Can an AI voice call your leads? Only if they said yes.

Imagine a roofing company in Ohio. A homeowner fills in a quote form at 2 p.m. By 2:01 an AI voice rings her phone, asks about the leak and offers a time for a visit. It is fast, polite and cheap. The question is whether the company was allowed to make that call.

In the US, the main law is the Telephone Consumer Protection Act, or TCPA. It limits calls that use an "artificial or prerecorded voice" unless the person has given consent. For years, nobody was sure whether a voice made by AI counted. In February 2024 the Federal Communications Commission (FCC) settled it. Its declaratory ruling, adopted on 2 February and released on 8 February, says AI-generated voices are "artificial" because a person is not speaking them, and that this includes voice cloning.

The ruling spells out the consequence. Calls with an AI voice need the called person's prior express consent. If the call carries an advertisement or is telemarketing, it needs prior express written consent. The caller must also identify itself and, for marketing calls, offer a way to opt out.

Regulators have used it. In September 2024 the FCC fined a political consultant $6 million for robocalls that used a cloned voice of a US president to tell voters in New Hampshire not to vote. That case was about fraud and caller ID spoofing, not honest sales calls. But it shows the FCC is looking.

What counts as consent

The FCC's rules define prior express written consent as an agreement in writing, signed by the person called, that clearly authorizes the seller to make these calls. An electronic signature counts. The FTC's Telemarketing Sales Rule asks for much the same for prerecorded sales calls: a written agreement that clearly says its purpose is to authorize the seller, includes the person's phone number and signature, and is not made a condition of buying anything.

The FTC's rule talks about "prerecorded" messages and does not mention artificial voices. We found no FTC text that says how it treats AI voices, so the careful reading is to build to the stricter TCPA standard.

Hours, opt-out and do-not-call

• Hours. Both the FCC and FTC rules set 8 a.m. to 9 p.m., local time where the person is, as the window for sales calls.
• Opt-out on every call. The FTC rule requires prerecorded sales calls to offer an automated keypress or voice opt-out. When used, it must add the number to the seller's do-not-call list and disconnect the call at once.
• Do-not-call. You may not call numbers on the national registry or on your own list of people who asked you to stop. A stop request must be honored within a reasonable time, no more than ten business days, and kept for five years.

What is in force today, and what is not

Several rules in this area have been announced, delayed, struck down or replaced. Here is where each stands on 7 November 2026, from the official texts.

Two plain-language notes. The one-to-one rule would have stopped lead sellers from passing one form's consent to many companies. The court said the FCC went beyond what the TCPA allows. And the "revoke-all" idea was that telling a bank "stop texting me offers" would also stop its fraud alerts. Banks, utilities and consumer groups all asked the FCC to change it.

The FCC has said it will keep working on related questions, so check its site again before you launch.

Two EU laws matter for an AI that phones people.

ePrivacy rules on consent. Article 13 of the ePrivacy Directive says automated calling systems without human intervention may be used for direct marketing only with subscribers who have given prior consent. For other marketing calls, each country decides between opt-in and a do-not-call approach. National laws add detail, so check each country you call.

The AI Act's transparency duty. Article 50(1) of the AI Act says providers must design AI systems that interact directly with people so that those people are told they are dealing with an AI system, unless that is obvious to a reasonably informed person. The information must be given clearly at the latest at the first interaction. Article 50(4) separately requires whoever deploys a system that creates a "deep fake" to disclose that the content is AI-generated. The Act defines a deep fake as AI-generated audio, image or video that resembles real persons and would falsely appear authentic. A cloned voice of a real person is the kind of thing this describes.

The Article 50(1) duty sits with the company that builds the assistant, not the business that uses it. If you are the business, ask your supplier how the system tells people, and say so aloud yourself at the start of the call. Our guide to the EU AI Act and GDPR for small teams covers the wider picture, including personal data.

The UK rules are the Privacy and Electronic Communications Regulations, or PECR, enforced by the Information Commissioner's Office (ICO). The ICO's guidance sets out three points:

• Automated marketing calls need specific consent. That means calls that play a recorded message. General consent for marketing, or consent for live calls, is not enough. It must specifically cover automated calls. If consent is withdrawn, the calls must stop.
• Identify yourself. Automated calls must include your name and a contact address or freephone number, and let your number, or an alternative contact number, be displayed.
• Live sales calls are different. You must screen numbers against the Telephone Preference Service (TPS) and the Corporate TPS, unless that person has told you specifically that they are happy to be called.

What about an AI voice? The ICO's innovation advice looked at software that used AI to synthesise a short recording of a call handler's voice to play at the start of a marketing call. The ICO said the calls would contain recorded matter and would not comply with regulation 19 unless specific consent had been obtained. That was advice to one organization, not formal guidance, and we found nothing from the ICO on fully conversational AI agents. The cautious approach is to treat an AI-voice sales call as an automated call and get specific consent.

Ofcom, the communications regulator, treats repeated silent or abandoned calls as persistent misuse under its policy statement. We found no Ofcom text that mentions AI voices. If your system sometimes connects and says nothing, that is its territory.

This list is ours, built from the rules above. It follows the strictest common ground across the US, EU and UK, so it works as a default. It is general information, and local rules may add more.

• 1. Ask for the right consentSay plainly that your business will call, that the call may use an AI voice, and what it will be about. A signed or electronic agreement that names your business is the strongest form. Do not bundle it into terms of purchase.
• 2. Record itKeep who agreed, when, how, the exact wording they saw and the number they gave. If a regulator or a customer asks, this record is your defense. Never rely on a bought list you cannot trace to a consent.
• 3. Match the lead to the permissionConsent to emails is not consent to calls, and consent to live calls is not consent to AI calls. Old lists are the riskiest: only call back people who agreed to be contacted by phone.
• 4. Check the lists firstScreen against your own do-not-call list, the national registry in the US, and TPS and CTPS in the UK, every time, before each campaign.
• 5. Call at lawful hoursFor US sales calls, 8 a.m. to 9 p.m. where the person is, not where you are. Store time zones with phone numbers.
• 6. Say it is an AIOpen with who you are, who you represent and that this is an AI assistant, and give a way to reach a person. The EU requires it, and it is good practice everywhere.
• 7. Honor stop requests fastTreat "stop", "do not call me again", a keypress or a reply as a stop. Log it, add the number to your list at once and confirm it in your system. The legal limit in the US is ten business days, but a stop that takes a week to apply creates risk.
• 8. Get the voice owner's written permissionIf the AI uses a cloned voice, keep the voice owner's written agreement, including what the voice may say and how long the permission lasts.