TCPA Compliance Checklist for AI Voice Calls (2024)
The short answer: Under the FCC’s February 2024 declaratory ruling, AI-generated voices are legally treated as artificial or prerecorded voices under the TCPA — full stop. That means prior express written consent is required before calling consumers on cell phones for most marketing purposes, and robocall rules apply even if a human joins the call afterward. Work through the checklist below before any campaign goes live, and get your own legal counsel to review your specific use case.
Nothing in this article constitutes legal advice. TCPA law is fact-specific, changes frequently, and the consequences of non-compliance can be severe. Consult a qualified telecommunications attorney for guidance on your situation.
Why the 2024 FCC Ruling Changed the Game
Before February 2024, many teams running AI outbound calls operated in a grey zone, arguing that a sufficiently interactive AI voice was not truly “prerecorded.” The FCC closed that door. Its declaratory ruling confirmed that calls made using AI-generated voices — regardless of how dynamic, conversational, or real-time the generation is — are subject to the same TCPA restrictions as traditional robocalls using pre-recorded audio.
Practically, this means:
- Calling a cell phone with an AI voice for marketing purposes without prior express written consent exposes you to statutory damages of $500–$1,500 per call (willful violations).
- The Do Not Call Registry, state DNC lists, and internal opt-out lists all still apply on top of the consent requirements.
- Business-to-business calls are not automatically exempt — B2B exemptions are narrower than many teams assume, and state laws may be stricter.
- Calling a reassigned number to a new consumer who never consented is its own liability exposure, even if the previous subscriber did consent.
The ruling also prompted the FCC to begin formal rulemaking processes that could further tighten AI-voice calling rules. Treat this checklist as a floor, not a ceiling.
Pre-Launch Compliance Checklist
1. Consent: Do You Actually Have It?
This is the single most important question. Work through each sub-item before touching the dial button.
- Written consent obtained? Prior express written consent for marketing AI voice calls must be a clear, knowing agreement — a web form checkbox buried in terms of service is legally risky. The consent language should specifically disclose that the consumer may receive autodialed or prerecorded/artificial voice calls.
- Consent is call-specific? Consent for email marketing does not transfer to AI voice calls. Consent for calls from Company A does not transfer to Company B, even under the same parent organization. Under rulemaking proposals following the 2024 ruling, one-to-one consent requirements are being emphasized — blanket consent shared across multiple sellers is increasingly problematic.
- Consent records stored? You must be able to prove consent for every number you call. Store the date, time, IP address, and exact consent language version for each record.
- Consent age verified? Consent degrades over time. There is no single federal rule on expiration, but industry practice and emerging guidance suggest revisiting consent that is more than 12–18 months old, especially if the consumer has had no recent engagement.
2. List Hygiene Before Every Campaign
- Scrub against the National Do Not Call Registry no more than 31 days before calling. This is a hard federal requirement.
- Scrub against any state DNC lists relevant to where your contacts reside (not just where your business is located).
- Scrub against your own internal DNC list — anyone who has previously opted out of your calls must never be redialed.
- Run numbers through a reassigned number check. The FCC’s Reassigned Numbers Database (RNDB) exists for this purpose. Calling a reassigned number is not a guaranteed safe harbor but it is documented due diligence.
- Verify that numbers are formatted correctly and are valid US numbers before upload. Malformed records can create compliance exposure if they accidentally match a valid number.
3. Calling Hours
Federal TCPA rules prohibit calls before 8:00 AM or after 9:00 PM in the recipient’s local time zone — not your time zone. State laws are sometimes stricter. Build time-zone logic into your campaign settings and double-check it before launch. A contact list without accurate state or time-zone data is a compliance risk before it is a performance risk.
4. Caller ID and Disclosure Requirements
- Your caller ID must display a number that consumers can call back to reach you or opt out. Displaying a spoofed, invalid, or unmonitored number violates the Truth in Caller ID Act on top of TCPA.
- The AI voice must identify who is calling — business name and purpose — at or near the start of the call. Concealing the caller’s identity is a separate violation.
- If the AI is representing a third-party client (e.g., an agency running calls on behalf of a brand), the brand whose goods or services are being promoted must be identified, not just the agency.
5. Opt-Out Mechanism
Every AI voice call must offer a clear, easy, real-time opt-out path — typically a keypress (e.g., “Press 9 to be removed from our list”) or a spoken command the AI is configured to recognize. The opt-out must be honored immediately and permanently. Calling back someone who opted out, even “accidentally,” is one of the most common sources of TCPA litigation.
Compliance Summary Table
| Requirement | Federal Rule | Notes |
|---|---|---|
| Prior express written consent (marketing, cell phones) | Required | Must be call-type specific; one-to-one consent increasingly expected |
| National DNC scrub | Required (within 31 days) | State lists are additive, not a replacement |
| Internal DNC list | Required | Must be maintained and honored indefinitely |
| Calling hours (recipient’s time zone) | 8 AM – 9 PM local | Some states are stricter (e.g., Florida, Oklahoma) |
| Valid, callable caller ID | Required | Spoofed or dead numbers violate Truth in Caller ID Act |
| Caller identity disclosure | Required at call start | Name the brand whose offer is being promoted |
| Real-time opt-out mechanism | Required | Must be honored immediately; log and suppress permanently |
| Reassigned number check | Recommended (RNDB available) | Not a guaranteed safe harbor but documented due diligence |
| Consent records retention | Recommended minimum 4 years | Match your statute of limitations exposure |
During the Campaign: Ongoing Controls
Monitor Opt-Outs in Real Time
Your calling platform should feed opt-outs back to your CRM and suppression list automatically, not in a nightly batch. A four-hour delay between an opt-out and suppression can still generate liability if calls continue in that window.
Cap Attempts Per Number
There is no single federal rule on call frequency, but excessive attempts to reach the same number can be characterized as harassment and invite state-law claims or regulatory attention. Many teams cap at two to three attempts per number per campaign window as a reasonable practice.
Log Everything
Keep call logs that record: number dialed, timestamp, call duration, outcome (answered, voicemail, opt-out, etc.), and the agent or campaign ID. These records are your defense if a complaint is filed.
Voicemail Compliance
If your AI leaves a voicemail, the same rules apply — the message is a prerecorded artificial voice communication. The voicemail must identify the caller, state the purpose of the call, and include a callback number. Do not leave marketing messages on voicemail if you do not have the appropriate consent level for that contact.
Common Mistakes That Create Exposure
- Assuming B2B lists are exempt. The TCPA’s cell phone restrictions apply to the number, not the employment status of the person who answers. If you are dialing a contact’s mobile number, you need consent regardless of whether it’s a “business call.”
- Reusing old consent records. Buying a lead list and trusting that someone else obtained consent is a high-risk practice. You need to be able to document and verify consent yourself.
- Ignoring state laws. States including Florida, Oklahoma, and Washington have passed their own mini-TCPA or AI-specific legislation that can be stricter than federal rules. A call that is federal-compliant can still be a state-law violation.
- Treating “informational” calls as exempt. Calls that lead naturally to a sale — even if framed as a “courtesy check-in” — may be classified as telemarketing under TCPA. Intent and context matter, but so does outcome.
- Overlooking the human-agent handoff. When an AI call transfers to a live agent, the call does not “reset” its compliance status. The underlying consent requirement still governs the entire interaction.
A Note on Platforms and Vendor Responsibility
Your AI calling platform should make compliance easier, not something you have to bolt on manually. Look for platforms that offer built-in time-zone logic, opt-out handling, suppression list management, and consent record fields. If you’re evaluating tools, our own platform QALRA is designed for AI outbound calling and includes campaign controls relevant to these requirements — though as with any platform, you remain responsible for your own compliance posture and should have counsel review your full workflow.
Frequently Asked Questions
Does the 2024 FCC ruling apply to B2B AI calls?
The ruling itself addressed the definition of AI-generated voices as artificial or prerecorded under TCPA — it did not create a broad B2B exemption. The TCPA’s cell phone restrictions apply to the number being dialed. If you are calling a contact’s mobile number, the personal-use nature of that line typically brings it under TCPA coverage even in a B2B context. B2B landline calling has more flexibility, but state laws can fill the gap. Get specific legal advice for your call type and target audience.
What counts as “prior express written consent” for AI voice calls?
It must be a written agreement (including electronic forms) in which the consumer clearly authorizes calls using an automatic telephone dialing system or an artificial or prerecorded voice. The disclosure must be clear and conspicuous — not buried — and must identify the specific company authorized to call. A pre-checked box or an implied agreement from a general terms-of-service acceptance is legally risky.
Can I rely on a third-party lead vendor’s consent documentation?
This is one of the riskiest practices in outbound calling. You can use third-party consent, but you are legally exposed if that consent does not hold up. You need to receive and store the actual consent records (not just a certification), verify the consent language met legal requirements at the time it was obtained, and confirm the consent specifically covers your company or category of caller. Emerging FCC guidance on one-to-one consent is making broad, shared-consent lead lists increasingly problematic for marketing calls.
What happens if I call a reassigned number?
If the previous owner of a number gave you valid consent and the number was later reassigned to a new person, you can still be liable for calls to the new subscriber who never consented. The FCC maintains the Reassigned Numbers Database (RNDB) to help callers identify potentially reassigned numbers. Checking the RNDB does not guarantee immunity, but it demonstrates reasonable due diligence. Build reassignment checks into your list hygiene workflow.
Do voicemails left by AI count as TCPA-covered calls?
Yes. A voicemail left by an AI-generated voice is an artificial or prerecorded voice message and is covered by TCPA. The same consent requirements that govern live AI calls apply to the voicemail itself. Additionally, the message must identify the caller and include a callback number. “Ringless voicemail” — audio deposited directly into voicemail without a ring — has been a contested area, but the FCC has signaled these are also covered as calls under the TCPA.
How long do I need to keep consent records?
The federal TCPA has a four-year statute of limitations for private claims. State statutes of limitations vary. As a practical baseline, retain consent records for at least four years from the date of the last call made under that consent — not just four years from the consent date itself. Store records in a format that makes them retrievable quickly if a complaint or litigation hold arises.