TCPA Compliance for AI Voice Agents: Consent, Opt-Out, and Fines in 2026

A 10,000-call AI outbound campaign without prior express written consent is a $5M-$15M statutory exposure under the TCPA. There is no good-faith defense. There is only "we had consent on file."

What the rule says

flowchart LR
  UA[SIP UA] -- REGISTER --> Reg[Registrar]
  UA -- INVITE --> Proxy[SIP Proxy]
  Proxy --> Dispatcher[Kamailio dispatcher]
  Dispatcher --> Worker1[FreeSWITCH worker]
  Dispatcher --> Worker2[FreeSWITCH worker]
  Worker1 --> AI[(AI agent)]
  Worker2 --> AI

The Telephone Consumer Protection Act (47 U.S.C. § 227) prohibits non-emergency calls to a residential or wireless number using an "artificial or prerecorded voice" without prior express consent (PEC) for informational calls or prior express written consent (PEWC) for marketing/telemarketing calls. The FCC's February 2024 Declaratory Ruling extended "artificial voice" to AI-generated voices, including conversational agents. Statutory damages are $500 per violation, trebled to $1,500 for willful or knowing violations. Class actions can aggregate these into seven- and eight-figure judgments. Beyond federal TCPA, the Florida Telephone Solicitation Act (FTSA), the Oklahoma TCPA, the Washington CEMA, and California's CIPA add state-level overlays.

What it means for AI voice agent operators

Three operational realities shape the 2026 TCPA picture for AI voice:

First, consent is the only defense and it must be granular. PEWC requires a clear, conspicuous disclosure, a signature (electronic is fine), the seller's name, and language stating the consumer is not required to consent as a condition of buying anything. Generic "I agree to terms" checkboxes do not work.

Second, the called party can revoke consent in any reasonable manner: verbal "stop calling" during a call, an SMS reply STOP, a website form, a mailed letter. Your system must catch all of these and propagate to a single suppression list within 10 business days. Litigation tracker data shows revocation-handling failures are now the #1 TCPA fact pattern.

Third, AI specifically widens the attack surface. A conversational AI generates speech in real time, which means accidental "I'll call you back" statements without consent footing become per-call violations, not edge cases. Your prompt and tool design must prevent unconsented re-engagement.

How CallSphere stays compliant

CallSphere's Sales Calling AI ships with a TCPA-aware conversation graph: every outbound flow opens with an AI disclosure plus opt-out instructions, runs at most 5 concurrent calls per tenant on Twilio, and writes any verbal "stop", "remove", or "do not call" utterance to a suppression table within the same call turn. The platform scrubs the lead list against the National DNC (and configurable state DNCs) every 31 days. Healthcare AI uses HIPAA-aligned consent records (BAA in place, SOC 2 controls, signed audit log of every consent capture). Twilio Trust Hub signs outbound at STIR/SHAKEN Level A. Across 6 verticals, 50+ businesses, 4.8/5 average rating, the TCPA flow is well-tested with the 14-day trial including the suppression-list dashboard so customers can audit revocations themselves.

Compliance checklist

1. Capture PEWC for any AI marketing call: clear disclosure, electronic signature, "consent is not a condition of purchase".
2. Capture PEC (less formal but still express) for informational AI calls.
3. Disclose AI use at consent capture, not just at call time.
4. Scrub the National DNC every 31 days; track scrub timestamps.
5. Honor verbal "stop" / "remove" / "unsubscribe" during the call, immediately.
6. Propagate revocations across SMS, voice, and email channels within 10 business days.
7. Restrict outbound to 8am-9pm local to the called party.
8. Cap concurrent dial rate per tenant; high concurrency without consent compounds exposure.
9. Maintain a per-number consent ledger with source, timestamp, IP, and audio reference if verbal.
10. Require a vendor BAA / DPA when using a third-party AI model (OpenAI, Anthropic).
11. Monitor TCPA litigation patterns quarterly; FTSA and OK TCPA are now top filing venues.
12. Buy TCPA-specific insurance with a per-call sublimit; standard E&O often excludes TCPA.

FAQ

Is established business relationship (EBR) a defense? Not for AI/artificial-voice calls. EBR exempts manual marketing calls from DNC, not consent for artificial-voice calls. Get express consent regardless.

Does an inbound caller waive TCPA on a callback? A callback in response to a request, made promptly, is fine. A callback two weeks later or to a different number is risky.

What about "we'll let you know about future offers"? That is not consent for AI marketing calls. PEWC requires explicit disclosure that you will use prerecorded or artificial voice.

How do I revoke consent for a third-party data broker list I bought? You inherit the data broker's consent quality, including its weaknesses. Industry practice is to re-confirm consent on the first contact and treat any failure as a do-not-call.

Are B2B calls exempt? TCPA primarily targets residential and wireless numbers. Business landlines are largely out of scope, but cell phones used by employees are in scope and most US business phones are mobile.

Sources

• FCC: TCPA Confirms AI Technologies (Feb 8, 2024)
• 47 U.S.C. § 227 (TCPA)
• FCC: Makes AI-Generated Voices Illegal

Try the 14-day trial, see pricing, or talk to /contact about TCPA-safe deployment.