Compliance Guide

Is AI outbound calling legal? TCPA, GDPR, PECR and the EU AI Act for voice agents

AI outbound calling is legal in the US, UK and EU with consent, disclosure and opt-out. What TCPA, PECR, GDPR and the AI Act require, plus a checklist.

Author
By the Open Team
|Updated November 12, 2026|11 min read

Yes, AI outbound calling is legal in the US, the UK and the EU, but only inside rules written for robocalls and telemarketing. In all three, an AI-generated voice counts as an automated or artificial voice, so you need the right level of prior consent, a clear disclosure of who is calling (and, in the EU, that it is an AI), a working opt-out, and a lawful basis for the personal data the call touches. Service calls to existing customers are far easier to run lawfully than cold marketing calls.

This article is general information, not legal advice. Rules change and they turn on the facts of your programme, so have counsel in each market review it before you dial.

TL;DR

  • US: Since February 2024 the FCC treats AI voices as "artificial" under the TCPA. Marketing calls need prior express written consent; informational calls to mobiles need prior express consent. Statutory damages run $500 to $1,500 per call.
  • UK: PECR regulation 19 bans automated marketing calls without specific prior consent. Maximum fines rose to £17.5m or 4% of global turnover in February 2026.
  • EU: The ePrivacy Directive requires prior consent for automated marketing calls. Since 2 August 2026, Article 50 of the EU AI Act requires people to be told they are talking to an AI unless it is obvious.
  • Country rules on top: Germany needs prior express consent for any B2C phone advertising. France moved to opt-in on 11 August 2026. The Netherlands has been opt-in since 2021.
  • Service calls are the low-risk start: payment reminders, delivery updates and appointment confirmations to existing customers carry far less risk than prospecting.
  • Your vendor should make compliance easy to operate: DNC handling, time windows, opt-out detection, consent records and disclosure scripts. The checklist below covers what to ask.

Why AI voice calls fall under robocall law

Calling laws regulate the method, not the technology. The US TCPA covers calls using an "artificial or prerecorded voice". The UK's PECR and the EU's ePrivacy Directive cover "automated calling systems" that run without human intervention. An AI voice agent that dials, speaks and responds on its own fits all of these descriptions, even though the conversation is two-way and not a recording.

That decides your consent bar, because laws are far stricter on automated calls than on live ones. Do not assume an AI agent is treated like a human SDR.

The second question is purpose. Every regime separates marketing (selling, upselling, promoting) from service or transactional calls (a failed payment, a delivery slot, a booking confirmation). Marketing calls carry the strictest rules.

United States: the TCPA and the FCC's 2024 ruling

What changed in 2024

In February 2024 the FCC issued a declaratory ruling confirming that AI-generated voices, including voice clones, are "artificial" voices under the Telephone Consumer Protection Act. It was not a ban. It means AI calls follow the same rules as prerecorded calls.

Call typeLineConsent needed
Marketing / telemarketingMobile or residentialPrior express written consent
Informational (non-marketing)MobilePrior express consent
EmergencyAnyExempt

Prior express written consent is a signed agreement (an e-signature or web form counts) authorising that specific seller to call that number. A bought lead list rarely gives you that.

What every AI call must include

Under the FCC's artificial-voice rules, a call must clearly identify the business making it at the start and give a callback number. Marketing calls need an automated, interactive opt-out mechanism the person can use during the call. Telemarketing is limited to 8 a.m. to 9 p.m. in the called party's local time, and the National Do Not Call Registry still applies.

Revocation

Since April 2025, people can revoke consent by any reasonable means, honoured within 10 business days. In September 2026 the FCC voted to let callers designate an exclusive opt-out method, disclosed on every call. Until that takes effect, or if you designate nothing, a caller who says "stop calling me" in their own words has opted out.

Why US risk is high

The TCPA allows private lawsuits with statutory damages of $500 per violating call, up to $1,500 if wilful. Class actions multiply that across every number dialled. Several states, including Florida and Oklahoma, have their own "mini-TCPA" laws with stricter consent or calling-hour rules.

United Kingdom: PECR, UK GDPR and Ofcom

PECR regulation 19 says you cannot make automated marketing calls unless the person has told you they consent to automated calls from you. General marketing consent, or consent to live calls, is not enough. The ICO has fined firms for "robo calls" and warned about avatar-style calls that pose as people.

Live marketing calls are screened against the Telephone Preference Service (TPS) instead. Whether a conversational AI agent counts as "automated" has not been tested in a published ICO decision, but the cautious reading is that it does, so plan for regulation 19 consent.

Penalties went up in 2026

The Data (Use and Access) Act 2025 brought PECR fines up to UK GDPR levels: £17.5 million or 4% of global annual turnover, whichever is higher. Those provisions came into force on 5 February 2026.

The rest of the UK checklist

  • Calling line identification: present a valid number that can be called back. Withheld numbers on marketing calls breach PECR.
  • UK GDPR: a lawful basis for processing, a privacy notice that covers call recording and transcription, and data minimisation for what the agent stores.
  • Automated decisions: if the AI makes a decision with legal or similarly significant effect (for example, declining a payment plan), the automated decision-making rules apply.

European Union: ePrivacy, GDPR and the AI Act

ePrivacy: automated marketing calls are opt-in everywhere

Article 13 of the ePrivacy Directive requires prior consent for direct marketing through automated calling systems without human intervention. That is EU-wide. For live calls, each member state chooses opt-in or opt-out, and the trend is clearly towards opt-in.

CountryB2C marketing callsNotes
GermanyPrior express consentUWG §7. No existing-customer exception for phone. Fines up to €300,000
FrancePrior consent since 11 Aug 2026Replaced the Bloctel opt-out. Calls about an existing contract still allowed. Fines up to €375,000 for companies
NetherlandsOpt-in since 1 Jul 2021Existing-customer exception has been narrowed; check ACM guidance
OthersVariesCheck the national regulator before each market launch

GDPR applies to every call, marketing or not

Recordings, transcripts and the CRM fields the agent writes are personal data. You need a lawful basis (contract or legitimate interest usually covers service calls; consent usually covers marketing), clear information at the start of the call, retention limits, and a data processing agreement with your voice vendor. If the vendor or its model providers process data outside the EU, you need a valid transfer mechanism.

EU AI Act Article 50: tell people it is an AI

Since 2 August 2026, Article 50(1) of the AI Act requires AI systems that interact with people to be designed so those people are informed they are dealing with an AI, unless that is obvious from the context. A natural-sounding voice agent is exactly the case where it is not obvious. The disclosure should come at or before the first interaction, which on a phone call means the opening line. Fines for breaching Article 50 reach €15 million or 3% of worldwide turnover.

An opener that covers ePrivacy, GDPR and the AI Act: "Hi, this is the virtual assistant for [Company], an AI calling about your delivery on Thursday. This call is recorded. You can say 'stop' at any time."

GCC: a short note

UAE: Cabinet Resolution No. 56 of 2024, in force since 27 August 2024, limits telemarketing calls to 9 a.m. to 6 p.m. local time, requires checking the TDRA's Do Not Call Registry, and comes with fines under Resolution No. 57 starting at AED 50,000 for calling a registered number. The UAE data protection law also applies.

Saudi Arabia: the Personal Data Protection Law requires consent for direct marketing, a clear sender identity and an easy way to opt out, with withdrawal honoured promptly. SDAIA is consulting on amendments, so check the current text first.

How to run AI outbound calling lawfully

  1. Classify every campaign as marketing or service, and existing customer or prospect. That sets the consent bar in each country.
  2. Prove consent per number: when, where, how, and the exact wording shown. If you cannot prove it, do not dial it.
  3. Script the first ten seconds: company name, AI disclosure, purpose, recording notice, opt-out.
  4. Enforce calling windows by the recipient's location, not your office's.
  5. Treat any spoken objection as an opt-out and sync it to every channel.

Vendor checklist: what to ask an AI outbound calling provider

No vendor can make your programme compliant for you: you own the consent, purpose and script. A vendor can make the controls easy to run and hard to bypass. Ask for evidence on each line:

QuestionWhat a good answer looks like
How are DNC and suppression lists enforced?Checked before every dial, with sync from your CRM and national registries
Can calling windows be set per region and time zone?Yes, based on the recipient's number or CRM location
Is opt-out detected in natural language?"Stop calling", "take me off your list" and similar are caught and written back automatically
Can the opening disclosure be locked?The AI disclosure and recording notice play before the agent can go off script
Where is consent recorded?A consent record per number, exportable for audits
Where are recordings and transcripts stored, and for how long?Named regions, configurable retention, PII redaction
Which sub-processors and model providers touch call data?A published list and a DPA
Which caller IDs are presented?Your own verified numbers through your carrier
What evidence is available for security reviews?A trust centre with current documentation you can verify yourself

Be wary of any product sold as "TCPA compliant" or "GDPR compliant" out of the box. The law applies to how you use a tool.

Where Open fits

Open's AI outbound calling runs through your existing carrier and the caller IDs you have approved. The controls in the checklist are product settings: do-not-call lists, time-of-day windows per region, opt-out detection on every call, consent capture, voicemail detection, and PII redaction on transcripts. Every call keeps its recording, transcript and outcome for audit.

If the call is one step in a longer journey, outbound sequencing mixes AI calls with WhatsApp, SMS and email. Replies go to the same agent that handles your support inbox, so an opt-out given on one channel is not lost on another. Pricing is $0.75 to $0.90 per resolution depending on volume, handoffs to a human are not billed, and carrier minutes pass through at cost (pricing). Open's security and privacy documentation lives at trust.open.cx, and the wider voice product covers inbound as well.

A sensible first project is a service campaign to existing customers, such as failed-payment callbacks.

Sources

Frequently Asked Questions

Yes, in the US, UK and EU, if you meet the rules for automated or artificial-voice calls: prior consent, identifying your business, an opt-out and permitted hours. Cold AI marketing calls without consent are unlawful in all three.

In the EU, yes: since 2 August 2026 the AI Act requires disclosure unless it is obvious, and a realistic voice usually is not obvious. The US TCPA requires you to identify the business, not the AI, though some states have their own bot-disclosure laws. Disclosing in the opening line is the safest default everywhere.

Yes. The FCC's February 2024 ruling treats AI-generated voices as "artificial" under the TCPA, interactive or not, so prerecorded-call rules apply.

Usually yes, with fewer hurdles. Service calls such as payment reminders or delivery updates do not need marketing consent in most markets, but you still need a lawful basis under GDPR, clear identification and an opt-out.

In the US, $500 to $1,500 per call in private lawsuits, plus FCC and state enforcement. In the UK, up to £17.5 million or 4% of global turnover under PECR since February 2026. In the EU, GDPR fines reach €20 million or 4% of turnover, AI Act transparency breaches reach €15 million or 3%, and national telemarketing fines apply on top.