most require appointment by the carrier before soliciting. Some states, such as Florida and Texas, have specific rules about non-resident licensing and the use of unlicensed staff in marketing activities. If your campaign uses call center agents or appointment setters, verify that each person touching a Medicare lead is either licensed or operating within a clearly defined administrative role that does not involve plan discussion. A common enforcement action involves unlicensed staff quoting premiums or confirming benefits.

Advertising filing and review. A handful of states require insurers and sometimes producers to file advertising materials with the state insurance department before use, or to maintain copies for examination. California, New York, and a few others have advertising regulations that go beyond CMS requirements, including specific rules about testimonial use and the disclosure of producer compensation. Even where filing is not required, states expect you to be able to produce any advertisement on demand during a market conduct exam.

Consumer protection statutes. State unfair trade practice laws often prohibit specific marketing tactics that CMS also prohibits, but with different definitions and penalty structures. For example, some states have enacted stricter rules on the use of the word "free" in marketing, or on door-to-door solicitation of seniors. Others require specific disclosures when marketing Medicare Advantage plans that have provider network limitations. These statutes are enforced by state attorneys general as well as insurance departments, which means a single campaign can attract scrutiny from multiple regulators.

Call recording and consent laws. All-party consent states, including California, Florida, Illinois, and Pennsylvania, require that all parties on a call consent to recording. If your campaign uses recorded calls for quality assurance or compliance purposes, you need state-specific consent language at the start of every call. Several states also have their own do-not-call lists that operate alongside the national registry, and telemarketing rules that can be stricter than the federal TCPA. A campaign that works in Arizona may be non-compliant in California simply because of the recording consent prompt.

These state variations are not hypothetical. Market conduct exams routinely cite producers for using unapproved advertising, failing to document consent, or marketing in states where they hold no license. The practical takeaway is that state-specific campaigns require state-specific compliance checklists, not a single national template.

Compliance-Safe Language for Local Ads and Landing Pages

The language in your local ads and landing pages is where compliance either holds or breaks. CMS has published extensive guidance on acceptable and prohibited terminology, and states often adopt or amplify those standards. The safest approach is to build a library of pre-approved phrases and require every campaign to draw from that library rather than drafting from scratch.

Start with the required disclaimers. Every Medicare Advantage or Part D advertisement must include the appropriate CMS disclaimer, and the disclaimer must be prominent and readable. For local campaigns, the disclaimer should also identify the specific plan or plan type being marketed and the service area. A generic disclaimer that does not match the state or county being targeted is a common deficiency. If your ad references a specific county or metro area, the disclaimer should reflect that geography.

Next, audit your benefit language. CMS prohibits misleading claims about savings, network size, or extra benefits, and states enforce similar prohibitions under their unfair trade practice laws. Phrases like "free benefits," "guaranteed acceptance," and "no cost to you" are high-risk unless they are factually accurate and properly qualified. A safer pattern is to describe the benefit category and direct the consumer to verify eligibility: "Some plans in your area include dental coverage. Call to check whether you qualify." This approach satisfies the educational intent without overpromising.

Testimonials and endorsements require special handling. CMS rules restrict the use of testimonials in certain contexts, and several states require that testimonials be accompanied by disclosures about compensation and typical results. If you use a consumer testimonial in a local ad, confirm that the person actually said what is quoted, that the testimonial is not edited to mislead, and that any required state disclosure is included. The same applies to celebrity endorsements, which CMS treats as marketing materials subject to review.

Landing pages add another layer because they collect information. Any landing page that captures a name, phone number, or email for Medicare marketing purposes must include a clear privacy disclosure and, where required, a consent statement that meets both federal and state standards. Several states require specific language for consent to telemarketing, and some require that the consent be separately presented rather than buried in terms and conditions. A landing page that works in one state may fail in another because the consent language does not meet the stricter state standard.

For agents buying leads or running inbound campaigns, the landing page is often the first compliance artifact a regulator will request. Keep a version history of every landing page, including the exact consent language displayed at the time each lead was generated. If you work with a lead provider, ask whether they maintain state-specific consent language and whether they can produce it on demand. This is one of the questions worth asking before you buy, and it is a core part of evaluating pay-per-call marketing partners, where the quality of consent documentation directly affects your ability to defend the lead.

Recordkeeping and Consent Practices for Local Campaigns

Compliance is ultimately proven through documentation. When a regulator asks how you marketed in a specific state, the answer must be a set of records, not a recollection. CMS requires plan sponsors and their downstream entities to maintain marketing records for a minimum period, typically ten years for Medicare Advantage and Part D, and states may impose their own retention periods. The practical standard is to retain every marketing artifact, every consent record, and every call recording for at least the longest applicable period.

Build a state-specific recordkeeping system with the following components:

• Campaign inventory by state: A log of every ad, landing page, email, direct mail piece, and call script used in each state, with the date it went live, the approval record, and the CMS submission number if applicable.
• Consent and SOA documentation: For every lead, the exact consent language the consumer agreed to, the timestamp, the IP address or call record, and the scope of appointment if a personal marketing appointment occurred.
• Call recordings and quality reviews: Recordings retained per state consent requirements, with a sampling protocol that verifies agents are using approved language and are not making prohibited statements.
• Licensing and appointment records: Verification that every person involved in the campaign was licensed and appointed in the state where the consumer resided at the time of contact.
• Complaint and enforcement log: A record of any consumer complaint, regulator inquiry, or carrier audit, with the resolution and any corrective action taken.

These records serve two purposes. They demonstrate compliance during an exam, and they surface problems before they become enforcement actions. A monthly review of call recordings, for example, often catches script drift, where agents gradually adopt language that was never approved. Catching that drift early is far less expensive than responding to a CMS or state inquiry.

Consent practices deserve separate attention because they are the most common failure point in state-specific campaigns. The safest operating model is to capture consent at the point of lead generation, specify the plan types and the state, and refresh consent if either changes. If you buy leads, verify that the consent record travels with the lead and that it matches your intended use. If you generate your own leads, build the consent capture into the landing page and the call flow, and test it in every state where you market. A consent record that is valid in one state may be insufficient in another, so the capture process should be state-aware from the start.

Finally, treat state-specific compliance as a living process rather than a one-time project. State insurance departments issue bulletins, update regulations, and change enforcement priorities. CMS updates the MCMG annually. A campaign that was compliant last year may not be compliant this year. Assign someone to monitor regulatory updates in each state where you market, and schedule a quarterly review of your campaign inventory against the current rules. For agents and agencies that market nationally, this monitoring is not optional; it is the difference between a scalable campaign and a series of avoidable penalties.

Medicare marketing compliance for state-specific campaigns comes down to disciplined execution: know the federal floor, map the state additions, control your language, and document everything. Agents who build these habits can market aggressively in multiple states without gambling on regulatory outcomes. Those who skip the state-level work often find that a single compliance failure costs more than the campaign ever earned.