TCPA and AI Voice in 2026: FCC Ruling 24-17 and What Outbound Teams Must Know
The Telephone Consumer Protection Act of 1991 (TCPA) is the single biggest legal risk for AI outbound voice calling. The FCC's February 2024 Declaratory Ruling 24-17 made explicit that AI voice is treated identically to traditional robocalls. Most live AI cold-call deployments are non-compliant. Here is the operator guide.
Last verified May 2026. This is editorial content, not legal advice; engage US counsel for your specific deployment.
§FCC Ruling 24-17: What Changed
On 8 February 2024 the FCC adopted Declaratory Ruling 24-17, interpreting the TCPA's reference to "artificial or prerecorded voice" to include AI-generated voice. The FCC voted unanimously. The ruling was effective immediately on adoption.
Before 24-17, there was legal ambiguity about whether real-time AI voice generation (Vapi-style live LLM-driven voice) was covered by TCPA's prerecorded-voice provisions. The argument was: TCPA was written in 1991 for cassette-tape robocalls; live AI voice is technically not pre-recorded. The FCC rejected this argument explicitly. The ruling is grounded in consumer-protection logic: a recipient receiving an automated synthetic voice call should not have weaker protection because the synthesis happens in real time.
The practical effect: Vapi, Retell, Bland, Synthflow, and 11x Julian-style voice deployments are now treated identically to traditional autodialer robocalls under TCPA. The same consent requirements, the same do-not-call rules, the same penalty framework.
§The Consent Hierarchy: PEC vs PEWC
TCPA has two tiers of consent depending on call type and recipient phone type:
Prior Express Consent (PEC)
Required for non-marketing AI voice calls to cell phones. Can be obtained verbally, in writing, or electronically. Must demonstrate that the consumer agreed to receive the type of call being placed. Example: a customer who provided their cell number on a web form to receive product updates has given PEC for related product-update voice calls.
Prior Express Written Consent (PEWC)
Required for marketing AI voice calls to cell phones or residential lines. Must be in writing (electronic acceptable per E-SIGN), specify the seller name, identify the phone number, disclose that consent is not required for purchase, and be signed. Pre-checked boxes do not constitute PEWC per FCC interpretation. Most outbound AI sales calls trigger PEWC because they have marketing intent.
The compliance ceiling: PEWC. For outbound AI sales calls to consumers or business cell-phone numbers (which is most modern outbound), PEWC is the safest posture. Lower consent standards exist for narrow non-marketing exceptions but are routinely contested by plaintiffs and do not survive class-certification challenge consistently.
§What Counts as PEWC Documentation
FCC and court interpretation of PEWC documentation has tightened in 2024-2026. The defensible structure:
1. Explicit consent text identifying AI voice
The PEWC capture must specifically identify that AI or prerecorded voice may be used in the calls. Generic "we may contact you" consent does not satisfy AI-specific PEWC under FCC 24-17 interpretation. Example compliant text: "I consent to receiving marketing calls from [SELLER] at the phone number above, including calls made using AI-generated voice or prerecorded voice, on a recurring basis. Consent is not required for purchase. Message and data rates may apply."
2. Active opt-in (not pre-checked)
The consumer must take affirmative action (click, sign, tap) to indicate consent. Pre-checked boxes on forms have repeatedly been struck down as inadequate PEWC. Best practice: separate consent checkbox below the main form-submission button, unchecked by default.
3. Documentation retention
Retain the consent record (timestamped form data plus URL of consent page plus IP address) for at least 5 years after last call, ideally longer to cover statute-of-limitations plus class-action discovery margin. Court-admissible audit trail is the primary defence against PEWC class actions.
4. Revocation handling
Consumers can revoke PEWC at any time by any reasonable means. STOP keyword on text, verbal opt-out during call, email request, or contact via your unsubscribe channel all count. Honour revocation within 10 business days at the latest (FCC standard). Log revocations to defend against repeated-violation claims.
§The Per-Call Penalty Math
TCPA Section 227(b)(3) provides for a private right of action with statutory damages of $500 per violation, trebled to $1,500 per violation for wilful or knowing violations. Each individual call is a separate violation. The math compounds quickly:
| Campaign size (non-compliant calls) | Statutory damages | Trebled (wilful) |
|---|---|---|
| 100 calls | $50,000 | $150,000 |
| 1,000 calls | $500,000 | $1.5M |
| 10,000 calls | $5M | $15M |
| 50,000 calls | $25M | $75M |
| 250,000 calls | $125M | $375M |
Real settlements in the AI-voice TCPA space have ranged from $5 million to $40 million. The headline number is rarely the final settlement because plaintiffs typically settle for 10 to 30 percent of theoretical maximum exposure plus injunctive relief plus attorneys' fees. The exposure is real even at the discounted settlement value.
§The Compliant Outbound Voice AI Architecture
Sales teams that want to use AI voice for outbound legitimately can do so by designing the consent flow upstream of the call. The pattern:
Step 1: Capture PEWC before any AI outbound call
Web form, in-person sign-up at trade show, account-creation flow, or other consent capture before the AI calls. The consent must be on file and timestamped before the first call.
Step 2: Filter outbound list against DNC and consent status
Cross-reference outbound list against National DNC Registry, state DNC lists, internal opt-out list, and the PEWC consent database. Call only prospects with affirmative consent AND no active opt-out.
Step 3: AI voice identifies itself at call open
FCC ruling 24-17 plus state AI disclosure laws (CA SB-1001 for California) require the AI to identify itself as AI when asked, and best practice is to identify proactively. Example: "Hi, this is Ana, an AI assistant calling from [SELLER]. Is this a good time?"
Step 4: Honour revocation immediately during call
If the prospect asks to stop, requests opt-out, or expresses any negative intent, the AI must end the call gracefully and log the revocation to the opt-out list. Continued calling after revocation triggers wilful-violation treble damages.
Step 5: Maintain end-to-end audit trail
Consent record, DNC cross-check timestamp, call recording, opt-out log, retention for 5+ years. The audit trail is the primary defence against TCPA class action class certification.
§State Layers on Top of Federal TCPA
Several US states layer additional restrictions on top of TCPA. The most consequential for AI voice:
- + California (CA SB-1001, 2018): Requires AI bots to identify as AI when asked, in commercial transactions. Adds to TCPA baseline.
- + California (CIPA, Cal Penal Code 631-632): All-party consent for recording, independently of TCPA. See CIPA + AI calls.
- + Florida (FTSA, FL Stat 501.059): 2021 act creates private right of action for telephone solicitation violations, often paired with TCPA claims.
- + Washington (RCW 80.36.400): Restricts automated voice calls; supplements TCPA with state-level requirements.
- + New York (Gen Bus Law 399-pp): Telemarketing restrictions including registration requirements for sellers.
- + Massachusetts, Pennsylvania, Illinois, Maryland: All-party consent recording states (similar to CIPA) that affect AI recording disclosure.
The conservative posture for a national outbound AI voice campaign is to comply with the strictest applicable state law (typically California or Massachusetts) and apply that standard universally. Per-state routing complexity is rarely worth the maintenance cost.