Is AI Cold Calling Legal? 9 TCPA & Compliance Rules for AI Voice Agents

You have built the AI cold calling pipeline. The voice agent sounds natural, your CRM webhooks are firing, and your morning cron job is loaded with leads. Before you initiate that first dial, you need to answer one question: Is AI cold calling legal?

Yes, but it is heavily regulated. Since the FCC’s landmark 2024 ruling, AI voice agents fall under the same compliance framework as traditional robocalls. State legislatures have since layered additional disclosure requirements on top. If you want to scale outbound without risking six-figure penalties, you need to understand where the guardrails are today.

A Quick Note on the Tech: ElevenLabs

ElevenLabs is a leading AI voice synthesis platform that provides the hyper-realistic text-to-speech and conversational engines powering modern outbound agents. You can explore their voice generation capabilities and API documentation directly on the ElevenLabs website.

This guide covers US law. If you plan to dial internationally, the EU’s GDPR/ePrivacy Directive and Canada’s CASL operate under entirely different consent frameworks. Get jurisdiction-specific counsel before expanding beyond US borders.

The FCC Ruling That Changed Everything

On February 8, 2024, the FCC issued Declaratory Ruling FCC 24-17, classifying AI-generated voices as “artificial voices” under the Telephone Consumer Protection Act (TCPA). Your AI agent, regardless of how naturally it handles objections, is legally in the same category as a legacy robocall.

All standard robocall restrictions now apply: consent requirements, calling-window limits, opt-out obligations, and identification rules. The TCPA specifically requires that artificial-voice calls identify the calling entity at the beginning of the call.

B2B vs. B2C: Where Consent Rules Diverge

The most common compliance mistake is applying consumer rules to business prospects, or the reverse.

Cell phones require Prior Express Written Consent (PEWC) before any AI voice call. This means a documented opt-in: a signed form, a checked box, a recorded agreement. Without PEWC, an unsolicited AI call to a mobile number is not permitted.

Business landlines are treated differently. B2B calls to published business landlines are exempt from the National Do Not Call Registry, which applies to residential and personal lines. However, you must maintain an internal, company-specific do-not-call list. If a business asks you to stop calling, suppress that number. Calling windows, caller ID accuracy, and recording disclosures still apply.

If your data source does not explicitly confirm a number is a hardwired business landline, treat it as a mobile number and require PEWC.

Six Core Rules for AI Outbound Calls

Wire these six rules into your pipeline architecture.

1. Consent by phone type. Block mobile numbers from the AI dialer unless PEWC is attached. Route only consented mobile numbers or verified business landlines to the agent.

2. Calling windows. Restrict calls to 8:00 AM through 9:00 PM in the recipient’s local time zone. Your dialer’s cron schedule must adjust dynamically, not just follow your server clock.

3. Opt-outs. When a prospect asks to be removed, the agent must recognize the intent, log it, and suppress the number permanently. Do not program the agent to negotiate or retry.

4. Caller ID and identification. Display a valid callback number and identify the calling entity. Spoofed or blank caller IDs violate both the TCPA and the STIR/SHAKEN authentication framework.

5. AI disclosure. State laws increasingly require you to tell the recipient they are speaking with an AI. Even where not yet mandated, a brief disclosure in the opening prompt builds trust and protects you against incoming legislation.

6. Recording consent. AI agents capture and transcribe audio. Two-party consent states require you to announce that the call is being recorded before any substantive conversation begins.

State AI-Disclosure Laws

This is the fastest-moving area of AI call compliance. Here is where things stand:

Texas (SB 140, effective September 1, 2025). Requires disclosure that a call is AI-generated within the first 30 seconds. This applies to commercial and political automated calls.

California (AB 2905). Amends the state’s automatic dialing-announcing device statutes to explicitly include AI-generated voices in the definition of “artificial voice.” Before a recorded or AI-generated message plays, the system must first deliver an unrecorded, natural-voice announcement identifying the caller. Penalties reach $500 per violation. Note that California’s BOT Act (B&P § 17940) applies to online interactions, not phone calls, so AB 2905 is the relevant statute here.

Florida and Oklahoma. Both states have telemarketing statutes with disclosure provisions that can apply to automated or AI-assisted calls. The specifics depend on the call context and the type of solicitation.

Most other states. No explicit AI-disclosure statute yet, but TCPA identification rules still apply, and state mini-TCPA laws may impose additional restrictions.

Before dialing into any state, verify its current telemarketing and AI-disclosure statutes. This list will look different in six months.

The Financial Risk

TCPA statutory damages are $500 per call for negligent violations and $1,500 per call for willful ones. A single unscrubbed list of 10,000 mobile numbers, dialed once, creates a theoretical exposure of $5 million to $15 million. Plaintiffs do not need to prove actual harm, which makes TCPA claims a favorite of class-action firms. The FCC continues to issue multi-million-dollar enforcement actions against unconsented AI robocall operations.

The 9-Point Compliance Checklist

These six rules above map to nine operational steps in a typical AI calling pipeline. Use this as your pre-launch audit.

#	Step	Pipeline Phase
1	Verify consent source for every number (PEWC for mobiles, confirmed landline for B2B)	Lead validation
2	Scrub residential and mobile numbers against the National DNC list	Data pull
3	Enforce the 8AM – 9PM local-time calling window	Dialer scheduling
4	Embed AI disclosure in the agent’s opening prompt	Prompt configuration
5	Program real-time opt-out recognition and graceful exit	Prompt guardrails
6	Transmit accurate, non-spoofed Caller ID via your telecom provider	Telecom config
7	Include a recording-disclosure notice at call start	Call flow logic
8	Log full transcripts and dispositions for audit trails	Post-call CRM sync
9	Suppress opted-out numbers permanently across all campaigns	CRM suppression

Check all nine before you scale. Miss one, and you have left a gap that a class-action attorney will find.

Build It Right, Scale Safely

AI cold calling is a regulated channel, not a legal free-for-all. The teams that embed compliance into the pipeline from day one – rather than bolting it on after the first cease-and-desist letter – are the ones scaling outbound without looking over their shoulder.

Treat these rules as design constraints. Build them in, test them, and document them. Your future legal team will thank you.

---

This article is for informational purposes only and does not constitute legal advice. Telecommunications law changes frequently. For guidance specific to your use case, consult an attorney specializing in TCPA and telecommunications compliance.