The Hidden Risk of AI Voice Calls Under TCPA

The FCC's February 2024 Declaratory Ruling changed everything for outbound AI calls. The agency confirmed that AI-generated voices are "artificial or prerecorded voice" under the TCPA, which means the Established Business Relationship exemption no longer applies — consent is required regardless of how long you've known the contact or how human the voice sounds.

This ruling creates a two-tier consent framework that catches many organizations off guard. Prior Express Written Consent (PEWC) is mandatory for marketing calls to wireless numbers nationwide and prerecorded calls to residential landlines, while Prior Express Consent (PEC) covers informational calls like appointment reminders or fraud alerts. The distinction matters because TCPA statutory damages range from $500 to $1,500 per call with no aggregate cap, turning even modest campaigns into multi-million dollar exposure.

Recent settlements illustrate the stakes. Gen Digital (Norton/LifeLock) agreed to a $9.95 million settlement in January 2026 for prerecorded calls to non-customers. Hy Cite Enterprises (Royal Prestige) settled for $4.75 million in early 2026, with class members eligible for $600–$1,000 each. QuoteWizard's $19 million settlement became a reference point for vendor-chain liability failures.

• AI voice classification triggers consent requirements even without an autodialer
• EBR exemption is eliminated for artificial voices under the TCPA
• Vendor-chain liability extends to the hiring organization regardless of which vendor placed the call
• State variations exist — Texas, Louisiana, and Mississippi allow oral consent for marketing calls post-Bradford ruling

The compliance burden doesn't stop at federal law. Texas SB 140 requires AI disclosure within the first 30 seconds of calls, with similar laws in California, Florida, Colorado, Illinois, and Utah. The FCC's one-to-one consent rule, effective January 27, 2025, demands seller-specific consent documentation — though the Eleventh Circuit has vacated this rule, creating ongoing uncertainty. Legal experts note that "the compliance posture you set in mid-2025 is probably already wrong somewhere in your stack."

My AI Call Center addresses this by reviewing list source and consent records before any campaign launches, flagging bought lists without clear permission records, and declining campaigns where consent cannot be verified. Opt-outs are logged and honored immediately across all campaigns, and AI disclosure occurs on every call. The managed service model means consent verification isn't a checkbox — it's a prerequisite for launch.

Building a Defensible Consent Verification Framework

Knowing which tier of consent you need is one thing; building a framework that survives a subpoena is another. The difference between a defensible campaign and a class-action target comes down to what you documented at the point of capture — and whether it holds up years later.

Under the TCPA, consent splits into two categories, and confusing them is expensive. Prior Express Written Consent (PEWC) is required for marketing AI calls to wireless numbers nationwide and prerecorded calls to residential landlines, while Prior Express Consent (PEC) suffices for informational and transactional calls like appointment reminders or fraud alerts, according to compliance guidance for voice AI outbound.

The critical trap: an established business relationship does not exempt AI calls. As legal analysis of AI voice compliance makes clear, the artificial voice itself triggers the consent requirement regardless of prior relationship. A reminder call to an existing patient and a sales call to the same person sit in entirely different legal categories.

Effective January 27, 2025, the FCC implemented a stricter PEWC standard requiring consent to be obtained "a single seller at a time," eliminating the ability to share or resell consumer consent across multiple parties, with clear and conspicuous disclosure required, per the FCC's official FAQ on the one-to-one consent rule. Legal analysis from Nelson Mullins notes the rule also demands a logical, topical association between the consent and the message content.

Note that the rule's status remains contested — ActiveProspect's consent management research reports the Eleventh Circuit vacated it in early 2025. The safest posture is to comply as if it stands.

State law adds another layer. Following the Fifth Circuit's Bradford v. Sovereign Pest Control ruling, industry compliance tracking notes that oral consent may suffice for marketing AI calls in Texas, Louisiana, and Mississippi — while the other 47 states still require written consent. This is why My AI Call Center reviews list source and consent records against the specific jurisdictions a campaign will touch before launch.

A defensible framework captures evidence the moment consent is given. Consent documentation best practices describe time-stamped records as "your legal safety net," including full disclosure context, date/time, IP address or device, and capture method.

Practical steps include:

• Pair every lead form with two unchecked consent checkboxes — one for transactional PEC, one for marketing PEWC — with no pre-checked boxes or bundled permissions.
• Name the specific seller in the consent language, per the one-to-one rule, and never share consent records across entities.
• Retain consent evidence for at least seven years, exceeding the TCPA's four-year statute of limitations, as defense counsel recommends.
• Log capture method and jurisdiction, since oral consent carries different weight in Texas, Louisiana, and Mississippi than elsewhere.

Consent language must be explicit and unambiguous — stating who is collecting data, who will contact, how, and why. Vague or generic permission text is where most defensible frameworks quietly fail.

Operationalizing Compliance in AI Calling Campaigns

Operationalizing compliance in AI calling campaigns requires precise execution of real-time disclosures, opt-out handling, consent evidence retention, and vendor liability controls—all embedded in My AI Call Center’s list review and campaign launch process. The FCC’s February 2024 ruling treats AI-generated voices as artificial or prerecorded under the TCPA, triggering prior express consent requirements regardless of existing business relationships. This means even informational calls need documented consent, and marketing calls demand prior express written consent (PEWC) in 47 states, with oral consent sufficient only in Texas, Louisiana, and Mississippi post-Bradford ruling.

To operationalize compliance, My AI Call Center implements real-time AI disclosure within the first 30 seconds of every call, aligning with Texas SB 140 and similar state laws requiring upfront identification of AI use. Systems are programmed to recognize and honor opt-out requests via any reasonable method—such as verbal “stop” or keypad inputs—within the required timeframe, which ranges from as little as 2 seconds under some interpretations to 10 business days under current FCC guidance. Consent evidence, including timestamps, capture method, and disclosure context, is retained for a minimum of seven years to exceed the TCPA’s four-year statute of limitations and defense counsel recommendations, protecting against class-action exposure.

Vendor chain liability is managed through rigorous list and consent review during campaign setup, ensuring that consent documentation is seller-specific and not shared across entities, as required by the FCC’s one-to-one consent rule effective January 27, 2025. This prevents liability under precedents like Lamb v. Mortgage One Funding, which holds organizations responsible for calls placed by their vendors or agents. By integrating these controls into every campaign launch—from list validation to outcome routing—My AI Call Center ensures compliance is not an afterthought but a foundational layer of operational discipline.

TCPA statutory damages range from $500–$1,500 per call with no aggregate cap, meaning even modest campaigns face multi-million dollar risk if consent verification fails. Opt-outs must be honored within 2 seconds to 10 business days depending on jurisdiction, and consent evidence should be retained for seven years to withstand legal scrutiny. These operational safeguards transform compliance from a checkbox into a measurable, auditable process that protects both clients and recipients.

Organizations using My AI Call Center benefit from this structured approach: list source and consent records are verified before any call is placed, ensuring only approved, permissioned, or reviewed contacts are dialed. This disciplined workflow supports campaign types ranging from appointment reminders to win-back calls while maintaining adherence to evolving AI voice regulations. By embedding consent verification into the pre-launch checklist, My AI Call Center helps clients run more useful calls without amplifying compliance risk.