# Cold calling means contacting someone who has not previously opted in or given permission. If prior consent exists, it is no longer cold calling; it is an opt-in outbound campaign.
# In most countries (including the US, UK and EU), it is generally illegal (narrow exceptions can exist) to use voice AI for cold calling. It doesn’t matter whether the cold call is for marketing or non-marketing purposes. Without prior consent, it is unlawful.
# If you lack prior consent, do not make the call using Voice AI. However, the same rule doesn’t apply to cold calls made by live human agents.
# Live cold calls can be permitted, but they remain subject to separate rules: national/state do-not-call lists, company-specific opt-outs, calling-time limits, caller-identification requirements, GDPR/data-protection duties, and country- or sector-specific restrictions.
# Don’t rely on a caller's B2B or B2C status to assume an exemption applies. A B2C or B2B exemption under one rule does not necessarily carry over to another rule.
# Never assume that a business contact, business number, or business purpose permits unsolicited AI-voice outreach. Validate the applicable jurisdiction, line and subscriber type, consent, DNC/TPS status, call purpose, and relevant state or national rules before dialling.
# Recorded verbal consent may be valid in the UK and EU if it is specific, informed, freely given, clearly covers automated AI voice calls from the named organisation, and can be reliably evidenced.
# For US telemarketing calls using an AI/artificial or prerecorded voice, recorded verbal consent is generally insufficient because the TCPA requires prior express written consent.
# In the US, the FCC has ruled that calls using an AI-generated human voice are calls using an “artificial or prerecorded voice” under the TCPA. These calls are commonly described as robocalls.
# Under the TCPA, AI-generated voice calls and automated texts are regulated differently from genuinely live, human-agent calls or manually sent texts.
# In the US, before using voice AI for cold calling, obtain PEWC (prior express written consent). A verbal “yes” on a recorded call is not PEWC.
# PEWC should be a clear, signed (usually electronically signed) agreement that authorises a named seller to make marketing calls to a specific number using an artificial/prerecorded voice.
# Here is what a valid consent can look like:
- The PEWC should be seller-specific.
- The consent should be defensible:
- Affirmative, unchecked opt-in (not pre-ticked).
- Clear disclosure that consent covers telemarketing via ATDS and/or artificial/prerecorded voice.
- Statement that consent isn't a condition of purchase.
- Timestamp, source URL/lead source, campaign/version ID, and technical evidence (IP address, user agent, form-submission log).
# Call purpose, recipient/number type, applicable federal rules, and state law determine whether PEWC is required.
- Telemarketing/advertising calls using an AI voice → PEWC required.
- Non-marketing calls → prior express consent may suffice, subject to exemptions and state law. A campaign that satisfies the federal TCPA may still be restricted by state consent, AI-disclosure, DNC, telemarketing-registration, caller-ID, or call-recording rules.
# A non-marketing call can become a telemarketing call if it includes promotion/advertising at any point during the call.
# Don’t call numbers listed on a Fedral/state DNC (do not call) list. Honour opt-out.
# Maintain consent record for each caller.
# Don't text or call old leads via voice AI merely to request consent if that outreach itself isn't permitted. Instead, use an email to invite an affirmative opt-in.
# The burden of proof for showing evidence of consent relies on the caller and not the recipient.
# Maintain an internal do-not-call list that includes callers who previously opted out and train your voice agent not to dial those numbers again.
# Train your voice agent to capture spoken opt-out requests ("stop calling me,",” do not call me again”, "put me on your do-not-call list") and suppress the number promptly across all campaigns.
# Never design your voice agent to falsely claim it's human or evade a direct question about being automated.
# Use human-led outreach where it is legally permitted and commercially appropriate.
# For US telemarketing, do not wait for a 10 or 30 day legal maximum to process an opt-out. Record and suppress it during or immediately after the call, then sync it across your entire tech stack before the number can be called again.
# In the EU, the AI disclosure upfront applies both to inbound and outbound calls. The person must be told clearly that they are interacting with AI at the start of the first interaction.
# Example of AI disclosure: “Hi, you’re speaking with Ava, Acme Heating’s AI phone assistant. How can I help?”
# In the UK, AI disclosure upfront is not legally mandatory either for inbound or outbound calls. However, transparency is recommended, and automated marketing calls require specific prior consent under PECR.
# In the US (with the exception of a few states like California), AI disclosure upfront is not legally mandatory either for inbound or outbound calls.
# AB 2905 is a California law about AI voices in automated outbound phone calls.
According to this law, before an automated/prerecorded AI voice message plays, the recipient must first hear a real, live-sounding human voice that:
- Explains why the call is being made.
- Gives the business’s name, address, and phone number.
- Says that the next message uses an artificial/AI voice.
- Asks whether the person agrees to hear that automated message.
Only if the person agrees can the prerecorded AI message play. The rule took effect January 1, 2025.
Compliant approach:
“Hi, this is Sarah calling for Acme Heating, 10 Main Street, Denver, at 555-123-4567. This is about our maintenance-plan offer. The next message uses an artificial voice. Would you like to hear it?”
If the person says yes, the AI message can begin.
Not compliant under this California rule:
“Hi, I’m Sarah, Acme Heating’s AI receptionist. We’re calling about…”
That begins with the automated AI voice rather than first using the required natural, unrecorded voice announcement.
So a human agent would need to handle the short preamble and obtain permission before the AI message starts. That removes the labour-saving benefit of a fully autonomous outbound voice agent.
Luckily, this law doesn't apply to inbound calls handled by voice AI, but it does make selling voice AI automation services in California less appealing.
# Penalties for violation in the United States:
- For unlawful AI-voice calls or automated texts, statutory damages can be $500 per violating call or text.
- A court may award up to $1,500 per call or text if it finds the violation was knowing or willful.
- Exposure can scale rapidly with volume, including from one campaign, one lead list, or one complainant bringing a class action.
- If an AI/artificial voice begins a covered automated outbound call without the required natural-voice preamble, California law permits a civil penalty of up to $500 per violation and/or disconnection of service to the automatic dialing-announcing device for a period set by the CPUC.
- This California penalty is separate from TCPA exposure. If the same outbound AI call is telemarketing and lacks the consent required by federal law, the potential TCPA claim may add $500 or up to $1,500 for a knowing or willful violation.
- The combined theoretical exposure can therefore reach approximately $1,000 to $2,000 per call, before legal fees, class-action exposure, state mini-TCPA claims, DNC penalties, or other remedies.
# Penalties for violation in the UK:
- Automated marketing calls made without the required specific consent can breach PECR.
- The ICO can impose significantly higher PECR penalties: up to £17.5 million or 4% of total worldwide annual turnover, whichever is higher, for the most serious breaches; the standard maximum is £8.7 million or 2% of worldwide turnover.
# Penalties for violation in the EU:
- The EU ePrivacy Directive requires prior consent for automated calling machines used for direct marketing, but each Member State implements and enforces that rule through its own national law. As a result, there is no single EU-wide per-call fine or one universal automated-call penalty amount.
- Separate GDPR fines can apply for related personal-data failures, such as invalid consent, lack of a lawful basis, unlawful call recording, weak data-retention practices, failure to honour objections, or inadequate vendor controls.
- Under GDPR’s higher tier, supervisory authorities can impose fines of up to €20 million or 4% of total worldwide annual turnover, whichever is higher.