Is AI Cold Calling Legal? TCPA Rules for AI Voice (2026)

Is AI cold calling legal? In the US, AI calls are legal with the right consent, and true cold AI calls are not. In February 2024 the FCC ruled that AI-generated voices count as an "artificial or prerecorded voice" under the Telephone Consumer Protection Act (TCPA). So an AI call needs the called party's prior express consent, and if it is a sales or marketing call, their prior express written consent. Calling hours, do-not-call rules and opt-out rules apply on top. Calling strangers who never agreed to hear from you with an AI voice is the thing the ruling was written to stop.

This is not legal advice. I run a software company, not a law firm. The rules below come from the FCC's own pages, linked in each section, and state laws can add more. Before you run outbound AI calls at any volume, have a lawyer who handles TCPA work look at your consent language and your call lists.

What the FCC decided in 2024

On 8 February 2024 the FCC released a Declaratory Ruling (FCC 24-17) that answered the question directly. It confirmed that the TCPA's restrictions on "artificial or prerecorded voice" cover current AI technologies that generate human voices, including voice cloning. Its own press release headline was FCC Makes AI-Generated Voices in Robocalls Illegal.

Three points from the ruling matter for anyone using AI to call:

1. Consent is required. Callers must get prior express consent from the called party before an AI-voice call, unless it is an emergency or covered by an exemption.
2. Marketing needs written consent. If the call includes an advertisement or telemarketing, the rules require prior express written consent.
3. There is no "it sounds like a live agent" loophole. The ruling says plainly that the TCPA does not carve out technology that claims to be the equivalent of a live agent.

The ruling also notes that 26 state attorneys general asked for it, which tells you who is enforcing it.

The rules every AI call has to follow

The FCC's consumer guide, Stop Unwanted Robocalls and Texts, sums up the rules. Here is what they mean for an AI voice agent.

What has to be true before an AI dials a US number

C

Consent on file

Written consent if it is a sales or marketing call

then

then

N

Not opted out

No stop, no do-not-call request, not on the National Registry for telemarketing

then

then

I

Inside calling hours

8 a.m. to 9 p.m. in the person's local time, or narrower

dial

dial

I

Identifies itself

Name, business and number at the start, with an opt-out

What it costs to get wrong

The TCPA lets people sue. The statute (47 U.S.C. 227) sets damages at $500 per violating call, and a court can triple that to $1,500 if the violation was willful or knowing. An AI dialer makes a lot of calls, so the per-call number is the one to remember.

Statutory damages per violating call under the TCPA

• Per call$500
• Willful or knowingUp to $1,500

So what is legal with AI calling?

Plenty. The rules are about who you call without permission, not about using AI on the phone. These are the uses I see work, and that I built StrideOps around:

• Answering inbound calls. An AI receptionist answering your own phone line is not an outbound robocall.
• Calling leads who asked to be contacted. Someone fills in your form or a Facebook lead ad with clear consent language, and the AI calls them back in seconds. That is speed to lead, and it is the highest-return use of an AI caller I know.
• Following up with existing contacts who agreed to it. Appointment reminders, rebooking and reactivation of people who gave consent.
• Callbacks they requested. "Call me tomorrow at 3" is the easiest consent you will ever get.

What does not work is buying a list of numbers and pointing an AI at it. With an AI voice there is no version of that the 2024 ruling allows without consent.

"But my prospects are businesses"

Be careful here. The consent rule for artificial voice calls covers wireless numbers whether or not the person who answers is a consumer, and a lot of business owners answer on their cell phone. Business calling has its own nuances, which is exactly the kind of question to put to a lawyer before you build a campaign around it.

The rules are still moving

The FCC has been revising its consent revocation rules through 2025 and 2026. Its September 2026 fact sheet describes changes to how revocations are interpreted and a further proposal that could shorten how long callers have to honor them. The safe habit: honor every opt-out right away, on every channel, and check the current rules before you scale.

The settings that enforce the rules in StrideOps

Software cannot make a call legal. Consent comes from how you collected the lead, and that part is on you. What software can do is stop the AI from dialing the wrong person at the wrong time. Here is what StrideOps calling campaigns do, and what they do not.

What campaigns check before every dial:

• Calling hours in the contact's timezone. Each campaign has a calling window and days. The check uses the contact's saved timezone, and infers it from the phone number only when none is saved. If the timezone or hours are invalid, the call does not go out.
• Your do-not-call list and do-not-disturb flags. Before every dial, the campaign checks your organization's DNC list and the contact's do-not-disturb settings, and skips anyone on either. If that check cannot run, the call does not go out.
• Opt-outs feed the list automatically. A contact who texts STOP is added to your DNC list. A call outcome mapped to do-not-call does the same.
• Callbacks they asked for, still inside your hours. When someone says "call me tomorrow at 3," the campaign schedules it in their timezone and still respects your calling window.
• Daily caps and retries you set. Limit dials per day and decide how many attempts a contact gets.

What StrideOps does not do for you:

• It does not collect consent. Your forms, ads and scripts need consent language your lawyer is happy with.
• It does not scrub your list against the National Do Not Call Registry. The DNC check is your organization's own list, so scrub purchased or older lists before you import them, and add registry numbers to your DNC list.
• It does not write your AI's opening line. Put the name, business, callback number and an opt-out at the start of your agent's script, and test it.

If you want the deeper playbook on running an AI caller well, read AI SDR outbound calling.

FAQ

The bottom line

AI calling is legal when the person agreed to be called. Cold AI calling to people who did not is what the FCC's 2024 ruling targets, with $500 to $1,500 per call on the line. Collect consent properly, honor opt-outs right away, call inside the hours, and let software enforce the rest. Then have a lawyer check it.

---

About the author

Josh Pocock is the founder and CEO of StrideOps.ai. He scaled his own AI agency past $50K a month on GoHighLevel, Vapi and n8n, and his agency Executive Stride has built systems for 400+ businesses. StrideOps started as the platform he built to replace that stack.

Sources: FCC Declaratory Ruling FCC 24-17 (released 8 February 2024), the FCC consumer guide "Stop Unwanted Robocalls and Texts" (last reviewed 27 February 2026), the FCC fact sheet of 9 September 2026, and 47 U.S.C. 227, all read 15 October 2026. This article is general information, not legal advice.