Is AI Cold Calling Legal? TCPA, DNC & AI-Disclosure Rules (2026)

What the FCC actually ruled in February 2024

In January 2024, voters in New Hampshire received a call using a cloned voice of President Biden telling them to skip the state primary. The FCC responded within a month — not by writing an AI statute, but by applying the one already on the books.

Declaratory Ruling FCC 24-17 found that AI technologies such as voice cloning “fall within the TCPA's existing prohibition on artificial or prerecorded voice messages because this technology artificially simulates a human voice.” The Commission grounded that in the ordinary meaning of the statute and in case law describing an artificial voice under the TCPA as “a sound resembling a human voice that is originated by artificial intelligence.” The reasoning is blunt: the voices are artificial because a person is not speaking them.

Three consequences follow, and they took effect on release rather than after a phase-in:

• Consent attaches. Callers must obtain prior express consent before placing a call that uses an artificial or pre-recorded voice generated through AI. For telemarketing and advertising, 47 CFR § 64.1200(a)(2) raises that to prior express written consent.
• Identification attaches. 47 CFR § 64.1200(b) requires every artificial or pre-recorded voice message to state the identity of the business responsible for the call at the start, and to give a callback number.
• Opt-out attaches. Where the message introduces an advertisement or constitutes telemarketing, it must offer an automated, interactive opt-out mechanism.

What the ruling did not do is ban AI voices. It classified them. Unconsented AI robocalls became unambiguously illegal; consented AI calls remained lawful. That distinction is the whole subject of this page.

The four tests that decide legality

Every compliant outbound AI calling program passes the same four tests. They are cumulative — passing three is failing.

The scrubbing test is the one operators most often underestimate. The FTC's National Do Not Call Registry Data Book for Fiscal Year 2025, released in December 2025, reports roughly 258.5 million active registrations as of 30 September 2025 — about 1.9% more than FY2024, with over 4.7 million numbers added during the year. That is not a niche list. It is most of the reachable US phone population, and it is the first thing a plaintiff's lawyer checks.

The consent test also runs in reverse. In FCC 24-24, adopted in February 2024 and effective 11 April 2025, the Commission confirmed that a consumer may revoke consent by any reasonable means. The words stop, quit, end, revoke, opt out, cancel and unsubscribe must be treated as revocation, other phrasings are not precluded, and the request must be processed within a reasonable time not exceeding 10 business days. One element remains waived: the requirement that a revocation made in response to one type of informational message be applied across the sender's unrelated messaging programs (47 CFR § 64.1200(a)(10)). The FCC extended that waiver a second time on 6 January 2026 — Order DA 26-12 — to 31 January 2027. Everything else above — reasonable-means revocation and the 10-business-day deadline — has been in force since 11 April 2025.

One test that disappeared: the FCC's one-to-one-consent rule, which would have required consent to name a single seller, was vacated by the Eleventh Circuit in Insurance Marketing Coalition Ltd. v. FCC, No. 24-10277 (11th Cir. 24 January 2025), on the day before it was to take effect. The court held the FCC had exceeded its statutory authority: to give prior express consent, a person need only “clearly and unmistakably” state beforehand that they are willing to receive the call. Bundled consent survives — but the underlying TCPA requirements did not move an inch.

The legal difference between compliant B2B outreach and illegal robocalling

Here is the most expensive misconception in outbound: that “we only call businesses” is a legal defence. It is a partial one, and the part it misses is the part that matters for AI voice.

The FTC's Telemarketing Sales Rule (16 CFR Part 310) genuinely does exempt most business-to-business calls. Section 310.6(b)(7) exempts telephone calls between a telemarketer and a business to induce the purchase of goods or services, with a carve-out for retail sales of nondurable office or cleaning supplies. That exemption is real — and it is an exemption from the FTC's rule, not the FCC's statute. The TCPA has no equivalent B2B carve-out for artificial voice.

Read the TCPA text closely. Section 227(b)(1)(A)(iii) restricts calls using an artificial or pre-recorded voice to any telephone number assigned to a cellular telephone service. It does not ask who pays the bill or whether the handset sits on a desk. And under 47 CFR § 64.1200(e) and the FCC's 2003 Report and Order, a wireless number listed on the Do Not Call Registry is presumptively residential — a presumption rebuttable only case by case, and one that courts have continued to litigate. Meanwhile the TSR exemption itself reaches calls to induce a sale to a business entity, not to individuals employed by it.

So the modern B2B prospect — a decision-maker whose “work phone” is a personal mobile — sits in the exact gap where the TSR exemption stops and the TCPA keeps going. Dialing that number with an AI voice and no consent is the single most common way a program that calls itself B2B becomes a TCPA case.

Notice what is not in that table: the word AI. Every row applies identically to a human rep with a power dialer. The AI changes the volume, not the rules — which is precisely why it changes the stakes. Damages accrue per call, so exposure scales linearly with the thing AI is best at.

Do you have to say it is an AI?

Federal law does not yet have a general answer. Every trend line says the answer is becoming yes.

• Federal (proposed). The FCC's Notice of Proposed Rulemaking FCC 24-84(CG Docket No. 23-362, adopted 7 August 2024, released 8 August 2024) proposes to define an “AI-generated call,” to require callers to disclose AI use at the start of such calls, and to require that disclosure during the consent process. It also proposes to exempt people with hearing and speech disabilities who use AI voices on non-advertising calls. As of July 2026 it remains a proposal, not a rule.
• Federal (already binding). 47 CFR § 64.1200(b) already requires an artificial-voice message to identify the business responsible for the call. You do not have to say “I am an AI” federally; you do have to say who is calling.
• Utah.The Artificial Intelligence Policy Act (S.B. 149, effective 1 May 2024, amended by S.B. 226, effective 7 May 2025) requires a person using generative AI in a consumer transaction to disclose that fact in response to a clear and unambiguous request. For regulated occupations, disclosure must come at the outset — and orally when the interaction is verbal. S.B. 226 added a safe harbor: no enforcement for disclosure failures if the AI itself clearly and conspicuously identifies as non-human at the start of and throughout the interaction.
• California.The Bolstering Online Transparency (B.O.T.) Act (S.B. 1001, Bus. & Prof. Code §§ 17940–17943, effective 1 July 2019) makes it unlawful to use a bot to mislead a person in California about its artificial identity in order to incentivize a sale, with a safe harbor for disclosure that is clear, conspicuous, and reasonably designed to inform. Its text reaches bots operating online, which § 17940 defines by reference to public-facing websites and applications — so its reach over a voice phone call is unsettled rather than established.
• European Union (binding from 2 August 2026). Article 50(1) of the EU AI Act (Regulation (EU) 2024/1689) requires AI systems intended to interact directly with natural persons to be designed so that those persons are informed they are interacting with an AI system — unless it is obvious to a reasonably well-informed, observant and circumspect person. Article 50(5) requires that information to be given clearly and distinguishably “at the latest at the time of the first interaction or exposure.” An AI voice good enough to be worth deploying is, by construction, not “obvious.”

Be careful with secondary sources here. A widely-repeated claim that Texas S.B. 140 imposes a 30-second AI-disclosure requirement does not survive reading the bill: S.B. 140 (89th Legislature, effective 1 September 2025) expands the Texas telephone-solicitation regime to cover text and multimedia messages and adds a Deceptive Trade Practices Act hook. It is a telemarketing-registration law, not an AI-disclosure law.

The operational conclusion is straightforward. Disclosure costs one sentence at the top of the call. It eliminates an entire category of exposure, it satisfies Utah's safe harbor and the EU's Article 50 in one move, and it pre-complies with the rule the FCC has already proposed. Disclose.

Calling into the EU: GDPR still applies

The EU AI Act governs whether you must announce the AI. The GDPR (Regulation (EU) 2016/679) governs the data underneath the call, and it applies whether the caller is a person or a model.

• Article 21(2) — objection to direct marketing. Where personal data is processed for direct marketing, the data subject has the right to object at any time, and once they object the processing must stop. There is no balancing test to run and no grace period to argue over.
• Article 17 — right to erasure. A contact can require their personal data to be erased, including where they have objected under Article 21. Your outbound stack has to be able to actually delete, not just flag.
• A record you can produce. Where you rely on consent, you must be able to demonstrate it. Call recordings and transcripts are themselves personal data, and in some jurisdictions voiceprints attract separate biometric regimes.

The through-line across all of it — TCPA, TSR, the AI Act, the GDPR — is that the obligations are per contact and per call. They cannot be satisfied by a policy document. They have to be enforced by the system that places the call.

How Veera handles this

Veera's AI voice calling is live, and three compliance controls are enforced by the platform rather than left to the operator to remember:

• Quiet hours, per call, timezone-aware. Every call is checked against the recipient's own local window before it is placed — resolved from the contact's timezone, not the sender's clock and not an area-code guess. This is the 47 CFR § 64.1200(c)(1) test, applied at dial time.
• Suppression before send. An opt-out is written to a suppression list that is checked before the next send, so a revocation cannot be outrun by a queued message. The email path ships with a CAN-SPAM one-click unsubscribe header (RFC 8058 List-Unsubscribe-Post) wired in.
• Erasure on request. When a contact asks to be forgotten, their data is erased — the Article 17 mechanic, implemented rather than promised.

Being precise about what these controls are — and are not. They are product controls. They are not legal advice, not a compliance certification, and not a claim of blanket GDPR compliance. Veera does not capture consent for you, subscribe to the Do Not Call Registry on your behalf, or write your AI-disclosure script. Those remain the operator's responsibility, and you should confirm your obligations for your own jurisdictions.

Being honest about what is live. AI voice calling is live today. SMS, WhatsApp, and email as standalone outbound channels are built and activating — we describe them as launching, not as things you can run today. The one live send exception is in-call WhatsApp document delivery, which is transactional and bound to an active, consented call.

Consent state is only useful where your team already looks. Veera syncs into GoHighLevel and HubSpot two ways rather than replacing them, so opt-outs and call outcomes land on the contact record in the CRM your agency already runs — not in a second system nobody checks before dialing. Veera is free to start.

Frequently asked questions

Related

• AI calling compliance — the hub: quiet hours, suppression, consent, and disclosure across every outbound channel
• TCPA quiet hours — the 8 a.m.–9 p.m. window in depth, and why the recipient's timezone — not the area code — governs
• Do Not Call and suppression — scrubbing the federal registry, state lists, and your internal do-not-call list before you dial
• What is an AI Business Aide? — the pillar — where AI calling sits in the wider category
• AI cold calling software — how the dialer, voice AI, CRM logging, and compliance layers actually work
• AI outreach CRM for agencies — two-way GoHighLevel and HubSpot sync, so consent state lives on the contact record
• Best AI SDR tools for outbound calling — the 2026 field, and which tools enforce compliance rather than document it
• Veera vs Bland — how two AI voice platforms differ on compliance enforcement and CRM sync
• Supervisor takeover — handing a live AI call to a human — the escape hatch a disclosure often triggers
• Multilingual voice AI — why disclosure scripting has to survive a language switch