Is AI cold calling legal?

The short answer

• AI voice calls count as "artificial voice" calls under the Telephone Consumer Protection Act. That's the same bucket as prerecorded robocalls.
• Calling a cell phone with an artificial voice requires the person's prior express consent. If the call is telemarketing, it requires prior express written consent. The same written-consent rule applies to telemarketing calls to residential landlines.
• A live human who dials a number by hand isn't using an artificial voice. Since the Supreme Court's 2021 Duguid decision, they usually aren't using a regulated "autodialer" either, so most of those consent requirements don't apply. Do-not-call rules, calling hours, and state laws still do.

Put simply: an AI SDR cold-calling a list of cell numbers is one of the riskiest things you can do in outbound sales right now. A person calling the same lead with good context is ordinary sales.

What the FCC decided in 2024

In February 2024, after AI-cloned voices were used in robocalls during the New Hampshire primary, the FCC issued a unanimous declaratory ruling. It said the TCPA's restrictions on "artificial or prerecorded voice" calls include AI-generated voices, including voice clones and conversational voice agents that generate speech in real time.

The FCC didn't create a new law. It confirmed that a 1991 law already covers the new technology. Every consent rule that applies to robocalls applies to an AI voice agent, no matter how natural it sounds or how well it handles objections.

What consent you'd need for AI calls

"Prior express written consent" is a high bar. It means a signed agreement (an e-signature or checkbox counts) that clearly authorizes calls using an artificial voice to a specific number, from the specific seller. It also has to make clear that consent isn't a condition of purchase. A generic "contact me" form usually doesn't meet it.

Consent can also be revoked. The FCC has made clear that people can revoke consent by any reasonable means, such as replying "stop," saying so on a call, or emailing you, and you have to honor it promptly.

Why human-dialed calls are treated differently

The TCPA's strictest rules attach to two technologies: artificial or prerecorded voices, and automatic telephone dialing systems (ATDS, or "autodialers").

A person speaking in their own voice isn't an artificial voice. And in Facebook v. Duguid (2021), the Supreme Court read "autodialer" narrowly: equipment that stores or produces numbers using a random or sequential number generator. Clicking a number in a CRM, or tapping it on a phone, generally isn't that.

One caution: how the human dials matters. Predictive and "power" dialers that ring many numbers at once and connect whoever answers to an available rep raise their own legal questions. They also create abandoned and silent calls, which have separate rules. Some state laws (below) define regulated dialing equipment more broadly than federal law. The cleanest setup is one human, one call, started by that human.

Rules that still apply to human calls

• National Do Not Call Registry. Telemarketing calls to numbers on the registry are prohibited unless you have an established business relationship or permission. An inquiry from the person generally creates that relationship for 3 months, and a purchase for 18 months.
• Your internal do-not-call list. If someone asks you to stop calling, you must record it and stop, across your whole company.
• Calling hours. Telemarketing calls are only allowed between 8am and 9pm in the recipient's local time, and some states are narrower.
• Identification. The caller has to give their name, the business they're calling for, and a phone number or address where that business can be reached.
• Call recording. About a dozen states, including California, Florida, Illinois, Pennsylvania, and Washington, require every party's consent to record. If you don't need recordings, don't make them.

State "mini-TCPA" laws

Several states have their own telemarketing laws, and some go further than federal law. Florida's Telephone Solicitation Act and Oklahoma's Telephone Solicitation Act both restrict calls made with automated systems for selecting and dialing numbers unless there's prior express written consent. Both limit solicitation calls to roughly 8am–8pm and cap repeat calls (no more than three in 24 hours on the same subject). Other states require telemarketer registration or have their own do-not-call lists. California also requires bots that try to sell to people to disclose that they're bots.

If you call nationally, build to the strictest common denominator rather than tracking 50 rulebooks.

What's at stake

The TCPA allows $500 per call in statutory damages, tripled to $1,500 for willful or knowing violations. It also has a private right of action. Plaintiffs don't need to show any actual harm, and cases are routinely brought as class actions. A campaign of 10,000 non-compliant AI calls is a theoretical $5–15 million exposure.

The ground keeps shifting, too. In 2025 the Supreme Court held that federal courts don't have to defer to the FCC's reading of the TCPA. A rule that seems settled at the agency can be argued differently in court, in either direction. Planning around the narrowest safe reading is the conservative choice.

A safer playbook for phone follow-up

1. Let AI do the research and the writingHave your agent pick the leads worth calling, pull context (what they did, what you know about them), and draft the talking points. None of that touches the phone network.
2. Collect real consent where you canIf your form collects phone numbers, add a clear consent line. It costs nothing and makes every kind of follow-up cleaner.
3. Put a human on the actual callOne person, one call, dialed by that person, from a brief. That's the part regulators and prospects both care about.
4. Enforce the mechanics in softwareLocal calling hours, do-not-call checks before every dial, one open attempt per number, and a timestamped audit trail. Build these in so they don't depend on someone remembering.
5. Feed outcomes back to the agentDispositions and notes go back into your system, so the next step (email, meeting prep, or leaving them alone) happens automatically.

That's exactly the split Ring a Human is built around: your agent writes the brief, a vetted human dials, and the compliance checks are enforced in code.