Why Loyalty Enrollment Calls Are Riskier Than They Look

A loyalty enrollment call to a customer who has shopped with you for years feels harmless. Under federal law, it may be one of the riskiest calls your business can make.

The core issue is that AI-generated voices count as "artificial voices" under the Telephone Consumer Protection Act. In its February 2024 Declaratory Ruling (FCC-24-17), the FCC confirmed that TCPA restrictions apply to AI technologies that generate human voices, and that these calls require prior express consent from the called party. The statute, as legal analysts note, "does not allow for any carve out of technologies that purport to provide the equivalent of a live agent."

Then there is the marketing question. Loyalty enrollment calls encourage customers to join a program tied to future purchases, which places them squarely in marketing territory. Regulators assess a call's purpose, not its opening sentence, and any call whose purpose includes encouraging purchase of goods or services qualifies as marketing even if no transaction happens on the call. That means prior express written consent, not just a phone number collected at checkout.

The most expensive trap is the established business relationship exemption. Many operators assume a long customer history covers them. It does not for AI calls. The EBR rule exempts only the DNC Registry restriction — a live agent can dial a 16-month-old customer on the DNC list under EBR, but an AI agent cannot call that same person without separate consent. Compliance analysts call this the single most expensive misunderstanding in the AI outbound playbook, because the artificial voice itself triggers the consent obligation.

The financial stakes compound quickly:

• Statutory damages run $500 to $1,500 per call, with no aggregate cap.
• TCPA class-action filings are up 95% year over year, with aggregate verdicts exceeding $925 million.
• Liability follows the entity on whose behalf calls are made — outsourcing to a vendor does not shift the risk downstream.
• Automation can make violations worse, since calling numbers that should have been removed multiplies the volume of each mistake.

This is why list discipline matters before a single call dials. At My AI Call Center, every Loyalty Program Enrollment campaign starts with a list and consent review — checking the list source, consent records, and calling windows before launch. Bought lists without clear permission records get flagged, and in most cases declined, before a client spends anything.

The lesson for any business running AI enrollment calls: treat them like regulated telemarketing. Get proper written consent, scrub against the DNC Registry at least every 31 days, honor opt-outs within 10 business days, and document everything for at least the four-year statute of limitations.

The Five Compliance Rules That Protect Loyalty Campaigns

A single misstep in a loyalty enrollment campaign can cost $500 to $1,500 per call in statutory damages — and TCPA class-action filings are up 95% year over year, with aggregate verdicts exceeding $925 million. The good news is that the rules are knowable. Five of them cover nearly all of the exposure.

Rule 1: Verify written consent before dialing — and assess purpose, not script. Loyalty enrollment calls that encourage purchases are marketing calls, and regulators assess the call's purpose rather than its opening sentence, according to legal analysis of the FCC's consent framework. That means an "account check-in" that pivots to enrollment is marketing, requiring prior express written consent in 47 states. This is why My AI Call Center reviews list source and consent records before any loyalty campaign launches, and declines bought lists without clear permission records.

Rule 2: Scrub against the National DNC Registry every 31 days. Callers must check their lists against the registry at least every 31 days, and automation makes violations worse, not better — compliance guidance warns that automated systems dialing stale lists multiply the violation volume.

Rule 3: Disclose AI within the first 30 seconds. The FCC's February 2024 Declaratory Ruling confirmed AI-generated voices are "artificial voices" under the TCPA, and Texas SB 140 requires disclosure within the first 30 seconds. A simple opening — "This is an AI assistant calling from [Company] on a recorded line" — satisfies most jurisdictions.

Rule 4: Honor opt-outs within 10 business days — ideally instantly. Per updated FCC guidance, consumers may revoke consent in any reasonable manner, including words like stop, quit, or revoke. Real-time opt-out capture across all campaigns is the best practice, and DNC requests should carry into permanent suppression records.

Rule 5: Retain consent records for at least four years. The TCPA statute of limitations runs four years, though defense counsel recommend seven. Because liability follows the entity on whose behalf calls are made — not the vendor — documentation is your only real defense.

State rules add a second layer:

• Florida requires written consent that explicitly references AI for marketing calls.
• Texas, Louisiana, and Mississippi accept oral consent for artificial-voice calls under the Fifth Circuit's Bradford ruling; the other 47 states still require written consent.
• Roughly half of states impose their own calling-time and recording-consent rules on top of federal requirements.

As one attorney put it: "Prior express written consent is king: Get it. Document it. Store it." Campaign requirements vary by location, industry, and consent status, so obtain legal guidance before launch — but these five rules are the operating system every compliant loyalty campaign runs on.

Why Outsourcing Doesn't Outsource Your Risk

Handing your loyalty enrollment calls to an outside calling partner might feel like handing off the compliance risk too. It isn't. The entity on whose behalf the calls are made stays on the hook — and the case law proves it.

In the Lamb v. Mortgage One Funding class action, the proposed class definition reaches every consumer called by the company "or from any of the company's vendors, lead generators, or agents." As one legal analysis of the case puts it bluntly: "If you are buying AI calling from a third party and assuming the third party owns the compliance risk, Lamb is the case that proves you wrong."

The financial stakes explain why. TCPA statutory damages run $500 to $1,500 per call, with no aggregate cap, and TCPA class-action filings are up 95% year over year, with aggregate verdicts exceeding $925 million. Recent settlements — $9.95 million from Gen Digital, $19 million from QuoteWizard — show how quickly a flawed list turns into a nine-figure category of risk.

Outsourcing the work is fine. Outsourcing the accountability is impossible. What a responsible partner does instead is build the controls that protect both parties before a single call goes out. That is exactly how My AI Call Center approaches loyalty enrollment campaigns: list source and consent records are reviewed before launch, scripts and opt-out handling require client approval, and nothing runs until it's signed off.

A pre-launch review process should cover:

• Consent verification — confirming written permission exists for AI-placed calls, since the FCC's February 2024 ruling requires prior express consent for artificial voices
• DNC scrubbing discipline — lists checked against the National DNC Registry at least every 31 days
• Approved scripts with AI disclosure and a clear escalation path to a human
• Opt-out and DNC logs — capture in real time, honoring requests within the FCC's 10-business-day window at minimum

Here is where list discipline matters most: a bought list with no clear permission records isn't a bargain — it's a liability with a phone number attached. As attorney Marc Jacobs warns, "One misstep — a missing opt-out, a failure to disclose voice synthesis, a bad number — risks sparking a lawsuit with statutory damages of $500 to $1,500 per violation."

That's why lists lacking documented consent get flagged — and in most cases declined — before any spend. Telling a client plainly that a list won't support the campaign is cheaper than telling them later why it triggered one.

Running a Compliant Loyalty Enrollment Campaign: Step by Step

A compliant loyalty enrollment campaign is not built on launch day — it is built before the first call is ever dialed. With TCPA statutory damages of $500 to $1,500 per call and no aggregate cap, the pre-launch checklist is where the risk actually gets managed.

The process starts with a consent record review. Because the FCC's February 2024 Declaratory Ruling treats AI-generated voices as "artificial voices" under the TCPA, requiring prior express consent, every loyalty enrollment list must show documented permission before it can support a campaign. This is where the established business relationship trap matters most: EBR exempts only the DNC Registry restriction, not the AI consent requirement. A live agent may call a 16-month-old customer on the DNC list — an AI agent cannot.

Next comes the calling window and quiet-hours check. Roughly half of states maintain their own calling-time and holiday rules, so calls are scheduled only inside approved windows that respect both federal and state-specific quiet-hours requirements.

Then the script and disclosure approval. Every call opens with AI disclosure, satisfying jurisdictions like Texas, which requires AI disclosure within the first 30 seconds. At My AI Call Center, nothing launches until the client approves the script, disclosure language, opt-out handling, and escalation path.

Once live, opt-out handling runs in real time. Keyword opt-outs — STOP and REVOKE — are logged and honored immediately, well inside the FCC's requirement that revocation requests be honored no later than 10 business days. DNC requests are carried across all campaigns and into client DNC records, and lists are scrubbed against the National DNC Registry at least every 31 days.

After the campaign closes, the deliverables arrive as documentation, not just results:

• A dispositioned contact list with named outcome codes and per-call notes
• Opt-out and DNC logs showing every suppression request and when it was honored
• A completion and coverage report showing what actually happened — no invented numbers

That documentation matters because liability follows the entity on whose behalf the calls are made. As legal commentators put it, prior express written consent is king — get it, document it, store it, and retain records for at least the four-year TCPA statute of limitations.

One final note: campaign requirements vary by location, industry, contact type, consent status, and technology. Before launching any loyalty enrollment campaign, clients should obtain appropriate legal guidance to confirm their specific compliance obligations.