Call-bot.ai

Voice AI agents for business14 min read

AI Outbound Calling: How It Works, TCPA and GDPR Compliance, and Cost

AI outbound calling means a voice agent dials a contact list and holds the conversation. The legal question comes first: since the FCC's February 2024 ruling, an AI voice counts as an artificial voice under the TCPA, so U.S. calls generally need the called party's prior express consent, in writing for telemarketing. In the EU, consent rules and national law decide.

A woman in a denim jacket speaking on her phone at an office desk, with an open notebook and a laptop in front of her

Photo: Vitaly Gariev · Pexels

Standing up an outbound AI voice campaign is now a configuration task: the platforms document how to upload a contact list, pick a number, set a calling window and let an agent work through the list. Whether you may place those calls is a separate question, and the platform does not answer it. Consent records, calling rules and, in some places, a duty to disclose the AI do.

This guide covers how a campaign runs, which uses fit, what U.S. and European rules said on October 21, 2026, and where outbound calling adds cost. It is information, not legal advice: have a lawyer review your consent flow and scripts before you dial. For the technology itself, start with what an AI voice agent is.

How an outbound AI voice agent campaign works

Vapi splits a campaign into four parts: the agent that holds each conversation, the phone number, the contacts and the schedule. Retell, ElevenLabs and Bland describe a CSV upload with per-contact variables.

  1. Lead list and consent. Each row needs a consent record behind it: who agreed to what, when and how. None of the platform documentation we read says the platform itself checks these records.
  2. Pre-dial check. Vapi documents a webhook, called just before dialing, that can confirm "current consent, suppression status, account state, time zone" and skip a contact by returning eligible: false.
  3. Dialing. Calls leave from a number you own or imported; Vapi's free numbers cannot place outbound calls. STIR/SHAKEN, the framework that digitally signs calls, appears in Vapi's docs with three attestation levels. Carriers may mark a number "Spam Likely," which Retell's documentation says lowers pickup rates and can lead to a ban; it offers verified numbers and branded calls as fixes.
  4. Conversation. The agent follows a prompt or flow personalized with each row's variables and must recognize voicemail. Retell runs detection for the first three minutes after connection; Vapi's comparison table lists "Prone to false positives" as the weakness of its legacy Twilio option.
  5. Handoff. Vapi documents blind and warm transfers to a human; Retell lists warm transfer among its call-center features.
  6. Logging. Vapi shows each contact as pending, dispatched, completed, failed, skipped or pre-dial failed, with transcript, recording and analysis for dialed calls. Compliance needs a second log: for telemarketing, the FTC's Telemarketing Sales Rule requires sellers and telemarketers to keep call records and a complete record of each consent the rule requires for five years.

Test opt-out handling and voicemail behavior before launch (how we approach evaluation).

Use cases that fit, and ones that do not

The purpose of a call, not the technology, sets the consent standard. The FCC defines telemarketing as a call made "for the purpose of encouraging the purchase or rental of, or investment in, property, goods, or services" (47 CFR 64.1200(f)(13)).

Fit, with consent in place

  • Appointment reminders to people who gave you their number for that purpose. These are informational calls, which need prior express consent absent an exemption.
  • Qualifying leads who opted in. This is usually telemarketing, so the consent they gave should be written and cover calls from you with an artificial voice.
  • Payment reminders on your own invoices. Debt collectors face extra limits: Regulation F presumes a violation above seven calls in seven days per debt, or on any call within seven days after a conversation about that debt.
  • Surveys with no sales pitch, which the FTC says the Do Not Call Registry does not block. An AI voice calling a cell phone still needs consent.

Do not fit

  • Cold calls to consumers with no consent. The FCC's 2024 ruling rules out an AI exemption.
  • Purchased lead lists. Written consent must authorize the seller that is calling, which a list assembled by someone else rarely proves.
  • Calls that need judgment, such as complaints or bad news. Use a handoff.

United States: what the TCPA and the FCC require

The Telephone Consumer Protection Act (47 U.S.C. § 227) restricts calls made with "an artificial or prerecorded voice." In its Declaratory Ruling FCC 24-17, adopted February 2 and released February 8, 2024, the FCC "confirm[ed]" that these restrictions "encompass current AI technologies that generate human voices," so such calls "require the prior express consent of the called party" absent an emergency or exemption. A footnote adds that telemarketing calls need prior express written consent, and the ruling rejects any carve-out for technologies that "purport to provide the equivalent of a live agent."

Under the current rule text (47 CFR 64.1200, up to date as of October 19, 2026), a campaign must handle these points:

  • Written consent: a signed agreement, electronic signature allowed, naming the phone number and disclosing that the person authorizes telemarketing calls "using an automatic telephone dialing system or an artificial or prerecorded voice," and that signing is not a condition of purchase. Because the FCC treats an AI voice as an artificial voice, we read this as a reason to say so in your form; that is our reading, not FCC text.
  • Revocation: by "any reasonable method," honored within ten business days at most, with no exclusive opt-out channel allowed. On September 30, 2026 the FCC adopted Report and Order FCC 26-67, which will let callers designate an exclusive way to revoke consent (an automated opt-out on the call, standardized reply words to a text, or a website or phone number they name) if they clearly disclose it. It takes effect 30 days after publication in the Federal Register; as of October 22, 2026 we found no publication. Until then, an agent should treat "stop calling me" mid-call as a request.
  • Identification: state the business's registered name at the start, give a callback number, and, for telemarketing or for calls made under the residential-line exemptions, offer an automated opt-out within two seconds. The ruling applies these duties to AI calls.
  • Do Not Call: the registry covers personal numbers, home or cell, not business numbers, and businesses must update their telemarketing lists within 31 days, per the FTC; telemarketers also keep an internal list.
  • Hours: sales calls to residential subscribers are limited to 8 a.m. to 9 p.m. at the called party's location under that rule, which does not cover calls made with the person's prior express invitation or permission or within an established business relationship, and under the FTC's Telemarketing Sales Rule, which allows calls at other times only with the person's prior consent. Vapi's docs warn against inferring local time from an area code.
  • Caller ID: telemarketers must transmit it and not block it, with a number that accepts do-not-call requests. STIR/SHAKEN duties fall on voice service providers.
  • Exposure: for calls that break the artificial-voice and autodialer rules, private plaintiffs can recover $500 per violation or actual monetary loss, whichever is greater; for do-not-call violations, up to $500 per violation, once the person has received more than one such call from the same entity within 12 months. In both cases, courts may raise the award to up to three times for willful or knowing violations.

United States: what is still unsettled

One-to-one consent is gone. In December 2023 the FCC adopted a rule requiring written consent to name "no more than one identified seller" (Federal Register, Jan. 26, 2024). The Eleventh Circuit vacated that part before it took effect; its mandate issued April 30, 2025, and an FCC order of July 14, 2025 restored the previous wording, effective August 29, 2025. Consent must still authorize the seller that is calling.

We found no adopted federal AI-disclosure rule. In August 2024 the FCC proposed to define "AI-generated call" and to require callers to disclose at the start of each call that it "is using AI-generated technology." As of October 21, 2026 we found no order adopting it: no Federal Register final rule carries the proceeding's title, and the FCC's docket (23-362) holds the 2023 inquiry, the 2024 ruling and proposal and a comment-date order, with no rules order and a latest filing dated October 13, 2026. That is not permission to hide the AI.

Courts need not follow the FCC. In McLaughlin Chiropractic v. McKesson (June 20, 2025), the Supreme Court held that district courts may "independently" assess an agency's reading of a statute, giving it "appropriate respect." On our reading, the same applies to the FCC's AI ruling: it does not bind judges in private suits, who decide what the statute means. The Court did not rule on the AI ruling; the case concerned an FCC order on faxes. In Bradford v. Sovereign Pest Control (February 25, 2026), the Fifth Circuit wrote that "contrary to the FCC's regulation, Congress permits either written or oral consent for any auto-dialed or pre-recorded call." That is one circuit's decision; the FCC rule remains in the regulations, and state laws can still require writing.

States add their own rules. We read two. California's Public Utilities Code § 2874, amended effective January 1, 2025, requires calls placed with an "automatic dialing-announcing device" to start with a natural-voice announcement and to tell the person "if the prerecorded message uses an artificial voice," defined as one "generated or significantly altered using artificial intelligence." Whether a live conversational agent counts as such a device is not settled in the sources we read. Florida's Telephone Solicitation Act requires "prior express written consent" for unsolicited sales calls using an automated dialing system or a recorded message, with $500 or actual damages per violation.

Europe: GDPR, ePrivacy and the AI Act

ePrivacy Directive 2002/58/EC, Article 13(1), allows "automated calling and communication systems without human intervention" for direct marketing "only in respect of subscribers or users who have given their prior consent." An AI agent talking with no human on the line sits close to that wording; we found no official text ruling on language-model agents, so plan for opt-in. For other marketing calls, Article 13(3) lets each Member State choose opt-in or opt-out, and Article 13(5) leaves protection of subscribers other than natural persons, such as businesses, to Member States.

The GDPR applies in parallel: a phone number, a voice and a recording are personal data, so you need a lawful basis under Article 6(1), consent or legitimate interests, and Recital 47 says direct marketing "may be regarded as carried out for a legitimate interest." Article 21(2) to (4) gives a right to object to direct marketing at any time, which must be brought to the person's attention "at the latest at the time of the first communication." The agent must explain and honor that right.

AI Act Article 50(1), applicable since August 2, 2026, requires AI systems "intended to interact directly with natural persons" to inform them of it unless that is obvious. The duty sits with providers: the platform vendor, or you if you build the agent in-house or modify one and put it into service under your own name. The Commission's non-binding guidelines, whose content the Commission approved on July 20, 2026 (formal adoption was to follow once all language versions were available), list AI-enabled voice assistants as in scope and give a spoken "This is an AI-powered assistant" at the start as an example for telephony. The July 2026 Digital Omnibus did not change paragraph 1.

National rules differ: since August 11, 2026, the CNIL says consumers in France can no longer be phoned for marketing without prior consent (page in French), with exceptions such as calls about a current contract.

What outbound calling adds to the bill

Price pages mostly describe running a call; outbound adds lines inbound does not. On pages read October 21, 2026, Retell lists $0.005 per dial for batch calls and $0.10 per outbound call for branded caller ID, and says it bills only connected calls; Bland lists a $0.015 minimum per outbound attempt on its telephony and bills voicemail as standard call time; Dialzara sells outbound by contact ($750 a month for 1,500 contacts on its Outbound Starter plan). For telephony, content upkeep and oversight, see the hidden-costs breakdown; for platform prices, the platform comparison; for inbound use, AI receptionist cost.

Frequently asked questions

Is AI outbound calling legal in the United States?

It can be, with the right consent. The FCC ruled in February 2024 that AI-generated voices are artificial voices under the TCPA, so calls need prior express consent (absent an exemption), and written consent for telemarketing. This is not legal advice.

Do I have to tell people the caller is an AI?

We found no adopted federal rule requiring it, but you must identify the business, California requires an artificial-voice notice on some dialer calls, and AI Act Article 50(1) puts a disclosure duty on providers in the EU.

Can I call business numbers?

The registry does not cover business numbers, but the TCPA's artificial-voice rule for wireless numbers turns on line type, not on whether the person is a consumer.

What hours can I call?

Under FCC and FTC rules, sales calls to residential subscribers are limited to 8 a.m. to 9 p.m. at the called party's location; the FTC rule allows calls at other times only with the person's prior consent, and the FCC rule does not cover calls made with the person's prior express invitation or permission or within an established business relationship. State laws add their own rules, so check each state you call.

In short

The agent is the easy part; the consent file is the hard part. In the U.S., an AI voice needs the consent any artificial voice needs, in writing for sales calls; the one-to-one rule is vacated and we found no adopted AI-disclosure rule. In Europe, plan for opt-in, objection handling and an AI disclosure. To scope a project, talk to us.

Sources

Talk to us about your project