AI Calling Rules in 2026: The FTC and FCC Guide

20 min read

Summarize with AI

ChatGPTGeminiClaudeGoogle AIGrokPerplexity

AI calling rules in the United States come from two federal agencies that regulate different halves of the same phone call. The Federal Communications Commission controls the channel, meaning whether you are allowed to place the call at all. The Federal Trade Commission controls the sales relationship, meaning what you may say once someone answers.

Both agencies acted in 2024, both have moved again since, and one widely reported rule was struck down in court before it ever applied. Most compliance guides written in 2024 are now wrong in at least one important place.

This guide covers what is actually binding as of September 2026, what is still only proposed, what was vacated, and the specific infrastructure your operation needs in place before the next call goes out. It is informational and not legal advice.

Key takeaways

• The FCC ruled in February 2024 that AI-generated voices are artificial voices under the TCPA, and that ruling is current, binding law.
• The one-to-one consent rule was vacated by the Eleventh Circuit in January 2025 and never took effect, despite guides that still describe it as law.
• Revocation of consent must be honored by any reasonable method, and the cross-channel piece of that rule is the real 2026 deadline.
• The FCC’s proposed AI disclosure requirement from August 2024 is still a proposal, not a rule.
• The FTC’s amended Telemarketing Sales Rule brought voice cloning inside the robocall prohibition, narrowed the business-to-business exemption, and extended recordkeeping to five years.
• Texas, Virginia, Florida, and Colorado impose obligations on top of federal law, and about a dozen states require all-party consent to record.
• TCPA damages are $500 to $1,500 per call with no statutory cap, and FTC civil penalties exceed $50,000 per violation.

Table of contents

• What the AI calling rules are
• Why two agencies, and what each one controls
• The FCC February 2024 ruling, which is current law
• The one-to-one consent rule that never took effect
• Consent revocation and the 2026 cross-channel deadline
• The August 2024 disclosure proposal, still not final
• The FTC Telemarketing Sales Rule updates
• State laws that stack on top of federal rules
• Penalties under current law
• What compliant AI calling requires right now
• Compliance mistakes that show up in litigation
• What is likely to change next
• AI calling rules FAQ
• The bottom line

What the AI calling rules are

The AI calling rules are the set of federal and state requirements that govern outbound phone calls in which software generates the voice, covering consent before the call, conduct during the call, and records kept afterward. There is no single AI calling statute. The obligations come from the Telephone Consumer Protection Act as interpreted by the FCC, the Telemarketing Sales Rule enforced by the FTC, and a growing pile of state telemarketing and AI statutes.

That structure matters because compliance is not one checkbox. A campaign can satisfy the FCC’s consent requirement and still violate the FTC’s conduct rules, or satisfy both and still breach a state recording law. The three layers apply at the same time and are enforced by different parties, including private plaintiffs.

Why two agencies, and what each one controls

The FCC’s authority flows from the TCPA, a 1991 statute governing how the phone network may be used for automated outreach. It restricts automatic telephone dialing systems and the use of artificial or prerecorded voices to reach cell phones. The FCC interprets the statute and can issue declaratory rulings that apply existing law to new technology, which is exactly what it did with AI voices.

The FTC’s authority flows from the Telemarketing Sales Rule, which governs what telemarketers may say and do. The TSR covers disclosures, prohibited practices, the National Do Not Call Registry, and recordkeeping. The FTC brings civil actions and seeks civil penalties, and state attorneys general can enforce parts of the same framework.

In practice the two overlap on every call. You need the TCPA consent to place an AI call to a cell phone, and you need TSR-compliant conduct during it. Sorting which agency governs which part of your operation is the first step in building a program that survives review. Our AI calling glossary defines the recurring terms if the acronyms are new to you.

The FCC February 2024 ruling, which is current law

On February 8, 2024, the FCC adopted a Declaratory Ruling that settled a question the industry had argued for years. Some operators claimed that real-time conversational AI was different from a prerecorded message and therefore sat outside the TCPA’s restriction on artificial or prerecorded voices. The Commission rejected that unanimously.

The ruling holds that technologies generating human-sounding voices, including voice cloning, large language model voice agents, and real-time conversational AI, are artificial voices under the statute. The TCPA does not carve out technologies that purport to provide the equivalent of a live agent. The classification applies whether the voice is generated in real time or played back from a model.

What that means operationally is simple. Any outbound call where software generates the voice carries the same consent requirement as a traditional robocall. Prior express consent is required for informational calls to a cell phone. Prior express written consent is required for marketing calls, and it has to be clear, voluntary, specific to automated calling, documented, and retrievable on demand.

An established business relationship does not cure the problem. If you have sold to a customer before but hold no documented written consent covering AI-generated marketing calls, you cannot use AI to call their cell phone for marketing. The ruling also strengthened the FCC’s ability to fine violators and to have carriers block traffic from bad actors, and it left private TCPA damages fully intact.

The one-to-one consent rule that never took effect

This is the single most common error in AI calling compliance content, so it is worth stating plainly. The FCC’s one-to-one consent rule, which would have required a consumer to consent separately to each individual seller rather than to a list of partners on a lead form, was vacated by the United States Court of Appeals for the Eleventh Circuit in January 2025. It never took effect. Any guide that describes it as binding in 2025 or 2026, or that gives it a January effective date, is wrong.

The operative federal standard remains ordinary prior express written consent under the TCPA. A consumer can still consent to be contacted by multiple sellers through a single disclosure, provided the disclosure is clear, conspicuous, and names or reasonably identifies who will be calling.

Adopting one-to-one consent as internal policy is still a defensible business decision. Litigation risk in lead-generation calling turns almost entirely on whether a jury believes the consumer understood who would call them, and a per-seller consent record is the strongest version of that evidence. Treat it as risk management rather than as a legal requirement, and do not let a vendor sell it to you as compliance with a rule that does not exist.

Consent revocation and the 2026 cross-channel deadline

The FCC formalized how consumers revoke TCPA consent in a rule whose core provisions took effect in April 2025. Consent may be revoked by any reasonable method. A consumer who says stop calling me on a live call, replies STOP to a text, or writes remove me in an email has revoked consent, and any further call or text to that number is a violation. Callers must honor the request within a short window, and they cannot force consumers into a designated opt-out format.

The piece that lands in 2026 is scope. Revocation in one channel has to apply across channels, so a STOP reply to a text suppresses calls as well, unless the consumer clearly limits the request to one type of message. Operations that run calling, texting, and email through separate systems owned by separate teams are the ones most exposed here, because the suppression has to propagate between them.

For AI calling specifically, the requirement is concrete. Your agent has to recognize a verbal stop request inside a live conversation, log it immediately, and push it to a shared suppression list before the next campaign runs. An opt-out captured in a transcript that nobody processes is worse than no capture at all, because it documents that you were told.

The August 2024 disclosure proposal, still not final

On August 7, 2024, the FCC issued a Notice of Proposed Rulemaking that would add AI-specific requirements on top of the February ruling. These are proposals. As of September 2026 they have not been finalized, and no federal rule currently compels a spoken AI disclosure.

The proposal would require three things.

• Upfront AI disclosure. The caller would have to state clearly at the start of the call that AI is generating the voice, conspicuously rather than buried mid-script.
• Consent language naming AI. Written consent forms would have to state explicitly that the person agrees to AI-generated calls and texts. General marketing consent language would not qualify.
• A two-second opt-out. An automated opt-out mechanism reachable by voice or keypress would have to be available within two seconds of the initial message.

The current Commission under Chairman Brendan Carr, who took the chair in January 2025, has signaled a lighter regulatory posture and has separately proposed trimming some existing TCPA and Do Not Call provisions. Whether this proposal is finalized, narrowed, or quietly shelved is unresolved. Track it, and note that disclosing AI use costs you nothing today and removes a rebuild later.

The FTC Telemarketing Sales Rule updates

The FTC moved through a different mechanism. It finalized amendments to the Telemarketing Sales Rule on March 7, 2024, effective April 2024. Three changes bear directly on AI calling. The full text as published in the Federal Register is available through govinfo.gov, and the FTC’s plain-language compliance material sits in its guide to complying with the Telemarketing Sales Rule.

Voice cloning falls inside the robocall prohibition

The FTC confirmed that the TSR’s existing prohibition on illegal robocalls reaches voice cloning technology, including entities providing digital soundboard technology used to mimic or clone individual voices on outbound calls. If your platform clones a voice to deliver calls, you are inside the robocall prohibitions rather than outside them.

Under the TSR, a robocall to a number on the Do Not Call Registry is a violation, and a robocall carrying a false or misleading message is a violation. Bringing voice cloning inside that definition means both apply to your AI calling program by default.

Business-to-business calls lost most of their exemption

The TSR historically excluded most business-to-business telemarketing. The 2024 amendment narrows that. Deceptive statements and material misrepresentations in B2B telemarketing are now prohibited, so unsupported claims about performance, pricing, return on investment, or capability create exposure even when the person answering is a business buyer.

This matters because a large share of AI calling programs target small business owners on personal cell phones. Teams used to point at the B2B exemption to explain why the TSR did not reach them. That argument is much weaker now, and it was never a defense to the TCPA in the first place.

Recordkeeping went from two years to five

The amended rule requires telemarketers to keep detailed records for five years rather than two. The list is longer than most teams expect.

• Call detail including numbers dialed, dates, times, and dispositions
• Customer information and purchase history
• Proof of any established business relationship you rely on
• Consent records, including recordings or documentation showing what the consent covered
• National Do Not Call Registry access and scrubbing logs
• Contracts with service providers, including any vendor supplying AI voice or soundboard technology
• Copies of every unique prerecorded message used

If you run AI calling through a third-party platform, the vendor relationship itself is now part of your record set. Deleting configuration exports or letting a contract lapse out of your archive after a campaign ends creates a gap you cannot fill later.

State laws that stack on top of federal rules

Federal law is the floor. Several states sit well above it, and a national campaign inherits the strictest rule that touches any number on the list.

Colorado’s effective date has already moved once, so confirm its current status with counsel before you build around it. The Act is enforced by the state attorney general and carries no private right of action, which makes it a different kind of risk from a TCPA class action.

Recording law is the quieter trap. About a dozen states require all-party consent to record a conversation, and the rule that applies is the one where the called party sits, not where your office is. California, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Oregon, Pennsylvania, and Washington are the usual list. If your platform records calls or captures transcripts through live audio processing, your opening script needs a recording disclosure for those states.

Penalties under current law

• TCPA statutory damages run $500 to $1,500 per call with no cap. A court may award $500 for each negligent violation and up to $1,500 for each willful or knowing one. There is no aggregate ceiling, so a 10,000-call campaign placed without proper consent carries theoretical exposure of $5 million to $15 million. Plaintiffs’ firms monitor AI calling programs specifically, and filings have climbed since the February 2024 ruling.
• TSR civil penalties exceed $50,000 per violation. The maximum is adjusted for inflation each year, so check the current figure rather than quoting an old one. The FTC can also seek injunctive relief, which in practice can mean shutting the program down.
• State penalties compound. Florida’s per-call penalties are high by design, Texas allows treble damages through its consumer protection statute, and coordinated actions by multiple attorneys general stack on top of private litigation rather than replacing it.

The honest read is that the damages numbers are worst-case arithmetic rather than typical outcomes. Most matters settle for far less. The reason to take them seriously is that the exposure is per call, which means a configuration mistake scales linearly with your dial volume.

What compliant AI calling requires right now

This is the minimum infrastructure, based on what is binding today rather than what has been proposed.

• Documented prior express written consent. Every cell number needs consent that specifically authorizes automated or AI-generated voice calls, captured voluntarily, timestamped, and retrievable. Consent gathered before February 2024 that never mentions automated or artificial voices may not hold.
• DNC scrubbing before every launch. Check the national registry ahead of each campaign rather than once at acquisition, and check state registries for Florida, Texas, and the others that maintain them. Keep your internal do-not-call list in the same workflow.
• Same-day opt-out processing. Any stop signal, including a verbal one captured mid-call, must reach your suppression list before the next call goes out, and it must cross into your text and email programs.
• AI disclosure in the opening. No federal rule requires it yet. Do it anyway. Complaint rates fall when the call is honest about what it is, and a call that misrepresents itself as human invites an FTC deception theory.
• Five years of records. Call logs, consent documents, scrubbing logs, opt-out records, and vendor contracts, all retained and actually retrievable.
• Calling windows enforced per record. Federal law permits 8am to 9pm in the called party’s time zone. Several states are narrower. Enforce it at the record level using the number’s time zone, not by rough geography.
• Recording disclosure where required. If you record, script the disclosure for all-party consent states and confirm your vendor stores the audio in a way your counsel is comfortable defending.
• Written vendor contracts on file. A third-party platform relationship is part of your five-year record set, not a procurement detail.

For how these controls look when they are built into the calling platform rather than bolted on, see our breakdown of what a TCPA compliant AI calling platform has to do.

Compliance mistakes that show up in litigation

The failure patterns are repetitive. Buying leads and never reading the consent disclosure the aggregator actually showed the consumer. Relying on an established business relationship for marketing calls. Treating a nationwide campaign as one configuration when four states on the list need their own.

Two more are specific to AI. The first is capturing a verbal opt-out in a transcript and never routing it to suppression, which converts a paperwork problem into documented knowledge. The second is letting the agent improvise claims about pricing or results, which is now actionable under the TSR even on business-to-business calls. Both are fixed in configuration, not in court. Our legal and compliance overview lays out the controls in more detail.

What is likely to change next

Three variables are worth watching through the rest of 2026 and into 2027.

The first is the direction of the current FCC. It has proposed streamlining or eliminating several TCPA and Do Not Call provisions, which could ease some obligations. The February 2024 AI ruling is not publicly under reconsideration, so plan on the consent requirement for AI voice calls surviving whatever else moves.

The second is the disclosure proposal. If it is finalized in any form, saying that a call uses AI becomes a script requirement rather than a good practice. Operations already disclosing have nothing to change. Everyone else rewrites their openings under a deadline.

The third is state enforcement. Attorneys general in California, Texas, Florida, and New York have been active in this area, and the February 2024 ruling gave states an explicit hook for AI calling violations. Expect state actions to grow faster than federal ones, because the state statutes are newer and the penalties are easier to calculate.

AI calling rules FAQ

Is AI cold calling legal in 2026?

Yes, when it is done with documented prior express written consent, current Do Not Call scrubbing, and compliant call timing. The FCC’s February 2024 ruling confirmed that AI-generated voices are artificial voices under the TCPA, which means consent is required before calling a cell phone. Without that consent, an AI call to a cell phone violates federal law regardless of how conversational the agent sounds or how useful the offer is.

What did the FCC rule about AI voices in February 2024?

On February 8, 2024 the FCC adopted a Declaratory Ruling holding that AI-generated voices constitute an artificial voice under the TCPA. It covers voice cloning, large language model voice agents, and any technology producing a human-sounding voice, whether generated live or played back. The ruling took effect immediately and requires prior express consent for such calls to cell phones, with written consent for marketing.

Is the one-to-one consent rule in effect?

No. The FCC’s one-to-one consent rule was vacated by the Eleventh Circuit in January 2025 and never took effect, so any source presenting it as binding law is out of date. The operative standard is ordinary prior express written consent, and a single clear disclosure naming the sellers who will call remains valid. Many lead buyers still collect per-seller consent voluntarily because it is stronger evidence in litigation.

Does the FTC regulate AI calling?

Yes, through the Telemarketing Sales Rule. The March 2024 amendments confirmed that voice cloning technology falls inside the TSR’s robocall prohibition, extended the misrepresentation prohibition to business-to-business telemarketing, and raised required recordkeeping from two years to five. The FTC can seek civil penalties and injunctive relief, and its rules govern conduct during the call rather than permission to place it.

Do I have to say that my call uses AI?

No federal rule requires it as of September 2026. The FCC proposed an upfront disclosure requirement in August 2024 and has not finalized it. Disclose anyway. Several states are moving toward their own disclosure requirements, complaint rates are lower when the call is upfront, and a call that presents itself as human can be attacked as deceptive under the FTC’s rules even without a specific disclosure mandate.

What is the TCPA penalty for an AI calling violation?

Statutory damages are $500 per negligent violation and up to $1,500 per willful or knowing violation, assessed per call, with no cap on the aggregate. A 10,000-call campaign placed without proper consent carries theoretical exposure between $5 million and $15 million. Most cases settle well below the arithmetic maximum, but the per-call structure means a configuration error scales directly with your dial volume.

What records do I need to keep for AI calling compliance?

Under the amended Telemarketing Sales Rule, five years of records. That includes call logs with dates, times and dispositions, consent documentation showing what the consumer agreed to, Do Not Call registry access logs, opt-out records, and written contracts with any AI calling platform or voice technology vendor. The vendor contract requirement surprises teams most often, because procurement records are usually kept on a shorter cycle.

What changes for consent revocation in 2026?

Scope. Consumers could already revoke consent by any reasonable method under the rule that took effect in April 2025. The 2026 development is that revocation in one channel carries across channels, so a STOP reply to a text has to suppress voice calls too unless the consumer limited the request. Operations running calling, texting, and email on separate systems need those suppression lists connected.

Are there state AI calling laws I need to follow?

Yes. Texas SB 140 extended telemarketing rules to texts and tied violations to treble damages from September 2025. Virginia SB 1339 requires honoring text opt-outs for ten years from January 2026. Florida’s Telephone Solicitation Act sets its own written consent standard with steep per-call penalties. Colorado’s AI Act adds notice and retention duties for high-stakes verticals including lending and insurance, after a delay to June 30, 2026.

Does the B2B exemption protect calls to business owners?

Only partly, and not enough to rely on. The TSR’s business-to-business exemption was narrowed in 2024, so misrepresentation rules now apply to those calls. More importantly, the exemption never applied to the TCPA at all, and most small business owners answer on personal cell phones, which brings the full consent requirement back regardless of how the lead was labeled.

The bottom line

The binding parts of the AI calling rules are narrower than the headlines suggest and stricter than most teams are actually operating. Consent before the call, honest conduct during it, revocation honored across every channel, and five years of records. One rule everyone quotes, one-to-one consent, was vacated and never applied.

Build for the rules that exist and adopt the proposed ones early where they are cheap. Disclosing AI at the top of a call and keeping per-seller consent records both cost almost nothing today and remove the scramble if either becomes mandatory. Have counsel review your consent language before volume goes up, because that is the one item you cannot retroactively fix.

Legal disclaimer. This post is informational and is not legal advice. Regulatory requirements change frequently and the summaries above are general. Consult qualified counsel before making compliance decisions about your outbound calling program.