Understanding TCPA Consent Requirements for AI and Robocalls

The FCC's February 2024 Declaratory Ruling settled a critical question: AI-generated voices are treated as "artificial voices" under the TCPA, triggering prior express consent requirements regardless of how human they sound. The statute "does not allow for any carve out of technologies that purport to provide the equivalent of a live agent," so even the most natural-sounding AI falls under the same rules as prerecorded messages. For marketing calls, that means Prior Express Written Consent (PEWC) in 47 states; for informational or transactional calls, Prior Express Consent (PEC) suffices, which can be oral or satisfied by voluntarily providing a phone number.

• Marketing AI calls require PEWC in 47 states; oral consent is valid only in Texas, Louisiana, and Mississippi after the Bradford v. Sovereign Pest Control ruling
• Informational AI calls require PEC, which can be oral or implied from a voluntarily provided number
• Established Business Relationship (EBR) exempts manual calls from DNC Registry restrictions but does not exempt AI calls from consent requirements

The Bradford decision created a narrow carve-out where oral consent satisfies TCPA for artificial-voice calls in Texas, Louisiana, and Mississippi, but this does not change requirements in the other 47 states. Organizations running multi-state campaigns must apply the most restrictive applicable rule for each dialed number based on the called party's state. A common misconception is that an Established Business Relationship covers AI outreach; it does not. The artificial voice itself triggers the consent requirement, so EBR provides no safe harbor for AI-initiated calls.

Statutory damages range from $500 to $1,500 per violation with no aggregate cap, and class actions routinely exceed $10 million in settlements. TCPA class-action filings increased 95% year over year in 2025–2026, with aggregate verdicts exceeding $925 million. Vendor liability is also clear: the entity on whose behalf calls are made bears liability regardless of which vendor dials. At My AI Call Center, we review list source, consent records, and calling windows before any campaign launches, and we honor opt-outs and DNC requests across all campaigns immediately.

Honoring Opt-Outs and Managing Revocation Under the 2025 TCPA Opt-Out Rule

A single ignored opt-out can cost $500 to $1,500 in statutory damages — and courts treat "willful" to include reckless disregard, meaning continuing to call after an opt-out request is treated much like a deliberate violation. That is why the FCC's new Opt-Out Rule, effective April 11, 2025, deserves close attention from any organization that runs outbound calling.

The rule fundamentally changes how consumers can revoke consent. Under the FCC's revocation framework, consumers may now revoke consent in "any reasonable manner" — not just by texting STOP or following a prescribed opt-out mechanism. If a customer says "stop calling me" mid-conversation, that counts.

Businesses must honor revocation requests within 10 business days, a significant reduction from the previous 30-day window, according to compliance guidance on outbound operations. The clock starts the moment the request is received, regardless of channel.

The rule does allow one narrow exception: a clarification message. As legal analysis from BCLP explains, this message must be sent within five minutes of the revocation request, may only be sent once, and cannot contain any marketing content. The consumer must affirmatively respond to avoid further contact.

Tracking requirements have also grown more granular. Organizations must now record opt-outs by both communication type and channel:

• Communication type — marketing versus informational, since revoking consent for one does not automatically revoke it for the other.
• Channel — whether the opt-out arrived by call, text, email, or in writing, with discontinuation requirements varying by message type.
• Timestamp and exact language of the request, to demonstrate timely compliance.
• Suppression across all systems, so opted-out contacts are never re-imported through a stale CRM sync.

Documentation matters as much as speed. Opt-out records should be retained for at least four years, matching the TCPA's statute of limitations — and defense counsel recommend seven years for consent documentation. Suppression list failures, not bad consent language, drive most enterprise TCPA exposure, so records must be airtight.

This is why managed services like My AI Call Center log opt-outs immediately and carry DNC requests across all campaigns into client records. Whether you run calls in-house or through a partner, remember that courts have held the entity on whose behalf calls are made bears the liability — you cannot outsource it.

With TCPA class-action filings up 95% year over year and aggregate verdicts exceeding $925 million, revocation handling is no longer a back-office detail. It is a core requirement of any compliant calling program.

Building State-Specific Compliance and Data Hygiene Protocols

Federal TCPA compliance is only half the battle. Once your calls cross state lines, you inherit a patchwork of state-level rules that can turn a compliant campaign into a liability overnight.

The safest operating principle is simple: apply the most restrictive applicable rule for each dialed number based on the called party's state. According to compliance guidance from WFM Labs, several states tighten the federal 8:00 AM–9:00 PM calling window — Florida and Washington cut off calls at 8:00 PM, while Oklahoma caps contact at three calls per number in any 24-hour period.

Consent standards vary too. A TCPA compliance analysis notes that the Fifth Circuit's Bradford v. Sovereign Pest Control ruling allows oral consent to satisfy TCPA requirements for artificial-voice calls in Texas, Louisiana, and Mississippi — but the other 47 states still demand Prior Express Written Consent for marketing calls. Penalties escalate sharply at the state level: Connecticut can impose up to $20,000 per violation, far above the federal $500–$1,500 range.

The practical takeaway: build your calling windows, consent tiers, and disclosure scripts around state rules, not just the federal baseline. That is why services like My AI Call Center review list source, consent records, and calling windows before any campaign launches — state-specific quiet hours and day restrictions get baked into the campaign plan, not discovered after a complaint.

But state rules are not the biggest risk. Data hygiene is.

Expert analysis from Bland.ai is blunt: most enterprise TCPA exposure comes from data hygiene failures — stale suppression lists, incomplete CRM syncs, re-imported opted-out contacts — not bad consent language. And courts treat "willful" violations to include reckless disregard, meaning a suppression list you forgot to scrub is legally indistinguishable from deliberate misconduct.

The failure modes to guard against:

• Stale suppression lists that never get refreshed against your current opt-out records
• Incomplete CRM syncs where opt-outs logged in one system never reach the dialer
• Re-imported opted-out contacts that silently re-enter an active campaign list
• Suppression lists left unscrubbed after a contact flags them — which courts cite in willful findings

The scale of exposure makes this worth engineering properly. WFM Labs' compliance wiki estimates that 100,000 calls with a systemic consent deficiency could produce $50–150 million in statutory damages. A broken suppression list turns every dialed number into a potential class member.

Build your protocols accordingly: scrub against the National DNC Registry every 31 days, sync opt-outs across every connected system in real time, and log every DNC request with a timestamp. Whether you run calls in-house or through a managed partner, the discipline is the same — the list has to be as clean at call 10,000 as it was at call one.