Are AI phone calls legal?

AI voice agents are changing how businesses communicate with customers - from qualifying sales leads and scheduling appointments to handling support conversations at scale. But as more companies start using AI to make and answer phone calls, one question comes before everything else:

The answer is generally yes, but there is no room for assumption. AI phone calls are legal as long as you follow the same rules that apply to any automated call: get permission, say who's calling, and let people opt out. The details shift from country to country, and the United States has the most developed rulebook, so that's where this guide spends most of its time. But the core idea travels almost everywhere. Be upfront, get consent, give people an easy way out.

The bigger change is happening underneath the law. Honesty about using AI is fast becoming something customers expect, not just something regulators require. More on why that matters for your business, in plain terms, further down.

What are AI phone calls?

AI generated voice calls use artificial intelligence, natural language understanding and machine learning to handle calls instead of using a human agent. AI voice calls are often used to phone outbound calls, answer inbound inquiries, lead qualification and appointment booking - often working alongside AI scheduling tools to automate customer interactions.

TCPA and FCC rules for AI cold calling

In the US, the main law is the Telephone Consumer Protection Act, or TCPA, which has limited automated and recorded calls since 1991. The open question was whether an AI voice that sounds human counts as artificial or prerecorded voice calls. On February 8, 2024, the Federal Communications Commission (FCC) settled it: AI-generated voices, including cloned voices, fall under the same rules as any other artificial or recorded call. The ruling took effect immediately with regard to the legal landscape.

The FCC's press release said it had made AI voices in robocalls "illegal." Lawyers who read the actual ruling, like the firm Wiley, noted it didn't go that far. AI generated calls are still legal. They just have to follow the existing rules and they break into three parts:

Consent

For marketing calls, you need prior express written consent, often shortened to PEWC. For informational, non-marketing calls, you need prior express consent, which is a lower bar. Two details trip people up. Consent doesn't transfer between companies: if someone agreed to hear from your partner, that's not permission for you. And since April 2025, people can revoke consent "in any reasonable manner," using words like stop, quit, cancel, or unsubscribe, and you have to honor it within 10 business days.

The Do Not Call list (DNC)

Separate from prior express written consent, the National Do Not Call Registry blocks marketing calls to registered numbers. You have to scrub your call lists against it regularly, with every 31 days the common standard, plus any state DNC lists. Ignoring the registry can cost far more than expected, making AI voice agent pricing only part of the total compliance cost, with penalties reaching up to $43,792 per call.

Identification and opt-out

You have to say who is responsible for the call, and give people a clear way to stop future calls. There's also a strong signal about where this is heading: in mid-2024 the FCC proposed requiring AI-voice calls to announce, right at the start, that they are AI generated calls. That rule isn't final, but the direction is obvious. Some states already require it. California's AB 2905 mandates AI disclosure on calls, and Texas's SB 140 requires it within the first 30 seconds.

Penalties for non-compliance

Within the legal framework, maintaining compliance when integrating AI is a heavily regulated challenge. Standard consumer protection act (TCPA) violations can penalise $500 per call, rising to $1,500 for willful ones. For intentional breaches of robocall rules, the FCC can add civil penalties up to $10,000 per call. The bigger risk is class actions, where settlements have averaged around $12.4 million.

The FTC layer: false claims and the Air AI shutdown

The FCC isn't the only US regulator watching. The Federal Trade Commission, or FTC, polices deceptive business practices, and during an enforcement push called Operation AI Comply it said plainly that there's no AI exemption from the laws already on the books.

The clearest example is a company called Air AI. In August 2025 the FTC sued it for tricking small businesses with false earnings and refund promises while selling an AI calling product. In March 2026 the two sides settled: the owners were banned from selling business opportunities, hit with an $18 million judgment (mostly suspended because they couldn't pay), and ordered to pay $50,000 toward refunds. Analysts noted the deeper problem was AI diallers hitting cell phones at scale without permission, on top of the misleading marketing.

Are the voices themselves legal to use?

Permission to call is one thing. The voice you use is another, and it has its own rules. A standard AI voice from a licensed provider is fine to use commercially - the risks involving data privacy laws shows up when a voice imitates a real, identifiable person.

A growing set of federal and state laws now protect a person's voice from being copied without consent. Tennessee's ELVIS Act, passed in 2024, was the first to explicitly cover AI-generated voice clones, and it applies to everyone, not just celebrities.

California, New York, Illinois, and others have extended their right-of-publicity laws in similar directions. A proposed federal law, the NO FAKES Act, would create a nationwide version, but as of 2026 it hasn't passed.

The practical rule for this legal challenge is that only clone a voice with the clear, written, specific implied consent of the person it belongs to. Using someone's voice without permission can trigger publicity-rights claims, impersonation laws, and fraud statutes all at once.

State recording laws

Federal rules decide whether you can place the call. State rules decide whether you can record it, and AI calling trips here constantly because AI agents record and transcribe by default. Understanding how to record phone calls legally is essential when deploying AI callers across multiple regions.

The federal baseline is one-party consent: if you're on the call, you can record it. But about a dozen states require all-party consent, where everyone has to agree first. The states usually counted in this group are California, Connecticut, Delaware, Florida, Illinois, Maryland, Massachusetts, Montana, Nevada (for automated phone calls), New Hampshire, Pennsylvania, and Washington.

Two rules make it practical. Calls across state lines follow the stricter state's rule, confirmed in the California case Kearney v. Salomon Smith Barney. And the penalties bite: California allows damages up to $5,000 per violation, Florida treats secret recording as a felony, and Illinois adds biometric risk if your AI identifies people by voiceprint.

The simple safe move: tell people the call may be recorded, every time, and capture that agreement before the conversation starts with explicit consent.

Beyond the US: how other countries handle AI calls

The US has the most detailed rules, but it's far from alone. Call into other countries and you'll find the same pattern with local names attached.

• European Union. The GDPR covers the personal data you handle during the call, including any recording. Separate ePrivacy rules generally require consent before automated marketing calls.
• United Kingdom. PECR rules cover marketing calls and mostly mirror the EU's stance. The UK's data regulator, the ICO, has already warned firms using automated voices that didn't make clear the caller wasn't a human agent voice.
• Canada. Two laws apply: CRTC telemarketing call rules and CASL, the anti-spam law. Both require consent before automated commercial calls, plus caller identification and DNC scrubbing, with penalties reaching into the millions.
• Australia. The regulator, ACMA, requires consent for marketing calls, clear identification, and Do Not Call compliance.
• India. The telecom regulator, TRAI, runs a national preference registry, and marketing calls to registered numbers are restricted. AI calls fall under the same unsolicited-call rules.

‍

The common thread matches the US: consent, transparency, and a clean way out. Build your process around those three and you're most of the way to avoiding any non compliance issues.

The Hard Part: Where legal and ethical compliance matter

Consent is messy to track. People give it on one channel, revoke it on another, and you're expected to keep up across every system in near real time. Records have to be tamper-resistant and reachable years later.

Why AI changes the risk equation

Traditional sales teams have always had to follow calling rules, but AI changes the scale of the problem. A human salesperson might make dozens of calls a day. An AI agent can make thousands or millions.

That creates what businesses often underestimate: the scale paradox.

A compliance mistake that affects one human caller becomes a completely different problem when repeated automatically across a large campaign. The question is no longer just “Was this call allowed?” but “What happens if this same mistake happens 100,000 times before anyone notices?”

That is why AI calling requires stronger safeguards than traditional outbound. Permission tracking, opt-out handling, disclosures, and audit trails are not just compliance checkboxes anymore, they are what prevent small mistakes from becoming large-scale violations.

The laws also move faster than most teams can follow, and they differ by state and country, so a campaign that's clean in one place can be illegal a state line away. AI adds its own wrinkle: a voice agent can improvise, which means it can wander past what your consent and disclosures actually cover. The AI technology that makes calls efficient is the same thing that makes them hard to keep inside the lines.

The ethics of AI powered calling

Staying legal is the floor. Staying ethical is what keeps customers, and the two aren't the same thing. Three tensions matter most here when using AI systems:

Prioritise Transparency. You can technically meet the law while still leaving people unsure whether they're talking to a machine. The ethical move is to remove the doubt early, in plain language.

Personalisation vs consent. AI can tailor a call using everything you know about someone, which can feel helpful or invasive depending on whether they expected it. Use the data people knowingly gave you for the purpose they gave it, not whatever you happen to have.

The human balance. AI handles volume well, but some moments (a frustrated customer, a sensitive decision) need a person. The best setups make the handoff to a human agent fast and obvious rather than trapping people in a loop with a bot.

Using AI calls responsibly in your business

Done well, AI calling earns trust instead of spending it. A few principles separate the programs that build goodwill from the ones that burn numbers.

Lead with disclosure and let it build trust rather than treating it as fine print. Use AI where it genuinely improves the experience, like instant answers, no hold music, and 24/7 availability, and route the rest to people. And know the difference between a helpful AI call and a robocall.

Transmitting AI generated robocalls blast an unwanted recorded message to a called party, while a responsible voice AI call goes to someone who expects it, identifies itself, and solves something. If your use case is really just mass outreach to strangers, cold calling won't fix the underlying problem, and the legal exposure is the same as any other illegal robocall.

AI Outbound calling compliance in practice

This is where the rules become daily operations. Four things to get right on every AI outbound call.

• Timing. Federal rules limit calls to 8AM-9PM. in the recipient's local time zone. Honor the recipient's zone, not yours.
• Frequency. Don't hammer the same person. Cap attempts, and stop once they've asked you to.
• Identity. State who's calling and on whose behalf at the start, and disclose the AI.
• Opt-out requests. Make stopping easy, accept any reasonable phrasing, and process it within the required window.

Best practices for AI phone call compliance

Pulling it together, the programs that stay clean tend to share the same habits:

• Capture consent properly, with written consent for marketing, and log it with a timestamp and source you can produce later.
• Scrub against state national DNC registries on a regular cycle.
• Disclose the AI at the start of every call, regardless of whether your state requires it yet.
• Default to telling people the call may be recorded, so you're covered in stricter states and countries.
• Honour opt-outs and revocations quickly, accepting any reasonable wording.
• Only use voices you're licensed to use, and only clone a real voice with explicit written consent.
• Keep humans available for the calls that need them.

Why being upfront about AI is becoming a business advantage

Most guides treat "tell people it's AI" as a chore. The data says the opposite. Being honest about AI is turning into something that wins customers, and the businesses that do it early are set up to come out ahead.

Two things are happening at once. On the legal side, the rules are moving toward required disclosure: the FCC wants AI calls to announce the AI up front, and California and Texas already require it. On the customer side, people are asking for the same thing before any law forces it.

In a 2026 Adobe survey, nearly three in four people said brands should tell them when a voice is AI-generated, and 88% said they've already heard a voice and wondered if it was real. A late-2025 study found that being upfront about AI was the single biggest factor in earning trust, ahead of how accurate the AI was or whether a human was reachable.

Put the two sides together and the move is obvious. The disclosure you might see as a burden is the exact thing your future customers want. Do it now, before the rules make everyone do it.

This is also where your choice of tools matters. It's far easier to build consent, AI disclosure, and recording notices into your calls when your underlying text-to-speech is designed for responsible use. Voice quality plays a part too. A clear, natural voice makes a disclosure feel like part of the conversation rather than a robotic warning.

Your AI calling compliance checklist

Before you place a single AI call, make sure you have:

• Permission on file for each number, with written consent for marketing.
• An AI disclosure at the start of the call.
• Caller identification naming who's responsible.
• A working opt-out that accepts any reasonable wording.
• DNC screening against national and state lists on a regular cycle.
• Recording consent that defaults to telling everyone.
• Calling-hour limits for each person's local time zone.
• Licensed or consented voices only, with explicit written consent for any cloned voice.
• Records of consent, disclosures, and opt-outs you can produce on request.

‍

If you're building this into your own product, the Murf API is designed to support that kind of responsible setup from the start.

‍