Your AI is making calls. The law already has rules for that.

1. What changed, and the case proving it

In February 2024 the FCC issued a declaratory ruling confirming that voices generated or cloned by AI count as an "artificial voice" under the Telephone Consumer Protection Act. It took effect immediately and it still stands.

That single classification is what matters. The TCPA has restricted artificial and prerecorded voice calls since 1991, so your AI agent did not land in a legal grey area. It landed inside a rulebook that already existed, with thirty years of case law behind it.

This is already being litigated

In February 2026 a class action was filed in the Eastern District of Michigan against a mortgage lender, alleging its AI voice agent cold called consumers about refinancing without prior express written consent, including a number that had been on the National Do Not Call Registry since 2023. These are allegations and the case has not been decided.

One detail in that complaint should get the attention of anyone building these systems for other people. The proposed class is not limited to the lender. It is drawn to reach calls made by the company or by its vendors, lead generators and agents.

2. Who you can legally call

The protections attach to the line, not to the person or how they use it. Work through it in this order.

The cell rule goes off the number, not the owner. A sole trader's mobile is still a mobile, and a business using a wireless number does not strip the protection from it. That is the trap most outbound programmes fall into, because business contact lists are full of mobile numbers.

3. What actually counts as consent

Prior express written consent is a specific thing, not a checkbox labelled "I agree". A record that holds up has to capture all six of these.

• Timestamp. When the submission happened.
• IP address. So you can answer "someone else put my number in".
• Checkbox state. Evidence it was actually ticked, not assumed or pre-ticked.
• The number exactly as entered by the person.
• The exact disclosure wording shown on that day. If you later change the form, you need the old version too.
• Explicit mention of artificial or prerecorded voice. "Calls and texts" is not enough.

A checkbox is the signature. The wording around it is what you are actually relying on.

Consent is channel specific

Someone opting in to text messages has not consented to an AI voice call. Someone who left a number to get a quote has not consented to marketing calls. Each use has to be covered by what they actually agreed to.

You cannot borrow it

Consent given to a lead vendor, a partner, or a previous owner of a list is not consent given to you. A list described as "opt in" transfers no protection. If you cannot show how that person agreed to hear from you, you do not have consent.

4. The list you already have

This is the question almost everyone actually has. You have thousands of leads, they came from somewhere, and nobody kept consent records. What now?

You cannot fix it by calling them.

What you can do is move them through a channel that is not regulated the same way, and let them opt in properly.

1. Reach out by email, which is not governed by the TCPA.
2. Send them to a landing page with an unchecked box, the full disclosure wording, and capture of all six elements above.
3. Dial only the people who come through that form. The rest of the list stays undialled.

Yes, you will convert a fraction of the list. A smaller list you can defend is worth considerably more than a large one that is a liability per record.

5. What has to happen on the call

Consent gets you permission to dial. The call itself has its own duties.

• Identify the business at the start. The caller needs to know who is calling before anything else happens.
• Provide a number they can call back. It has to actually reach you.
• Keep an internal do-not-call list, and honour a request immediately. Not at the end of the campaign. Immediately, and permanently.
• Honour revocation mid-call. If someone asks you to stop during the conversation, that is a revocation and the agent has to respect it on the spot.

6. Where the law is moving

Three decisions have shifted the ground recently. None of them make outbound AI calling easier in practice, and one of them is routinely misread as permission to relax.

7. State rules stack on top

Federal compliance is the floor, not the ceiling. States have added AI specific duties, and they apply based on where the person you called is, not where you are.

• California (AB 2905), effective 1 January 2025. A call using an AI generated voice has to disclose that fact up front, in the opening announcement.
• Utah (AI Policy Act, SB 149 as amended by SB 226). You must disclose that the person is dealing with AI when they ask, and proactively in higher risk and regulated contexts.

More states are adding rules here. If you call across state lines, the safe operating position is to disclose the AI voice at the start of every call. It satisfies the strictest rule you are likely to meet and it costs you very little.

8. Pre-flight checklist

Before a single outbound call goes out, you should be able to answer yes to all of these.

1. You can produce written consent for every number on the list
2. That consent names your business, not a lead vendor
3. It covers voice calls specifically, not just SMS or email
4. It explicitly mentions artificial or prerecorded voice
5. You have the timestamp, IP, checkbox state and exact wording shown
6. Numbers are scrubbed against the National DNC Registry
7. Your own internal do-not-call list is scrubbed too
8. You know which numbers on the list are wireless
9. The agent identifies the business in its opening line
10. The agent discloses it is AI, at minimum when asked
11. A working callback number is available on request
12. The prompt cannot talk past a refusal or a removal request

9. Sources

Every figure on this page is drawn from the following. Where a judgment was later changed on appeal, that is noted, because the headline number is often quoted without it.

• FCC Declaratory Ruling (FCC 24-17), February 2024. AI generated voices are "artificial" under the TCPA. fcc.gov
• Statutory damages. $500 per violating call, up to $1,500 where the violation is wilful or knowing.
• Krakauer v. Dish Network. 51,119 calls at $400 each, trebled for wilfulness to roughly $61 million. Affirmed by the Fourth Circuit; the Supreme Court declined to hear it.
• Wakefield v. ViSalus. A jury found 1,850,440 unlawful calls. The resulting judgment of about $925 million was reversed by the Ninth Circuit and sent back for the amount to be reconsidered. The call volume is the point, not the headline figure.
• Insurance Marketing Coalition Ltd v. FCC, Eleventh Circuit, 24 January 2025. One-to-one consent rule vacated.
• McLaughlin Chiropractic Associates v. McKesson Corp, Supreme Court, 20 June 2025.
• Bradford v. Sovereign Pest Control of TX, Fifth Circuit, 25 February 2026. Binds Texas, Louisiana and Mississippi only.
• February 2026 class action filed in the Eastern District of Michigan concerning AI voice cold calls. Allegations only; undecided at the time of writing.
• California AB 2905, effective 1 January 2025. Utah AI Policy Act, SB 149 (2024) as amended by SB 226 (2025).