AI phone call laws: is it legal to make AI calls?

Is it legal to make AI calls? Most articles on this question either reassure ("AI calls are legal!") or alarm ("AI calls are banned!"). Both skip the detail that decides your case: which kind of call, to whom, with what consent. This guide works from the primary texts, the FCC order, the CFR, the UK statute book and the AI Act, and states what each one says, as of October 2026. It also notes where the law is unsettled, which is more often than the vendor guides admit.

Is it legal to make AI calls? The short answer by jurisdiction

United States

The FCC's February 2024 ruling

The TCPA restricts calls that use "an artificial or prerecorded voice". It has never defined either word. In a Declaratory Ruling adopted on 2 February and released on 8 February 2024 (FCC 24-17), the Commission confirmed that those restrictions "encompass current AI technologies that generate human voices." That covers voices that wholly simulate a person and voices cloned from a real one. In both cases, the FCC said, the call is initiated using an artificial or prerecorded voice under the TCPA.

Three practical consequences follow from the order and the rules it points to:

1. Consent. Callers using AI voices "must obtain the prior express consent of the called party", absent an emergency or an exemption.
2. Identification. All artificial or prerecorded voice messages must provide certain identification and disclosure information for the entity responsible for the call.
3. Opt-out. Where the call is telemarketing, it must offer an opt-out method so the person can ask not to be called again.

The ruling didn't create new rules. It confirmed that the existing ones apply to AI. One sentence matters most for conversational agents. The TCPA, the FCC wrote, "does not allow for any carve out of technologies that purport to provide the equivalent of a live agent." An AI that listens and answers is still an artificial voice.

What the rules require, line by line

The detail sits in 47 CFR § 64.1200:

• Mobile numbers (§ 64.1200(a)(1)(iii)): no artificial-voice call without prior express consent, whether the call is marketing or not.
• Telemarketing to mobiles and homes (§ 64.1200(a)(2) and (a)(3)): requires prior express written consent. That's a signed agreement that clearly authorises the seller to make artificial-voice telemarketing calls, and states that agreeing isn't a condition of purchase (§ 64.1200(f)(9)).
• Identification (§ 64.1200(b)(1)–(2)): at the beginning of the message, state clearly the identity of the business, using its registered name. During or after the message, state a telephone number the person can call.
• Automated opt-out (§ 64.1200(b)(3)): telemarketing messages must offer an interactive voice or key-press opt-out within two seconds of the identification. A conversational AI that accepts "stop calling me" covers the voice route.
• Calling hours (§ 64.1200(c)(1)): no telephone solicitations before 8am or after 9pm in the called person's local time.
• Revocation (§ 64.1200(a)(10)): consent can be revoked "in any reasonable manner" and must be honoured within ten business days.

The statute gives consumers a private right of action of $500 per violation, and a court can treble it for wilful or knowing violations. The FCC ruling also notes that state attorneys general can use the TCPA against these calls. That's a meaningful point, because the ruling followed a letter from 26 of them.

What changed in 2025 and 2026

• One-to-one consent was struck down. The FCC's rule requiring consent to name a single seller was vacated by the Eleventh Circuit on 24 January 2025 in Insurance Marketing Coalition v. FCC, before it took effect. Consent must still be clear and unmistakable.
• Courts now read the TCPA for themselves. In McLaughlin Chiropractic v. McKesson (20 June 2025), the Supreme Court held 6–3 that district courts in enforcement cases aren't bound by the FCC's interpretation and must apply ordinary statutory interpretation, giving the agency's view appropriate respect. In theory, a defendant could now argue that an AI voice isn't "artificial". In practice, it's a hard argument to win, and not one to build a business on.
• The "revoke-all" rule keeps slipping. The core revocation rule (any reasonable means, ten business days) has applied since 11 April 2025. The part that would make a stop request to one type of message apply to all of a caller's unrelated robocalls and robotexts was first delayed to April 2026 by the FCC's DA 25-312 order. It was then pushed to 31 January 2027. If you treat every "stop" as a stop for everything, you're already compliant with the stricter version.

The FTC's Telemarketing Sales Rule

The FTC's TSR applies to sales calls alongside the TCPA. Under 16 CFR § 310.4:

• Do Not Call: no sales calls to numbers on the National Do Not Call Registry without a signed agreement or an established business relationship.
• Prerecorded messages: sales calls delivering a prerecorded message need the consumer's prior signed written agreement. The TSR doesn't mention AI. Assume an AI voice gets at least this treatment.
• Abandoned calls: a call is abandoned if no sales representative speaks within two seconds of the person's completed greeting. The safe harbour requires an abandonment rate of 3% or less, at least 15 seconds or four rings, and a recorded message with the seller's name and number when nobody is available.
• Disclosures: the seller's identity, that the purpose is to sell, and the nature of the goods or services, all stated promptly.
• Hours: 8am to 9pm at the called person's location.

Most calls to businesses are exempt from the TSR, with exceptions such as retail sales of office or cleaning supplies. The TCPA's artificial-voice rule for mobile numbers still applies to a business owner's mobile.

United Kingdom

PECR: live calls versus automated calls

PECR sets two tracks. Live marketing calls can go to numbers not registered with the TPS or Corporate TPS, unless the person has told you to stop. Automated marketing calls are stricter. The ICO's guidance says consent must specifically cover automated calls, and "general consent for marketing, or even consent for live calls, is not enough." Every automated call must include your name and a contact address or freephone number, and you must allow your number to be displayed.

Whether an AI voice is "automated" depends on regulation 19's definition. An automated calling system is one capable of automatically initiating a sequence of calls to more than one destination and "transmitting sounds which are not live speech". A synthetic voice isn't live speech, and a campaign dialler works through a sequence of numbers. One open question remains: regulation 19 restricts "recorded matter", and a voice generated live isn't recorded in the ordinary sense. No court has resolved this.

The ICO's direction of travel is clear, though. In September 2025 it fined Home Improvement Marketing £300,000 and Green Spark Energy £250,000 for automated marketing calls without consent. Those calls used avatar software that made people think they were talking to "Jo, Helen or Ian" from the UK, when the lines were recorded by voice actors and played by agents abroad. The ICO also warned that robo-call technology makes automated calls harder to spot. A fully synthetic voice is unlikely to be treated more gently than recorded clips were.

The stakes went up in 2025. The Data (Use and Access) Act 2025 raised the maximum PECR fine from £500,000 to £17.5 million or 4% of annual global turnover, in line with UK GDPR. The ICO notes that its PECR guidance is under review following the Act.

Ofcom: persistent misuse

Separately from the ICO, Ofcom can act against anyone who persistently misuses a phone network. Under the Communications Act 2003, misuse means using the network in a way that causes someone "unnecessarily to suffer annoyance, inconvenience or anxiety". It becomes persistent when repeated often enough to show a pattern or recklessness. The maximum penalty is £2,000,000.

Ofcom's persistent misuse policy targets silent and abandoned calls from diallers, with a long-standing cap of 3% abandoned calls. For an AI caller, the risks are specific:

• Silence after pickup. A person who says "hello" and hears nothing has, from their side, received a silent call. Keep the gap under a second.
• Answering-machine mistakes. If the system treats a live person as a machine and hangs up, that's an abandoned call. If it treats a machine as a person, the brand ends up on a voicemail.
• Withheld numbers. Present a number people can call back.

European Union

ePrivacy and GDPR

The ePrivacy Directive's Article 13 requires prior consent for direct marketing using automated calling systems without human intervention. It leaves other unsolicited calls, such as live calls, to each member state. Many states have chosen opt-in for live sales calls too. The Netherlands went further on 1 July 2026, abolishing the soft opt-in for existing customers so that sales calls in principle need prior consent, and banning withheld caller ID.

GDPR adds an absolute right: a person can object to direct marketing at any time, and once they do, their data can no longer be processed for that purpose. "Stop calling me" on an AI call is that objection.

The AI Act's Article 50

Since 2 August 2026, Article 50(1) of the AI Act has required providers to design AI systems that interact directly with people so that those people are informed they are interacting with an AI, unless it's obvious to a reasonably well-informed person. Article 50(5) requires the information to be given "in a clear and distinguishable manner at the latest at the time of the first interaction".

On a phone call, "obvious" is a weak defence. Modern synthetic voices are designed not to be obvious. The safe reading is that the disclosure belongs in the opening line. The 2026 Digital Omnibus delayed other parts of the Act but, according to Goodwin's analysis, left the Article 50 duties unchanged in substance, with fines of up to €15 million or 3% of worldwide turnover.

Sector rules sit on top

General calling law is the floor. Regulated sectors add their own layer. In British gambling, for example, operators must collect direct marketing consent per product and per channel (casino, betting and bingo; phone, email and SMS) since 1 May 2025. A casino email opt-in isn't a casino phone opt-in. How that plays out in a retention programme is covered in the player reactivation guide. Financial services, debt collection and healthcare each have their own equivalents.

What compliant AI calling looks like in practice

The rules differ in detail but point the same way. Here's the operating standard that satisfies all three regimes, and how Dial Milo handles each part:

1. 1

   Call only lists with the right consent

   Record how each number was collected and what the person agreed to. US telemarketing needs written consent. UK automated calls need consent to automated calls specifically. Sector rules may need per-channel opt-ins. Dial Milo only calls the people you upload or send it. The consent records are yours.

2. 2

   Disclose the AI and the business in the first sentence

   Milo says it's an AI at the start of every call, which is on by default. For sensitive sectors it confirms it's speaking to the right person before naming the brand, so a family member who answers learns nothing.

3. 3

   Respect local hours, per person

   Milo calls each person in their own local time within the hours you set (10:00 to 20:00 by default), which sits inside the US 8am–9pm window. See calling hours and contact limits.

4. 4

   Make stop mean stop, everywhere and immediately

   When someone asks not to be called, Milo records an opt-out and the number goes on your do-not-call list. No campaign will call it again. That's stricter than the ten-business-day rule and matches the delayed revoke-all standard. See managing contacts and lists.

5. 5

   Avoid silent and abandoned calls

   Keep the pause after pickup under a second. Milo detects answering machines using carrier detection plus listening for voicemail greetings, and hangs up without leaving the brand on a voicemail. Voicemails and no-answers are retried within your attempt limit.

6. 6

   Limit frequency across campaigns

   A contact cooldown stops anyone being called twice within N days across all your campaigns, so a person can't be worked by three campaigns in a week.

None of these settings makes an unconsented list lawful. The longer argument for why AI voices and cold lists don't mix is in AI cold calling. For the wider operating playbook, see the AI outbound calling guide.