Search this keyword and you get two kinds of posts: vendor name-drops, or a rewritten FCC press release. Neither is useful to the person actually shipping outbound AI calls — the one with a launch date on the calendar and a legal team asking a single question: are we going to get sued?
This is the operator version. No vendor pitch until the last section, and even there it's architecture, not a logo. What the rules actually require in 2026. Where AI-dialed calls trip the wire. How to capture consent that survives a lawsuit. And a checklist you can hand to compliance before you dial a single number.
One caveat up front. This is a builder's guide, not legal advice. TCPA statutory damages run $500 to $1,500 per call, and plaintiff firms run automated sweeps for violations. Have counsel sign off on your specific flow. What follows gets you 90% of the way there, so that conversation is short and cheap.
The 2026 rulebook: TCPA + the FCC one-to-one consent rule in plain English
Two things govern an outbound AI call in the US.
The TCPA (Telephone Consumer Protection Act, 1991) is the statute. Here's the part that matters for AI: place a call using an autodialer, or a call carrying a prerecorded or artificial voice, to a wireless number, and you need prior express consent. If the call is marketing, you need prior express written consent (PEWC). "Artificial voice" is the hinge for anything AI — we'll come back to it.
The FCC one-to-one consent rule was the FCC's 2024 crackdown on what counts as valid consent. The target was lead-gen "consent farms," where one checkbox authorized hundreds of "marketing partners." The core of it, as operators implement it now:
- Consent goes to one identified seller at a time — not a bundled list hiding behind an "and our marketing partners" link.
- The call topic has to be logically and topically associated with the site or interaction where consent was collected. A mortgage-quote form does not authorize a solar-panel call.
- The consumer takes a clear affirmative action — an unchecked box they check, not one pre-checked for them.
Status note: the one-to-one rule's effective date was delayed and then vacated by the Eleventh Circuit in early 2025, so the FCC's specific one-to-one mandate is not federally enforced as of 2026. This does not make bundled consent safe. The underlying TCPA PEWC standard still applies, several states (notably Florida's FTSA and Oklahoma) wrote one-to-one-style requirements into their own statutes, and the FCC signaled it will revisit. Every serious operator we work with builds to the one-to-one standard anyway. It's the defensible floor, and re-plumbing consent later costs far more than doing it once. Treat one-to-one as a design requirement, not a debate.
Bottom line: calling wireless numbers with an AI voice to sell something means per-seller, topic-matched, affirmatively-given written consent — plus everything below.
Does an AI voice agent count as an autodialer or prerecorded call?
This is where teams talk themselves into a lawsuit. "It's a live conversational AI, not a robocall, so the prerecorded rules don't apply." Wrong instinct, and an expensive one.
There are two independent triggers, and you probably hit at least one.
1. Artificial or prerecorded voice. The TCPA restriction on "artificial or prerecorded voice" was never limited to a WAV file playing on loop. A synthetic TTS voice generating speech in real time is an artificial voice. The FCC's February 2024 Declaratory Ruling ended the argument: calls using AI-generated voices are "artificial" under the TCPA, full stop. A conversational AI agent speaking in a synthesized voice sits squarely inside the artificial-voice rules — same consent bar as an old-school robocall, arguably higher.
2. Autodialer (ATDS). Dial from a stored list using an automatic process and you're in autodialer territory for wireless numbers. Facebook v. Duguid (2021) narrowed the ATDS definition to systems using a random-or-sequential number generator, and many list-based dialers technically slip out from under it — but don't lean on this. The artificial-voice trigger catches you no matter how the number was picked. If the voice is synthetic, ATDS status is usually moot.
Practical read: assume your outbound AI agent gets treated as an artificial-voice call. That means prior express written consent for any marketing call to a cell phone, and prior express consent (written isn't strictly required, but get it) for informational calls like appointment reminders. When in doubt, collect PEWC. It covers both.
Getting valid prior express written consent for AI-dialed outbound
PEWC isn't a vibe. It has specific elements, and a consent record survives a lawsuit only if it proves all of them:
- A clear disclosure near the submit action, stating the consumer agrees to receive autodialed / artificial-voice / prerecorded calls and texts at the number provided.
- Identification of the specific seller placing the calls. Name your company, not a category. That's the one-to-one point in practice.
- A statement that consent is not a condition of purchase. If they have to consent to buy, the consent is invalid.
- Affirmative action — an unchecked checkbox the user checks, or equivalent. No pre-checked boxes. No "by continuing you agree" buried in a footer.
- The number they consented on, captured server-side.
Then comes the part most homegrown setups get wrong: you have to prove it later. Store an immutable consent record per number.
{
"phone": "+15551234567",
"consent_type": "PEWC_marketing",
"seller": "YourCo Inc.",
"timestamp": "2026-07-26T14:03:22Z",
"source_url": "https://yourco.com/quote",
"disclosure_text_hash": "sha256:9f2c...",
"ip": "203.0.113.7",
"form_snapshot_id": "snap_88213"
}
Hash and version the exact disclosure language you showed. Plaintiff counsel will ask what did the checkbox say on the day you called — and "we redesigned that page since" is not an answer. Capture the rendered disclosure, not a pointer to a page that has changed.
Consent also has a shelf life in practice. There's no universal federal expiry, but stale consent — 18+ months, no interaction — is a litigation magnet. Many operators re-confirm or suppress numbers that go quiet past a set window.
DNC lists, revocation, and honoring opt-outs in real time
Consent is necessary, not sufficient. You still have to scrub, and you still have to stop on command.
Do-Not-Call scrubbing. Before a marketing campaign runs, scrub against:
- The National DNC Registry (federal).
- State DNC lists where they exist.
- Your internal / company-specific DNC list — anyone who has opted out of your calls. This is the one that generates most lawsuits, because it's the one companies forget to maintain.
Scrub at campaign build and re-scrub near dial time. Registrations change daily and numbers recycle.
Revocation — the 2024 FCC rule that bites hardest. As of the FCC's April 2025 effective date, a consumer can revoke consent through any reasonable means, and you must honor it. For an AI agent, that's concrete:
- If the caller says "stop calling me," "take me off your list," "do not call," "remove me" — or any reasonable equivalent — mid-conversation, that's a valid revocation. Your agent has to catch it in natural language, not just a DTMF "press 9."
- You must stop within a reasonable time, capped at 10 business days. In an automated system there's no excuse for taking days. Suppress immediately.
- Revocation via reply STOP to a text, a call back saying stop, an email, a web form all count. Opt-out has to hold across channels, which means your DNC state has to be shared — not siloed per campaign.
This one's a hard requirement for AI specifically. A human agent hears "stop calling me" and complies. An AI agent will cheerfully keep pitching unless you built real-time opt-out intent detection that writes to a suppression list the dialer checks before the next call and mid-call. Without that plumbing, every angry caller is a potential claim.
Call disclosure, AI-identification, and two-party recording rules by state
Three separate obligations that operators love to conflate.
AI / artificial-voice identification. For prerecorded and artificial-voice calls, the caller's identity and contact info must be disclosed at the start. There's also a growing expectation — and in some states, a requirement — to disclose that the caller is an AI. Several states have moved on this: California's "Bot Disclosure" law, plus newer 2024–2025 AI-disclosure statutes in states like Utah, require that a consumer be told they're talking to a bot when it could reasonably matter. Safe default: say "this is an AI assistant calling on behalf of [Company]" in the first few seconds. Cheap, and it kills a whole category of complaint.
Recording consent — one-party vs two-party. If you record calls (most do, for QA and training), consent to recording is separate from consent to call. Roughly a dozen states are all-party (two-party) consent for recording — CA, FL, PA, IL, WA, MA, and more. Outbound campaigns cross state lines, so the operational answer is simple: get recording consent on every call regardless of state, via an opening "this call may be recorded." Detect the called number's state if you want precision, but blanket disclosure is the low-risk path.
Calling hours. Federal TCPA restricts calls to 8am–9pm in the called party's local time zone. Some states are tighter. Your dialer has to window by the recipient's area-code time zone, not your server's clock.
Pre-launch compliance checklist for outbound AI campaigns
Hand this to whoever owns the launch. Any unchecked box means you're not ready.
- Consent captured as PEWC for every number, with per-seller, topic-matched disclosure.
- Immutable consent records stored with timestamp, source URL, and hashed disclosure text.
- Consent-not-a-condition-of-purchase language present on the capture form.
- Federal + state + internal DNC scrub at build and re-scrub near dial time.
- Real-time opt-out detection in the agent (NL "stop"/"remove me"), writing to a shared suppression list honored across channels within 10 business days (target: instant).
- AI identity disclosure in the first few seconds ("AI assistant on behalf of [Company]").
- Recording disclosure on every call (all-party-safe default).
- Calling-hours window enforced by recipient time zone (8am–9pm).
- Consent shelf-life policy — suppress or re-confirm stale numbers.
- Audit log capturing consent proof, disclosure played, opt-outs, and DNC scrub results per call — exportable.
- Counsel sign-off on the specific flow and disclosure language.
Where the platform should enforce it — not your ops team
Here's the design principle that separates a compliant operation from a lucky one: compliance controls belong at the call layer, not in a spreadsheet and a training doc. Anything a human has to remember to do will eventually not get done — and at outbound scale, "eventually" is measured in hours.
What that means in practice, and what to demand of any platform, build-your-own or buy:
- Consent gating at dial time. The dialer refuses to place a call to a number with no valid consent record. Not a warning — a hard block.
- Automatic DNC scrub against federal, state, and internal lists on every campaign, logged.
- Native real-time opt-out. The voice agent detects "stop calling me" in natural language and writes to a suppression list the dialer reads before the next attempt — no engineer in the loop.
- Disclosure baked into the opening turn so AI-identity and recording notices can't be skipped.
- Time-zone-aware dialing by recipient area code.
- Immutable, exportable audit logs — consent proof, disclosure played, opt-out events, scrub results — because your defense is only as good as your records.
This is exactly the layer Finn is built to own: consent gating, DNC scrubbing, natural-language opt-out honored in real time, and per-call audit logs, enforced at the call layer so a rep can't fat-finger their way into a $1,500 claim. Whether you build or buy, the rules above don't change. Where you enforce them decides whether you sleep at night — and a real TCPA Compliance for AI Calls: The 2026 Consent Playbook is one you wire into the dialer, not one you tape to a monitor.
FAQ
Is it legal to make outbound AI calls in 2026? Yes, if you comply with the TCPA. AI-generated voices are treated as "artificial voice" under the FCC's 2024 ruling, so marketing calls to cell phones need prior express written consent, DNC scrubbing, honored opt-outs, and proper disclosures. Informational calls (e.g., appointment reminders) have a lower bar but still need prior express consent.
Does the FCC one-to-one consent rule still apply after it was vacated? The FCC's specific one-to-one mandate is not federally enforced as of 2026 (vacated by the Eleventh Circuit in 2025), but the underlying TCPA written-consent standard still applies, and states like Florida and Oklahoma enforce one-to-one-style rules. Build to the one-to-one standard — it's the defensible floor.
Does my AI voice agent count as a robocall or autodialer? For consent purposes, assume yes. A synthetic TTS voice is an "artificial voice" under the TCPA regardless of whether your dialer meets the narrow post-Duguid autodialer definition. That triggers the artificial-voice consent rules on calls to wireless numbers.
How fast do I have to honor an opt-out? A consumer can revoke consent by any reasonable means, including saying "stop" mid-call, and you must comply within a reasonable time capped at 10 business days. In an automated system, suppress immediately — there's no operational reason to wait.
Emit this FAQ block as FAQPage JSON-LD for rich-result eligibility.
Internal links
- Outbound Voice AI for Enterprise Sales — TCPA-Safe Playbook for 2026
- 10 Best HIPAA AI Voice Agents for Healthcare (2026)
- AI Receptionist for Business: Capture Every Missed Call
- AI Call Center Cost in 2026: A Transparent TCO Model
- AI Voice Agent vs IVR: The 2026 Enterprise Buyer's Guide
CTA
Shipping outbound AI calling and want consent gating, DNC scrubbing, and real-time opt-out enforced at the call layer instead of in a checklist? See how Finn handles compliance →
