Is AI Cold Calling Illegal? How to Comply With New FCC Rules & Global Regulations

If you are using - or planning to use - AI calls to reach your customers, you need to understand what is legally allowed, what is recently restricted, and how to protect your business. From the latest FCC guidance in the US to global compliance rules, you’ll learn all the key requirements for AI calls, plus the common pitfalls to avoid and practical steps to stay compliant.

Understanding the New Rulebook: What Changed With the FCC?

Any outbound cold calls made with AI-generated voices - synthetic or cloned voices created with machine learning or other AI tools, as well as with human-prerecorded voices - are defined as “robocalls” and are subject to FCC (Federal Communications Commission) restrictions in the US. 

In 2024, the FCC updated the Telephone Consumer Protection Act (TCPA) and stated that robocalls used for telemarketing or outreach must have prior written express consent of a called party, clearly disclose AI involvement, and include an immediate opt-out option. This is not something new, since the Protection Act already regulated robocalls; however, it wasn't clear before whether using AI-generated or prerecorded voices was included. The Telemarketing Sales Rule (TSR), which works alongside the TCPA, additionally prohibits deceptive practices and bans calls to numbers on the Do‑Not‑Call Registry.

The violation of FCC rules can pose significant fines. In May 2024, the FCC proposed a $6 million fine against political consultant Steven Kramer for using an AI-generated voice of President Biden in robocalls to mislead voters. Additionally, the telecom company that helped send those calls - Lingo Telecom - had to pay $1 million. These cases show that with enforcement getting stronger, businesses that use AI voice calls must be careful or face fines.

Consent, Disclosure, and Opt-Out: The Core Compliance Pillars

For AI calls to be legal according to the FCC rules, you need to consider three compliance pillars: consent, disclosure, and opt-out mechanisms.

The prior express consent should be given through a signature, a written or online form, or an SMS opt-in. The consent must be documented with timestamps, IP addresses, the phone number to be called, and other collected data.

Disclosure comes with the caller identifying themselves and stating the purpose of the call. For calls made using AI or prerecorded voices, the disclosure of AI involvement should be included as well. 

The opt-out mechanism includes some methods for the called party to press a digit, text, or say "STOP” to avoid receiving future calls, etc. The caller should respect this request within 10 business days -otherwise, it may be considered a violation of FCC rules and could lead to significant fines, legal complaints, or further enforcement actions.

US and International Regulatory Comparison

So far, the discussed rules are applicable only to the US. To summarise, the key laws are:

• TCPA (Telephone Consumer Protection Act) - all robocalls made with AI-generated or prerecorded voices require prior written consent, disclosure, and opt-out methods, as well as Do-Not-Call compliance, caller ID, and timing limits. (Calls can only be made between 8 a.m. and 9 p.m. local time to avoid disturbing recipients during early or late hours.)
• TSR (Telemarketing Sales Rule) - bans misleading telemarketing calls, requires AI calls to have disclosures, record-keeping, and one-to-one consent.
• Do-Not-Call Registry - a national list where people can register their phone numbers to avoid unsolicited telemarketing calls. Telemarketers must regularly check the list and avoid calling registered numbers.

Specific states in the US require stricter regulations regarding robocall timelimits, caller IDs, etc. Therefore, make sure to check the laws in the state of the called party.

Globally, the legal landscape for AI calls is similar, with some regions having stricter regulations:

• Europe/UK PECR (Privacy and Electronic Communications Regulations) - require explicit opt-in consent, meaning individuals must clearly agree - unambiguously and specifically - to receive telemarketing calls. Pre‑checked boxes or vague statements don’t count. Also, under GDPR (General Data Protection Regulation), any call made is treated as data processing, so the law requires the called party to permit the collection and handling of personal data.

• CASL (Canada’s Anti‑Spam Legislation) - covers AI calls under its Unsolicited Telecommunications Rules, and requires express consent, identified caller ID, and compliance with the national Do-Not-Call List. Additionally, the business is required to keep an internal Do-Not-Call List and keep track of all the calls.

• Indian UCC (Unsolicited Commercial Communication) Regulations - require telemarketers to use specific number series (like 140/1600) and check calling lists against the National Customer Preference Register (DND). Violations of these rules can lead to fines and call blocking through the TRAI DND app.

• Australian Spam Act - states that all voice calls must not be fraudulent or spam and must include a valid opt-out method. Similar to other countries, there is a national Do Not Call Register, which prohibits marketing calls to listed numbers unless consent exists. 

Here are the key requirements for each mentioned region:

Legal vs Illegal: Common, Edge-Case, and Non-Solicitation Scenarios

So, what AI calls are clearly legal? These are the ones that are directly necessary to the called party, such as appointment reminders, support messages, billing notifications, etc. Emergency alerts or calls with clear social value (public safety updates, government notifications, accessibility services for people with disabilities) are always legal.

Sales, promotions, or cold calls made with AI need prior express consent and all of the previously discussed requirements (AI disclosure, opt-out methods, etc.) in order to be legal. Some grey areas that might be risky are:

• Implicit consent might not be enough, such as a vague note or a buried checkbox.

• Existing customer interactions may allow some flexibility, but it is still recommended to follow the same rules as for cold outreach.

• B2B calls made with AI may also allow some flexibility, but be cautious with misleading or frequent AI calls, which could trigger enforcement.

Compliant vs. Non‑Compliant Scenarios at a Glance

Be careful with implicit consent. This can come in the form of informal permission, which is assumed because the customer gave their phone number. For instance, a dentist making an AI call to confirm the appointment works with implicit consent. However, a business using AI to pitch a product without prior explicit consent is illegal.

Business Risks & Enforcement: What’s at Stake?

Violations of AI call regulations can pose the following fines:

• TCPA (Telephone Consumer Protection Act) violations pose fines of $500-$1500 per call. The amount depends on whether the violation was “willful or knowing.”

• FCC (Federal Communications Commission) fines for AI or prerecorded voice violations can exceed $23,000 per call. The exact amount is based on severity, intent, volume of calls, history of violations, and the company’s efforts to comply.

• GDPR (General Data Protection Regulation) violations in Europe can result in fines of up to 4% of the company’s global revenue.

The number of lawsuits related to AI call violations is growing. Court filings increased from 331 to 691 in just one year. Most of these are customer complaints triggered by unsolicited robocalls. Besides fines, robocall complaints can also damage your brand reputation.

Deploying AI Responsibly: Ethical and Technological Considerations

Despite the legal landscape surrounding AI calls, you might still wonder whether they’re ethical. They absolutely can be as long as you're transparent and honest with your disclosures. Be upfront about using AI and clearly explain the purpose of the call. This helps your business build trust and avoids confusion with your customers.

You should also be aware of the risks of AI errors, which can sometimes introduce bias or lead to discrimination. For example, AI-generated voices might misinterpret certain accents or speech patterns, causing slightly offensive outcomes. To prevent this, regularly test and review your generated voice. 

Human-like AI voices that sound very natural should also be used carefully. Always let the recipient know that the call is made by a bot to avoid misleading them or creating false impressions.

Finally, data privacy is a major concern when it comes to AI-powered calls. Make sure all call records, consent logs, and personal information are stored securely to protect against data leaks or misuse.

Here is a checklist for the responsible use of AI calls:

• Be transparent about the use of AI during the call
• Review your AI voice models to check for biases
• Secure data: use encryption, access controls and privacy procedures

Pathways to Compliance: Practical Steps for Business and Sales Leaders

To deploy AI-powered calls responsibly, inspect your script for proper AI disclosures and test the opt-out methods are working correctly. Verify that consent records are accurate. 

Upon choosing the AI calling platform, ensure the platform offers the following features:

• AI-voice disclosures at call start

• Real-time compliance monitoring

• Encrypted storage of all the call recordings 

• Rate limits to prevent mass unsolicited calls

When you finally launch AI calls, do not stop compliance monitoring. Use AI compliance tools (such as RingCentral, insight7, etc.) to monitor real-time calls. Stay updated on the updates of AI calls regulations in your country/region.

The last good practice is to join professional associations and compliance-focused organisations (e.g, Linux Foundation's Trustmark Initiative) to stay informed about the best practices. Participate in user forums or advocacy groups to stay updated on all the compliance trends and constantly evolving consumer expectations. 

FAQ

Are AI-generated robocalls/cold calls illegal everywhere?

• No. The AI-generated or prerecorded “robocalls” are legal if they adhere to local laws. In the U.S., the FCC (Federal Communications Commission) requires telemarketing robocalls to have prior express written consent, AI disclosure and opt-out methods. Violation of these rules can make robocalls illegal. Similarly, other regions have their own rules that must be followed.

What’s the legal definition of “AI-generated voice” vs. pre-recorded messages?

• The FCC in the US defined “AI-generated voice” as any artificial voice created by machine learning, voice cloning, or other AI tools. FCC treats both AI-generated and prerecorded human voice calls as robocalls. 

How do requirements differ for B2B vs. B2C calls?

• No clear difference is established between B2B and B2C calls currently in the US when AI prerecorded voices are used. In some cases (like the EU), B2B calls might have more relaxed rules, but still the safest practice is to follow the same rules for both types of calls.

How should consent and records be managed and stored?

• Consent should be documented, but depending on the jurisdiction in your region, it can be written, oral, form-based, etc. It should be stored for at least 5 years, with timestamps, IP addresses and call/web-form logs. 

Can AI calls be used for non-sales purposes?

• Yes. AI calls can be used for appointment reminders, support notifications, billing alerts, emergency alerts, accessibility services (for people with disabilities) or other high social value messages. In such cases, these calls often do not need strict consent, though they typically still require disclosure and opt-out options. 

What are the top three compliance mistakes businesses make?

• Assuming implicit consent (e.g, your customer gave their phone number without a clear and documented agreement for AI telemarketing calls)
• Forgetting to state “This is an AI-generated voice” at the start
• Weak opt-out mechanisms - not providing a clear, real-time option for your customers to stop calls

What should my company do if we receive a regulatory inquiry?

• Immediately pause all the AI outbound campaigns.
• Gather all the audit logs, consent records, and call scripts.
• Hire a compliance attorney to review the regulator’s notice and the gathered materials.
• Respond in time and demonstrate your remediation steps.
• Update your compliance procedures, pivot script if necessary and document all the other changes.