The Jurisdictional Split: Why Spam Legality Depends on Where Your Recipient Lives

The same email that is perfectly legal in Texas can be illegal in Toronto—and the difference isn't the content. It's the recipient's mailbox.

The United States operates under an opt-out model. The CAN-SPAM Act lets businesses email first and remove people who unsubscribe, provided they honor requests within 10 business days, per the FTC's compliance guide. Most of the world disagrees. GDPR in the EU, Canada's CASL, and laws in Australia, Brazil, Japan, and New Zealand all require consent before the first message, according to comparisons of global email laws.

The critical rule: the law follows the recipient, not the sender. A U.S. business emailing someone in Germany must meet GDPR's consent standard for that contact. This is why "it's legal where I am" is a dangerous assumption—your compliance obligations shift with every recipient's location.

The penalties make the stakes concrete:

• CAN-SPAM: up to $53,088 per violating email, a figure updated in January 2025
• GDPR: up to €20 million or 4% of global annual revenue
• CASL: up to $10 million CAD for organizations, $1 million for individuals
• CCPA/CPRA: $7,998 per intentional violation, per consumer

Enforcement is not theoretical. Verkada paid $2.95 million—the largest CAN-SPAM settlement in FTC history—for sending 30 million emails over three years with no opt-out and no physical address, per enforcement reporting. France's Orange was fined €50 million under GDPR for ads blended into inboxes. Experian paid $650,000 simply because its unsubscribe flow broke during a platform migration.

Voice outreach adds another layer. The FCC has ruled that AI-generated voices count as "artificial or prerecorded voice" under the TCPA, making such calls illegal without prior express consent. A Fifth Circuit decision later allowed consent to be inferred from conduct, but only in Louisiana, Mississippi, and Texas—evidence that even federal rules vary by where your recipient sits.

This jurisdictional patchwork is exactly why My AI Call Center reviews list source and consent records before any campaign launches, and declines bought lists lacking clear permission documentation. In opt-in jurisdictions especially, a list without a paper trail isn't a shortcut—it's a liability.

If you're planning outbound campaigns across regions, get your lists reviewed first. Plan a compliant campaign with My AI Call Center—managed outbound calling on approved, permissioned lists, from 9¢ per connected minute.

AI Voice Calls and the TCPA: Why Prior Express Consent Is Non-Negotiable

The FCC has drawn a clear line: AI-generated voices are "artificial or prerecorded" under the TCPA, and that classification makes prior express consent non-negotiable for every outbound call. The agency confirmed this in a declaratory ruling that treats AI voice robocalls as illegal without consent, putting them on the same legal footing as traditional prerecorded messages. For businesses running voice outreach, that means the consent standard is not optional — it is the gate every campaign must pass before a single dial is placed.

The FCC's confirmation that AI voices fall under the TCPA's restrictions aligns with enforcement reality: penalties for violations can reach up to $53,088 per call under CAN-SPAM-adjacent frameworks, and the FCC has made clear that AI-generated voice robocalls are illegal without prior express consent. Yet a Fifth Circuit ruling in 2026 introduced a jurisdictional wrinkle, holding that express consent may be given orally or inferred from conduct — such as providing a cellphone number and engaging with calls — without written documentation. That interpretation applies only in Louisiana, Mississippi, and Texas, and does not override stricter standards in other circuits or state laws.

• Prior express consent required for every AI voice call, regardless of jurisdiction
• Consent records must include timestamp, source, and exact opt-in language
• Opt-out keywords (STOP, REVOKE) honored immediately and synced to client DNC lists
• AI disclosure on every call — recipients can ask if the call is AI-assisted, request a human, or opt out
• No bought lists without clear permission records; flagged and declined in most cases

My AI Call Center builds every campaign around this consent-first discipline. Before launch, each list is reviewed for source, consent records, and calling windows — approved, permissioned, or reviewed contacts only. Bought lists without verifiable permission are flagged and typically declined. Opt-outs are logged and honored instantly, not within the 10-business-day CAN-SPAM window or the 15-day CCPA/CPRA window, but immediately. That standard eliminates the jurisdictional guesswork and keeps voice outreach on the right side of the TCPA, the FCC, and the courts.

How My AI Call Center Verifies Consent Before Every Campaign Launch

Before any campaign goes live, the list must pass a structured consent review — no exceptions. My AI Call Center checks the source of every contact, the timestamped opt-in records, the exact language used at signup, and the applicable calling windows for each jurisdiction. This process aligns with regulatory requirements that the law follows the recipient, not the sender, meaning a U.S. caller reaching someone in Germany must meet GDPR standards for that contact. Bought lists without clear, documented permission are flagged and, in most cases, declined before a single dollar is spent.

• List source and acquisition method verified against consent requirements
• Timestamped opt-in records with source URL and exact consent language reviewed
• Calling windows mapped to state, provincial, and national quiet-hour rules
• AI disclosure and opt-out handling (STOP, REVOKE) built into every script
• DNC requests synced immediately across all campaigns and client records

The FCC has confirmed that AI-generated voices fall under the TCPA's definition of "artificial or prerecorded voice," requiring prior express consent before any outbound call using such technology. This means consent verification is not optional — it is a legal prerequisite. Penalties for non-compliance are steep: up to $53,088 per violating email under CAN-SPAM and up to €20 million or 4% of global revenue under GDPR. Even in jurisdictions where oral consent may suffice for TCPA-covered calls, such as the Fifth Circuit's recent ruling, My AI Call Center maintains a higher standard by requiring documented, reviewable consent records for every contact.

Opt-out requests are honored immediately — not within the 10 business days CAN-SPAM allows, and not within the 15 days CCPA/CPRA permits. This exceeds regulatory minimums and reduces risk, especially given enforcement actions like the Verkada settlement, where the FTC secured $2.95 million for sending 30 million emails with no opt-out mechanism and no physical address. Every campaign launches only after the list, the script, the disclosure, and the escalation path are approved. Nothing ships until the consent evidence is verified.