Voice AI Compliance 101: How to Stay Legal Across TCPA, GDPR, and 50+ Countries

You want AI on the phones because leads go cold in minutes and your team cannot dial fast enough. Your lawyer wants to know why an automated voice is calling consumers in three countries. Voice AI compliance is where those two conversations meet, and it is far more learnable than most teams expect.

Every market runs on the same skeleton: get permission, respect the do not call lists, call at humane hours, say who you are, and stop when asked. The details differ, and the details are what regulators fine. The United States prices violations per call. Europe prices them as a share of revenue. India decides whether your calls connect at all.

This guide maps the rules that govern AI calling, SMS, and WhatsApp across the markets most teams sell into. Treat it as a working map rather than legal advice, and have counsel sign off before your first campaign.

Voice AI compliance at a glance

Here is the map before the territory. Each jurisdiction gets its own section below; this table is the version you print.

TCPA rules and the FCC ruling on AI voices

The Telephone Consumer Protection Act is the US baseline for automated calling, and it grew teeth for AI in February 2024, when the FCC ruled that AI generated voices count as artificial voices under the law. An AI sales call to a consumer now sits in the same category as a prerecorded robocall: marketing requires prior express written consent, not a purchased list and good intentions.

Written consent has a specific shape. It must:

• Be in writing, with electronic signatures accepted
• Name the business authorized to call
• Specify the phone number being consented to
• Not be a condition of buying anything

A web form with a clear checkbox does the job. A scraped list never does.

The US position has moved since this section was first written: the revocation rule took effect in April 2025, and the one to one consent rule was struck down in January 2025. Our deep page on TCPA compliance for AI voice agents sets out the current state with the FCC orders attached.

Consent is the start, not the whole obligation. Scrub every campaign against the National Do Not Call Registry, maintain your own suppression list, and honor a "stop calling me" the moment it is said, permanently. Calls are allowed between 8am and 9pm in the recipient's local timezone, caller ID must be accurate, and every call needs a working opt out. The statute sets damages of 500 to 1,500 dollars per call or text, there is a private right of action, and class actions multiply the number fast.

One useful exception: the established business relationship. A purchase within the past 18 months, or an inquiry within the past three, opens a window to call without separate written consent, provided your form disclosed it. A demo request from yesterday is callable. A trade show badge scan from two years ago is not.

US state rules: CCPA, Florida, and beyond

Federal law is the floor, not the ceiling. California's CCPA and CPRA give residents the right to know what data you hold, to have it deleted, and to opt out of its sale, so your privacy notice has to say what your AI does with call data. Florida runs its own do not call list on top of the federal registry and gives consumers their own path to sue over automated calls. Texas expects the company's name and contact details disclosed early in the call, and Oklahoma keeps a state DNC list of its own.

Tracking fifty variants is not a strategy. The working posture: comply with the strictest states you call into, apply that posture everywhere, and let the easier states inherit it.

GDPR and lawful basis for AI calls in the EU

GDPR applies to any company processing personal data of EU residents, wherever that company sits. Phone numbers, recordings, transcripts, and CRM notes all qualify. Before an AI agent dials, you need a lawful basis, and for outreach that means one of two things.

Consent is the clean path: freely given, specific, informed, unambiguous, and never a pre-ticked box. Legitimate interest can cover a relevant follow up the person would reasonably expect, like a call back on the inquiry they submitted this morning, as long as opting out is easy. Cold promotional calling on legitimate interest is where companies get hurt; when the campaign is marketing, consent is the safer basis.

The obligations continue after the call. Individuals can demand access to their data or its deletion, and you have about a month to comply. Retention must be justified: recordings kept forever "for training" is exactly the pattern regulators dislike. And if a vendor processes call data on your behalf, a data processing agreement defining who does what is mandatory, not paperwork theater.

UK rules: PECR and the Telephone Preference Service

The UK pairs its version of GDPR with PECR, the regulation that speaks directly to marketing calls. Two things matter most. First, screen against the Telephone Preference Service before any consumer marketing call; numbers on the TPS are off limits without consent. Second, PECR holds automated marketing calls to the highest bar of all: prior consent, no exceptions. Where a conversational AI agent lands on that spectrum is a live question, so the safe posture for AI calling in the UK is consent.

Business to business calling gets more room under legitimate interest, with corporate TPS screening and a working opt out still required. The ICO publishes plain English guidance on all of it and enforces with fines of up to 500,000 pounds.

India: TRAI, DND, and the 140 and 1600 series

India regulates commercial calling harder than almost anywhere, through TRAI's Telecom Commercial Communications Customer Preference Regulations. The system is built on registration. Businesses and their telemarketers register on the carriers' DLT platforms, headers and message templates get approved in advance, and the TRAI DND registry lets any subscriber block promotional traffic entirely. Scrubbing against DND is not optional.

Number series do the signaling. Promotional telemarketing calls originate from numbers starting with 140, and the 1600 series is reserved for transactional and service calls from banks and other principal entities, so recipients and carriers can tell traffic apart at a glance. Promotional calls from ordinary 10 digit mobile numbers are exactly the traffic carriers block and penalize, and promotional windows are limited to daytime hours.

For teams running multilingual voice AI across India's markets, this registration layer is the first build task, before a single Hindi or Tamil prompt gets written.

India moved again in February 2025: senders must now notify their access provider in writing before using an auto dialer, and the penalty schedule bars or disconnects telecom resources rather than issuing fines. The deep page on TRAI rules for AI voice agents works through the current regulation.

Canada, Australia, and Brazil

Canada's CASL requires express or implied consent for commercial electronic messages, and implied consent expires: roughly two years after a purchase, six months after an inquiry. Telemarketing calls run through the national DNCL on top of that, and penalties reach 10 million Canadian dollars per violation for businesses, so Canadian lists deserve the same hygiene as US ones.

Australia's Do Not Call Register Act requires scrubbing the national register, and the industry standard confines telemarketing to weekdays 9am to 8pm and Saturdays 9am to 5pm, with Sundays and public holidays off the table.

Brazil's LGPD tracks GDPR closely: consent for marketing communications, rights of access, correction, and deletion, and fines that can reach 2 percent of local revenue per violation, capped at 50 million reais. If your process satisfies GDPR, Brazil is mostly a translation exercise.

Channel rules: WhatsApp templates and A2P 10DLC

Platforms enforce faster than regulators. WhatsApp requires a documented opt in before your first message, gives you a 24 hour session window after a user replies, and outside that window allows only message templates Meta has approved in advance. Its quality rating tracks block and report rates; let them climb and your sending capacity shrinks well before the number gets banned. Recovery is slow enough that prevention is the only sensible plan.

US SMS adds a carrier layer on top of the TCPA: A2P 10DLC registration through The Campaign Registry, covering your brand and each messaging use case. Unregistered traffic gets filtered aggressively, which shows up as delivery rates quietly collapsing rather than an error message. Who owns this registration work, you or your vendor, is one of the sharper differences between buying a platform and hiring a partner; our comparison of Kaigen Labs and Retell AI shows where that line falls.

Call recording laws by region

Recording is worth doing: it powers quality review, dispute resolution, and agent improvement. The rules are about notice. Most US states require only one party's consent, but a meaningful set, including California, Florida, Illinois, Massachusetts, Pennsylvania, and Washington, require everyone on the line to agree. The EU expects notice at the start of the call plus a retention period you can defend. Canada and Australia vary by province and state, and the UK's ICO recommends notification as good practice.

The fix is one sentence. Open every call with a recording disclosure and the option to object, and you satisfy the strictest jurisdiction on the list while sounding more professional in all the others.

What a compliant AI calling setup looks like in practice

Very little of this is legal work. Most of it is plumbing: DNC and DND scrubs that run before every campaign rather than once at import, timezone gating on the dialer, opt out detection inside the conversation that writes to a suppression list in real time, consent records with timestamps, retention policies that delete recordings on schedule, and disclosure lines built into every script.

The question is who builds and runs that plumbing. On a raw platform it is your engineers, indefinitely. A managed deployment ships with it: when the Kaigen team builds an agent, consent capture, scrubbing, and disclosure are wired in during the Build phase of the Kaigen Method, and pilots go live in two to three weeks with the compliance posture already in place. The broader split of who owns what is covered in what a managed voice AI partner takes off your plate.

Before you launch, four questions expose most of the gaps.

Run these honestly and compliance stops being the scary part of voice AI. It becomes the reason your calls sound more professional than the spam your prospects screen out, and the reason a procurement or legal review does not stall your rollout.

FAQ

Does the TCPA apply to AI generated voice calls?

Yes. The FCC ruled in February 2024 that AI generated voices are artificial voices under the TCPA, so marketing calls that use them require prior express written consent, accurate caller ID, and an opt out that works immediately.

Can my AI agent call a lead who filled out a web form?

In the US, an inquiry creates an established business relationship you can call for about three months, provided the form disclosed it. In the EU and UK, a prompt follow up on a direct inquiry can rest on legitimate interest, but consent is the safer basis for anything promotional.

What are India's 140 and 1600 number series?

TRAI assigns promotional telemarketing calls to numbers starting with 140 and reserves the 1600 series for transactional and service calls, so recipients and carriers can tell traffic apart. Register on the DLT platforms and scrub the DND registry before dialing, or your calls get blocked.

Do I have to tell people they are talking to an AI?

Disclosure rules are tightening in several jurisdictions, and US rules for artificial voice calls already require identifying the caller. An honest introduction costs nothing, builds trust, and protects you as the rules keep moving.

Can I record calls in two party consent states?

Yes, once everyone on the line consents. A recording announcement at the start of the call, with a genuine option to object, satisfies two party states and is good practice in every other market.