AI cold calling is not inherently legal or illegal. The answer depends on the destination, recipient, purpose, dialing and voice technology, consent, data use, recording, and sector. Treat data processing, permission to call, recording or transcription, and AI disclosure as four separate legal tests. This guide explains the US, European Union (EU), European Economic Area (EEA), and UK baseline and the safeguards responsible teams add. It is general information, not legal advice. Qualified counsel should approve each real call flow.
The short answer: four separate legal gates decide the outcome
An AI voice call can pass one legal test and fail another. A lawful basis to hold a prospect's phone number does not necessarily give you permission to call it. Permission to call does not necessarily permit recording. Telling the person that the caller is AI does not cure a missing consent or a Do Not Call violation.
Treat every campaign as four linked reviews:
| Legal gate | The question to answer |
|---|---|
| Personal-data processing | May you collect, enrich, use, store, profile, share, or delete the lead and call data for this purpose? |
| Marketing-call permission | May this entity call this recipient, on this number, with this dialing and voice technology, at this time? |
| Recording and transcription | May you record or transcribe the conversation, and what may you do with the output? |
| AI disclosure | Must you tell the person that they are interacting with AI, when, and in what form? |
Start with the actual architecture. An AI-generated voice speaking to the recipient, a prerecorded synthetic message, an automatically initiated call, and an AI copilot assisting a human representative can receive different treatment. Number type, consumer or business status, sector, and the locations of every participant can also change the result.
The safest campaign design uses a destination-specific policy matrix. A global toggle labeled “compliant” cannot represent these differences.
United States: federal rules are only the starting point
The US has overlapping federal, state, and sector rules. Business-to-business (B2B) is not a universal exemption, and a purchased list is not proof that a particular seller may place a particular AI call. The Federal Communications Commission (FCC) and Federal Trade Commission (FTC) administer different parts of the federal framework.
| Legal gate | Binding baseline | Operational consequence |
|---|---|---|
| Personal-data processing | The US has no single general federal privacy law for all commercial lead and call data. The FTC Act Section 5 prohibits unfair or deceptive practices. State privacy laws and sector rules may add notice, opt-out, consent, security, and use limits. California's collection notice rule is one state example, not a national default. | Map the recipient's state and the data involved, including recordings, transcripts, inferred interests, and voiceprints. Do not treat call consent as blanket permission for analytics, sharing, or model training. |
| Marketing-call permission | The Telephone Consumer Protection Act (TCPA) restricts specified calls that use an automatic telephone dialing system or an artificial or prerecorded voice. The FCC has ruled that an AI-generated human voice counts as an artificial voice under the TCPA. The FCC telemarketing rule and the FTC Telemarketing Sales Rule (TSR) add consent, Do Not Call, identification, calling-time, and other controls where they apply. | Classify the call technology, purpose, number type, and recipient before dialing. Apply federal and state Do Not Call rules, seller-specific suppression, caller identification, registration, and any stricter state or sector restriction. |
| Recording and transcription | The federal Wiretap Act includes a one-party-consent exception, but states can impose stricter requirements. California, for example, requires all-party consent for covered confidential communications under Penal Code section 632. | Identify all participant locations before recording or real-time transcription. Use the strictest applicable consent and notice rule unless counsel reaches a different choice-of-law conclusion. Review storage, analysis, biometrics, sharing, and training separately. |
| AI disclosure | The FCC ruling classifies AI-generated voices under the TCPA. It does not itself create a universal script requiring every commercial AI caller to say “I am AI.” State and sector laws can impose narrower disclosure duties. | Disclose the AI identity at the outset as a standard transparency safeguard, then apply any state or sector wording and timing required for the campaign. Disclosure does not replace call consent, recording notice, or privacy information. |
US suppression, timing, and evidence controls
Where the federal rules apply, telephone solicitations are generally limited to 8 a.m. through 9 p.m. at the called person's local time. A stricter state or sector window controls when applicable. The FCC rule also requires covered callers to maintain a written, entity-specific Do Not Call policy, train relevant personnel, and honor entity-specific requests for five years. The TSR has its own scope, records, and exceptions.
Store the exact consent or written agreement required for the call type, including the seller covered, number, wording, source, timestamp, and affirmative action. Store every revocation and suppression request, and propagate it to the customer relationship management (CRM) system, dialer, vendors, and future lists before another call is attempted.
European Union and EEA: GDPR permission is not call permission
The General Data Protection Regulation (GDPR) governs personal-data processing across the EU and is incorporated into the EEA. Electronic-marketing and recording rules still depend heavily on national law.
| Legal gate | Binding baseline | Operational consequence |
|---|---|---|
| Personal-data processing | GDPR Articles 5 and 6 require data-protection principles and a lawful basis. Recital 47 says direct marketing may be a legitimate interest, but that is not automatic permission. Article 14 requires information when lead data came from another source, generally no later than the first communication when the data are used to contact the person. Article 21 gives the person an absolute right to object to direct marketing and related profiling. | Document the purpose, basis, balancing assessment where relevant, source, recipients, transfers, retention, and rights. Present the objection right clearly and separately. Stop direct-marketing processing after an objection. |
| Marketing-call permission | ePrivacy Directive Article 13 requires prior consent for automated calling systems without human intervention. For other unsolicited direct-marketing calls, Member States choose opt-in or opt-out protection. National law also determines registers, B2B treatment, calling windows, identification, and consent records. | Build a country-specific rule set. Do not turn a GDPR legitimate-interest assessment into permission to place the call. Screen national objection registers and internal suppression data before dialing. |
| Recording and transcription | Recording or transcribing is personal-data processing under the GDPR. ePrivacy Article 5 protects communications confidentiality, while national criminal, civil, telecommunications, employment, and evidence laws determine participant recording rules. | Decide the lawful basis, notice, consent where required, purpose, retention, access, processor terms, and security for both audio and text. A quality-assurance recording does not automatically authorize model training or a new analytics purpose. |
| AI disclosure | In the EU, AI Act Article 50 applies from 2 August 2026. Providers of AI systems intended to interact directly with natural persons must design them to inform people that they are interacting with AI unless that is obvious in the circumstances. The information must be clear and provided by the first interaction at the latest. | Treat an outbound AI voice agent as requiring an opening AI disclosure in the EU unless counsel confirms the narrow “obvious” exception. Back-office transcription without direct interaction requires a separate analysis. |
The EU AI Act does not automatically have the same legal effect throughout the wider EEA. The EFTA AI Act status record identifies the regulation as EEA-relevant while incorporation is pending. Confirm local effect in Iceland, Liechtenstein, and Norway before relying on Article 50 as the disclosure rule there.
National rules can be more specific than this regional baseline. Germany, for example, requires prior express consent for consumer telephone advertising under Unfair Competition Act section 7, and section 7a requires covered consent evidence to be retained for five years. That is a German requirement, not an EU-wide retention period.
United Kingdom: UK GDPR and PECR answer different questions
The UK is a separate legal regime. A lawful basis under the UK GDPR does not override the Privacy and Electronic Communications Regulations (PECR).
| Legal gate | Binding baseline | Operational consequence |
|---|---|---|
| Personal-data processing | The current UK GDPR requires a lawful basis, transparency, purpose limitation, minimisation, retention, security, and rights handling. Article 21 gives an absolute objection right for direct marketing. | Document the data source, purpose, basis, legitimate-interest assessment where used, privacy information, retention, vendors, transfers, and objection flow. Keep suppression data so the objection remains effective. |
| Marketing-call permission | PECR regulation 21 restricts unsolicited live direct-marketing calls to numbers registered with the Telephone Preference Service (TPS) or Corporate Telephone Preference Service (CTPS) and to people who have objected, subject to its exceptions. Regulation 19 requires prior consent for recorded matter sent through an automated calling system. Claims-management and pension marketing have stricter rules. | Screen TPS, CTPS, and internal suppression records. Classify the conversational system rather than assuming a novel AI voice falls outside the automated-call rule. Provide the marketer's identity and required contact information. |
| Recording and transcription | The Investigatory Powers Act section 3 prohibits intentional unlawful interception. The Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-keeping Purposes) Regulations 2018, regulation 4, read with regulation 3, authorise specified business monitoring or record-keeping only in defined circumstances, including all reasonable efforts to inform every person who may use the system that communications may be intercepted. They are not a blanket consent substitute for UK GDPR or PECR. | Give an early recording or transcription notice, obtain consent where required, and assess all participant locations. Limit use, access, and retention. Do not describe the UK as a simple one-party-consent jurisdiction. |
| AI disclosure | The cited UK framework does not contain a general equivalent to EU AI Act Article 50. UK GDPR transparency still applies. Article 22A defines a significant decision, and Article 22C requires safeguards for covered significant decisions based solely on automated processing. | Disclose AI identity at the outset as an ethical and risk control. If the system makes or materially supports decisions, document whether the automated-decision safeguards apply and how a person can request human intervention or contest a decision. |
PECR does not set a general nationwide marketing-call window equivalent to the US federal 8 a.m. to 9 p.m. rule. Sector rules can be narrower. Use a time-zone-aware business-hours policy as an operational safeguard, then apply the relevant sector requirement.
Build controls that produce evidence, not just policy documents
A defensible operating model can answer who approved each call and reconstruct what happened. The following controls are operational safeguards. Some implement legal duties in particular markets; others create evidence and reduce ethical risk.
- Map the call before choosing a rule. Record the destination, recipient and number type, sector, purpose, seller, dialing method, voice generation method, and every participant or system location.
- Gate each number by jurisdiction and campaign. Keep machine-enforced allow, deny, and counsel-review states. A missing classification should block the dial rather than fall through to a permissive default.
- Control list intake. Preserve the list source, collection notice, consent language, beneficiary, channel, timestamp, and proof. Quarantine records whose scope does not cover the actual seller, technology, or purpose.
- Unify suppression. Check national and state registers where applicable, plus the seller's internal list. Accept spoken opt-outs and ordinary language such as “do not call me again.” Propagate the request to the CRM, dialer, and vendors before the next dial.
- Enforce local calling windows. Calculate the recipient's local time and apply the narrowest federal, state, national, sector, and internal policy window. Treat uncertain time zones as blocked or manual-review records.
- Version every opening. Keep the company identity, call purpose, AI disclosure, recording or transcription notice, privacy information, and opt-out route appropriate to the destination. Store the script version used for each call.
- Separate recording from reuse. Make recording and real-time transcription independently configurable. Define allowed downstream uses for audio, transcripts, summaries, quality review, profiling, biometrics, and training.
- Make stopping easy. The agent should recognize opt-outs, cease the marketing exchange, confirm the suppression where appropriate, and avoid forcing the person through extra questions. Provide a human route for complaints, uncertainty, and consequential decisions.
- Monitor outcomes. Review complaints, disclosure failures, opt-out latency, suppression misses, wrong-time calls, recording errors, escalation failures, and differences across demographic or language groups.
- Control change. Legal, privacy, security, product, and business owners should approve the policy and material script or model changes. Include prohibited behaviors, incident response, rollback, and scheduled reassessment in the production-readiness checklist.
Keep a per-call evidence ledger
The ledger should make a call decision reproducible without retaining unnecessary conversational data.
| Evidence | Why it matters |
|---|---|
| Lead source and data provenance | Shows where the number and associated personal data came from |
| Destination, recipient, sector, and number classification | Determines which rules and exceptions were applied |
| Consent or other calling basis | Ties exact wording, seller, purpose, channel, proof, and timestamp to the call |
| Registry and internal suppression checks | Shows which lists were screened and when |
| Local-time and calling-window result | Explains why the dial was allowed at that moment |
| Identity, AI, privacy, and recording script versions | Shows what the person was told |
| Recording and transcript policy | Captures whether each was enabled, its purpose, access, and deletion date |
| Opt-out, complaint, and human escalation events | Proves that the system stopped, suppressed, or handed off as designed |
| Policy version and approver | Connects the decision to the rule set in force for that call |
There is no universal retention period for this ledger. Set field-level retention from the applicable law, limitation periods, accountability need, and data-minimization duty. Keep suppression records long enough to prevent another prohibited call while limiting the data to what that function needs.
Ethical voice AI sets a higher bar than minimum compliance
Ethics governs choices that law may permit. The central question is whether the system respects the recipient's autonomy and gives the organization meaningful control over the agent.
Be transparent without using disclosure as a shield
Identify the organization, commercial purpose, and AI nature early. Do not design the voice, pacing, or script to make a person believe the agent is human. A disclosure is only useful when the following conversation matches it.
Protect autonomy and avoid manipulation
The agent should accept refusal immediately. Prohibit manufactured urgency, emotional pressure, repeated rebuttals after a clear no, and claims the system cannot substantiate. Add stricter stop and escalation rules when age, health, distress, financial difficulty, or other vulnerability becomes apparent.
Minimize data and downstream uses
Collect only what the defined task needs. Do not turn every call into a training record by default. Separate sales qualification, quality assurance, analytics, and model improvement as distinct purposes with distinct access and retention rules.
Test fairness and failure behavior
Measure recognition, qualification, escalation, and opt-out performance across accents, languages, speech impairments, noisy lines, and other conditions relevant to the deployment. Averages can hide who bears the errors. Include these cases in a broader voice-agent testing program.
Keep people accountable
Assign named owners for the campaign, data, legal interpretation, scripts, models, vendors, complaints, and incidents. Human escalation should be available when the person asks for it or the system detects uncertainty, vulnerability, a dispute, or a consequential decision. The human route must have enough context to help without making the person repeat sensitive information.
Frequently asked questions
Is AI cold calling illegal in the US?
There is no blanket answer for every call. The FCC treats AI-generated human voices as artificial voices under the TCPA, so calls using them must satisfy the rules for the specific purpose, number, consent, and recipient. The TSR, Do Not Call rules, state laws, recording laws, and sector rules may also apply.
Is AI cold calling legal in the EU?
It can be lawful only when both the data-processing and electronic-marketing rules are satisfied. The GDPR governs the personal data. The ePrivacy Directive requires consent for automated calling without human intervention, while national law controls many other live-call rules. EU AI Act disclosure duties also apply to direct AI interaction.
Does telling someone the caller is AI make the call legal?
No. AI disclosure answers only the transparency question. It does not create permission to process lead data, place the call, ignore a suppression record, call outside an allowed window, or record the conversation.
Is consent always required for an AI marketing call?
Consent requirements depend on the call technology, destination, number and recipient type, purpose, and sector. Some rules allow other bases or contain exceptions. Others require prior consent or a specific written agreement. Record the exact basis used for every number and campaign.
Put the approved policy into production controls
Counsel and privacy owners should define the markets, scripts, evidence, and stop rules first. The implementation then needs testing, traceability, and reliable execution. We help technical teams build and run production voice AI agents through a managed runtime, REST APIs, and a web application. Once your call policy is approved, start evaluating Dasha against those requirements.
