TCPA Compliance for AI Voice Agents: A 2026 Operator's Guide

TL;DR

Updated June 2026 to reflect the FCC's current treatment of AI voices, the vacated one-to-one consent rule, and the 2025 wave of state telemarketing laws.

• Since February 2024, the FCC treats AI-generated and cloned voices as "artificial or prerecorded voice" under the TCPA. An AI sales call is held to the same consent, disclosure, and do-not-call rules as any other robocall.
• If you dial from a list (most call centers do), your real exposure usually is not the "autodialer" rule. It is the artificial-voice rule, which does not care how you dialed.
• On outbound calls, the consent and do-not-call burden sits with you, the calling business, not your voice-AI vendor. And in a dispute, you carry the burden to prove what happened.
• The practical defense is records: being able to show what was said, that it was not altered, and when. That is the gap an AI compliance layer fills.

This article is operator education, not legal advice. TCPA rules change and vary by state. Confirm your obligations with qualified counsel.

If you run outbound calls in SSDI, ACA health insurance, Medicare, or debt relief, you already know these are among the most-litigated verticals in the country for telemarketing. The plaintiff's bar runs ads recruiting people who got "robocalls." A single campaign can generate a class action.

Now add an AI voice agent to that picture. The question every operator should be asking in 2026 is simple: does putting an AI on the call change your TCPA exposure? The short answer is that the AI is now squarely inside the same rules, and the way you run it determines whether you can defend yourself.

TCPA compliance for AI voice agents is the set of consent, disclosure, and recordkeeping rules that apply when an AI-generated voice places outbound calls, which, since a February 2024 FCC ruling, are regulated the same as any other "artificial or prerecorded voice" call under the Telephone Consumer Protection Act.

Does the TCPA apply to AI voice agents?

Yes, and the line is clear. On February 8, 2024, the FCC issued a Declaratory Ruling confirming that the TCPA's restriction on calls using an "artificial or prerecorded voice" includes voices generated by AI, including voice cloning. It was a unanimous vote, prompted by a request from 26 state attorneys general. There is no carve-out for AI that is good enough to sound like a live agent. The ruling is explicit that mimicking a human does not exempt the technology.

One nuance worth getting right, because the headlines got it wrong. The FCC's own press release said the ruling "makes AI-generated voices in robocalls illegal." The ruling does not categorically ban AI voices. It places them under the existing robocall rules. So the real question is not "are AI calls legal," it is "am I running my AI calls like the regulated robocalls they now are."

What those rules require for an artificial or prerecorded voice call: identify who is calling at the start of the call, provide a callback number, and for marketing calls offer an automated opt-out. And for telemarketing, you generally need prior express written consent before the call goes out, not just a verbal okay.

Autodialer or artificial voice? The distinction that trips up operators

This is where a lot of call centers misread their own risk.

In 2021, the Supreme Court decided Facebook v. Duguid and narrowed the definition of an automatic telephone dialing system (ATDS). To count as an autodialer, a system has to store or produce phone numbers using a random or sequential number generator. Dialing a curated list of known leads, which is what a BPO does all day, generally does not meet that definition.

So far so good, and many operators stop there: "we dial from a list, we are not using an autodialer, we are fine." That is half the picture. Duguid narrowed only the autodialer rule. It left the artificial-or-prerecorded-voice rule completely intact.

Here is the consequence. An AI voice agent calling a hand-built lead list can fall outside the autodialer rule and still land squarely inside the artificial-voice rule. With an AI on the line, the voice is the trigger, not the dialer. "We don't use an autodialer" is not the shield people think it is once there is a synthetic voice on the call.

Who is liable, you or your AI vendor?

This matters because it shapes what you should expect a vendor to actually do for you.

TCPA liability attaches to the entity that initiates the call and to the seller the call is made for. That is the calling business, the lead buyer, the BPO. It is not the tooling vendor. Consent, the permission to make the call in the first place, is obtained upstream by your lead source, before the call ever happens. Your voice-AI platform does not gather it and cannot vouch for it.

So in practice, you own:

• Prior express consent, written for telemarketing, captured by your lead source.
• Do-not-call scrubbing, both the National DNC Registry and your own internal list.
• Calling-hours limits, commonly 8am to 8pm in the called party's local time, with some states extending to 9pm.
• Honoring opt-out and revocation requests.

A voice-AI platform can help you execute and document some of these. None of them transfer the statutory liability off your books. If a vendor implies their product makes you "TCPA-compliant," be skeptical, that is not a thing a calling tool can do for an obligation the law places on the caller.

What you must be able to prove in a dispute

TCPA litigation turns on evidence, and the burden is on you.

When a claim lands, the caller has to be able to show that consent existed and that the call was handled properly. Courts and regulators expect records of when, where, and how consent was obtained, what disclosures were made on the call, and proof that opt-out requests were honored.

The reason this is not academic is the damages math. Under section 227(b), the provision AI voice calls fall under, statutory damages are $500 per violation, rising to $1,500 per violation for willful or knowing conduct. Do-not-call violations under section 227(c) are a separate claim with their own damages of up to $500 per call.

Put numbers to it. A single afternoon's campaign can place thousands of calls. If a disclosure or opt-out failure repeats across even 1,000 of them, that is a $500,000 exposure before anyone argues willfulness, which trebles it to $1.5 million. That is how a recordkeeping gap becomes a company-ending number, and it is exactly why "the recordings are in our storage somewhere" is not a defense strategy. You need records that are complete, organized, and credible enough to hold up.

What changed in 2024 to 2026

The ground has moved several times recently. The parts that matter for an outbound operator:

• Feb 2024, FCC AI-voice ruling. AI and cloned voices are "artificial or prerecorded voice" under the TCPA (covered above). Still in force.
• March 2024, FTC. The FTC updated the recordkeeping requirements in its Telemarketing Sales Rule and reaffirmed its prohibition on robocalls that use voice cloning. This is a separate regime from the FCC's TCPA, but for a telemarketer it lands on the same desk.
• The "one-to-one consent" rule. A rule that would have required separate consent for each individual seller named on a lead form was adopted, then vacated by a federal appeals court in early 2025 before it ever took effect, and the language was subsequently removed. Bundled lead-generation consent is again permissible at the federal level, though individual states can be stricter.
• AI disclosure. A federal proposal to require an explicit "this call uses AI" disclosure was issued in 2024 but remains a proposal, not law, as of mid-2026. Do not assume it is required yet, but watch it, and note that the existing artificial-voice identification rules already apply.
• State mini-TCPA laws keep expanding. Florida's Telephone Solicitation Act, Texas SB 140 (effective September 2025), Connecticut SB 1058, and others each add their own consent rules, calling restrictions, and in several cases a private right of action with per-call damages. If you call into multiple states, federal compliance is the floor, not the ceiling.

Where an AI compliance layer fits, and where it does not

Start with the honest part: no tool makes your calls "TCPA-compliant." Compliance is a function of consent you gathered, lists you scrubbed, and rules you followed, all of it upstream of the call. What a compliance layer can do is make what happened on the call provable, and catch problems you would otherwise miss until a demand letter shows up.

Two things actually move the needle.

QA on 100% of calls, not a 2% sample. Traditional call-center QA listens to a handful of calls a week. An AI layer can score every single call against a checklist you define: the things your agents must say and must never say. For an SSDI or ACA campaign, that checklist can include the TCPA-relevant items that get people sued, did the agent honor an opt-out, did it avoid guaranteeing benefits, did it stay on the approved script. Each result is tied to the exact line in the transcript that triggered it, so a flag is evidence you can point to, not a reviewer's hunch. Two honest caveats: it checks the checklist you configure, not every conceivable violation, and it is an automated judge that helps your compliance team, not a substitute for one.

A signed, tamper-evident record of every call. Each call gets packaged into a single signed record that holds the transcript (what was said), a cryptographic hash of the audio (proof the recording has not been altered), and the timestamp (when it happened). If a complaint arrives six months later, you can show what was actually said, that the record has not been changed since, and when it occurred. This is the difference between "we think the call was fine" and "here is the call, and here is the proof it is intact." Two things to be clear about: this proves the call, not the upstream consent, which still lives in your lead source's records. And today that record is signed by Klariqo. Independent third-party verification is a layer we are adding, not one to claim yet.

There is also the moment do-not-call obligations actually get tested: when someone on the call says "take me off your list." The system detects that in-call opt-out, flags it, and can show whether the agent honored it. That does not replace your pre-call DNC scrubbing, which stays your dialer's job. It documents the live moments where a do-not-call failure turns into a violation.

The through-line is simple. Klariqo does not make you compliant. It makes what was said provable, signed, unaltered, and timestamped, and it scores every call against your compliance checklist. The consent and do-not-call burden stays yours. We make it defensible.

FAQ

Are AI voice calls legal under the TCPA? Yes, but regulated. Since February 2024 the FCC treats AI-generated and cloned voices as "artificial or prerecorded voice," so AI outbound calls must follow the same consent, disclosure, and opt-out rules as any robocall. The ruling regulates these calls, it does not ban them.

Do I need written consent to make AI sales calls? For telemarketing or advertising calls using an artificial or prerecorded voice, which now includes AI voices, the TCPA generally requires prior express written consent obtained before the call. Purely informational, non-sales calls have a lower bar (prior express consent).

I dial from a list, not an autodialer. Am I exempt? Not from the part that matters here. Facebook v. Duguid narrowed the autodialer definition, but the artificial-or-prerecorded-voice rule is separate and still applies. An AI voice on a list-based call is still covered.

Who is liable if my AI vendor's call breaks the TCPA, me or the vendor? Liability attaches to the business initiating the call and the seller it is made for, which is you. Consent is gathered upstream by your lead source. A vendor can help you document compliance, but the statutory liability stays with the caller.

What records do I need to defend a TCPA claim? You should be able to show when, where, and how consent was obtained, what disclosures were made on the call, and that opt-out requests were honored, all with credible, unaltered records. The burden of proof is on the caller, so the quality of your records is the quality of your defense.

Does Klariqo make my calls TCPA-compliant? No, and no tool can. Compliance depends on consent and lists you control upstream of the call. What Klariqo does is make each call provable: a signed, tamper-evident record of what was said and when, plus QA that scores every call against your compliance checklist. We make it defensible. The obligations stay yours.

See it for yourself

The fastest way to understand a tamper-evident call record is to inspect one. Klariqo signs every AI call as a vCon, an open standard for packaging a conversation into a single verifiable file, and you can check one in the public verifier at klariqo.com/vcon. Drop in a signed call record and it will tell you whether it is intact and which key signed it, right in your browser.

If you run outbound AI calls in a regulated vertical and want every call scored against your compliance checklist and signed as evidence, that is what Klariqo is built for.

Last updated: June 20, 2026. Operator education, not legal advice.