Guide

AI Voice Agents and TCPA Compliance: What the Rules Actually Require

By Mandeep Rao · July 2026 · 9 min read

The short version: the TCPA does not have a special category for AI. If your software places a call to a consumer and a synthetic voice speaks, US regulators treat that the same as a prerecorded robocall — which means you need the same prior express consent, the same identification at the top of the call, the same opt-out path, the same quiet-hours limits, and the same Do Not Call scrubbing. The FCC said so explicitly in a February 2024 declaratory ruling. Nothing about that is fatal to using AI voice agents; businesses run them compliantly every day. But the compliance work is not optional, and it is not something you bolt on after launch. This guide walks through what actually applies, where the real exposure is, and what to demand from any vendor. It is written by a software founder, not a lawyer, and it is not legal advice — before you dial a single consumer, have counsel review your specific program.

The TCPA does not have an AI exemption

The Telephone Consumer Protection Act dates to 1991, long before anyone was synthesizing speech in real time. It restricts calls to consumers that use an automatic telephone dialing system or an artificial or prerecorded voice. The recurring mistake businesses make is assuming that because an AI voice is conversational rather than a static recording, it falls outside that language. It does not.

In February 2024 the FCC issued a declaratory ruling confirming that AI-generated voices used in calls to consumers are "artificial" voices for TCPA purposes. That ruling did not create a new rule so much as close off an argument. The practical effect is that an AI voice agent calling a consumer sits under the same consent regime as a prerecorded robocall, and the same statutory penalties apply.

Those penalties are why this matters more than most compliance topics. The TCPA gives consumers a private right of action with statutory damages of $500 per violating call, trebled to $1,500 for willful or knowing violations, and no cap on the number of calls in a suit. There is a mature plaintiffs' bar built around this. A campaign that dials a bad list for a week can generate real exposure without a single complaint reaching you first.

Inbound and outbound are legally different situations

This distinction does more work than anything else in the guide, and it is the one most vendors blur. The TCPA restricts calls made to consumers. When a customer dials your number and an AI agent answers, you are not placing a call, and the TCPA consent framework is largely not the thing you are navigating.

That does not mean inbound is unregulated. Call recording is governed by state wiretap law, and roughly a dozen states require all parties to consent before a call is recorded — which is why the standard practice is an announcement at the start of the call rather than a state-by-state matrix. Consumer protection law still prohibits deceiving the caller about what they are talking to, and several states have enacted or proposed AI disclosure requirements of their own.

But the risk profile is genuinely different. If you are nervous about starting with AI voice, starting inbound is the low-exposure entry point: answering your own phone after hours, taking overflow when your team is on other calls, booking appointments for people who chose to call you. Most of the businesses we work with start there and only add outbound once their consent plumbing is real.

What outbound actually requires

For outbound calls to consumers using an artificial voice, these are the obligations to build around. Treat this as the shape of the requirements rather than a substitute for counsel, because several of the details have been actively litigated and revised in the last two years.

The consent piece deserves emphasis. Prior express written consent for marketing calls means a signed agreement — an electronic signature or a checked box on a form counts — that clearly discloses the person will receive autodialed or artificial-voice marketing calls at the number they gave, and that consent is not a condition of purchase. A phone number typed into a form is not consent by itself. A purchased list is almost never consent. If you cannot produce the record showing exactly when and how a given number consented, you cannot defend the call.

• Prior express written consent for any marketing or sales call using an artificial voice; prior express consent for purely informational or transactional calls
• Identification at the start of the call: the name of the business responsible for the call, plus a phone number or address a consumer can use to reach you
• An automated, interactive opt-out mechanism available throughout the call for telemarketing — the consumer must be able to say stop and be added to your do-not-call list without reaching a human
• Calling window limited to 8am–9pm in the called party's local time, which means you need the number's time zone, not your own
• Scrubbing against the National Do Not Call Registry and against your own internal do-not-call list before every campaign
• Honoring revocation promptly and across channels — FCC rules adopted in 2024 require honoring a revocation made through any reasonable means, and treat it as applying to the whole program rather than the one campaign
• Retained records: the consent artifact, the timestamp, the source, the script, and the call log, kept long enough to cover the four-year statute of limitations

Disclosure: what the rules say and what to do anyway

There is a difference here between what is currently mandated federally and what is simply the right call. As of July 2026, the FCC's 2024 declaratory ruling settled the consent question for AI voices, and the Commission has separately proposed AI-specific disclosure requirements for calls. Rulemaking in this area has been moving, and some state legislatures have gotten there ahead of the federal government. Verify the current status with counsel rather than relying on a blog post's snapshot — including ours.

Regardless of where the federal rules land, disclose. Tell people they are speaking with an AI assistant, at the top of the call, in plain words. The business case is stronger than the legal one: the failure mode for undisclosed AI is not usually a fine, it is a customer who realizes halfway through and feels tricked by your company. Every operator we know who tested both ways landed in the same place — disclosure costs you almost nothing in booking rate and removes the entire category of complaint.

The other half of disclosure is escalation. An AI agent should hand off to a human on request, immediately and without an argument, and should recognize when it is out of depth. A caller who asks to speak to a person and cannot get one has been handled worse than if nobody had answered at all.

The five failures that actually cause problems

Almost every TCPA problem we have seen or read about traces back to a small number of operational failures rather than to some subtle misreading of the statute. They are all preventable at the software layer.

Notice that four of the five are data problems, not AI problems. This is the thing to internalize: the AI is rarely what gets you in trouble. The list is what gets you in trouble. An AI agent is dangerous mainly because it lets a bad list get dialed faster than a human team ever could.

• Dialing a purchased, scraped, or inherited list with no per-number consent record
• Calling into a time zone where it is 7am or 10pm because the system used the account's local time instead of the number's
• Continuing to call someone who asked to stop, because the opt-out was captured in one system and the dialer read from another
• Never scrubbing against the National DNC Registry, or scrubbing once at import and never again
• Treating a form fill from three years ago as live consent for a new campaign

What to demand from an AI voice vendor

Compliance features are easy to claim on a pricing page and hard to fake in a live demo. Ask the vendor to show you the enforcement, not the checkbox: make them try to schedule a call outside the permitted window and show you that the system refuses, and make them show you where a revocation lands and how the dialer sees it.

For our part, Lead Friendly is a voice-first agentic CRM, and we build the guardrails into the calling layer rather than leaving them to the operator: calls are gated to the permitted local-time window for the number, opt-outs and do-not-call state are stored on the contact so every channel and campaign reads the same record, AI disclosure is part of the agent's opening, and 10DLC registration for any SMS follow-up is walked through during onboarding rather than left for you to figure out. Plans start at $49/mo for Starter, with Pro at $99 and Agency at $199, and there is a 7-day free trial with 30 voice minutes that does not ask for a card — see leadfriendly.com/pricing for the current breakdown. If you want to see the guardrails in the context of a specific workflow, the dealership setup at leadfriendly.com/for/auto-dealerships is the one we get asked about most.

What we will not tell you is that any vendor makes you compliant. No platform can. The software can enforce timing, hold the consent record, and honor an opt-out consistently — that is genuinely most of the operational risk. It cannot verify that the consent you loaded was real, and it cannot substitute for a lawyer reviewing your scripts and your consent language before you dial. Get that review. It is a few hours of counsel against a statute that prices mistakes at $500 a call.

FAQ

Is it legal to use an AI voice agent to call customers?

Yes, in the US, provided you follow the same rules that apply to prerecorded robocalls. The FCC confirmed in February 2024 that AI-generated voices count as artificial voices under the TCPA, so calls to consumers require prior express consent — prior express written consent for marketing — along with identification at the start of the call, an opt-out mechanism, 8am–9pm local calling windows, and Do Not Call scrubbing. This is general information, not legal advice; have counsel review your specific program.

Do I have to tell people they are talking to an AI?

The federal disclosure picture has been in flux, and some states impose their own AI disclosure requirements, so check the current rules with counsel. Our practical recommendation is to disclose regardless of what is strictly mandated: say it plainly at the start of the call. It costs very little in outcomes and eliminates the most common complaint about AI calling, which is that the caller felt deceived.

Does the TCPA apply when an AI answers an inbound call?

Largely not. The TCPA governs calls placed to consumers, so a customer calling your number and reaching an AI agent is a different legal situation. State call-recording consent laws still apply — several states require all-party consent, which is why announcing recording at the start is standard — and deception rules still apply. Inbound is the lower-risk place to start with AI voice.

What are the penalties for getting this wrong?

The TCPA provides a private right of action with statutory damages of $500 per violating call, rising to $1,500 per call for willful or knowing violations, with no cap on the number of calls in a single suit. Because damages are per call, an automated system dialing a non-consented list can accumulate significant exposure quickly, which is why list hygiene matters more than any other control.