AI cold calling laws: what's actually legal and what will get you in trouble.

I'm a software engineer, not a lawyer. If you're setting up an AI calling system for your business, you should talk to an attorney about your specific situation.

What I can tell you is what I've learned from building these systems, what the rules look like in plain English, and where businesses tend to get into trouble.

The short version: AI calling has strict legal requirements and the fines for violations are not small. The good news is that if you're building a legitimate business and you follow a basic set of rules, this is completely usable technology.

The bad news is that a lot of people selling AI calling tools either don't know the rules or hope you don't ask.

Everything else in this post comes back to one idea: consent.

You cannot use an AI agent to call someone who hasn't given you permission to contact them that way.

That's it. That's the core rule. The complexity comes in what "permission" actually means legally and what counts as proper consent.

Under the Telephone Consumer Protection Act (TCPA), using an AI-generated voice to call someone requires prior express written consent from that person. Not verbal. Not implied. Written. That means a form, a checkbox, a signed document, or a digital equivalent where the person explicitly agreed to be contacted by you using automated or AI calling technology.

No consent on file, no outbound AI call. Full stop.

In February 2024, the FCC clarified that AI-generated voices are treated the same as robocalls under the TCPA. This wasn't a gray area before, but the ruling removed any remaining argument that AI voices were somehow different.

The practical effect: if your AI calling system makes outbound calls, every single call requires prior express written consent from the recipient. The same rules that applied to robocalls in 2010 now explicitly apply to AI voice calls in 2024.

This ruling came after some high-profile cases of people using AI-cloned voices for election-related robocalls. The FCC moved fast on it.

The fines under the TCPA range from $500 to $1,500 per call for unintentional violations. For willful violations it can go higher. Multiply that by the number of calls in a campaign and you understand why the lawyers pay attention to this.

Here's where a lot of confusion happens.

Inbound calls are calls where the customer calls you and an AI answers. The customer initiated contact. The legal requirements here are much simpler. You still need to disclose that the caller is talking to an AI... but the consent issue for the call itself is basically resolved by the fact that they called you.

Outbound calls are calls where your system dials the customer. This is where the full weight of the TCPA kicks in. Every outbound AI call to a consumer requires prior express written consent. Not just a business relationship. Not just a previous call. Written consent specifically for automated or AI calling.

Most legitimate businesses that use AI calling are doing inbound. Someone runs ads, the calls come in, the AI answers and captures lead information. That's a clean use case and a genuinely useful tool.

Outbound AI calling to people who haven't explicitly consented is the situation that generates the lawsuits.

Business-to-business calling has somewhat different rules than calling consumers. The TCPA's consent requirements were primarily designed to protect consumers from unwanted calls on personal numbers.

That said, state laws add another layer. And states have been moving toward stricter rules, not looser ones.

California is the strictest state in the country on this. If you're running any kind of automated calling campaign, California's laws apply to any California resident you're calling regardless of where your business is based. The state attorney general has been active on enforcement.

Pennsylvania, where we're based, has its own wrinkle: two-party consent for recording. If you're recording calls in Pennsylvania, everyone on the call needs to know they're being recorded. Violating this is a criminal offense, not just a civil matter. That means the AI needs to disclose at the start of every call that the conversation may be recorded.

The safest position across the board is to require explicit consent before any outbound AI call, disclose the AI nature of the call immediately, and disclose recording if you're capturing the conversation.

Here's the setup we build and recommend.

For inbound: the AI answers and within the first few seconds says something like "Hi, this is an automated assistant for [Business Name]. This call may be recorded for quality purposes." Then it handles the conversation, captures the information, and routes or follows up as configured.

For outbound: we only build outbound systems for businesses that have a documented consent process already in place. That means you can show me a form or record where the customer explicitly agreed to be contacted via automated calling. If that's not there, we don't build the outbound system.

The consent documentation matters. Not just having it, but being able to produce it if you ever need to. A spreadsheet with consent dates, a CRM field, a documented form submission... something that can prove who consented, when, and to what.

The businesses that run into trouble are usually the ones that are trying to use AI calling as a shortcut to reach people who haven't asked to hear from them. That's not a technology problem. That's a business model problem.

AI calling is a legitimate tool that can genuinely help a small business capture inbound leads and stop losing calls when the owner is unavailable.

The rules are real but they're not complicated if you're running a legitimate operation. Get consent before any outbound AI call. Disclose that it's an AI at the start of every conversation. Disclose recording if you're capturing the call. Keep documentation of your consent process.

If you're running paid ads and missing inbound calls because you can't always pick up... an AI calling system is a real solution to a real problem. We've seen it work.

If your goal is to build a system that calls people who haven't asked to hear from you... that's not something we build. And to tell you the truth, the legal exposure isn't worth it anyway.

Want to talk through what a compliant setup looks like for your business? That's the kind of conversation we have every week.