AI Calling Compliance: TCPA, DNC, GDPR & AI-Disclosure (2026 Guide)

The five pillars at a glance

Each row is a separate legal regime with its own enforcer, its own clock, and its own penalty. They are listed in the order a single outbound call encounters them.

Pillar 1 — TCPA consent and quiet hours

The Telephone Consumer Protection Act (47 U.S.C. § 227) is the statute with teeth. Its restriction on artificial or pre-recorded voice calls now reaches AI voice agents directly: in Declaratory Ruling FCC 24-17 — adopted 2 February 2024, released 8 February 2024 in CG Docket No. 23-362 — the Commission held unanimously that AI technologies which generate human-sounding voices, voice cloning included, are “artificial” under the TCPA. An AI call therefore needs prior express consent, and prior express written consent where the call is marketing.

Exposure scales linearly with dial volume, which is why TCPA claims aggregate into class actions. Under 47 U.S.C. § 227(b)(3) a private plaintiff recovers actual monetary loss or $500 per violation, whichever is greater. Where the court finds the violation willful or knowing it may, in its discretion, increase the award to not more than three times that amount — so $1,500 per call is a discretionary ceiling, not an automatic multiplier. Each call is its own violation.

Calling hours are the pillar most often lost by accident. Under 47 CFR § 64.1200(c)(1) a telephone solicitation may not be placed before 8 a.m. or after 9 p.m. at the called party's location — a fact about the recipient, not about the area code on the number, which mobile portability has decoupled from geography.

Consent is revocable, and the revocation rule tightened. 47 CFR § 64.1200(a)(10), effective 11 April 2025, requires a caller to honor a revocation within ten business days of receipt. Separately, the FCC's one-to-one consent rule never took effect: the Eleventh Circuit vacated it in Insurance Marketing Coalition Ltd. v. FCC (No. 24-10277, 24 January 2025), holding the Commission had exceeded its authority by departing from the ordinary meaning of prior express consent.

TCPA quiet hours for AI calls →

Pillar 2 — Do Not Call and internal suppression

The National Do Not Call Registry is not a rounding error. The FTC's National Do Not Call Registry Data Book for Fiscal Year 2025, released in December 2025, reports more than 258 million active registrations — up over 4.8 million on the prior year — and more than 2.6 million Do Not Call complaints received in FY2025, the majority reporting robocalls rather than live telemarketers.

Two different lists are in play, and complying with one does not satisfy the other. The Registry (47 CFR § 64.1200(c)(2)) is the government list a consumer joins once; registrations have been permanent since the Do-Not-Call Improvement Act of 2007 took effect in February 2008. An internal do-not-call list (47 CFR § 64.1200(d)) records requests made to your company specifically — a Registry listing is not an internal request, and a number absent from the Registry can still be on your internal list.

Three numbers govern the mechanics: an internal request must be honored within ten business days under 47 CFR § 64.1200(d)(3), honored for five years under § 64.1200(d)(6), and the Registry must be re-scrubbed at least every 31 days to hold the safe harbor. Suppression is a before-dialing check, not an after-the-fact report.

Do-Not-Call and suppression lists for AI outbound calling →

Pillar 3 — AI disclosure

This is the pillar moving fastest. As of 16 July 2026 no general federal rule compels an AI caller to announce itself; the FCC proposed one in its Notice of Proposed Rulemaking FCC 24-84, adopted 7 August 2024, and has not adopted it. That is a narrower gap than it sounds: 47 CFR § 64.1200(b) already requires every artificial or pre-recorded voice message to identify the business responsible for the call at the start of the message and to state a contact number.

The date to plan against is 2 August 2026, when Article 50(1) of the EU AI Act (Regulation (EU) 2024/1689) begins to apply. It requires that people be informed they are interacting with an AI system, at the latest at the time of first interaction. Article 99(4) puts penalties for transparency breaches at up to €15,000,000 or 3% of total worldwide annual turnover, whichever is higher.

States already impose narrower duties — but the statute most often cited at AI callers is not one of them. California's B.O.T. Act (SB 1001, Cal. Bus. & Prof. Code §§ 17940–17943, effective 1 July 2019) makes it unlawful to use a bot to mislead someone about its artificial identity in order to incentivize a purchase or sale, but it reaches only bots communicating online: § 17940 defines a bot as an “automated online account” and defines “online” as appearing on a public-facing internet website, web application, or digital application. A phone call is none of those, so the B.O.T. Act governs a web chat widget rather than a dialer. Utah's Artificial Intelligence Policy Act (SB 149, as amended by SB 226 effective 7 May 2025) carries no such limitation and does reach a call: it requires a supplier using generative AI in a consumer transaction to disclose that fact on a clear and unambiguous request. Colorado's SB 24-205 was repealed and replaced by SB 26-189, signed 14 May 2026 and effective 1 January 2027, before it ever took effect.

AI caller disclosure laws: what you must tell people →

Pillar 4 — CAN-SPAM and the email the call produces

A call that ends in “send me the details” has just moved the program into a second statute. The CAN-SPAM Act of 2003 (15 U.S.C. §§ 7701–7713), implemented by the FTC's CAN-SPAM Rule at 16 CFR Part 316, governs the follow-up: the message needs a functioning opt-out that works for at least 30 days after sending, the opt-out must be honored within ten business days under 15 U.S.C. § 7704(a)(4)(A), and no fee or extra information may be demanded as a condition of honoring it.

Penalties are assessed per message. Under the FTC's inflation adjustment at 16 CFR § 1.98, effective 17 January 2025, each non-compliant email carries a maximum civil penalty of $53,088 — a figure that compounds across a single campaign.

The stricter deadline is private, not statutory. RFC 8058 (January 2017) defines one-click unsubscribe through the List-Unsubscribe and List-Unsubscribe-Postheaders. Google and Yahoo's bulk sender requirements took effect on 1 February 2024, but the one-click duty ran on its own clock: Google gave senders already carrying an unsubscribe link until 1 June 2024 to implement it in commercial and promotional mail. Senders pushing 5,000+ messages a day are now expected to support it and to process the resulting opt-out within 48 hours. Ten business days is the law; 48 hours is what your deliverability depends on.

CAN-SPAM and one-click unsubscribe (RFC 8058) →

Pillar 5 — GDPR and CCPA erasure

The first four pillars govern the call. This one governs the data that made the call possible. GDPR Article 17 gives a data subject the right to obtain erasure without undue delay on any of six grounds, and Article 12(3) puts a concrete clock on “without undue delay”: one month from receipt, extendable by two further months for complex cases only if the data subject is told inside the first month. Article 19 requires you to pass the erasure on to each recipient of the data. Article 83(5) sets the ceiling at €20,000,000 or 4% of total worldwide annual turnover, whichever is higher.

Article 21(2) is the provision outbound teams underestimate: the right to object to processing for direct marketing is unconditional. There is no balancing test and no legitimate-interest argument to win — once the objection lands, the processing stops.

Regulators are actively auditing this. The EDPB's Coordinated Enforcement Framework report on the right to erasure, published 18 February 2026, covered 32 data protection authorities examining 764 controllers, and set out seven recurring challenges — among them a lack of appropriate internal procedures to handle requests, insufficient information provided to individuals, reliance on inefficient anonymisation techniques in place of deletion, and the deletion of personal data held in back-ups.

California runs a parallel regime on a different clock. Cal. Civ. Code § 1798.105 gives a right to delete, § 1798.130(a)(2) allows 45 days to respond, extendable once by a further 45, and § 1798.155 sets penalties of $2,500 per violation and $7,500 per intentional violation.

GDPR and CCPA erasure for outbound contact data →

The order the checks have to run in

The five pillars are not a checklist to review quarterly. Four of them are gates that must close before a specific event, and the order matters because a later gate cannot repair an earlier one — a disclosure at connect does not cure a call placed to a suppressed number, and an erasure honored next month does not unring a call placed at 6 a.m. local time.

1. Before the contact enters the campaign: establish and record a lawful consent basis, and know which one it is.
2. Before the number is dialed: scrub against the National Do Not Call Registry (re-scrubbed inside 31 days) and against your own internal do-not-call list.
3. At the moment of dialing: resolve the recipient's local time and hold the call if it falls outside 8 a.m.–9 p.m. there.
4. At the start of the message: identify the business responsible for the call, and disclose the AI where the jurisdiction requires it.
5. Before any follow-up email: check suppression again, and ship a working one-click unsubscribe with the message.
6. Whenever a request arrives: honor revocation within ten business days and erasure within one month (GDPR) or 45 days (CCPA), and propagate both to every system holding the record.

How Veera enforces each pillar by default

Veera's AI voice calling is live. Three of the controls above are enforced by the product rather than left to the operator to remember, which is the distinction that matters when the gate has to close before the call rather than appear in a report after it.

Quiet hoursare evaluated per call against the recipient's own timezone — not the area code, and not the sending account's timezone — so a call outside the local 8 a.m.–9 p.m. window is not placed. Opt-outs are written to a suppression list that is checked before the next send, and the email path carries a one-click unsubscribe built on the RFC 8058 headers. Erasure is honored on request: when a contact asks to be forgotten, their data is erased.

Being precise about what is live: Veera's SMS, WhatsApp, and email channels are built and activating rather than available today. The one live send exception is in-call WhatsApp document delivery, which is transactional and bound to an active, consented call.

Consent state is only useful where your team already looks. Veera syncs into GoHighLevel and HubSpot two ways rather than replacing them, so opt-outs and call outcomes land on the contact record in the CRM your agency already runs — not in a second system nobody checks before dialing. Veera is free to start.

These are product controls, not legal advice and not a compliance certification. Consent capture, AI disclosure scripting, Do Not Call Registry subscription, and record retention remain the operator's responsibility — see how the compliance layer sits inside AI cold calling software for where the boundary falls in the category generally.

Frequently asked questions

Related

• TCPA quiet hours — the 8 a.m.–9 p.m. window in depth, and why the recipient's timezone — not the area code — governs
• Do-Not-Call and suppression — the federal Registry, your internal list, the 31-day scrub, and the five-year retention duty
• AI caller disclosure laws — what you must tell people, federally and under the EU AI Act and Utah — and why California's bot law stops at the browser
• CAN-SPAM and one-click unsubscribe — RFC 8058 headers, the ten-business-day rule, and the 48-hour bulk-sender expectation
• GDPR and CCPA erasure — Article 17, the one-month clock, the unconditional marketing objection, and the CCPA parallel
• Is AI cold calling legal? — the direct answer, FCC 24-17, and the $500–$1,500 per-call exposure
• What is an AI Business Aide? — the pillar — where AI calling sits in the wider category
• AI cold calling software — how the dialer, voice AI, CRM logging, and compliance layers actually work
• AI outreach CRM for agencies — two-way GoHighLevel and HubSpot sync, so consent state lives on the contact record
• Best AI SDR tools for outbound calling — the 2026 field, and which tools enforce compliance rather than document it
• Supervisor takeover — handing a live AI call to a human — the escape hatch a disclosure often triggers
• Multilingual voice AI — why disclosure scripting has to survive a language switch