TCPA and AI Voice Calling: Is AI Cold Calling Legal in 2026?

What the FCC actually ruled in February 2024

On February 8, 2024, the FCC issued a unanimous Declaratory Ruling confirming that the TCPA's restrictions on "artificial or prerecorded voice" calls cover calls that use AI to generate a human-sounding voice. The reasoning was simple: those voices are artificial because a person is not speaking them. The ruling applies to any AI technology that initiates an outbound call using an artificial or prerecorded voice, including voice cloning.

It took effect immediately and did not create a new rulebook. It attached AI voice calls to the existing one. Everything the TCPA and 47 C.F.R. § 64.1200 already required of a prerecorded call now clearly applies to an AI agent: consent before the call, identification of the entity responsible for it, a working way to opt out, restricted hours, and honoring Do Not Call requests.

A second piece is still pending. In August 2024 the FCC adopted a Notice of Proposed Rulemaking in the same docket (FCC 24-84, released August 8, 2024 and published in the Federal Register on September 10, 2024) that would define "AI-generated call" and require callers to disclose the use of AI both when obtaining consent and at the start of the call. Comments closed in October 2024, and as of this writing the proposal has not been adopted as a binding federal rule. The underlying TCPA obligations are in force regardless, and several states have moved ahead of the FCC on disclosure.

Consent is the requirement that decides everything else

Consent is the gate. Without it, no amount of good scripting, polite tone or careful timing makes an AI voice call to a mobile number compliant. Under 47 U.S.C. § 227(b), calls placed to a wireless number using an artificial or prerecorded voice require the called party's prior express consent, and when the call delivers an advertisement or constitutes telemarketing, the standard rises to prior express written consent.

"Written" means a signed agreement — an e-signature counts — that clearly authorizes artificial or prerecorded voice calls to the specific number the person provided, and that is not a condition of purchase. A checkbox buried in terms of service generates litigation. A standalone disclosure next to the phone-number field, captured with a timestamp and the exact language shown, survives it.

Two recent developments cut in opposite directions. The FCC's "one-to-one consent" rule, which would have banned bundled consent across multiple sellers, was vacated by the Eleventh Circuit in Insurance Marketing Coalition Ltd. v. FCC on January 24, 2025; bundled lead-form consent is not, by itself, federally prohibited today. Pushing the other way, the FCC's revocation rules took effect on April 11, 2025: a consumer may revoke consent in any reasonable manner that clearly expresses a desire not to receive further calls, and revocation must be honored within ten business days.

The related "revoke-all" rule, which would treat an opt-out on one subject as an opt-out for all of a caller's future robocalls and robotexts, has been delayed repeatedly; in January 2026 the FCC pushed its effective date to January 31, 2027. Deferred is not gone, and honoring a broad opt-out broadly is cheap to implement and hard to regret.

• Capture consent language, timestamp, channel and the exact number consented to.
• Keep the record as long as you might have to defend the call.
• Treat any request to stop as a stop, in whatever words it arrives.
• Suppress revoked numbers everywhere, not only where the opt-out arrived.

The B2B assumption that gets teams in trouble

A common belief in outbound is that B2B calling is exempt from all of this. That is partly true and dangerously incomplete. The FTC's Telemarketing Sales Rule does carve most business-to-business calls out of its requirements at 16 C.F.R. § 310.6(b)(7). But the TSR is not the TCPA, and the TCPA's restriction on artificial and prerecorded voice calls to wireless numbers has no equivalent B2B exemption.

That matters, because a large share of the "business" numbers in any B2B database are mobile numbers. A prospect's cell phone is a cell phone whether they use it for work or not, and the consent requirement applies regardless of how business-focused the pitch is. Treat mobile numbers in a B2B list as consent-gated by default; direct-dial office lines are the lower-risk surface.

Disclosure: say that it is an AI, early and plainly

Federal law already requires that a prerecorded or artificial voice call identify, at the beginning of the message, the business responsible for initiating it, and provide a callback number. For calls to residential lines, 47 C.F.R. § 64.1200(b) also requires an automated interactive opt-out mechanism, offered within two seconds of the identification information, that adds the number to your do-not-call list and disconnects.

Disclosure that the voice is artificial is a separate question, and state law has already moved. California amended Public Utilities Code § 2874 through AB 2905 (2024) to require that an automatic dialing-announcing device call inform the person called if the message uses an artificial voice — defined as a voice generated or significantly altered using artificial intelligence. Maine's AI transparency law, LD 1727, "An Act to Ensure Transparency in Consumer Transactions Involving Artificial Intelligence," was signed in June 2025 and took effect in September 2025; it bars using AI in trade and commerce in a way that could mislead a reasonable consumer into thinking they are talking to a human unless they are clearly and conspicuously notified otherwise, and it reaches programs that mimic human dialogue through text or voice, so voice agents are in scope.

Because the FCC's own disclosure proposal is still pending and the state patchwork is growing, the sensible answer is to disclose everywhere rather than maintain a per-state script matrix that has to be re-audited every legislative session. Disclosing costs a sentence.

There is also a practical argument that has nothing to do with law. A prospect who works out mid-call that they were misled stops listening. A prospect told in the first sentence either engages or ends the call quickly. For the mechanics of the channel rather than the law, start with how AI cold calling works.

• Identify the company by name at the top of the call, not at the end.
• Say the caller is an AI assistant, in plain words, in the first few seconds.
• Give a callback number that a monitored line actually answers.
• Make "take me off your list" work immediately, without a human intervening.

Calling hours are a time-zone problem, not a clock problem

The federal rule at 47 C.F.R. § 64.1200(c)(1) prohibits telephone solicitations before 8 a.m. or after 9 p.m. local time at the called party's location. The phrase that matters is "at the called party's location." The window follows the prospect, not your office, and not the area code's nominal time zone if the person has moved.

Several states are stricter. Florida's Telephone Solicitation Act narrows the window to 8 a.m. through 8 p.m. in the consumer's local time. Oklahoma uses the same 8 a.m. to 8 p.m. window, and Maryland's Stop the Spam Calls Act prohibits telephone solicitations outside 8 a.m. to 8 p.m. in the called party's time zone. All three also cap solicitation calls at three per consumer in a 24-hour period on the same subject matter, regardless of which numbers you dial from. Where federal and state rules differ, the stricter one governs. Time-of-day allegations are among the easiest for a plaintiff to plead, because the timestamp in your own call log either sits inside the window or it does not.

This is one of the places where automation is genuinely safer than a human dialer. A rep glancing at a list has no idea that a 512 number now lives in New York. A system that resolves each lead's timezone before dialing and holds the attempt for the next eligible slot does not make that mistake at 7:58 p.m. on a Friday. Frequency caps, holiday and Sunday rules also vary by state, so national campaigns should default to the narrowest window they must meet anywhere they dial.

Recording consent varies by state and is a separate law

Call recording is governed by wiretap and eavesdropping statutes, not by the TCPA, so it is a separate compliance track. Federal law under 18 U.S.C. § 2511 permits recording with the consent of one party. Roughly a dozen states require the consent of all parties, with California, Florida, Illinois, Massachusetts, Pennsylvania and Washington among the most frequently litigated. The Reporters Committee for Freedom of the Press maintains a state-by-state Reporter's Recording Guide, the standard public reference for current rules in each jurisdiction.

AI voice agents record almost by definition — transcription, quality review and CRM logging all depend on it — so all-party consent is a hard requirement, and penalties in the strictest states are criminal rather than civil. The workable pattern is the one contact centers have used for years: announce that the call is recorded in the same breath as identifying the company and disclosing the AI, and treat any objection as an instruction to stop recording or end the call. Announcing on every call rather than only in all-party states removes a whole category of routing logic.

• Announce recording before anything substantive is discussed, and log the announcement as part of the recording.
• Store recordings behind access controls and signed, expiring URLs rather than public links.
• Set a retention period and actually enforce it.

Do Not Call obligations, in both directions

There are two lists and you owe duties to both. The National Do Not Call Registry is run by the FTC and covers consumers who have asked not to receive telemarketing calls; under the Telemarketing Sales Rule, telemarketers have been required since January 1, 2005 to access it and purge newly registered numbers at least every 31 days. The FCC's parallel rule at 47 C.F.R. § 64.1200(c) requires registry data obtained no more than 31 days before the call is made.

The second list is your own. 47 C.F.R. § 64.1200(d) requires a written internal do-not-call policy, personnel training, and honoring a do-not-call request within a reasonable time not exceeding ten business days. Internal DNC failures are easy to create and hard to explain, because they begin with someone saying "stop calling me" and that request never reaching the system that places calls.

Several states maintain their own registries as well, so a national program has more than one list to scrub against. State mini-TCPA statutes have proliferated since Florida's 2021 amendments, and Manatt's TCPA Connect newsletter tracks new ones as they move through state legislatures. Practically, DNC has to be enforced at dial time, not at import time, because lists go stale between upload and the moment a campaign reaches its last row.

What a compliant AI calling setup actually looks like

Compliance for AI voice is not one feature. It is a sequence of gates a call has to pass before it connects, plus a durable record that it passed them. Note what is not on the list below: any technique for making calls harder to trace, any workaround for the calling-hours window, any method of avoiding disclosure. Those are not gray areas.

• Consent recorded per number, with language and timestamp, and checked before the call is queued.
• AI disclosure and company identification in the agent's opening lines, not configurable away.
• Recording notice delivered on every call, with objections respected.
• Calling window resolved from the lead's own timezone, with the stricter of federal and state rules applied.
• National, state and internal DNC checks run at dial time.
• Every opt-out written back to a suppression list that all channels read from.
• A durable, auditable log of what was said, when, to whom, and on what basis.

How RingLeadAI implements this

A lot of AI voice tooling ships the dialer and leaves consent, hours, recording notice and DNC to whatever the customer builds around it. We built those gates into the AI cold calling product itself. Rynn, our voice agent, discloses that it is an AI assistant at the start of every call, identifies the calling company, and announces recording. Calling-hours windows are enforced per lead in the lead's own timezone and default to on. Consent gating and Do Not Call checks run before a number is dialed, not after a list is imported.

Compliance state does not stay inside the voice product. Opt-outs and suppressions propagate across email, voice and social, and call outcomes sync to your CRM through our integrations. If you are building a multichannel program rather than a phone-only one, our overview of AI outbound sales covers how the channels coordinate.

None of this is priced as an enterprise add-on. Voice plans start at $49 per month with a 7-day trial and no card required, so you can inspect the compliance behavior before committing. See pricing.

The honest framing is that these controls constrain your campaigns. They will stop calls you wanted to place. That is the point.

This is general information, not legal advice

Everything above describes publicly available federal and state requirements as of August 2026, with sources named so you can read them yourself: the FCC's February 2024 Declaratory Ruling (FCC 24-17) and August 2024 NPRM (FCC 24-84), both in CG Docket No. 23-362, 47 U.S.C. § 227, 47 C.F.R. § 64.1200, the FTC's Telemarketing Sales Rule and Do Not Call Registry rules, Insurance Marketing Coalition Ltd. v. FCC (11th Cir. 2025), California Public Utilities Code § 2874 as amended by AB 2905, Maine's 2025 AI transparency law, the Florida Telephone Solicitation Act, and the Reporters Committee for Freedom of the Press recording guide.

It is not legal advice, and it cannot account for your industry, your data sources, the states you call into or the consent you actually hold. Telemarketing law changes on a rolling basis, so rules accurate at publication may not be accurate when you read this. Have qualified counsel review your calling program before you launch it, and again when your geography or list sources change.

Keep reading

• RingLeadAI vs Instantly: An Honest Comparison for Cold Email Teams →
• What is an AI SDR? The Complete Guide for 2026 →
• How AI Cold Calling Works for B2B Sales Teams →
• All articles →