If you run outbound calls with an AI voice agent in the US, the rule that governs you is not an AI law. It's the TCPA — the same statute that has covered recorded calls for three decades. In a Declaratory Ruling released February 8, 2024, the FCC confirmed that an AI-generated voice counts as an "artificial or prerecorded voice." That means every consent rule that applied to robocalls now applies to your Retell or Vapi agent: written consent for marketing calls to mobiles, 8 a.m. to 9 p.m. local calling windows, do-not-call scrubbing, and honored opt-outs.
We build and run these agents for clients, so this is the briefing we give before anything dials a real number. Two of the most repeated "facts" in voice AI compliance content are wrong, and I'll show you which ones.
This is operational guidance from an implementation team, not legal advice. Before you launch, have counsel review your consent language and your call flow.
No, the FCC did not ban AI voice calls
The headlines in February 2024 said the FCC had made AI voices in robocalls illegal. That's not what happened, and it still shapes how nervous people are about deploying voice agents.
What the Commission actually did was classify AI-generated voices as "artificial or prerecorded voice" under the statute. Those calls are perfectly legal. They're consent-gated and restricted — a completely different thing from banned. You can run an AI voice agent lawfully in all fifty states today.
The practical takeaway: stop looking for permission to use the technology, and start auditing your consent data. That's where the actual risk sits. You can read the ruling itself in the FCC's published order, which is short and more readable than most agency documents.
Your consent tier depends on the call's purpose, not the tech
This is the part most teams get backwards. Nobody is evaluating whether your agent sounds robotic or human. The question is what the call is for.
Marketing calls need prior express written consent
Any call promoting a product or service to a wireless number requires prior express written consent. That's a specific legal artifact, not a checkbox someone vaguely clicked. It needs a signature (electronic is fine), your specific business name, the number being authorized, and a clear statement that agreeing isn't a condition of purchase.
If you bought a lead list, you almost certainly don't have this. Lead vendors routinely sell "TCPA-compliant" data where the consent was given to a comparison site with forty partner names in a scrollbox. That consent has been picked apart in litigation for years.
Informational calls need prior express consent
Appointment reminders, delivery notifications, account alerts, and rescheduling calls sit in a lighter tier. Prior express consent is generally satisfied when someone hands you their number in the context of that transaction. Booking an appointment and giving your phone number is consent to be called about the appointment.
This is why the highest-ROI voice AI use cases are usually the informational ones. Our clients see the fastest, cleanest wins on reducing no-shows with reminder calls precisely because the consent question is straightforward. Cold outbound is where teams get into trouble.
One important limit: an established business relationship exempts you from the do-not-call registry. It does not substitute for the consent you need to place an artificial-voice call. Those are separate requirements, and conflating them is a common and expensive mistake.
Do you have to say it's an AI?
Federally, not yet. The FCC proposed mandatory in-call AI disclosure in a September 2024 rulemaking, and as of now that proposal hasn't been finalized.
But "not federally mandated" is a long way from "safe to skip." State bot-disclosure laws, state unfair-and-deceptive-practices statutes, and the FTC's general prohibition on deception all create exposure if someone reasonably believes they're talking to a person. Juries don't love the argument that you technically weren't required to mention it.
Every agent we deploy discloses in the first sentence. The line we use is boring on purpose:
"Hi, this is an AI assistant calling from [Company] on a recorded line. Do you have a quick minute?"
That does three jobs at once — identifies the business, discloses the AI, and gives recording notice. It costs roughly three seconds of call time. In our deployments it has never been the reason a call failed; people hang up because the offer is irrelevant or the timing is bad, not because a bot was honest about being a bot. Disclosure is cheap. Litigation isn't.
The Texas SB 140 claim almost everyone gets wrong
Search "AI voice agent disclosure law" and you'll repeatedly find some version of this: Texas SB 140 requires AI voice technology to be disclosed within the first 30 seconds of a call.
I went and read the bill, because we have clients in Texas and I'm based in the Dallas area. That characterization is wrong.
Texas SB 140 (89th Legislature, effective September 1, 2025) redefines "telephone solicitation" to cover text and multimedia messages, not just voice calls. Its teeth are in enforcement: it creates a direct private right of action under the Texas Deceptive Trade Practices Act, letting consumers skip the old administrative-complaint step, and it allows recovery of mental anguish damages on top of economic damages.
So SB 140 is not an AI disclosure law. It's something arguably more dangerous to a marketing operation — a significant expansion of who can sue you and for how much, covering the SMS follow-ups your voice agent probably triggers. If you're running voice-plus-text sequences into Texas, that's the exposure to look at, and it has nothing to do with a 30-second timer.
The broader lesson: voice AI compliance content is mostly vendors quoting other vendors. Read the bill.
Recording is a separate consent problem
People conflate call consent with recording consent. They're independent.
Roughly a dozen states require all-party consent to record a call — California, Florida, Illinois, Pennsylvania, Washington, Massachusetts and others. If you record every call for transcription and QA (and if you're running a voice agent, you are — the transcript is the product), you need recording notice in the opening line and a real path to handle someone who says no.
Because caller location doesn't reliably follow area code anymore, we default to all-party-consent handling everywhere. One opening line, one standard, no state-detection logic to get wrong.
Opt-outs are where deployments actually fail
Consent gets all the attention. Opt-out handling is what breaks in production.
The revocation rules are deliberately broad: a person can revoke through any reasonable means, in any reasonable words. "Stop," "remove me," "don't call again," "I'm not interested, take me off your list" — all valid. You have ten business days to honor it, and it has to propagate across channels, not just the one they said it on.
Three failure modes we see constantly:
Keyword matching instead of intent detection. A regex looking for "stop" misses "please quit calling me." Your agent has an LLM in it — use it to classify revocation intent from the full transcript, then write to suppression.
Channel-siloed suppression. Someone opts out on a call, and the CRM keeps them in the SMS nurture because those live in different tables. That's a separate violation for every message after.
No propagation delay budget. Ten business days sounds generous until suppression is a nightly batch job that silently failed on Friday. We wire revocation as an event that writes to suppression immediately, and alert on the failure. This is the same CRM automation plumbing that handles the rest of your lead lifecycle — it just needs to treat opt-out as a first-class event rather than a field update.
Also: 8 a.m. to 9 p.m. in the called party's local time, computed from their number, not your dialer's timezone. Some states are stricter. And scrub against the national do-not-call registry at least every 31 days.
"Our vendor handles compliance" is not a defense
Liability follows the business on whose behalf calls are placed. Not the platform. Not the agency. Not the lead vendor.
Retell, Vapi, and Twilio give you excellent controls — consent fields, suppression APIs, recording toggles, calling-window enforcement. None of them assume your risk. If you're weighing platforms, our Vapi vs Retell comparison covers the build tradeoffs, but note that neither choice changes who gets named in a lawsuit.
The math is unforgiving. Statutory damages are $500 per call, trebled to $1,500 for willful violations, with no aggregate cap. A 10,000-dial campaign on bad consent data is a $5M to $15M theoretical exposure. Voice AI is dangerous here for a reason that has nothing to do with AI: it makes the cost of dialing approach zero, so volume scales faster than anyone's consent hygiene.
That's the real risk profile. Not the technology — the throughput.
What we check before an agent goes live
The pre-launch pass we run on every client deployment:
- Call purpose classified per campaign, with mixed-purpose defaulting to the marketing standard
- Consent verified at the record level — a database query before each dial, not a trusted CSV, with timestamp, source, and the exact agreed language stored
- Disclosure in the first utterance, before the agent asks anything
- Recording notice in the same line, all-party-consent handling by default
- Revocation detected by intent, written to a shared suppression layer across voice, SMS, and email
- Calling windows enforced from the recipient's number, with stricter state rules encoded
- DNC scrubbed on a schedule under 31 days
- Everything logged — transcripts, consent records, disclosure audio, suppression events
That last one matters more than it sounds. If you can't produce what your agent said on a specific call on a specific date, you can't defend it. The recording is the defense. We treat the logging layer as part of the agent, not as observability bolted on afterward — the same discipline we apply when deploying voice agents for lead follow-up.
The honest summary
Compliance is not what makes voice AI hard. Configuring it correctly takes an afternoon. The hard part is that voice AI makes dialing so cheap that it surfaces every weakness in consent data you were already sitting on — the bought lists, the vague checkbox, the opt-out that only ever hit one channel.
Fix the data. The agent configuration is the easy half.
If you're planning a voice agent and want a second set of eyes on your consent flow, call script, and suppression architecture before it dials anyone, get a free automation audit. We'll walk your setup and tell you what we'd change — including whether voice AI is even the right fit for your lead qualification in the first place.