TCPA AI Calls: Consent, Opt-Outs and Calling Hours for Outbound AI Agents

Yes, TCPA AI calls are regulated: the law covers calls made with a human-sounding voice. The FCC ruled in 2024 that AI-generated voices count as "artificial or prerecorded voices," so an outbound call from a voice agent needs the called party's prior express consent unless it is an emergency or an exemption applies. Marketing calls need written consent, a working opt-out, caller identification and legal calling hours. This is a working checklist for builders and buyers, not legal advice.

The rules sit in three places: the statute (47 U.S.C. 227), the FCC's rules in 47 CFR 64.1200, and FCC rulings that say how both apply to new technology. We read the primary texts for this post, including an FCC order from 30 September 2026 that changes how revocation works. Below, each rule is turned into something a voice agent can enforce before it dials. For the wider picture of how outbound agents work, see our AI voice agent guide and our walk-through of AI outbound calls.

What did the FCC decide about AI voices?

The FCC adopted its declaratory ruling on 2 February 2024 and released it on 8 February. It confirms that "the TCPA's restrictions on the use of 'artificial or prerecorded voice' encompass current AI technologies that generate human voices," and that such calls therefore "require the prior express consent of the called party to initiate such calls absent an emergency purpose or exemption."

The ruling adds two duties that matter for a voice agent. All artificial or prerecorded voice messages must give the identity of the entity responsible for the call. And when a message includes an advertisement or constitutes telemarketing, it must also offer specified opt-out methods for stopping future calls. The FCC says these requirements apply to any AI technology that initiates outbound calls.

Two things the ruling does not do. It does not ban AI calls, and it does not create a special AI regime: the same consent, identification and opt-out rules apply. A voice agent that sounds natural is treated like a robocall for consent purposes, so the design question is how to collect and prove consent, not how to avoid it.

Which consent does each kind of AI call need?

Consent depends on what the call says, not on how clever the agent is. The rules in 47 CFR 64.1200 draw the main line between calls that carry an advertisement or telemarketing and calls that do not.

	Consent the rules ask for	What your agent must also do
Marketing or telemarketing call (offers, promotions, sales pitch)	Prior express written consent of the called party, with limited exceptions such as certain nonprofit and healthcare messages	State who is calling at the start, give a callback number, offer an automated opt-out within 2 seconds of the identification, respect 8 a.m. to 9 p.m. local time and the national Do Not Call registry
Informational call (appointment reminder, order update, call-back the person requested)	Prior express consent of the called party, unless an emergency or an exemption applies	State who is calling, honor revocation, keep a consent record that shows what the person agreed to
Call that starts informational and drifts into a pitch	Treated by what it contains: if it includes or introduces an advertisement, the marketing rules apply	Keep the script's scope fixed in code; do not let the model improvise offers on a service call

Source: 47 CFR 64.1200(a), (b) and (c); FCC 24-17. Summary only, not legal advice.

BufferSol Technologies · buffersoltech.com

Three details are easy to miss.

The test is the content of the call. The rule for marketing calls in 64.1200(a)(2) covers any call that "includes or introduces an advertisement or constitutes telemarketing." A reminder that ends with "and we have a new service you might like" can turn a service call into a marketing call. Voice agents make this risk worse, because a model can wander. Give each call type a fixed script scope and block offers on service calls.

Written consent has to be provable. For marketing calls, "prior express written consent" means you need the record, not a recollection. Store the consent text the person saw, the number, the date and time, and the channel. We cannot tell you what wording is enough for your business; that is a question for your counsel.

Exemptions are narrow. The rule mentions certain nonprofit and healthcare messages, and others exist for narrow cases such as some financial-institution and package-delivery notifications. Do not build a product on the assumption that an exemption covers you without a lawyer's confirmation.

What must a voice agent say, and how fast must the opt-out work?

For artificial or prerecorded voice messages, 64.1200(b) asks for three things. The call must state "clearly the identity of the business, individual, or other entity that is responsible for initiating the call" at the beginning, and if a business is responsible, the name under which it is registered to do business must be stated. During or after the message, the call must give a telephone number for that business, and for telemarketing messages to residential subscribers that number must let people make a do-not-call request during regular business hours.

For telemarketing messages, the rule also asks for an automated, interactive voice or key-press activated opt-out mechanism, with brief instructions, "within two (2) seconds of providing the identification information." When the person opts out, the mechanism must automatically record their number to your do-not-call list and immediately end the call.

For a voice agent, the implications are practical:

• Open with the script the rule requires. Put the legal name and the callback number in a fixed script segment, not in a model prompt that can be reworded.
• Say it is an AI assistant. The TCPA text we read does not require that sentence, but it builds trust, and EU transparency rules point the same way. Our voice agent guide covers the EU side.
• Build the opt-out as a tool, not a sentence. When a caller says "stop calling me" or presses the key, a tool call writes the number to the do-not-call list and the call ends. The model never decides whether to honor it.

When can an AI agent call? Hours and do-not-call lists

Section 64.1200(c) bars telephone solicitations to a residential subscriber "before the hour of 8 a.m. or after 9 p.m. (local time at the called party's location)," and to numbers on the national do-not-call registry. So the clock that counts is the called party's, not yours. A US campaign that runs from one time zone will cross the line unless the dialer converts every number to its local time.

Local time is harder than it sounds. An area code is a poor guide to where someone is now, because people keep their numbers when they move. State laws can set tighter windows or add rules of their own, so treat 8 to 9 as the federal outer edge, not a target. Use the narrowest window your counsel approves, and check the do-not-call registry and your own opt-out list at dial time.

How does revocation work, and what changed in 2026?

This is the part most likely to be out of date in other guides.

The rule today. Under 64.1200(a)(10), a called party may revoke consent "by using any reasonable method to clearly express a desire not to receive further calls," and requests must be honored "within a reasonable time not to exceed ten business days from receipt." That includes a spoken request on a call. A voice agent that hears "please don't call this number again" has received a revocation.

The "revoke all" delay. The FCC's 2024 order also said a revocation made in response to one type of message applies to all future robocalls from that caller. The FCC's staff has delayed that part until 31 January 2027 and left other revocation rules as they are.

The September 2026 order. On 30 September 2026 the FCC adopted a Report and Order that changes both points. Callers may designate an exclusive way to revoke: an automated keypress or voice mechanism on the call, specific standardized words in reply to a text, or a website or phone number set up for opt-outs. The caller must "clearly and conspicuously" disclose the designated method on the call. A caller that does so "is not required to process revocation requests made by any other means." For informational calls, a revocation may be treated as covering only the category of call it was aimed at. A revocation made in response to advertising or telemarketing covers all future marketing calls from that caller.

The order takes effect 30 days after its publication in the Federal Register, and the FCC says the new text replaces the January 2027 date. Check the Federal Register notice for the exact date. The same document asks for comment on shortening the ten-business-day deadline and on requiring a "revoke all" method, so expect more changes.

What this means for a build: design for the stricter reading anyway. A voice agent can recognize spoken opt-outs reliably, so honoring them costs little, while ignoring a caller who clearly said stop is the fastest route to a complaint. If you designate a keypress opt-out as your exclusive method, the agent must disclose it on the call, in words the person can follow, and the keypress handler must be tested like any other safety feature.

What does a violation cost?

The statute is blunt. Under 47 U.S.C. 227(b)(3), a person may bring an action to recover actual monetary loss or "$500 in damages for each such violation, whichever is greater," and a court that finds a willful or knowing violation may increase the award to up to three times that amount. The FCC can also pursue civil forfeitures, and state laws may add their own remedies.

The "for each such violation" wording is why volume matters. An agent that dials a thousand numbers with a flawed consent check does not make one mistake, it makes a thousand. This is the strongest argument for putting consent logic in code that runs before the dial, and for testing it as hard as the voice itself.

A six-step pre-dial gate for your voice agent

The agent should never decide whether a call is allowed. A small service sits between the campaign list and the dialer and returns allow or block with a reason. Every check is plain code.

1. 011. Consent on recordFind a consent record for this number and this call type: wording shown, date, time and channel. No record, no call.
2. 022. Do-not-call and opt-outsCheck your internal opt-out list and the national registry where it applies. A revoked number is blocked for every channel you control.
3. 033. Local timeConvert to the called party's local time and block anything outside your approved window, never wider than 8 a.m. to 9 p.m.
4. 044. Call type and script scopeLoad the fixed script for this call type. Service calls cannot carry offers; marketing calls need the written-consent path.
5. 055. Identification and opt-outThe script opens with the registered business name, a callback number and, for marketing calls, the automated opt-out inside two seconds.
6. 066. Log everythingWrite the gate's decision, the call outcome and any opt-out to an audit log you can produce on request.

Source: BufferSol design, based on 47 CFR 64.1200

BufferSol Technologies · buffersoltech.com

During the call, a seventh safeguard runs in the agent itself: a revocation tool the model can call whenever it hears a stop request, which writes to the opt-out list in the same transaction as the hang-up. After the call, the log shows the decision at dial time, which is the record you need if a call is ever questioned.

What about the UK and EU?

The UK works differently. The ICO's telephone marketing guidance says you must not make an automated marketing call unless the person has specifically consented to receive that type of call from you. Live marketing calls must not go to numbers registered with the TPS or Corporate TPS unless the person has consented. The ICO page does not address AI voices directly and says it is under review, so confirm how your agent's calls are classed before launch. In the EU, national marketing-call rules and GDPR apply, and AI Act transparency duties require people to be told when they interact with an AI system.

Where should you start?

Start where consent is clearest: calling back a person who just asked to be called. A web-form lead who ticked a box and gave a number is a very different case from a purchased list. This is also where speed pays: our Done For You speed-to-lead automation is built around replying to every new lead within minutes, and an AI call-back is one way to do that once your consent record covers calls.

A realistic first pilot with BufferSol follows the same shape as our AI voice lead agent, which answers inbound calls, qualifies leads and books into the CRM: a working agent on your real data inside 30 days, with the prototype in about two weeks and a pilot on a first slice of calls. For outbound, the pilot adds the pre-dial gate, the opt-out tool and the audit log, so your counsel can review real call flows instead of a slide. Our AI voice agents service covers what we build, and our post on the AI appointment setter shows how booked calls land in the calendar.

Before anything dials a real person, send your consent wording, scripts and gate logic to a lawyer who handles TCPA work. The rules above are a map of the primary texts, and the details of your business decide the answer.