The Short Answer: Cold Calls Are Legal — Until They Break a Rule

Cold calling isn't illegal — but plenty of individual cold calls are. That distinction is worth millions of dollars to the companies that get it wrong, and it's the difference between a productive outbound program and a class-action settlement.

Under U.S. federal law, two frameworks govern outbound calling: the FTC's Telemarketing Sales Rule and the FCC's Telephone Consumer Protection Act. FTC guidance makes clear the TSR regulates telemarketing rather than prohibiting it, setting rules for disclosures, Caller ID, and calling hours. The TCPA works the same way — it restricts how calls are made, not whether they can be made at all.

Calls and campaigns become illegal when they break specific rules:

• National Do Not Call Registry violations — dialing numbers on the Registry without an applicable exemption, or failing to scrub your list at least every 31 days.
• Calling outside permitted hours — any call before 8 a.m. or after 9 p.m. local time violates the TSR.
• Consent failures — using autodialers, prerecorded voices, or AI-generated voices without required consent. Since the FCC's February 2024 Declaratory Ruling, AI voices count as artificial voices no matter how human they sound.

The stakes explain why compliance gets so much attention. TCPA violations carry statutory damages of $500 to $1,500 per call, with no aggregate cap, according to legal analyses of robocall claims. Recent class settlements reflect that math: industry tracking cites Hy Cite Enterprises at $4.75 million, Gen Digital at $9.95 million, and QuoteWizard at $19 million. TCPA class-action filings are also up 95% year over year.

As former Florida Assistant Attorney General Andrew Cove puts it, there's no "first call is free" rule for AI outreach — the first non-compliant call can be a violation. His advice is straightforward: get proper consent, maintain clean lists, respect opt-outs, and document everything.

That's the same logic behind how My AI Call Center runs campaigns — list source and consent records are reviewed before anything launches, and bought lists without clear permission records are flagged or declined. The law doesn't punish cold calling itself; it punishes calling without the records, windows, and consent to back it up.

The Rules That Turn a Legal Call Into an Illegal One

The difference between a legal sales call and an illegal one comes down to a handful of specific requirements — and missing any one of them can cost $500 to $1,500 per call. Under the FTC's Telemarketing Sales Rule and the TCPA, cold calling itself is legal. The violations happen when callers ignore the conditions attached to it.

Start with the Do Not Call Registry. Telemarketers must scrub their lists against it at least every 31 days. When someone asks not to be called again, that request must be honored within 10 business days — and the do-not-call record must be kept for five years.

Calling hours are just as strict. No calls before 8 a.m. or after 9 p.m. local time, per TCPA guidance. Some states add their own quiet hours and day restrictions on top of the federal baseline.

Then there are the exemptions — and they are narrower than most businesses assume:

• An established business relationship allows a live agent to call a past customer even if that customer is on the DNC list.
• Written permission to call exempts the caller from DNC restrictions.
• Most business-to-business calls fall outside TSR coverage entirely.

Here's the trap that catches clinics, franchises, and membership businesses every year: the EBR exemption covers the human, not the technology. Because the FCC's February 2024 ruling classifies AI-generated voices as "artificial voices" under the TCPA, an AI agent cannot legally call a DNC-listed past customer without separate consent — even though a live agent could. One legal analysis calls this "the single most expensive misunderstanding in the AI outbound playbook." The FCC was explicit that the statute "does not allow for any carve out of technologies that purport to provide the equivalent of a live agent."

Finally, understand what does not count as permission. A "warm list" has no legal meaning. Co-registration consents naming "and our partners" draw skepticism in court. And skip-traced or third-party numbers do not constitute consent at all — the caller is still liable if the subscriber never agreed to be contacted.

This is why list discipline sits at the front of every campaign we run at My AI Call Center. List source and consent records are reviewed before launch, and bought lists without clear permission records are flagged — and in most cases declined. We would rather tell you plainly that a list will not support the campaign than let the first call become the violation.

Why AI Voices Changed Everything: The FCC's 2024 Ruling

The FCC's February 8, 2024 Declaratory Ruling rewrote the compliance landscape overnight. The agency classified AI-generated voices as "artificial or prerecorded voice" under the TCPA, triggering consent requirements no matter how human the voice sounds — the statute "does not allow for any carve out of technologies that purport to provide the equivalent of a live agent." For non-emergency calls, that means prior express consent for residential lines and prior express written consent for marketing calls to wireless numbers, effective immediately.

This ruling closed the loophole many operators hoped existed. A law firm analysis put it plainly: "the law doesn't care how advanced the technology is. If it's not a live human making the call, it falls into a regulated category." The stakes are concrete — TCPA violations carry statutory damages of $500–$1,500 per call with no aggregate cap, and recent class settlements have ranged from $4.75M to $19M.

State legislatures moved quickly to layer on their own rules. Texas SB 140 (effective September 2024) requires AI disclosure within 30 seconds of call connection. California AB 489 and SB 1001 impose their own disclosure mandates. Florida requires written consent that explicitly references AI. Colorado, Illinois, and Utah have enacted variants. Federally, an August 2024 NPRM proposes mandatory in-call AI disclosure, but it is not yet final.

Carrier-level blocking adds a practical enforcement layer most teams overlook. Under a 2019 FCC Declaratory Ruling, carriers may block calls by default based on "reasonable analytics" — large call bursts, low call duration, sequential dialing, DNC registry correlation, and complaint volume. Non-compliant dialing patterns often never reach the intended recipient.

Wrong-number calls create a distinct liability tier. The TCPA requires consent from "the user of or subscriber to the cell phone" — not the intended recipient. Number reassignment means a call placed in good faith to a previously consenting contact can still violate the law if the number has been recycled.

• FCC ruling: AI voices = artificial voices under the TCPA (Feb 8, 2024)
• Marketing calls to cell phones require prior express written consent
• Texas SB 140 mandates AI disclosure within 30 seconds
• Carrier analytics can block calls before they connect
• Wrong-number liability attaches to the current subscriber, not the intended recipient

My AI Call Center builds these requirements into every campaign — AI disclosure on every call, keyword opt-outs (STOP and REVOKE) honored immediately, and consent records reviewed before any list is dialed. Campaigns run only against approved, permissioned, or reviewed contact lists with documented consent, and outcomes route back to your CRM with full disposition codes and opt-out logs. Clients are responsible for obtaining appropriate legal guidance before launch; campaign requirements vary by location, industry, contact type, consent status, and technology.

Who Actually Pays: Brand Liability Extends to Vendors and Agents

Hiring a calling vendor does not move TCPA liability off your books. The brand on whose behalf the calls are made can be held responsible even when a third party did the dialing.

That principle is now playing out in court. The class action Lamb v. Mortgage One Funding, filed February 24, 2026 in the Eastern District of Michigan, proposes to cover calls made "or from any of the company's vendors, lead generators, or agents." In other words, the company whose product was being pitched bears exposure regardless of which vendor picked up the phone. As one industry analysis put it, "If you are buying AI calling from a third party and assuming the third party owns the compliance risk, Lamb is the case that proves you wrong."

The financial stakes make this more than a technicality. TCPA statutory damages run $500 to $1,500 per illegal call with no aggregate cap, and recent class settlements have landed between $4.75 million and $19 million. Meanwhile, TCPA class-action filings are up 95% year over year. A single campaign run against a bad list can generate thousands of violations in a matter of days.

This is why the compliance conversation should happen before launch, not after the first complaint. When evaluating any calling partner — AI or human — the questions that matter are the ones a vendor cannot outsource back to you:

• Where did the list come from, and can consent be documented for every number on it?
• Does the vendor scrub against the National Do Not Call Registry at least every 31 days?
• Are opt-out and DNC requests logged, honored immediately, and carried into your own DNC records?
• Is the AI voice disclosed on every call, with a clear path to a human or an opt-out?
• Will the vendor decline a campaign when the list will not legally support it?

That last point deserves emphasis. A vendor that runs whatever list you hand it is not protecting you — it is handing you the liability with a dialer attached. This is the reason My AI Call Center reviews list source and consent records before any campaign launches, flags bought lists without clear permission records, and in most cases declines them. The review happens before you spend anything, because a campaign that cannot run compliantly has no value at any price.

None of this replaces your own judgment. Campaign requirements vary by location, industry, contact type, consent status, and technology, and clients are responsible for obtaining appropriate legal guidance before launch. But the structure of the engagement matters: a managed, compliance-reviewed process keeps the brand and the vendor working from the same rulebook, instead of each assuming the other one absorbed the risk.

How to Run Legal Outbound Campaigns: A Consent-First Checklist

Running a legal outbound campaign starts with list discipline. Before any dialing begins, verify the list source and consent records — bought lists without clear permission records are a liability, not an asset. The FCC's February 2024 Declaratory Ruling classified AI-generated voices as "artificial" under the TCPA, triggering consent requirements regardless of how human the voice sounds. Re-consent before AI outreach wherever records are unclear; "warm cold list" has no legal meaning, and co-registration consents face court skepticism. Honor opt-outs immediately — internal opt-out requests must be honored within 10 business days under updated FCC guidance, and do-not-call requests must be respected for five years. Disclose AI on every call; states including Texas, California, and Florida already require it. Keep records: the TCPA statute of limitations is four years, and many defense counsel recommend retaining records for seven.

• Verify list source and consent records before dialing
• Re-consent before AI outreach where records are unclear
• Honor opt-outs immediately with STOP/REVOKE keyword handling
• Disclose AI on every call
• Retain records for at least seven years

My AI Call Center builds these steps into every pre-launch review — checking list source and consent records, enforcing AI disclosure on every call, logging and honoring opt-outs in real time, and declining campaigns against bought lists without permission records. Only approved, permissioned, or reviewed lists move forward. Campaign requirements vary by location, industry, contact type, consent status, and technology; clients are responsible for obtaining appropriate legal guidance before launch.