Why 'We Have Their Number' Isn't Consent — And What It Costs

Most contact lists look callable until the moment someone asks where the consent came from — and the answer is "they filled out a form once" or "we've had their number for years." That assumption is where TCPA liability begins, not where it ends.

In February 2024, the FCC's Declaratory Ruling (FCC-24-17) removed any ambiguity about AI calling: AI-generated voices count as artificial voices under the TCPA, so prior express consent is mandatory before any call is placed. The FCC was explicit that the statute "does not allow for any carve out of technologies that purport to provide the equivalent of a live agent." Even without an autodialer, the AI-generated voice itself triggers consent requirements.

The stakes are not theoretical. TCPA statutory damages run $500 per call minimum, up to $1,500 per call, with no cap — meaning a non-compliant 10,000-call campaign carries $5M–$15M in potential exposure, according to legal analysis of AI voice compliance. Recent class settlements confirm the pattern:

• TCPA class actions in 2025–2026 settled in the $5M–$20M range, with filings up 95% year over year and aggregate verdicts exceeding $925 million, per one compliance playbook.
• Gen Digital (Norton/LifeLock) agreed to a $9.95 million settlement in January 2026 for prerecorded calls placed to non-customers.
• QuoteWizard's $19 million settlement remains a reference point for liability when consent cannot be traced through vendor chains.

That last point matters most for anyone outsourcing calls. Vendor chain liability means the entity on whose behalf calls are made bears liability — regardless of which vendor pressed dial. Hiring a platform does not transfer the risk, and some platforms leave verification entirely to you: HighLevel's own documentation states it does not perform platform-level contact consent validation before placing outbound Voice AI calls.

This is why list discipline is a feature, not a formality. My AI Call Center reviews list source and consent records before any campaign launches, flags bought lists without clear permission records, and in most cases declines them outright — telling you plainly if the list will not support the campaign, before you spend anything. Every campaign also delivers opt-out and DNC logs, so revocation failures ("customer says STOP but campaign keeps dialing") — a named enforcement pattern — never happen on your watch.

The takeaway is simple: a phone number is not permission. As one compliance practitioner puts it, "If consent cannot be confirmed, the call does not go out."

A Concrete Example of Consent — The Checkbox That Holds Up

The checkbox on a web form is small, but legally it carries enormous weight. When a consumer ticks that box and clicks submit, they create the documented permission that separates a lawful call from a $500-per-call statutory violation.

Here is a concrete example of valid consent language, quoted verbatim from a TCPA compliance resource:

"By checking this box, you agree that we may call you at the number you entered above with reminders, offers and other info, including possibly using automated technology, text and recorded messages. Consent is not a condition of purchase. Reply STOP to opt out of text messaging. Standard rates apply."

Four elements make this language work. It names the specific business, identifies the exact phone number authorized, states clearly that consent is not required to make a purchase, and — increasingly — references automated or AI-generated voice technology. Per compliance guidance on AI voice calling, all four should appear in any written consent you rely on.

The stakes are real. TCPA statutory damages run $500 per call minimum, up to $1,500 per call with no cap, meaning a non-compliant 10,000-call campaign carries $5M–$15M in potential exposure, according to legal analysis of AI voice compliance.

Not all consent is equal. The law recognizes two levels:

• Prior express consent (PEC) — oral or implied, sufficient for informational calls. It can be implied when a consumer knowingly provides a number in the normal course of business, provided messages closely relate to the original purpose.
• Prior express written consent (PEWC) — a signed disclosure naming the business, required for marketing calls in 47 states.

Since the FCC's February 2024 ruling confirming that AI-generated voices count as "artificial or prerecorded voice" under the TCPA, AI calls sit squarely inside these requirements — even without an autodialer, the AI voice itself triggers the consent obligation.

One nuance matters: consent belongs to the person, not the number. If a number is reassigned to a new subscriber, prior consent is invalidated. And consumers may revoke consent at any time, in any reasonable manner.

A valid consent record must show when consent was obtained, how, and for what — linked to the dialed number and queryable at call time. As compliance infrastructure guidance puts it: "If consent cannot be confirmed, the call does not go out." Records should be retained for four years, matching the federal statute of limitations.

That is why My AI Call Center reviews list source and consent records before any campaign launches, flags bought lists without clear permission records, and delivers opt-out and DNC logs with every campaign. Notably, some platforms take the opposite approach — HighLevel's own documentation states it does not perform platform-level consent validation before placing outbound Voice AI calls. The checkbox only protects you if someone can actually produce it.

How Consent Gets Recorded: When, How, and For What

A consent record that lives only in someone's memory is, legally speaking, no record at all. When a regulator or plaintiff's attorney asks you to prove a contact agreed to be called, the answer has to come from a queryable system — not a promise.

The recording standard is straightforward: consent must exist as an auditable trail showing when it was obtained, how, and for what, linked to the dialed number and retrievable at call time. As Teams Plus puts it, "If consent cannot be confirmed, the call does not go out." The same source recommends retaining records for four years, matching the federal TCPA statute of limitations, including every call attempt with timestamp, number, duration, disposition, and responsible campaign.

Revocation deserves equal attention. Consumers may revoke consent at any time in any reasonable manner, and consent attaches to the called party, not the number — number reassignment invalidates it entirely. One of the most common enforcement patterns is the revocation failure: the customer says STOP but the campaign keeps dialing. Those failures are expensive. TCPA statutory damages run $500 per call minimum, up to $1,500 per call with no cap, and recent class actions have settled in the $5M–$20M range, including a $9.95 million Gen Digital settlement in January 2026 (per TCPA litigation tracking).

A working consent record answers three questions at once:

• When — the date and time the contact agreed, retained for four years
• How — the channel (web form checkbox, oral consent, signed disclosure) and the exact language presented
• For what — the specific business, purpose, and number authorized, queryable at call time and linked to the dialed number

Not every platform meets this bar. HighLevel's own documentation states it does not perform platform-level contact consent validation before placing outbound Voice AI calls — the caller carries that burden alone.

This is why My AI Call Center reviews list source and consent records before any campaign launches, flags bought lists without clear permission records, and delivers opt-out and DNC logs with every campaign. Keyword opt-outs like STOP and REVOKE are logged and honored immediately, so a revocation failure never compounds across a dialing campaign.

The deeper principle comes from Ricardo J. Ordonez, President of Teams Plus: "Compliance at scale requires call logging, consent linkage at call time, real-time DNC scrubbing, and continuous abandonment tracking built into the infrastructure, not a policy document." A policy can say the right things; only infrastructure can prove them — and as one legal analysis observes, the same audit trail that protects a compliant operator convicts a non-compliant one.

How My AI Call Center Checks and Records Consent Before Dialing

A consent record is only worth what you can prove at the moment of the call. Compliance experts describe the standard plainly: consent must be linked to the number being dialed and retrievable at call time, with an auditable log of when consent was obtained, how, and for what — and if consent cannot be confirmed, the call does not go out.

That standard is exactly what My AI Call Center applies before any campaign launches. Step two of the process is a list and consent review: we look at the list source, the consent records behind it, and the calling windows before a single dial happens. Bought lists without clear permission records are flagged, and in most cases declined.

The plain promise behind this is simple: we tell you plainly if the list will not support the campaign, before you spend anything. That matters because the stakes are real. TCPA statutory damages run $500 per call minimum, up to $1,500 per call with no cap, and recent class settlements have landed in the $5M–$20M range, including a $9.95 million Gen Digital settlement for calls placed to people who never consented.

Not every provider works this way. HighLevel's own documentation states that it does not perform platform-level contact consent validation before placing outbound Voice AI calls — the burden falls entirely on the user. A managed service that reviews consent records before launch closes that gap by design.

Once a campaign runs, consent recording continues through the call itself:

• STOP and REVOKE keyword opt-outs are honored immediately, so a recipient's revocation never gets lost mid-campaign — a failure pattern enforcement attorneys name as a top violation risk.
• Opt-out and DNC logs are delivered with every campaign, and DNC requests carry across campaigns into the client's own DNC records.
• AI disclosure plays on every call — recipients can ask whether the call is AI-assisted, request a human, or opt out.
• Every contact comes back with a disposition code, including "opted out," so the audit trail shows what actually happened.

The result is a record that answers the three questions regulators ask: when consent was obtained, how, and for what. As one compliance practitioner puts it, the same audit trail that protects a compliant operator convicts a non-compliant one. Consent that lives in a spreadsheet nobody checks is not consent — it is a liability waiting for a subpoena.

Your Pre-Launch Consent Checklist

Before any campaign dials a single number, a few minutes of consent checking can protect you from the five-figure-per-call exposure that TCPA violations carry. With statutory damages running $500 per call minimum, up to $1,500 per call with no cap, a checklist is cheap insurance.

Verify every record answers three questions. A valid consent log must show when consent was obtained, how, and for what — and it must be linked to the number being dialed and retrievable at call time, according to compliance infrastructure guidance. If a record cannot answer all three, treat the contact as unconsented. Keep records for four years to match the federal statute of limitations.

Match the campaign type to the consent tier. Marketing calls generally require prior express written consent, while informational calls can rest on oral or implied consent, provided the message closely relates to the original purpose, as TCPA consent analysis explains. A reminder call to an existing patient sits differently than a promotional offer to a lead — scope each campaign accordingly.

Confirm revocation handling before launch. One of the most common violation patterns is revocation failure: a customer says STOP but the campaign keeps dialing. Your checklist should confirm keyword opt-outs (STOP, REVOKE) are honored immediately and logged into a DNC record that carries across every campaign.

Your pre-launch checklist should cover:

• Every list entry has a consent record — when, how, and for what — tied to the dialed number
• Campaign type matches the consent tier (informational vs. marketing)
• Opt-out and DNC logging is live, with immediate revocation honored across all campaigns
• State-specific quiet hours and AI disclosure rules are checked (Texas requires AI disclosure within 30 seconds; California, Florida, Colorado, Illinois, and Utah have their own variants)

Remember that consent is tied to the called party, not the number — number reassignment invalidates consent, so re-verify older lists. Requirements also vary by location, industry, contact type, and consent status, so get appropriate legal guidance before launch.

This is exactly why My AI Call Center runs a list and consent review before any campaign launches — and tells you plainly if a list will not support the campaign, before you spend anything. The first campaign review is free, consent check included.

Plan your campaign today — managed outbound calling for approved, permissioned lists, from 9¢ per connected minute.