TCPA Compliance for AI Cold Calling
Everything B2B sales teams need to run AI cold calling campaigns without getting sued. Consent, DNC rules, state calling windows, AI voice disclosure, and penalties — explained in plain English.
Last updated: September 2026 · Not legal advice — consult your attorney.
The 5-second summary
AI cold calling is lawful if you: (1) hold prior express written consent for every wireless and residential number you dial with an AI voice — 47 C.F.R. § 64.1200(a)(2) and (a)(3), which carry no B2B exemption and no established-business-relationship exemption, though a company's published landline sits outside them, (2) scrub against the National DNC Registry + state lists every 31 days, (3) call within legal windows (8am-9pm in the called party's local time), (4) honor opt-out requests within ten business days, and (5) disclose the AI at the beginning of the call rather than when asked. ClinchRev delivers that disclosure on every call; it cannot capture or verify consent, so item (1) is yours.
Is B2B AI cold calling TCPA-exempt?
Not for the calls most AI dialers actually place. A call to a business's published landline sits outside the artificial-voice consent rule. A call to a decision-maker's cell phone does not — and a purchased contact list is mostly cell phones. The exemption people mean when they say “B2B exemption” is about the number, not about the call being business-to-business, and it is not written into 47 C.F.R. § 64.1200(a)(2) as an exemption at all: that subsection simply never reached published business landlines in the first place.
The practical line for AI cold calling in 2026:
- Outside the rule: Direct-dial business numbers, switchboards, main lines, IVR receptionists, and numbers published in a company directory.
- Inside the rule — written consent required: Wireless numbers under § 64.1200(a)(2) and residential lines under (a)(3), including the cell phones of executives. The rule's only exceptions are tax-exempt nonprofits and certain HIPAA-covered healthcare messages. There is no business-to-business exemption, and the established-business-relationship exemption at § 64.1200(f)(5) applies only to telephone solicitations under the Do Not Call rules — it does nothing for you here.
- Not a grey area: Mobile numbers found on LinkedIn, in Apollo or ZoomInfo, or bought from a data vendor. Where a number came from is not a factor in § 64.1200(a)(2); the only question is whether it is a wireless number. If it is, you need written consent for it.
Worth being precise about the case everyone cites: the FTC's March 2026 settlement with Air AI was about deceptive marketing — false earnings claims and refund guarantees sold to small businesses, alongside Telemarketing Sales Rule violations — not about per-call TCPA damages. The order carries an $18M judgment, largely suspended for inability to pay, and a permanent ban on marketing business opportunities. The lesson for anyone buying an AI dialer is that what a vendor promises is enforceable too. The Air AI / FTC settlement guide covers what changed and how to stay clear.
What is the TCPA?
The Telephone Consumer Protection Act of 1991 (47 U.S.C. § 227) restricts telemarketing calls, auto-dialed calls, pre-recorded voice messages, text messages, and unsolicited faxes. The FCC enforces it; private plaintiffs can sue for $500-$1,500 per violating call.
In 2024, the FCC clarified that AI-generated voices fall under "artificial or prerecorded voice" — meaning AI calls require the same consent as traditional robocalls.
The 7 rules of AI cold calling compliance
Get prior express written consent before you AI-dial a cell phone
47 C.F.R. § 64.1200(a)(2) requires prior express written consent for an artificial-voice marketing call to a wireless number; (a)(3) requires it for a residential line. You need a signed form authorizing calls to that specific number. The rule's only exceptions are tax-exempt nonprofits and certain HIPAA healthcare messages — there is no B2B exemption and no established-business-relationship exemption. Calls to a company's published landline fall outside both subsections. ClinchRev cannot capture or verify consent.
Scrub DNC lists every 31 days
National DNC Registry ($82/area code/year in FY2026, $85 from 1 October 2026; first five area codes free) + state lists. Failure to scrub is strict liability — $500/call minimum.
Call only within legal hours
Federal: 8am-9pm local time, all seven days — there is no federal weekend or holiday exception. Some states have tighter windows. Use the called party's time zone, not yours.
Identify yourself at the start of the call
Name of the entity making the call + contact info. Required within first 2 minutes.
Honor opt-out requests within ten business days
The FCC's 2024 revocation rules cut the old 30-day outer limit to a reasonable time not exceeding ten business days (47 C.F.R. § 64.1200(d)(3)). If someone says 'take me off your list,' stop calling. Maintain an internal DNC list across all your numbers and entities.
Record and retain for 4+ years
Keep call recordings, consent records, and DNC scrub logs. You'll need them if sued. Four years matches the federal statute of limitations on a TCPA claim (28 U.S.C. § 1658); internal do-not-call requests must be honored for five years, and some state regimes run longer.
Disclose the AI at the beginning of the call
47 C.F.R. § 64.1200(b)(1) requires an artificial-voice call to identify the entity responsible for it at the beginning of the message, and FCC Declaratory Ruling 24-17 puts AI voices in that category. Say it unprompted in the opening seconds, and answer honestly if challenged later. ClinchRev's scripts carry this as a locked line that cannot be edited out.
State-specific "mini-TCPA" laws
Federal TCPA is the floor. Several states have stricter rules:
Florida
Requires prior express written consent for ALL marketing calls (Florida Telephone Solicitation Act). Penalties up to $500/call + attorneys' fees.
California
Higher consent standards via the California Invasion of Privacy Act (CIPA). Two-party consent for recordings.
Oklahoma
Mini-TCPA requires prior express written consent for telemarketing calls.
Washington
Limits telemarketing and requires disclosure of caller identity at the start of each call.
What ClinchRev does, and what stays with you
Compliance on an outbound program is split between the platform and the caller. Here is exactly where the line sits, so you can plan the rest of your process around it.
Built into the platform
- ✓ AI disclosure and a recording notice in every script. The agent says both, unprompted, within the first few seconds — “Quick honesty moment — I'm an AI voice agent, not a person, and this call is recorded” — and confirms it honestly whenever asked afterwards. The wording lives in a locked region of the script that the platform reattaches on every save, not in the part you edit.
- ✓ A script guard that rejects edits removing it. Any attempt — by you, by a teammate, by our own script optimizer, or through the API — to save a script with the AI disclosure, the opt-out handling or the calling-hours instruction stripped out is refused, and the account owner is notified.
- ✓ Automatic opt-out detection. When someone says “take me off your list”, “stop calling”, “remove me” or similar, the agent confirms it on the call and ends politely. Phrase matching plus an AI review of the transcript both run afterwards, so the opt-out is caught even if one of them misses it.
- ✓ An internal do-not-call list that covers your whole workspace. An opt-out is recorded against the phone number and email, then applied to every matching lead across all of your brands and pulled out of every campaign you are running. Reversing an entry takes a support request — it is deliberately not a button in the app.
- ✓ Calling windows and days you set per campaign. Start time, stop time, days of the week and time zone. Nothing dials outside them.
- ✓ Per-number daily calling caps. Each number has a daily ceiling that ramps up over its first 30 days and throttles back automatically if answer rates drop.
- ✓ Recordings and transcripts on every call. Both are stored and readable from the dashboard. See the retention note below for how long audio stays available.
Yours to run
- → National and state DNC registry scrubbing. ClinchRev does not hold a Registry subscription on your behalf and does not scrub your lists against the National DNC Registry or state registries. Registry access is licensed to the calling party under its own subscription account number, so scrub your lists with your own subscription or a scrubbing vendor and upload the cleaned result. The internal do-not-call list above sits on top of that — it is not a substitute for it.
- → Choosing calling hours that are legal for the people you are dialing. ClinchRev holds every campaign to the window you configure, in the time zone you pick. It does not look up where a prospect actually is, and it will not stop you setting a window that is outside 8am–9pm in their local time. Segment your lists by region and set each campaign's window accordingly.
- → Consent, and the decision about which numbers are lawful to dial. There is no consent field or signed-form upload in ClinchRev, and nothing in the platform checks whether a number is wireless or whether you hold written consent for it. Since 47 C.F.R. § 64.1200(a)(2) requires prior express written consent before an AI voice calls a wireless number, that check has to happen on your side before the list is uploaded. Keep the records wherever you collect them — CRM, form provider or document store — and keep them retrievable.
- → Legal advice. This guide is written by a software company, not a law firm. Nothing here has been reviewed by counsel, and we do not provide opinion letters. Have your own attorney sign off on your program.
State-by-state AI calling time windows (2026)
Federal law sets 8am–9pm at the called party's local time as the calling window, seven days a week — there is no federal weekend or holiday exception. A number of states are tighter. Below are the states whose windows we could tie to a specific statute or regulation; the rest currently track the federal floor.
Use this to decide what to set your campaign windows to. ClinchRev holds each campaign to the window and time zone you configure — it does not derive the prospect's local time or apply these state rules for you.
| State | Window | Sundays, holidays & other limits | Cite |
|---|---|---|---|
| Federal floor | 8am–9pm | None — the window runs all seven days, holidays included | 47 C.F.R. § 64.1200(c)(1); 16 C.F.R. § 310.4(c) |
| Rhode Island | Mon–Fri 9am–6pm; Sat 10am–5pm | No calls on Sundays or on state or federal holidays — the strictest state in the country | R.I. Gen. Laws §§ 5-61-2(2), 5-61-3.6 |
| Kentucky | 10am–9pm | Latest morning start in the country | KRS 367.46955(16) |
| Texas | Mon–Sat 9am–9pm | Sundays noon–9pm only | Tex. Bus. & Com. Code § 301.051 |
| Alabama | 8am–8pm | No calls on Sundays or holidays | Ala. Admin. Code r. 770-X-5-.17 |
| Louisiana | Mon–Sat 8am–8pm | No calls on Sundays or legal holidays; automated equipment is further restricted | LPSC Gen. Order R-29617 § V(A)(2); La. R.S. 45:811 |
| Mississippi | 8am–8pm | No Sunday calls | Miss. Code §§ 77-3-603, 77-3-723 |
| South Dakota | 9am–9pm | No Sunday calls | SDCL 37-30A-3(2) |
| Connecticut | 9am–8pm | Applies to the telephonic sales calls its mini-TCPA covers | Conn. Gen. Stat. § 42-288a(c) |
| Nevada | 9am–8pm | Tighter than federal at both ends | NRS 598.0918(3) |
| New Mexico | 9am–9pm | Later start than federal | NMSA § 57-12-22(B)(5) |
| Florida | 8am–8pm | Max 3 commercial calls per person per 24 hours on the same subject; prior express written consent required for automated or recorded marketing calls | Fla. Stat. §§ 501.616(6), 501.059(8)(a) |
| Oklahoma | 8am–8pm | Max 3 calls per person per 24 hours on the same subject | 15 O.S. § 775C.4(A) |
| Maryland | 8am–8pm | Max 3 solicitations per person per 24 hours on the same subject | Md. Com. Law § 14-4502(c) |
| Massachusetts | 8am–8pm | No Sunday or holiday rule in the operative regulation | 201 CMR 12.02(2) |
| Washington | 8am–8pm | Caller must identify itself within 30 seconds and end the call within 10 seconds of a request | RCW 80.36.390(8) |
| Wyoming | 8am–8pm | None identified | Wyo. Stat. § 40-12-302(d) |
| Indiana | 8am–9pm live; 9am–8pm autodialed | The tighter window applies only to automated dialing-announcing equipment | Ind. Code § 24-5-14-8 |
| Maine | 8am–9pm live; weekdays 9am–5pm autodialed | Automated calls limited to one per number per 8 hours | 10 M.R.S. § 1498(3) |
| Pennsylvania | 8am–9pm through 17 Oct 2026; Mon–Sat 9am–7pm from 18 Oct 2026 | Act 47 of 2026 adds a Sunday and legal-holiday ban from 18 October 2026 — confirm the final text before it takes effect | 73 P.S. § 2245(a)(1); Act 47 of 2026 |
| California | 8am–9pm (federal floor) | No stricter state window; CIPA two-party consent applies to recording, and prior express written consent is still required for AI-voice calls to cell phones | 16 C.F.R. § 310.4(c); Cal. Penal Code § 632 |
States not listed above track the federal 8am–9pm floor as far as we were able to verify; that is a research status, not a legal conclusion, and several widely circulated compliance charts contain Sunday restrictions we could not find in the statutes they cite. Windows run on the called party's local time, and an area code is not a location — a 212 number can ring in California.
This table is for reference only. Consult legal counsel for your specific situation. State laws change frequently.
TCPA consent requirements for AI calling
Prior Express Written Consent (PEWC) is the gold standard for AI and autodialed calls to cell phones for marketing purposes. Under the TCPA, a valid PEWC must include a clear written agreement (digital signatures are acceptable) that specifically authorizes calls to the number provided, discloses that the calls may be autodialed or use an artificial or pre-recorded voice (including AI voice), and explicitly states that consent is not a condition of purchase. Without all three elements, the consent does not satisfy TCPA requirements.
Several common consent practices do NOT satisfy PEWC requirements. General website terms of service that include buried consent language are insufficient. Pre-checked consent boxes do not constitute affirmative agreement. Verbal-only consent is not valid for autodialed or AI-voice marketing calls to cell phones — it must be written or digitally documented. The consent must also be specific to the calling entity; consent given to a third party does not automatically transfer. Under TCPA, consent has no set expiration, but best practice is to re-confirm consent every 18 months, particularly for large lists that may include numbers transferred to new owners.
The B2B exemption is frequently misunderstood. Calls to business landlines published for business use — a main company phone number listed on a website — fall outside the artificial-voice consent requirements at 47 C.F.R. § 64.1200(a)(2) and (a)(3). The cell phones of business contacts do not, even when those individuals are being called in a business context. If you are AI-dialing the mobile number of a VP of Sales, the written consent requirement applies regardless of whether the call is a business pitch.
The established business relationship is misunderstood the same way, and more dangerously. An existing customer or a contact you have done business with before does not give you a basis to place an artificial-voice call to their mobile. The established-business-relationship exemption is defined at § 64.1200(f)(5) “for purposes of telephone solicitations” — the Do Not Call registry rules under 47 U.S.C. § 227(c) — and at (f)(6) for faxes. It has no application to § 64.1200(a)(2). The exceptions that subsection does contain are tax-exempt nonprofits and certain HIPAA-covered healthcare messages, and that is the whole list.
Valid consent examples
- ✓ Signed lead form with explicit AI calling disclosure
- ✓ Digital checkbox (unchecked by default) with clear consent language
- ✓ Event registration form with TCPA disclosure and specific phone number field
- ✓ Text-to-consent (double opt-in via SMS confirmation)
- ✓ Consent not bundled as condition of purchase
Invalid consent examples
- ✗ General website TOS that mentions "communications"
- ✗ Pre-checked consent box on checkout
- ✗ Verbal agreement on a recorded call (not written)
- ✗ Consent to receive emails only (does not cover AI calls)
- ✗ Third-party list where original consent entity differs
Handling a TCPA complaint
If you receive a TCPA complaint — a demand letter, a regulatory inquiry, or a direct message from a prospect claiming you violated their rights — the steps you take in the first 48 hours matter significantly. Here is the recommended response framework:
- 1
Document everything immediately
Preserve all call recordings, consent records, DNC scrub logs, and campaign configuration for the period in question. Do not delete or alter any records. If your records are in a SaaS platform, export and archive them locally.
- 2
Assess class action risk
A single complaint may be opportunistic. Multiple similar complaints — same time period, same campaign, same type of claimant — may indicate an organized class action effort. Elevated risk warrants immediate counsel involvement.
- 3
Check your consent records for the complainant
Pull the specific phone number from your consent database. Verify that you have a valid PEWC record, that the DNC scrub was run within the required 31-day window, and that the call occurred within legal hours. Your records are your primary defense.
- 4
Add the number to your internal DNC list immediately
Regardless of whether you believe the complaint has merit, add the complainant's number to your internal Do Not Call list now. Further contact while a complaint is active will be treated as willful violation ($1,500/call).
- 5
Do not contact the complainant again
Not to apologize. Not to explain. Not to resolve informally. Any contact can be used as evidence of continued violation or as an admission. All further communication should go through legal counsel.
- 6
Consult telemarketing compliance counsel
TCPA litigation is a specialized area. Engage an attorney with specific TCPA defense experience. General business lawyers often underestimate the complexity of class certification risk and statutory damages calculations.
- 7
Let your records be your defense
If a lawsuit is filed, your consent records, DNC scrub logs, and call recordings are your primary evidence. Courts have ruled in favor of defendants who maintained clean, documented consent and scrub processes. Four years of retention is the sensible floor, since that is how long a federal TCPA claim can be brought.
What ClinchRev holds, and for how long: every call produces a call log — timestamp, number dialed, outcome, duration and a full transcript — and those stay in your dashboard for as long as your account is open. Recordings work differently: our voice provider deletes its copy 14 days after the call, so ClinchRev copies the audio into its own storage inside that window and serves your copy from there afterwards. If a recording is never available to copy during those 14 days, that audio is not recoverable.
ClinchRev does not publish a guaranteed retention period beyond that, and there is no one-click “compliance audit package” button. If you need records held for a set number of years — four is the usual floor, and some states point to longer — pull them yourself: the API returns each call's transcript, outcome, timestamps and recording URL, so you can mirror them into your own archive on whatever schedule you want. Opt-outs are the exception: do-not-call entries are never aged out, and removing one takes a support request rather than a click.
The 2024 FCC ruling and what it means for AI calling
On 8 February 2024, the FCC released Declaratory Ruling 24-17 in CG Docket 23-362, confirming that AI-generated voices constitute an "artificial or prerecorded voice" under the TCPA. This ended a legal gray area that some AI calling companies had exploited. From the ruling forward, AI-generated voice calls require the same prior express written consent as traditional robocalls — the ruling says so at paragraph 5 and cites 47 C.F.R. § 64.1200(a)(2) directly.
The ruling was triggered in part by the use of AI-generated voices in political robocalls — including a fake AI audio impersonating a presidential candidate telling people not to vote. The FCC moved swiftly to close the loophole. The AI voice = robocall standard now applies to all commercial outbound calling.
For B2B sales teams, the practical impact is blunt: if you are dialing a cell phone with an AI voice, you need prior express written consent for that number. A cell phone does not stop being a cell phone because its owner uses it for work, and § 64.1200(a)(2) has no B2B exemption and no established-business-relationship exemption to fall back on. A company's published landline is outside the rule; a mobile number bought from a data vendor is not. AI cold outbound to purchased mobile lists without written consent is what the ruling makes unlawful, and the exposure is $500 per call, trebled to $1,500 if the violation is willful, with a private right of action and no aggregate cap.
ClinchRev was built after the 2024 FCC ruling, so the disclosure requirement shaped the product rather than being retrofitted onto it: the AI states that it is an AI unprompted in the opening seconds of every call, confirms it honestly when challenged, and the script guard refuses to save a version with that language taken out. What the platform cannot do is supply the consent — there is no consent field in ClinchRev, so whether a given number is lawful to dial with an AI voice is settled before the list reaches us. Opt-outs are detected automatically and suppressed across your whole workspace. Registry scrubbing, calling hours keyed to where the prospect actually is, and consent records stay with you — see the split above for the full line.
Frequently asked questions
Is AI cold calling legal under the TCPA?+
It depends on the number you dial, and the rule is narrower than most vendors imply. An AI-generated voice is an 'artificial voice' under the TCPA (FCC Declaratory Ruling 24-17, CG Docket 23-362, released 8 February 2024). For a marketing call placed with an artificial voice, 47 C.F.R. § 64.1200(a)(2) requires prior express written consent before you dial a wireless number, and (a)(3) requires it for a residential line. The only exceptions written into that rule are calls by tax-exempt nonprofits and certain HIPAA-covered healthcare messages. There is no business-to-business exemption and no established-business-relationship exemption: the established-business-relationship exemption at § 64.1200(f)(5) applies only 'for purposes of telephone solicitations' under the Do Not Call rules, which is a different obligation in a different subsection. A company's published landline sits outside (a)(2) and (a)(3) altogether. Consent is on top of, not instead of, DNC scrubbing, legal calling hours and AI disclosure. ClinchRev has no field to capture or verify consent, so holding it — and being able to produce it — is yours.
What are TCPA penalties for AI calls?+
$500 per negligent violation, $1,500 per willful violation. Penalties apply PER CALL, not per recipient. Class actions have resulted in $10M+ settlements against solar, insurance, and debt collection companies using AI or auto-dialers without consent.
Do I need to disclose that the caller is AI?+
Yes, and at the start of the call rather than when someone asks. FCC Declaratory Ruling 24-17 (CG Docket 23-362, released 8 February 2024) treats AI-generated voices as an 'artificial voice' under the TCPA, which brings 47 C.F.R. § 64.1200(b)(1) with it: an artificial-voice call must identify the entity responsible for it at the beginning of the message. Waiting to be challenged is weaker than the rule. ClinchRev does not leave this to the script author — every script carries a locked line the agent delivers unprompted in the opening seconds: 'Quick honesty moment — I'm an AI voice agent, not a person, and this call is recorded.' Saving a script with that line removed is refused and the account owner is notified.
What counts as 'prior express written consent'?+
A signed form (digital signature ok) that (1) specifically authorizes calls to a provided phone number, (2) discloses that the calls may be autodialed or use pre-recorded/AI voice, and (3) is not a condition of purchase. Checkboxes on a form are acceptable if clearly worded.
What about B2B calls — does TCPA apply?+
To the number, not to the conversation. A call to a company's published main line is outside the artificial-voice consent rule at 47 C.F.R. § 64.1200(a)(2) and (a)(3). A call to a person's cell phone is inside it, and nothing about the call being a business pitch changes that — § 64.1200(a)(2) contains no business-to-business exemption and no established-business-relationship exemption. If you are AI-dialing the mobile of a VP of Sales, you need prior express written consent for that number.
How often do I need to scrub DNC lists?+
Minimum every 31 days for the National DNC Registry. State DNC lists may have different requirements. ClinchRev does not scrub against the National or state registries on your behalf — registry access is licensed to the calling party, so you scrub with your own subscription or a scrubbing vendor and upload cleaned lists. ClinchRev maintains an internal do-not-call list on top of that: anyone who opts out on a call is suppressed across every campaign in your workspace, permanently.
What are the calling time windows?+
Federal: 8am-9pm in the called party's local time zone. Many states have tighter windows (e.g., Pennsylvania: no calls on Sundays, Massachusetts: no calls before 8am).
The compliance tooling, built in from day one
Unprompted AI disclosure and a recording notice on every call, a script guard that will not let them be removed, workspace-wide opt-out suppression, and calling windows you control. Consent and registry scrubbing stay with you. Free 20 AI minutes to test.
Start Free Today