Is AI cold calling legal? The TCPA rules for AI voice calls, in plain English

This guide summarises United States federal rules and one state example as we understand them in October 2026. It is not legal advice. Rules change, courts disagree, and state laws add to the federal ones. Have a lawyer review your consent language and your lists before you call at scale.

If “AI cold calling” means an AI voice agent calling people who never agreed to hear from you, then in the United States it is not legal when the number is a mobile phone or a residential line, which covers almost every number on a modern lead list.

If it means an AI voice agent calling people who gave you written permission to call them, for example on the form they just submitted, it is legal, provided you also follow the rules on calling hours, identification, opt-outs and do-not-call lists.

The difference is consent, and the rest of this guide is about getting it right.

The Telephone Consumer Protection Act, the TCPA, restricts calls made with an automatic dialing system or an “artificial or prerecorded voice.” For years it was an open question whether a voice generated live by an AI model was artificial in that sense.

The FCC answered it on 8 February 2024. In a unanimous declaratory ruling it confirmed that calls using AI-generated voices are “artificial” under the TCPA, with immediate effect. The practical result is that an AI voice agent placing a call is held to the same consent rules as a prerecorded robocall.

Two court decisions since then are worth knowing. In January 2025 the Eleventh Circuit struck down the FCC's “one-to-one consent” rule before it took effect, so a consent form does not have to name a single seller, though it still has to clearly cover your business. In June 2025 the Supreme Court held in McLaughlin Chiropractic v. McKesson that district courts are not bound by the FCC's interpretations of the TCPA. That opens some arguments in court, but the statute's own words say “artificial voice,” and an AI voice is hard to describe as anything else. Do not plan a campaign around that argument.

The federal rules turn on two questions: is the call marketing, and what kind of line are you calling? A call is marketing if its purpose is to encourage someone to buy a product or service. Booking a sales consultation, a demo or a quote visit is marketing, even if the lead asked for information first.

Most AI appointment-setting calls are in the first row: an AI voice, a mobile number, and a sales meeting at the end. That row needs written consent.

The FCC's definition of prior express written consent has four parts. The agreement must:

1. Be in writing and signed. An electronic signature counts, such as a ticked box on a web form, a signed e-form or a texted “YES” in reply to a clear request, as long as it is valid under federal or state law.
2. Clearly authorize your business to make marketing calls using an automated system or an artificial or prerecorded voice. Saying “AI” or “artificial voice” plainly is the safest way to meet this.
3. Include the phone number the person agrees to be called on.
4. Say that agreeing is not a condition of buying anything.

Here is an example of form language that covers those four points. Treat it as a starting point for your lawyer, not a finished clause.

Keep the evidence: the exact wording the person saw, the time they agreed, the page or source, and the phone number. If you buy leads, ask the seller for that evidence before you call; consent collected for “partners” in small print is where most disputes start.

Consent for an old lead is the hardest case. A past purchase or enquiry is not written consent for AI calls. Our database reactivation playbook shows how to email those contacts first and invite them to opt in.

Many B2B teams assume the TCPA only protects consumers. That is only partly true.

• The rule for artificial-voice calls to mobile phones applies to any number on a mobile service, whoever pays the bill. A sales director's work mobile is covered.
• The rule for artificial-voice marketing calls to landlines covers residential lines. A genuine business landline, such as a company switchboard, falls outside it.
• Identification requirements apply to every artificial-voice call, whatever the line.
• State laws do not always draw the same line, and some cover business numbers.

In practice most numbers on a modern B2B list are mobiles, so most B2B AI calls need the same written consent as consumer calls.

Federal rules bar marketing calls before 8 am or after 9 pm in the called person's local time. Several states go further. Florida is the best-known example.

Time zones are where campaigns slip. If your list spans the continental United States, a window from 11 am to 8 pm Eastern keeps every contact inside both the federal hours and Florida's. If your calling tool schedules by your own office's time zone, as SuperCampaign's quiet hours do, set the window with your most western and most eastern contacts in mind.

Federal rules set three requirements for artificial-voice calls, and a fourth is on the way.

1. Identify the business at the start. Before anything else, say clearly who is calling.
2. Give a phone number. During or after the message, provide a number people can call to reach you or ask not to be called again.
3. Offer an automated opt-out on marketing calls. The rule was written for recorded messages, which must offer a voice or keypress opt-out straight after the identification. An AI agent should do the same: invite people to say “stop,” and act on it.
4. Disclose the AI, probably soon. In August 2024 the FCC proposed requiring AI-voice calls to disclose the AI at the start of each call. That rule had not been adopted when we last checked in October 2026, and some states have their own disclosure rules. Disclosing anyway costs nothing, and people who find out halfway through are the ones who complain.

Give the phone number at the end of the call, in the follow-up text, or both.

• National Do Not Call Registry: scrub marketing lists against it. Written consent from the person is the main way to call a registered number.
• Your own do-not-call list: when someone asks not to be called, record it, stop within ten business days, and keep honouring it for at least five years.
• Revoking consent: a person can withdraw consent in any reasonable way, on a call, by text, by email or by any other clear request, and you must stop within ten business days.
• Rules in motion: on 30 September 2026 the FCC voted to change parts of the revocation rules, including letting callers designate an exclusive opt-out method. The changes take effect 30 days after publication in the Federal Register. Check the current status before relying on them.

The practical rule is simpler than the legal one: an opt-out request on any channel should stop every channel, quickly, and should still be in force next year.

The TCPA lets the person who was called sue for $500 per unlawful call, and a court can triple that to $1,500 when the violation was willful or knowing. The numbers are per call, which is why TCPA cases are usually brought as class actions: a campaign of 10,000 calls without valid consent is a claim worth $5 million or more before legal fees.

State attorneys general and the FCC can also act, and several states have their own laws with their own private lawsuits. Florida's is the most active.

AI calling is not the problem; calling without permission is. These uses fit the rules well when consent is collected properly:

• Speed to lead: calling a lead within a minute of a form that includes the written-consent checkbox.
• Booked-call confirmation: confirming a meeting the person booked.
• No-show recovery: rebooking someone who missed a meeting they booked, with consent from the booking form.
• Callbacks at a time the person asked for.
• Database reactivation of contacts who gave written consent, with email first for the rest.

If you are deciding between AI and human setters for a list without AI consent, a live person dialling by hand has a lower bar. The trade-offs are in AI appointment setter vs human setter.

1. Every contact on the list gave written consent that covers AI or artificial-voice calls from your business, and you can show the wording, the time and the source.
2. The list is scrubbed against the National Do Not Call Registry and your own do-not-call list.
3. The calling window sits inside 8 am to 9 pm for every contact's time zone, and inside stricter state hours where they apply.
4. The agent's first sentence names your business and says it is an AI assistant, and it invites people to say “stop.”
5. Saying “stop” on a test call marks the contact do-not-call, and a STOP text reply does the same for calls.
6. A phone number for opt-outs is given on the call or in the follow-up text.
7. No contact gets more than three marketing calls in 24 hours, so you stay inside Florida's limit everywhere.
8. A lawyer has reviewed your consent language and your plan for old or purchased lists.

SuperCampaign runs AI call campaigns on your own Vapi and Twilio accounts. Some of the rules above are built into the product; the ones about who you may call stay with you.

Read the full calling-compliance page