AI Calling Compliance: TCPA, Recording and Disclosure Research

Start with the direction of the call

Most of the US consent law concerns calls a business initiates. Our reading, not legal advice, is that an AI receptionist answering a customer who calls in is in a different position from an AI agent that places outbound calls, though recording and disclosure rules can still apply to both. The sources below say which rule is about which direction, and where we are reading between the lines we say so.

US federal law: the TCPA and the 2024 FCC ruling

The Telephone Consumer Protection Act, at 47 U.S.C. section 227(b)(1), makes it unlawful to make any call, other than one made for emergency purposes or with the prior express consent of the called party, using an automatic telephone dialing system or an artificial or prerecorded voice. Section 227(b)(3) lets a person sue for actual monetary loss or $500 in damages for each violation, whichever is greater. If the court finds the violation willful or knowing it may increase the award to not more than three times that amount ¹.

On 8 February 2024 the FCC released a declaratory ruling (FCC 24-17, adopted 2 February 2024) confirming that the TCPA's restrictions on an artificial or prerecorded voice cover current AI technologies that resemble human voices or generate call content using a prerecorded voice. Callers must obtain the prior express consent of the called party before making a call that uses AI generated voice, absent an emergency purpose or exemption, and prior express written consent where the call is advertising or telemarketing. The ruling states that the TCPA does not allow any carve out for technologies that purport to provide the equivalent of a live agent, and that artificial voice messages must state at the start the identity of the business responsible for the call ².

The ruling concerns calls a caller initiates. It is silent on a customer calling in. State attorneys general and private plaintiffs can enforce the TCPA ^1,2.

The consent revocation rules are mid change

The FCC's 2024 order on how people revoke consent was due to take effect on 11 April 2025. On 7 April 2025 the FCC delayed only its 'revoke all' requirement, which treated an opt out from one type of call as an opt out from all, until 11 April 2026, and on 6 January 2026 it delayed it again to 31 January 2027 while it reviewed comments ³.

On 1 October 2026, after adopting it at its 30 September open meeting, the FCC released an order that replaces the 'revoke all' rule. According to a law firm alert, callers may treat an opt out from an informational robocall as applying only to that category, with telemarketing counted as one category, and may designate exclusive revocation methods if they clearly and conspicuously disclose them. Callers that do not designate a method must still honor revocation made by any reasonable means. The new rules take effect 30 days after publication in the Federal Register, which had not happened when the alert was published on 5 October 2026 ⁴. We read this on one law firm's summary and not on the order itself. Check the order before relying on it.

How much TCPA litigation is there?

TCPAWorld, a blog run by a class action defense lawyer, reported using WebRecon data that 1,052 TCPA class actions were filed in the first half of 2025 against 539 in the first half of 2024, a rise of 95.2%. It also reported that June 2025 alone had 257 TCPA cases, 202 of them class actions, or 78.6% ⁵. The blog's publisher sells legal services to defendants, and we did not open WebRecon's own report.

Recording calls: all party consent states

Recording rules are state law, and the strictest state in a call usually matters when callers and businesses are in different states, according to the guides we read. Rev's phone call recording guide, dated 1 November 2025, lists 11 states as requiring all parties to consent: California, Delaware, Florida, Illinois, Maryland, Massachusetts, Montana, Nevada, New Hampshire, Pennsylvania and Washington. It lists Connecticut, Michigan and New Jersey as nuanced or situational and notes that Nevada's statute reads as one party consent but its Supreme Court has interpreted it as requiring all parties for telephone conversations ⁶. A second guide counts 13 all party states by adding Connecticut and Michigan ⁷. Both are vendor guides, not statutes, and the count depends on how situational states are classified.

The point for AI agents is that a recording or transcript is made on every call. A voice agent that records or transcribes calls with callers in an all party state raises the same consent question that a human call recorder does.

AI vendors and wiretap claims: Ambriz v. Google

A newer risk is that the AI vendor, not just the business, is sued over call interception. In Ambriz v. Google, a putative class action in the US District Court for the Northern District of California about Google's Cloud Contact Center AI, the court denied Google's motion to dismiss on 10 February 2025. According to a Goodwin alert of 26 February 2025, the court held the plaintiffs plausibly alleged a wiretap under section 631(a) of the California Invasion of Privacy Act, that Google read the content in transit because it learned of it before or at the same time as the business customer, and it followed the 'capability test' from Javier v. Assurance IQ. Under that test a third party software provider can violate the law if its technology has the capability to use the data for its own benefit, whether or not it actually did ⁸.

This was a ruling at the pleadings stage, so the allegations are unproven. Goodwin notes the law is uncertain given a split between the capability test and a narrower 'extension' test. We could not confirm what happened to the case after that ruling, and a commentator suggests the standing question may now be raised on appeal. The alert recommends that customers disclose the use of third party AI voice technology and obtain the consent of both parties ⁸.

Telling people it is an AI

The EU AI Act's Article 50(1) requires providers to design AI systems that interact directly with people so that those people are informed they are interacting with an AI system, unless that is obvious to a reasonably well informed, observant and circumspect person. The article applies from 2 August 2026 ⁹. A Jones Walker article of 16 July 2026 reports that the Digital Omnibus delayed the high risk rules to 2 December 2027 and 2 August 2028 but left most Article 50 transparency obligations on their original date, with a grace period to 2 December 2026 only for marking of generated content in systems already on the market. It reports Article 50 breaches fall in the tier of up to 15 million euros or 3% of worldwide annual turnover, whichever is higher, with the lower figure applying to qualifying SMEs. Those are ceilings, not automatic penalties ¹⁰.

In the US there is no single federal duty to disclose an AI voice on an inbound call that we found. California's bot disclosure law, SB 1001, makes it unlawful to communicate with a person in California online with the intent to mislead them about the bot's artificial identity in order to incentivize a purchase or sale or influence a vote, and a clear, conspicuous disclosure avoids liability under it, per law firm summaries ¹¹. Utah's Artificial Intelligence Policy Act requires a person who uses generative AI to interact with a consumer to disclose, clearly and conspicuously, that it is generative AI if asked, with fines of up to $2,500 per violation, and has since been amended to focus on high risk interactions ¹². These two were read through law firm summaries only, and the Utah text has changed, so check the current statutes.

Disclosure is also a business question. In SurveyMonkey's December 2025 poll of 2,017 US adults, 89% said companies should always offer the option to speak to a person ¹³. In a 2019 randomized trial on more than 6,200 customers, disclosing that an outbound sales caller was a chatbot reduced purchases by more than 79.7% ¹⁴. Legal duties and commercial effects can pull in opposite directions.

What the evidence does not show

• This page is a research summary and not legal advice. Laws differ by state and country, change frequently and depend on facts. Talk to a lawyer before running outbound AI calls or recording calls.
• The 1 October 2026 FCC order was read through one law firm alert and not the order, and it was not in force when we checked. Earlier dates come from law firm summaries, not FCC documents ^3,4.
• The litigation counts come from a defense firm's blog quoting WebRecon, and we did not open WebRecon's report ⁵.
• State recording laws were read through vendor guides that disagree on the count, not through the statutes. We could not open the California Penal Code pages, which blocked our access ^6,7.
• The Ambriz ruling is a single pleadings stage order read through a law firm alert. We could not confirm the case's later history, and the law on whether vendors can be wiretappers is unsettled ⁸.
• The California and Utah AI disclosure rules were read through law firm summaries, and Utah's statute has been amended. Other states have their own rules that we have not covered ^11,12.
• We cover the US and the EU only. Rules in the UK, Canada, Australia and elsewhere differ, and we have not researched them.
• We found no study that measures how often AI calling or AI call recording leads to enforcement, apart from litigation counts for the TCPA generally.

Applying this as an agency

The sources suggest a short checklist to take to a lawyer for each client, not a legal conclusion. Is the call inbound or outbound? For outbound, where does consent come from and how is it recorded and revoked ^1,2,4? Are calls recorded or transcribed, and are any callers in all party consent states ⁶? Does the agent say it is an AI, and what do the laws of the caller's country require ^9,10? Which vendors sit in the audio path, and have they been told ⁸?

On Convocore each client has its own sub-account with its own agent, greeting and call logs, so disclosure wording and retention can be set per client. Software cannot decide the legal questions above. Get advice for each client's states and countries, and keep records of consent.

Method and limits

• Every number on this page comes from a source we opened and read on 9 October 2026, except where a source note below says we could only read a search summary.
• Sources are labelled primary (read at the original publisher), commissioned (paid for by a party with a commercial interest in the result), secondary (a report of the original) or forecast. Law firm alerts are labelled secondary, and statutes and agency rulings primary.
• Where sources disagreed or a figure could not be traced to an original, we left it out. Dates are given wherever the source gave them.
• Convocore sells white label AI phone agents and has a commercial interest in this market. We have included risks that argue for caution. If you find an error, write to support@convocore.ai and we will correct it.

Sources

1. 47 U.S.C. 227, Restrictions on use of telephone equipment (Telephone Consumer Protection Act)Primary source
   Legal Information Institute, Cornell Law School. Current US Code, read 9 October 2026.
   We read sections 227(b)(1) and 227(b)(3). The page is long and we read the first 100,000 characters of 132,090.
2. Declaratory Ruling, Implications of Artificial Intelligence Technologies on Protecting Consumers from Unwanted Robocalls and Robotexts, CG Docket No. 23-362, FCC 24-17Primary source
   US Federal Communications Commission. Adopted 2 February 2024, released 8 February 2024.
   We read the full ruling and the Chairwoman's statement. It concerns calls a caller initiates and does not discuss inbound calls.
3. The FCC Delays Effective Date of TCPA Revoke-All Rule Until January 31, 2027Secondary report
   Burr & Forman LLP. January 2026.
   A law firm summary. It states the 6 January 2026 order and the new date but does not say which other revocation provisions are in effect. The 7 April 2025 first delay and 11 April 2026 date come from other law firm summaries in search results.
4. FCC Replaces 'Revoke All' Rule and Permits Callers to Designate an Exclusive Revocation MethodSecondary report
   Manatt, Phelps and Phillips LLP. 5 October 2026.
   A law firm client alert on an order released 1 October 2026. We did not find or read the order. It was not yet published in the Federal Register when the alert was written.
5. Midyear Litigation Report: TCPA Class Actions Up Staggering 95.2% from 2024Secondary report
   TCPAWorld (Troutman Amin, LLP), citing WebRecon. 25 July 2025.
   A defense lawyer's blog. We did not open WebRecon's own report. We quote only the half year class action counts, the 95.2% rise and the June 2025 split as the blog states them.
6. Phone Call Recording Laws: What You Need to KnowSecondary report
   Rev. 1 November 2025.
   A transcription vendor's consumer guide, not a statute. It lists 11 all party states, 3 situational states and 38 one party states plus DC, and says to follow the strictest law for cross state calls and consult an attorney.
7. What is the Two-Party Consent State law and which states have that law?Secondary report
   Koncert support. Undated.
   A software support page. We read only a search summary, which reports 13 states including Connecticut and Michigan.
8. AI Voice Products Subject to California Invasion of Privacy ClaimsSecondary report
   Goodwin Procter LLP. 26 February 2025.
   A law firm alert on Ambriz v. Google (N.D. Cal., order of 10 February 2025). We did not read the order. The alert states no damages figures. We could not confirm the case's later history.
9. Article 50: Transparency Obligations for Providers and Deployers of Certain AI SystemsPrimary source
   EU Artificial Intelligence Act, text at artificialintelligenceact.eu (Future of Life Institute). Regulation (EU) 2024/1689; applies 2 August 2026.
   An unofficial but widely used copy of the Regulation's text. We read Article 50(1), (2) and (4). Check EUR-Lex for the official text.
10. Yes, August 2 Still Matters: The EU Approved a High-Risk AI Delay, but Most Transparency Obligations RemainSecondary report
    Jones Walker LLP. 16 July 2026.
    A law firm article. It says publication of the Omnibus in the Official Journal should be confirmed before relying on the delayed high risk dates. We did not read the Omnibus text.
11. I Am Robot: California's New Law Requires Disclosure of Use of Bots (SB 1001)Secondary report
    Perkins Coie LLP. 2018 to 2019.
    We read only search summaries of this and similar law firm pieces, not the statute (California Business and Professions Code section 17940 and following).
12. Utah Enacts Consumer Disclosure Requirements for Businesses Using Bots and Generative AISecondary report
    Davis Wright Tremaine LLP. April 2024, with later amendments.
    We read only a search summary. The summary also reports that the law was later amended to focus on high risk interactions, so the 2024 description may be out of date.
13. Customer service statistics: humans vs AI (2025 CX study)Primary source
    SurveyMonkey. Fieldwork 10 to 11 December 2025.
    2,017 US adults from a non-probability online panel, weighted to Census data, margin of error 2.5 points. SurveyMonkey sells survey software.
14. Frontiers: Machines vs. Humans: The Impact of Artificial Intelligence Chatbot Disclosure on Customer Purchases (Luo, Tong, Fang, Qu)Primary source
    Marketing Science, vol. 38, no. 6. Published online 20 September 2019.
    We read the abstract and introduction. Randomized field experiment, more than 6,200 customers, highly structured outbound sales calls, 2019 technology.

Questions

Related