Is AI outbound calling legal?

The Legal Gray Area Is Gone: AI Voices Are Robocalls Under the TCPA

Every day, businesses across the US fire up AI voice agents and dial cell phones without realizing they're stepping into one of the most litigated corners of federal law. The question they think is ambiguous — "is an AI voice really a robocall?" — actually got answered in February 2024, and the answer is yes.

In its February 2024 Declaratory Ruling (FCC-24-17), the FCC settled the matter outright: AI-generated voices count as an "artificial or prerecorded voice" under the TCPA. The ruling explicitly closed the loophole, noting the statute "does not allow for any carve out of technologies that purport to provide the equivalent of a live agent." In plain terms, your AI voice agent is legally a robocall, and it needs prior express consent before dialing a US cell phone.

The stakes are not theoretical. TCPA statutory damages run $500 to $1,500 per call with no aggregate cap, and TCPA class-action filings have surged 95% year over year, with aggregate verdicts exceeding $925 million. Recent settlements tell the story:

• QuoteWizard: $19M settlement — a reference point for failing to trace consent through the vendor chain
• Air AI: a $28M FTC settlement (April 2026) driven by AI dialers hitting unconsented cell phones at scale
• Gen Digital: $9.95M for prerecorded calls to non-customers; Hy Cite Enterprises: $4.75M, with class members eligible for $600–$1,000 each

Here's the part most businesses miss: the enforcement target is consent violations, not the AI itself. The Air AI settlement wasn't punishment for using synthetic voices — it was punishment for dialing people who never consented. The technology is legal; calling without a consent trail is what costs eight figures.

That distinction matters for how you buy leads and run follow-up. A lead without a retrievable consent record — disclosure text, timestamp, and the named contacting party — is a liability, not an asset. As compliance practitioners put it, a consent that can't be retrieved per number within an hour "functionally... does not exist in litigation." The burden of proving consent falls on the caller, every time.

This is why GrowthPros attaches a consent record to every lead we deliver and scrubs lists against the National DNC Registry before any outbound touch — not because AI follow-up is inherently risky, but because unconsented contact is. The gray area is gone. What separates a compliant AI calling program from a $19M headline is whether you can prove, per number, that the person on the other end said yes.

The Consent Rules That Actually Decide Legality (Including the Expensive Misunderstandings)

Most AI calling programs don't fail because the technology is illegal — they fail because someone assumed consent rules that don't exist. The FCC's February 2024 Declaratory Ruling removed the gray area: AI-generated voices are artificial or prerecorded voice under the TCPA, with no carve-out for technology that "purports to provide the equivalent of a live agent."

Consent is jurisdictional, not universal. Prior express written consent governs marketing calls in 47 states. But after the Fifth Circuit's Bradford v. Sovereign Pest Control ruling, oral consent suffices in Texas, Louisiana, and Mississippi — a circuit split that creates a patchwork where the called party's location determines your standard.

The single most expensive misunderstanding is the Established Business Relationship trap. EBR lets a live agent dial a past customer who's on the DNC list — but an AI agent cannot dial that same person without separate consent. As one compliance analysis puts it bluntly: your live SDR can call a 16-month-old customer on the DNC list; your AI agent cannot. The voice is what the law cares about.

State-level rules add a second layer:

• Texas SB 140 requires AI disclosure within the first 30 seconds of a call, with TRAIGA (HB 149) effective January 1, 2026
• California, Florida, Colorado, Illinois, and Utah mandate AI voice disclosure
• State mini-TCPA laws like Florida's FTSA and California's CIPA impose stricter standards than the federal TCPA

Then there's vendor-chain liability. In Lamb v. Mortgage One Funding (filed February 2026), the proposed class covers consumers called by the company "or from any of the company's vendors, lead generators, or agents." The entity on whose behalf a call is made is liable regardless of which vendor dialed. QuoteWizard's $19 million settlement shows what happens when consent can't be traced through that chain.

The evidentiary standard is unforgiving: a consent that can't be retrieved per number within an hour is functionally a consent that doesn't exist in litigation. The burden of proof falls on the caller, and statutory damages run $500 to $1,500 per call with no aggregate cap.

This is why GrowthPros attaches a consent record — disclosure text, timestamp, IP address, and named contacting party — to every lead before it reaches a client's CRM. In a regulatory landscape where rules keep moving and state analogues fill federal gaps, the only durable defense is consent provenance tied to every single call attempt.

The Compliance Infrastructure That Makes AI Calling Legally Defensible

The companies losing $9M to $20M TCPA settlements didn't have an AI problem — they had an infrastructure problem. The technology was never the legal risk; the missing consent trails, unscrubbed lists, and unretained records were.

The core principle is simple: consent must be retrievable, per number, on demand. As compliance analysts put it bluntly, a consent that cannot be retrieved per number within an hour is functionally a consent that does not exist in litigation. The burden of proving consent falls on the caller, which means every dial needs a documented trail behind it.

That trail has several moving parts, and each one is an infrastructure requirement, not a policy statement:

• DNC scrubbing every 31 days against the National Do Not Call Registry, which holds more than 249 million active numbers with tens of thousands added daily — a monthly scrub is the legal minimum, not best practice.
• Abandonment rate tracking against the FCC's 3% cap, measured over a rolling 30-day period per campaign.
• Calling windows limited to 8 a.m.–9 p.m. local time, with opt-outs honored immediately and permanently.
• Record retention matching the four-year TCPA statute of limitations — consent records, call logs, and disposition data kept queryable, with defense counsel recommending seven years.

Compliance, as practitioners note, either holds or breaks at the infrastructure layer. When the FCC's one-to-one consent rule was vacated and state mini-TCPA laws filled the gaps, the lesson wasn't that requirements relaxed — it was that granular consent capture survives wherever the legal line lands.

This infrastructure also clarifies risk. Not all AI calls carry equal exposure. Risk-tiered analysis places consented callbacks, missed-call returns, appointment confirmations, and reactivations of opted-in lists in the low-risk bucket. Cold outreach to purchased lists is where the lawsuits happen — courts have grown skeptical of consents naming "and our partners," and vendor-chain litigation like Lamb v. Mortgage One Funding extends liability to whoever benefits from the call, regardless of which vendor dialed.

This is why GrowthPros attaches a consent record — disclosure text, timestamp, IP address, and named contacting party — to every lead it delivers, and scrubs lists against the DNC Registry before any outbound contact. Reactivation campaigns target only pre-existing, opted-in relationships, never cold lists.

The takeaway for any business evaluating AI calling: ask your vendor how quickly they can produce consent for a specific number, how often they scrub, and how long they retain records. If the answers take longer than an hour to demonstrate, you've found your risk.

How to Run AI Outbound Calling That Holds Up: A Practical Checklist

Knowing the rules is one thing; running AI outbound calling that survives a subpoena is another. The gap between the two is where companies like QuoteWizard end up writing $19 million settlement checks — not because the AI failed, but because consent couldn't be traced through the vendor chain.

Start with the lead itself. Every lead you buy should arrive with a complete consent record: the exact disclosure text shown, a timestamp, the IP address, and the named party who obtained consent. As one compliance analysis puts it, a consent that can't be retrieved per number within an hour is functionally a consent that doesn't exist in litigation. The burden of proof falls on you as the caller, not the consumer.

For reactivation, the line is simple: only run AI sequences against opted-in lists you already own — never cold lists. Courts have grown skeptical of consents naming "and our partners," and the high-risk category where lawsuits concentrate is cold outreach to purchased lists. An established business relationship won't save you either — an AI voice triggers TCPA consent requirements even where a live agent could legally dial.

Here's the practical checklist:

• Verify every lead carries a consent record — disclosure text, timestamp, IP, and named contacting party — before any dial.
• Scrub against the National DNC Registry on every campaign; the registry holds more than 249 million numbers and adds tens of thousands daily.
• Build to the strictest consent standard: written, timestamped consent tied to the specific number, honoring opt-outs immediately and permanently.
• Require your lead vendor to prove consent provenance end-to-end — vendor chain liability means you answer for their dialing.
• Retain call logs and consent records for at least the four-year TCPA statute of limitations.

This is exactly how GrowthPros operates. Every lead is consent-recorded and DNC-scrubbed before delivery, reactivation targets only pre-existing opted-in relationships, and each lead lands in your CRM with its consent trail attached. AI voice, SMS, and email follow-up fires inside a five-minute window, 24/7 — included with every lead, not an upsell.

The payoff is measurable. The classic MIT Sloan / InsideSales.com research found that contacting a lead within five minutes versus thirty makes you roughly 100x more likely to make contact — and 21x more likely to qualify it. That speed is only sustainable when compliance is built into the infrastructure, not bolted on. Compliant AI calling isn't a constraint on speed-to-lead; it's what makes speed-to-lead possible at scale.

Want leads that arrive consent-recorded, DNC-scrubbed, and followed up inside five minutes? Book the 15-minute qualification call — it's free, honest about fit, and commits you to nothing.