TCPA Compliance for AI Outbound Calling Agents: A Developer's Guide

Quick Answer

The Telephone Consumer Protection Act (TCPA) governs outbound AI voice agents the same way it governs human predictive-dialer campaigns: calls to wireless numbers using an automated system generally require prior express written consent, must scrub against the National and internal Do Not Call registries, may only be placed between 8am and 9pm in the recipient's local time zone, and must keep abandoned-call rates under 3% per 30-day campaign per calling number. On top of federal TCPA, a growing number of US states (California, Utah, Florida, and others) require an explicit AI-voice disclosure early in the call. None of this is optional infrastructure — it needs to be built into the dialer and consent-capture flow from day one, not added after a first campaign gets flagged.

Why This Matters More for AI Agents Than for Human Dialers

Outbound AI voice agents make TCPA compliance harder to get right, not easier, for a few concrete reasons. First, an AI agent can dial at a volume and pace no human team can match — a single outbound campaign that would have taken a 20-person call floor a week can run in an afternoon, which means a pacing bug or consent-scrubbing gap gets multiplied across thousands of calls before anyone notices. Second, the FCC's February 2024 declaratory ruling explicitly confirmed that calls using AI-generated voices are "artificial voice" calls under TCPA — closing any ambiguity that a synthetic voice might somehow fall outside the rule's scope. Third, state legislatures have moved faster on AI-specific disclosure requirements than on any other outbound-calling issue in the last decade, meaning the compliance surface is now a moving target that a purely federal-law read of TCPA will miss.

For engineering teams, the practical upshot is that consent state, calling-window logic, abandonment tracking, and disclosure scripting can't live in a compliance spreadsheet next to the dialer — they need to be first-class fields in the campaign data model and enforced in code before a call is placed, not audited after the fact.

Consent Requirements

TCPA distinguishes between call types, and the consent bar rises with how automated and how promotional the call is:

• Prior Express Written Consent (PEWC) — required for any telemarketing/marketing call using an autodialer or artificial/prerecorded voice to a wireless number. This is the bar an outbound AI sales or lead-gen agent almost always needs to clear.
• Prior Express Consent (verbal or written) — sufficient for informational, non-marketing autodialed calls (e.g. appointment reminders, delivery notifications) where the consumer provided their number in the transaction giving rise to the call.
• Established Business Relationship exemptions have narrowed significantly since 2013 and should not be relied on as a substitute for documented consent for any new campaign.
• Consent must be revocable at any time, through any reasonable method — your agent's call flow and CRM both need a hard stop that removes a number from all future campaigns the moment revocation is detected, including mid-call.

Calling Windows & Do Not Call Scrubbing

Federal TCPA restricts telemarketing calls to between 8:00am and 9:00pm in the called party's local time zone — not the time zone the campaign is dialed from. This means a campaign dialer needs an accurate area-code-to-timezone (or better, a carrier-provided location) lookup before every call, and needs to hold or reschedule any number that falls outside the window rather than silently skip it and lose the lead. Numbers must also be scrubbed against the National Do Not Call Registry (updated numbers pulled at least every 31 days) as well as any internal do-not-call list built from prior opt-outs — both checks need to run immediately before dial, not once at list-import time, since consent and DNC status can change between list load and actual call.

Abandonment Rate & Pacing Algorithms

The FCC caps call abandonment at 3% of answered calls per 30-day campaign, measured per calling number — a call is "abandoned" if it's answered by a live person (or, per FCC guidance, an answering machine in some interpretations) but not connected to an agent within 2 seconds. This rule was written for human predictive dialers over-pacing ahead of agent availability, but it applies just as directly to an AI voice agent stack: if your dialer fires calls faster than your AI agent's session-spin-up and greeting latency can absorb, you generate exactly the abandoned-call pattern the rule targets.

In practice this means the pacing algorithm needs visibility into your AI agent's actual answer-to-first-word latency (see our answering machine detection guide for the related AMD-and-pacing mechanics), not just a fixed dial-ahead ratio borrowed from human-agent campaigns. A stack where the AI agent takes 1.5–2 seconds to spin up a LiveKit or Pipecat session after the callee answers needs a materially more conservative pacing ratio than one with sub-300ms answer-to-greeting latency.

AI-Voice Disclosure Laws

Federal TCPA does not yet impose a universal requirement to disclose that a call uses an AI-generated voice, but state law is moving quickly to fill that gap, and FTC guidance signals disclosure will likely become a de facto national standard regardless of federal rulemaking timing. As of 2026:

• California (SB 1001-adjacent bot-disclosure rules) requires disclosure when an automated system is used to influence a purchase or vote in a commercial or political call.
• Utah's AI Policy Act requires a clear and conspicuous disclosure that a consumer is interacting with AI, specifically for generative AI voice interactions, including outbound calls.
• Florida's telemarketing statutes have been amended to require disclosure of automated/AI systems in outbound sales calls, layered on top of existing TCPA obligations.

The engineering implication: hardcode an AI-disclosure line into the opening of every outbound call script as a default, and treat it as a configurable-per-jurisdiction compliance field rather than an optional script variant — retrofitting disclosure into a campaign already in flight is far more disruptive than shipping it as the default from day one.

Enforcement & Penalties

TCPA is a private right of action statute, which means individual consumers — not just regulators — can sue, and plaintiffs' firms actively monitor for exactly the kind of consent and pacing gaps an early-stage outbound AI stack is prone to:

• Statutory damages of $500 per violation, tripled to $1,500 for willful or knowing violations — and each individual call can count as a separate violation.
• Class-action exposure scales with campaign volume: a consent-scrubbing bug affecting even a few thousand calls in a 30-day window can produce seven-figure exposure at $500-$1,500 per call.
• The FCC and state attorneys general can bring separate enforcement actions independent of private lawsuits, with penalties that can exceed the per-call statutory damages in egregious or repeated cases.
• AI-specific enforcement is still developing case law as of 2026 — the FCC's 2024 ruling established that AI-generated voice falls under existing TCPA restrictions, but courts are still working through how state AI-disclosure laws interact with federal TCPA claims in practice.

The practical takeaway for an engineering team: the cost of a consent or pacing bug in an outbound AI stack isn't a support ticket — it's potential per-call statutory liability multiplied across your entire call volume, which is exactly why the dial-time compliance gate architecture below treats these checks as load-bearing, not optional.

Building Compliance Into the Stack

The pattern we use building outbound AI agent stacks on Asterisk, FreeSWITCH, and LiveKit is to treat consent, timezone, DNC status, and abandonment metrics as first-class fields checked by a compliance gate immediately before dial — not as a batch filter run once when a call list is imported:

• Consent state stored per phone number with a timestamp and source, checked at dial-time, not just at list-import time
• Timezone resolved per number (carrier lookup, not area-code heuristic alone) and checked against the 8am–9pm window at dial-time
• DNC and internal opt-out lists re-checked at dial-time, since a number can be added to either list minutes before a scheduled call
• Real-time abandonment-rate counter per calling number, feeding back into the pacing algorithm rather than being reviewed only in a post-campaign report
• AI-disclosure line configured per jurisdiction and enforced as a required first utterance in the agent's script, not an optional flag
• Full call/consent audit log retained per TCPA recordkeeping expectations, capturing consent proof, disclosure delivery, and call outcome

Compliance Gate: Dial-Time Check (Python)

A minimal dial-time compliance gate that an outbound dialer should call immediately before placing every call — not just once when the campaign list is built:

from datetime import datetime
from zoneinfo import ZoneInfo

def can_dial(number_record: dict, campaign: dict) -> tuple[bool, str]:
    """Returns (allowed, reason). Call immediately before every dial attempt."""

    # 1. Consent check — re-verified at dial-time, not just list-import time
    if number_record["consent_status"] != "granted":
        return False, "no_valid_consent"
    if number_record.get("revoked_at"):
        return False, "consent_revoked"

    # 2. DNC / internal opt-out — re-checked at dial-time
    if number_record["on_national_dnc"] or number_record["on_internal_optout"]:
        return False, "dnc_listed"

    # 3. Calling window — 8am-9pm in the CALLED PARTY's local time zone
    local_tz = ZoneInfo(number_record["resolved_timezone"])
    local_now = datetime.now(local_tz)
    if not (8 <= local_now.hour < 21):
        return False, "outside_calling_window"

    # 4. Live abandonment-rate check for this calling number (rolling 30-day)
    if campaign["abandonment_rate_30d"] >= 0.03:
        return False, "abandonment_rate_breached"

    return True, "ok"

def build_opening_script(number_record: dict) -> str:
    """AI-disclosure is a required prefix, configured per jurisdiction."""
    disclosure = DISCLOSURE_TEXT_BY_STATE.get(
        number_record["state"], DISCLOSURE_TEXT_BY_STATE["default"]
    )
    return f"{disclosure} {campaign_script_body}"

State-by-State Snapshot (Illustrative, Not Exhaustive)

State AI-disclosure law is expanding quickly — treat this table as a starting point for engineering design, not a legal reference, and confirm current requirements with counsel before each campaign launch.

International Equivalents to TCPA

An outbound AI voice agent calling into markets outside the US needs its own compliance review — TCPA doesn't apply, but each region has its own consent and calling-time regime that maps onto the same architectural pattern:

The dial-time compliance gate pattern from this guide generalizes across jurisdictions — swap the specific consent/DNC/calling-window rules for the target region's requirements rather than assuming TCPA logic covers international campaigns.

Consent Audit Trail Data Model

TCPA recordkeeping expectations and the enforcement exposure above both point to the same engineering requirement: every consent, disclosure, and call outcome needs to be independently reconstructable months later, not just logged as a pass/fail flag. A minimal audit-trail data model per phone number should retain:

• Consent record — type (PEWC vs. prior express consent), timestamp, capture method (web form, verbal, prior transaction), and source system reference
• Revocation record — timestamp and channel (mid-call verbal request, opt-out keyword, unsubscribe link), applied immediately across all future campaigns
• DNC scrub result — timestamp of the National DNC check and internal opt-out check that ran immediately before this specific call, not just the list-import-time check
• Disclosure delivered — which AI-disclosure script version played, and confirmation it was delivered before substantive conversation began
• Call outcome — connected, abandoned, machine-detected, or blocked by the compliance gate, with the specific gate reason if blocked

This is the data a defense counsel needs to produce quickly if a TCPA claim is filed — reconstructing consent and disclosure after the fact from scattered logs is far more expensive and risky than designing the audit trail as a first-class part of the campaign data model from day one.

Pre-Launch Checklist

• Consent type documented per number (PEWC vs. prior express consent) with timestamp and source
• National DNC Registry scrub run within the last 31 days, plus live internal opt-out check at dial-time
• Timezone resolved per number and enforced against the 8am–9pm calling window at dial-time
• Real-time abandonment-rate tracking wired into the pacing algorithm, not just a post-campaign report
• AI-disclosure script configured per jurisdiction and enforced as a required opening line
• Revocation handling — a caller saying "stop calling me" mid-call immediately flags the number across all future campaigns
• Full audit log of consent, disclosure, and call outcome retained per your compliance retention policy
• Legal/compliance sign-off obtained before the first production campaign, not just before the demo

FAQ

Related Reading