The Autodialer Confusion That Creates Real Exposure

Most teams guess wrong about autodialer status, and the guess is expensive. The TCPA's autodialer definition was written in 1991 for a technology landscape that looks nothing like today's, as the Congressional Research Service notes, and courts spent a decade disagreeing about what it covers.

The statute itself is narrow. An autodialer, formally an "automatic telephone dialing system," is equipment with the capacity to store or produce numbers using a random or sequential number generator, and to dial them. That's it. Before 2021, though, federal circuits were split six ways: the Third, Seventh, and Eleventh Circuits read the definition narrowly, while the Second, Sixth, and Ninth read it broadly, as Wiley's analysis of the litigation explains. The Supreme Court resolved the split in Facebook v. Duguid on April 1, 2021, holding unanimously that a device qualifies only if it uses a random or sequential number generator.

Here's where teams get tripped up:

• Volume isn't the test. The FCC's June 2020 ruling confirmed that calling a large volume of numbers is "not probative" of autodialer status, per Hinshaw's summary.
• Equipment that merely stores and dials a prescribed list, like a CRM contact list, falls outside the definition after *Duguid*.
• The "capacity" question remains circuit-split, so edge cases still carry legal uncertainty.

The dangerous assumption is that "not an autodialer" means "not exposed." It doesn't. AI-generated voices are treated as artificial or prerecorded voices under the TCPA, which triggers consent requirements independently of autodialer status, as Henson Legal's guidance puts it plainly. The FCC's 2024 declaratory ruling placed voice cloning squarely within TCPA scope, requiring prior express written consent. A wrong guess on classification doesn't end your liability; it just changes which provision the plaintiff cites.

The stakes explain why this matters. TCPA statutory damages run $500 to $1,500 per call with no cap, meaning a non-compliant 10,000-call campaign carries up to $15 million in exposure. Even where alleged harm is minimal, each unlawful call, text, or fax can generate a damages claim, which is why TCPA litigation has been described as a cottage industry.

That's why classification questions can't be answered casually. My AI Call Center treats list and consent review as the front-line control: list source and consent records are checked before any campaign launches, and bought lists without clear permission records are flagged, and in most cases declined. Prior express consent remains a defense even when an autodialer is used, so consent documentation matters more than any label you put on your dialing equipment.

The Legal Test: Random or Sequential Number Generators Only

Before 2021, whether your dialing platform counted as an autodialer depended on which federal circuit you were standing in. Six circuits disagreed, and the answer could swing a $500-per-call liability question either way.

That ended on April 1, 2021, when the Supreme Court decided Facebook, Inc. v. Duguid unanimously, 9-0. The Court read the TCPA's definition of an automatic telephone dialing system literally: equipment qualifies as an autodialer only if it has the capacity to store or produce telephone numbers using a random or sequential number generator.

The key move was applying the series-qualifier canon. That's the rule of interpretation holding that a modifier at the end of a list of parallel verbs applies to the whole series, not just the last one. So "using a random or sequential number generator" modifies both "store" and "produce." Justice Sotomayor's opinion put it plainly: the Court must interpret what Congress wrote, and expanding the definition beyond that "would take a chainsaw to these nuanced problems when Congress meant to use a scalpel."

The practical result: equipment that merely stores and dials a prescribed set of numbers, like a CRM contact list, falls outside the autodialer definition entirely. The Court also rejected the idea of a "human intervention" line-drawing test, noting that every device requires some human involvement and declining to say how much automation is too much.

Volume doesn't change the analysis either. In its June 25, 2020 Declaratory Ruling, the FCC clarified that making calls or texts to a large volume of numbers is not probative of autodialer status, according to analysis of the ruling. The test is whether the equipment can dial random or sequential numbers without human intervention, not how many calls it makes.

That distinction matters for anyone running structured outbound campaigns. Calling 5,000 permissioned contacts from a reviewed list is not, by itself, autodialer behavior. Calling randomly generated numbers is. This is why list discipline, checking list source and consent records before launch, and running campaigns only against approved, permissioned, or reviewed contact lists, is the front-line compliance control, and why a managed service like My AI Call Center builds that review into every campaign before anything dials.

One caution before you relax: narrowing the autodialer definition narrows one path to TCPA liability, not all of them. The "capacity" question remains split across circuits, and the FCC has historically read the definition to include predictive dialers, a position the Supreme Court did not endorse. And as the next consideration shows, AI-generated voices create consent obligations that exist completely independent of how the numbers were dialed.

Why AI-Generated Voices Trigger Consent Anyway

Even if your dialing equipment sails safely outside the autodialer definition after Facebook v. Duguid, an AI voice on the other end of the line changes the math entirely. The consent obligation attaches to the voice itself, not the dialer.

That's the practical effect of the FCC's 2024 declaratory rulings. In early 2024, the FCC confirmed that AI-generated voices count as "artificial or prerecorded voice" under the TCPA, which means prior express consent is required even when the dialer isn't technically an ATDS. A related ruling emphasized that voice cloning technologies fall squarely within the TCPA's scope and require prior express written consent for marketing calls, per legal analysis of the March 2024 FCC action. How natural the voice sounds doesn't matter. Courts are entertaining arguments that cloned and synthetic voices trigger liability regardless.

The stakes are real. TCPA statutory damages run $500 to $1,500 per violation with no cap, so a non-compliant 10,000-call campaign can create $5M to $15M in statutory exposure. And an established business relationship won't save you here: EBR may exempt manual calls from Do-Not-Call rules, but it does not exempt AI voice calls from consent requirements.

Most enforcement actions share a handful of failure points:

• Missing or late AI disclosure, when the call doesn't identify itself as AI-assisted
• Revocation failures, where STOP requests aren't honored promptly
• Consent gaps on transfers, when a call is handed off to a seller the consumer never agreed to hear from

The opt-out mechanics matter too. An automated interactive opt-out must be delivered within two seconds of the initial message, activatable by voice command or key press. This is why operators like My AI Call Center treat disclosure, keyword opt-outs, and consent-record review as campaign prerequisites rather than afterthoughts.

Two open questions keep lawyers busy. First, the FCC has historically read the autodialer definition to include predictive dialers, reasoning that random or sequential number generation may be obsolete, while the Supreme Court declined to extend the definition beyond number generators, per Congressional Research Service analysis. Whether the FCC's predictive-dialer position survives Duguid remains unresolved. Second, circuits still split on what "capacity" means: some courts look at a device's capabilities at the time of the call, others at its functions. A September 2024 FCC proposal to formally define AI-generated calls could bring clarity, but a final rule may not arrive until 2026.

Until then, the safe posture is simple: assume the AI voice triggers consent, document where that consent came from, and honor revocations the moment they arrive.

Building a Defensible Calling Operation

Knowing what the law actually requires turns compliance from a guessing game into a checklist you can run before launch.

The practical exposure isn't autodialer status. It's consent. Even when equipment falls outside the ATDS definition after Facebook v. Duguid, AI-generated voices independently trigger TCPA consent requirements, and statutory damages run $500 to $1,500 per call with no cap. A 10,000-call campaign that misses on consent can mean $5M to $15M in exposure before any settlement discussions begin.

That's why the operational commitments matter more than the legal label.

Five non-negotiables before any campaign goes live:

• List and consent review first. Source, permission records, and calling windows get checked before dial. Bought lists without clear consent documentation get flagged, and in most cases declined.
• AI disclosure on every call. Recipients can ask whether the call is AI-assisted, request a human, or opt out. The disclosure isn't a script line, it's a workflow.
• Keyword opt-outs honored immediately. STOP and REVOKE trigger removal across all active and future campaigns, not just the one in progress.
• 31-day DNC scrub cadence. Lists get checked against the National DNC Registry at least every 31 days, per FCC timing requirements.
• 2-second opt-out delivery. Automated interactive opt-out mechanisms activate within two seconds of the initial message, by voice command or key press.

These aren't aspirational. They're the operational commitments that turn a "TCPA-compliant" claim into something you can actually defend.

My AI Call Center runs structured outbound campaigns against approved, permissioned, or reviewed lists only, and the process bakes these commitments into launch: campaign review, list and consent check, script and escalation approval, then launch and monitor. Nothing dials until the list holds up and the disclosure is approved.

One important caveat: campaign requirements vary by location, industry, contact type, consent status, and technology. The right move for any specific situation is to get legal guidance before launch, not after the first complaint lands.