The Ownership Question Nobody Answered — Until Lawsuits Forced It

When a vendor runs your calls, who owns the conversation that just happened? Not the phone number, not the script — the recording, the transcript, the insights about your customer. And more urgently: can that vendor turn around and use your customers' voices to train their own models?

The courts are now forcing an answer. A proposed class action filed in the Northern District of California alleges that Google's Cloud Contact Center AI analyzes customer service calls in real time without alerting callers, and that Google can use that conversation data to "train or fine-tune" its other AI models (Bloomberg Law). These remain allegations, not adjudicated findings — but the theory behind them should worry every business using AI calling.

The Galanter v. Cresta Intelligence suit, filed in June 2025, goes further. Plaintiffs target the vendor's mere capability to reuse call data for its own purposes, regardless of whether it actually does so (Fisher Phillips). The damages sought are striking: $5,000 per call under two California provisions, with a class that could reach tens of thousands of residents. And critically, businesses that deployed the technology can be dragged in under an "aiding and abetting" theory.

The same litigation is testing whether the old "this call may be monitored for quality purposes" notice still holds up when third-party AI is on the line. Privacy attorneys now advise businesses to take specific contractual steps before signing with any AI vendor:

• Require written confirmation that call data will not be reused for unrelated model training, analytics, or commercialization.
• Disclose third-party AI access explicitly — generic monitoring notices may no longer be legally adequate.
• Verify consent records with timestamps before any campaign launches.
• Document opt-out and do-not-call handling across every campaign.

Here is the part most businesses miss: outsourcing the calls never outsources the liability. The FTC is explicit that the obligation to safeguard personal information stays with your business — it even names "contractors operating your call center" as a security risk you must inventory (FTC business guidance). As the FTC puts it plainly: "if you collect and retain data, you must protect it."

This is why data-reuse terms belong in the contract, not the marketing page. At My AI Call Center, call data is never shared or sold and is never used to train shared models — a commitment checked alongside list source and consent records before any campaign launches. If a vendor cannot say the same in writing, ask why.

Want a managed calling service that treats your data as yours? Plan your first campaign — the review is free, and calling starts at 9¢ per connected minute against approved, permissioned lists only.

What the Rules Actually Say: Consent, Disclosure, and Who's Responsible

The rules governing AI calling are no longer ambiguous — in 2024, regulators drew bright lines around consent, disclosure, and accountability. Here's what they actually say, in plain terms.

AI voices are "artificial voices" under federal law. In its February 2024 Declaratory Ruling (FCC-24-17), the FCC confirmed that the TCPA applies to AI technologies that generate human voices. That means every AI-generated outbound call requires the prior express consent of the person being called — no exceptions for "helpful" calls like reminders or surveys.

The financial stakes are real. TCPA violations carry penalties of $500 to $1,500 per call, with no cap on total damages. A single non-compliant campaign of a few thousand calls can generate seven-figure exposure, which is why consent records matter more than call volume.

Hiring a vendor doesn't transfer your responsibility. The FTC is explicit: companies may hire contractors to handle personal information, but the obligation to safeguard that data remains with the business — and the agency specifically names "contractors operating your call center" as a risk vector you must account for. If your AI calling vendor mishandles data, regulators come to you.

This is exactly why My AI Call Center reviews list source and consent records before any campaign launches, and declines bought lists without clear permission records. The legal duty sits with the client, so the vendor's job is to make meeting that duty easy and documented.

Disclosure rules are tightening too. Generic "this call may be monitored for quality purposes" notices are now being legally tested as inadequate when third-party AI tools are involved. In Galanter v. Cresta Intelligence, plaintiffs are seeking $5,000 per call under California law — a case that could reach tens of thousands of class members. A separate lawsuit alleges Google's contact center AI analyzed customer calls without alerting them and could reuse conversation data to train its models.

The practical compliance baseline that emerges from these rules:

• Prior express consent documented before any AI-voice call, with timestamps and the disclosure language used
• Explicit AI disclosure on every call — not a generic monitoring notice — with a path to a human and immediate opt-out
• Opt-out requests honored within 10 business days, with DNC records carried across campaigns
• Contracts that prohibit the vendor from reusing call data for model training, analytics, or commercialization

For healthcare organizations, there's a fourth layer. HIPAA obligations follow the data into AI systems, regardless of who operates them. According to HIPAA Journal's analysis, training AI on protected health information likely requires valid patient authorization, because model training may not qualify as treatment, payment, or healthcare operations. HHS has also proposed the first major HIPAA Security Rule update in 20 years, with stricter expectations for AI systems processing PHI.

As compliance attorneys at DarrowEverett put it, TCPA compliance works best as an integral part of AI strategy, not an afterthought. The rules reward businesses that treat consent, disclosure, and vendor contracts as design requirements — and punish those that bolt them on later.

The Five Contractual Protections That Define Real Data Ownership

How to Put It Into Practice: A Pre-Launch Data Ownership Audit

Before you launch any AI-driven calling campaign, a short, structured audit can save months of remediation. The FCC confirmed that AI-generated voices are "artificial voices" under the TCPA, requiring prior express consent for every call (FCC Declaratory Ruling FCC-24-17). Meanwhile, the FTC makes clear that the obligation to safeguard personal information stays with your business even when a contractor operates the call center (FTC business guidance). My AI Call Center builds this audit into every pre-launch review so nothing ships until the records, contracts, and scripts align.

• Inventory every contact list and its consent records — bought lists without documented permission are declined before they reach a dialer.
• Read the vendor contract for data-reuse language; Fisher Phillips attorneys recommend requiring explicit confirmation that call data will not be reused for model training, analytics, or commercialization (Cresta Intelligence litigation analysis).
• Confirm the call script includes AI disclosure, opt-out keywords (STOP, REVOKE), and a path to reach a human — generic "quality monitoring" notices are being tested as legally inadequate when third-party AI is involved (Fisher Phillips).
• Verify where outcomes, recordings, and DNC logs live and how they route back to your CRM; opt-out requests must be honored within 10 business days (TCPA compliance guidance).
• For clinics, confirm HIPAA-compliant handling before any PHI touches a campaign — training AI on PHI likely requires valid patient authorization since it may not qualify as treatment, payment, or operations (HIPAA Journal).

Requirements vary by location, industry, contact type, consent status, and technology; clients are responsible for obtaining appropriate legal guidance before launch. A disciplined audit turns those variables into a checklist you can clear this week.

Ownership You Can Verify: What Documentation Should Look Like

The difference between a vendor who claims compliance and one who proves it shows up in the paperwork. When the FTC says the obligation to safeguard personal information stays with the business even when contractors operate the call center, the only way to meet that obligation is with records you can actually hand to a regulator. Federal guidance names call-center contractors as a recognized risk vector businesses must inventory — so the documentation has to be complete before the first dial.

• Dispositioned contact lists with outcome codes for every record — confirmed, qualified, renewed, opted out, no answer
• Opt-out and DNC logs updated in real time and carried into your master suppression file
• Consent records checked and documented before any campaign launches
• A named outcome report per campaign — no invented numbers, just what actually happened

The FCC's February 2024 Declaratory Ruling confirmed that AI-generated voices are "artificial or prerecorded voice" under the TCPA, requiring prior express consent — and that consent must be verifiable. Courts are now testing whether generic "this call may be monitored" notices are adequate when third-party AI is involved. A named outcome report with per-call notes, routed follow-ups, and completion coverage gives you the evidence that disclosure happened, consent was valid, and opt-outs were honored within the required window.

My AI Call Center delivers exactly that package: dispositioned lists, opt-out/DNC logs, consent verification before launch, and a campaign report with real counts — not projections. The right vendor doesn't remove your legal responsibility; it gives you the records to meet it. If you want to see what that looks like for your list and goal, start with a free campaign review — we scope the objective, the list, and the consent status before any money is spent.