The Gaps: What TCPA Actually Leaves Out

Most people assume the TCPA blocks every unwanted call and text. It doesn't. The statute's reach is narrower than its reputation, and knowing exactly where it stops matters whether you're a consumer trying to stop calls or a business trying to stay on the right side of them.

Here are the genuine gaps.

Live human calls without an autodialer or prerecorded voice. The TCPA's core restrictions target calls made with an autodialer, artificial voice, or prerecorded message. A person dialing a phone and speaking live, with no automated equipment involved, generally falls outside those consent requirements. That said, live telemarketing isn't a free-for-all: the FTC's Telemarketing Sales Rule covers calling hours (8 a.m. to 9 p.m. local time), abandoned calls, and recordkeeping, according to call center compliance guidance.

Federal DNC protections favor landlines. In Lowrey v. Twilio Inc. et al., Judge Norman K. Moon held that Section 227(c)'s do-not-call protections apply to residential landlines, not cellular phones. That ruling significantly limits federal DNC claims for calls placed to cellphones, as reported by coverage of the court's holding.

Texts aren't "telephone calls" for the private right of action. The same ruling found that text messages don't count as telephone calls under Section 227(c)(5), which eliminates that particular private lawsuit pathway for texts to cellphones. Federal caller-ID and opt-out regulations also don't provide a private cause of action.

Offshore call centers aren't regulated yet. The FCC's March 2026 proposal on offshore call centers, covering English proficiency, caps, and disclosure, is just that: a proposal. Current TCPA rules don't restrict where a call center sits or require disclosure of offshore handling.

Two recent rule changes also reshape the picture. The FCC's one-to-one consent rule, which would have required consent to be given one seller at a time, was struck down by the Eleventh Circuit and formally removed in July 2025. And the broad revocation rule that would let a single opt-out stop all robocalls and robotexts from the same sender has been delayed to January 31, 2027.

One caution before you treat these gaps as loopholes: AI-generated voices do not escape the TCPA. A 2024 FCC declaratory ruling confirmed that AI-generated human voices count as "artificial or prerecorded voice" calls, and courts have rejected the idea that technology providers avoid liability by splitting the calling process between them.

That's why we treat the gaps as irrelevant to our own practice. My AI Call Center runs AI-powered campaigns, so we operate as if every restriction applies: consent records checked before launch, AI disclosure on every call, STOP and REVOKE keyword opt-outs honored immediately, and opt-out and DNC logs delivered with every campaign report. The statute's boundaries are narrowing where it counts, and building to the strictest standard is the only approach that holds up.

The Trap: Why the Gaps Are Narrower Than They Look

Here's the part most people miss: the gaps in TCPA coverage are real, but they're narrower than they look, and they close fast when AI is involved.

The biggest trap is assuming an AI voice call counts as a "live" call. It doesn't. Under a 2024 FCC declaratory ruling, AI-generated voices are treated as "artificial or prerecorded voice" under the TCPA. That means conversational AI calls, even ones that respond in real time and sound fully human, need prior express consent before they dial. The fact that the voice is generated on the fly rather than recorded in advance changes nothing.

The courts have closed another escape hatch too. In the Twilio and OpenAI litigation, the defendants argued that because they split the traditional functions of a telemarketer between them, neither should face TCPA liability. Judge Norman K. Moon rejected that outright: "Telemeters cannot insulate themselves from TCPA liability by dividing a solicitation into a two-step process." Providers working in concert with callers can be treated as having "made and initiated" the calls. If you're running AI campaigns through a third party, you can't contract your way out of exposure.

The financial stakes make this concrete. TCPA statutory damages run $500 to $1,500 per violation, and plaintiffs don't need to prove any actual injury to collect, per legal analysis from BCLP. A few hundred non-consented calls can turn into a six-figure problem fast.

What about the calls that genuinely sit outside TCPA's core rules? Live human telemarketing without autodialers or prerecorded voice is one of them. But "outside TCPA" rarely means "unregulated," because the FTC's Telemarketing Sales Rule governs live telemarketing as a separate regime:

• Calling hours limited to 8 a.m. to 9 p.m. local time
• Abandoned call rules: a sales rep must connect within two seconds of a completed greeting
• Recordkeeping requirements, including five-year retention for certain DNC records

So a campaign that dodges TCPA consent rules by using live agents still has to clear the TSR. And revocation rules keep tightening: opt-out requests must be honored within ten business days, and opt-out records should be retained for at least four years to match the TCPA statute of limitations.

This is exactly why list discipline matters more than clever legal positioning. My AI Call Center reviews list source and consent records before any campaign launches, declines bought lists without clear permission records, and logs every opt-out, because the burden of proving valid consent falls on the caller, not the consumer. Structured campaigns with one clear goal, run against permissioned lists, keep you on the right side of both regimes. Outside TCPA doesn't mean outside the rules.

How to Call Safely Inside the Gray Areas

Knowing where TCPA stops helping you is only half the picture. The other half is knowing how to operate in the gaps without drifting into a $500 to $1,500 per-violation statutory claim, which consumers can bring without proving any actual injury under 47 USC § 227(b)(3).

Start by assuming your AI voice is covered. Even where TCPA's reach is otherwise narrow, a 2024 FCC declaratory ruling confirmed that AI-generated voices count as "artificial or prerecorded voice." Real-time conversational AI doesn't escape scrutiny just because it isn't a traditional robocall, and courts have rejected the argument that splitting the telemarketer role between a technology provider and a caller insulates either party. Treat every AI-assisted call as requiring prior express consent, and disclose the AI on every call.

Document consent before you need it. The burden of proving valid consent falls on the caller, and it's the business's job to demonstrate why an opt-out request wasn't reasonable. This is why list discipline matters more than list size. My AI Call Center reviews list source and consent records before any campaign launches, and declines bought lists that lack clear permission records, because a list you can't document is a list that can't defend you in court.

Once someone opts out, the clock starts. The rules are specific:

• Honor revocation within ten business days of receiving the request.
• Recognize the FCC's opt-out keywords: STOP, QUIT, END, REVOKE, OPT-OUT, CANCEL, and UNSUBSCRIBE.
• Retain opt-out and DNC logs for at least four years, which matches the TCPA statute of limitations.

There's also a distinction most callers miss. An opt-out from a marketing message stops marketing only, so you may keep sending informational messages. But an opt-out from an informational message stops all future non-emergency contact. If your scripts blur the line between a reminder and a pitch, one "STOP" can shut down your entire relationship with that contact.

Structure helps here. Campaigns built around one clear goal, like confirming an appointment or qualifying a lead, keep each message clearly informational or clearly transactional, which makes the opt-out scope predictable. A post-revocation clarification text, if you send one, must go out within five minutes and can't contain marketing content.

Finally, don't build your program around rules that no longer exist. The FCC's one-to-one consent rule was formally removed in July 2025 after the Eleventh Circuit struck it down, and the broad cross-channel revocation rule is delayed to January 31, 2027, per current regulatory tracking. The safest posture is simple: assume coverage where it's ambiguous, prove consent where it's required, and log everything for four years.

How My AI Call Center Works Within These Limits

The rules only protect you if your process respects them. That's the gap between knowing what TCPA covers and actually running compliant calls, and it's where most campaigns get into trouble. At My AI Call Center, the compliance playbook isn't a policy binder. It's built into how every campaign launches.

The stakes are real. TCPA statutory damages run $500 to $1,500 per violation, and a caller bears the burden of demonstrating valid consent, according to compliance guidance from America's Credit Unions. With AI-generated voices now treated as artificial or prerecorded voice under a 2024 FCC declaratory ruling, an AI calling service can't lean on any exemption. So the list comes first.

Every campaign runs against approved, permissioned, or reviewed lists only. Before anything launches, the list source and consent records get checked. Bought lists without clear permission records get flagged, and in most cases they're declined. You hear it plainly if the list won't support the campaign, before you spend anything. That pre-launch review exists because proving consent after the fact is expensive; proving it before the first call costs nothing.

The disclosure and opt-out mechanics follow the same logic. Here's what happens on every campaign:

• AI disclosure on every call. Recipients can ask if the call is AI-assisted, request a human, or opt out.
• Keyword opt-outs like STOP and REVOKE are honored immediately. These mirror the revocation keywords the FCC recognizes, including STOP, REVOKE, and OPT-OUT, per BCLP's analysis of the TCPA opt-out rules.
• DNC requests are carried into your DNC records and respected across all campaigns, not just the one where the request came in.
• Opt-out and DNC logs ship with every campaign's outcome report, so you keep the documentation the statute of limitations expects. BCLP recommends retaining opt-out records at least four years.

The campaign structure helps too. Because an opt-out responding to an informational message stops all future non-emergency communications, while a marketing opt-out only stops marketing, each campaign is scoped around one clear goal. A reminder campaign reminds. A qualification campaign qualifies. That separation keeps the informational-versus-marketing boundary clean, which matters when it's the business's burden to explain why an opt-out request was handled a certain way.

One honest caveat: requirements vary by location, industry, contact type, consent status, and technology, and they shift as rules change. The one-to-one consent rule was removed in July 2025 after the Eleventh Circuit struck it down, and the broad revocation rule has been delayed to January 31, 2027. You should get appropriate legal guidance before launch. We handle the calling discipline; your attorney handles the legal judgment for your situation.

If you're planning a campaign and want the list and consent review done before you commit, you can plan a campaign with My AI Call Center. The first campaign review is free, and the full price is known before you approve launch.