The Telephone Consumer Protection Act (TCPA) wasn't written for AI voice agents — but courts are applying it to them anyway. This is the 2026 compliance guide every B2B sales team running AI cold calling needs to read before they dial their next number.
This is a long-form reference. Use the table of contents to jump to the section you need.
What the TCPA Actually Says
Passed in 1991 and amended by the Pallone-Thune TRACED Act (2019) and recent FCC declaratory rulings, the TCPA governs:
- Autodialed calls to wireless numbers (requires prior express consent)
- Pre-recorded / artificial voice messages (requires prior express written consent for telemarketing)
- Calls to numbers on the Do-Not-Call Registry (prohibited unless existing business relationship exists)
- Calling windows (8:00 AM – 9:00 PM local time of the called party)
Statutory damages: $500 per violation, trebled to $1,500 for willful violations. Class actions are common and devastating — average B2B TCPA class settlements run $5M–$40M.
Why AI Cold Calling Adds New Risk
The FCC's February 2024 declaratory ruling clarified that AI-generated voices qualify as "artificial or prerecorded voice" under the TCPA. Translation: every AI outbound call to a wireless number now requires prior express written consent — the strictest consent standard under the Act.
Three AI-specific risk factors every sales leader should understand:
- Voice cloning — If your AI uses a cloned human voice, some state AGs argue this increases deception liability
- Call cadence — AI platforms that dial 24/7 can easily stray outside legal windows as prospects move across time zones
- Disclosure timing — Several states (FL, WA, IL) now require AI self-identification within the first 5 seconds of connect
State-Level Layers (Where It Gets Ugly)
Federal TCPA is the floor. These states have added stricter rules:
| State | Key Requirement | Damages |
|---|---|---|
| Florida (FTSA) | Written consent for all telephonic sales calls | $500–$1,500/call |
| Washington (CEMA) | AI must identify as AI at start of call | $500/call + fees |
| Oklahoma (OTSA) | Mirrors FTSA; strict written consent | $500–$1,500/call |
| Maryland (MTCPA) | Restrictive calling windows + ID disclosure | $500/call |
| California | CCPA applies to call recordings as PII | Varies |
What "Prior Express Written Consent" Actually Means
To qualify:
- Written (typed into a form, digital signature accepted)
- Names the specific seller authorized to call
- Includes a clear disclosure that consent isn't required for purchase
- Identifies the phone number being consented on
- Must be freely given, not bundled into unrelated Terms of Service
A checkbox buried in a 40-page ToS won't survive discovery. Use a dedicated opt-in with explicit language.
The "Safe Harbor" Playbook
There's no statutory safe harbor in the TCPA, but courts consistently protect defendants that can show:
- Active DNC scrubbing against the Federal + applicable state registries (at least every 31 days)
- Written consent records tied to the specific contact + phone number
- Calling window enforcement by local time
- Internal DNC honoring — stop calling anyone who has asked to be removed
- Training + monitoring logs for the calling team (or AI model updates)
- Written TCPA policy reviewed annually
The Express Consent Workflow for B2B AI Calling
For B2B teams, the cleanest flow looks like this:
- Collect the business phone number on a form (webinar signup, gated asset, demo request)
- Disclosure reads: "By checking this box, you authorize [Your Company] and its AI calling assistant to contact you at [number] regarding [product/service]. Consent is not a condition of purchase. Msg & data rates may apply."
- Store timestamp, IP, form URL, and exact disclosure text on the contact record
- Route only consented numbers to AI outbound; unconsented numbers go to manual SDR dialing with human consent capture
AI Self-Identification Best Practices
Even where not legally required, AI self-identification dramatically reduces complaints and regulatory risk. ClinchRev's default opener:
"Hi, this is Alex — I'm an AI assistant calling on behalf of [Your Company]. Do you have 30 seconds? I can take you off our list any time."
This satisfies every state disclosure rule we've seen and measurably increases connect-to-conversation rates because prospects aren't suspicious.
Litigator Scrubbing
Professional TCPA plaintiffs maintain lists of "cell phones used to bait telemarketers." Several compliance vendors sell updated litigator databases. Every AI cold calling platform should scrub against them before dialing. If yours doesn't, that's a red flag.
FAQ
Does the TCPA apply to B2B calls?
Partially. Pure landline-to-business calls with no prerecorded content are largely exempt. Once you hit a wireless number (most decision-makers today) or use AI voice, you're in TCPA territory.
What if my prospect gave a business card?
Courts split on whether a business card equals express written consent. Assume no and get a proper digital opt-in.
How long do I have to retain consent records?
At least 4 years (federal statute of limitations). Many compliance counsel recommend 7 to cover state extensions.
Does ClinchRev handle this automatically?
Yes — DNC scrubbing, state DNC registries, litigator lists, calling windows, AI self-ID, and consent recording are all built in. See our compliance stack.