Legal, with consent, inside the windows, off the do-not-call list, identified, and in some states disclosed. Illegal without those. Most of the confusion in this category comes from vendors who skip the first condition. Here's what the rules say, with the citations, and what "calling your own inbound leads" has to look like to stay inside them.
This is not legal advice. I'm a founder who built a calling product and read the regulations closely. Bring your counsel; we'll answer their questions straight.
An AI voice is an "artificial voice" under the TCPA
On February 8, 2024, the FCC issued a unanimous declaratory ruling that AI-generated voices fall under the Telephone Consumer Protection Act's existing restrictions on "artificial or prerecorded" voices (2024). That ruling didn't create a new law. It confirmed that the 1991 statute and the FCC's implementing rules in 47 CFR 64.1200 apply to an AI agent exactly as they apply to a recorded message.
Consent: what kind, and for what
Under 64.1200(a)(2) and (a)(3), a telemarketing call using an artificial or prerecorded voice to a cell phone or residential line requires the called party's prior express written consent. The rule defines that in (f)(9) as a written agreement, bearing the signature of the person called, that clearly authorizes the seller to deliver telemarketing calls using an automated system or an artificial voice to a specific number (2026). Electronic signatures count; a checkbox on a web form with the right disclosure language is the usual mechanism.
Two things people get wrong here.
First, "they filled out my form" isn't automatically consent for an AI voice. The form has to say that the submitter agrees to receive calls using automated technology or an artificial voice from your company, and you have to keep the record. If your form says "we'll be in touch," you have an inquiry, not written consent.
Second, an existing customer relationship isn't a substitute. An established business relationship is an exemption from the national Do Not Call registry rules, not from the artificial-voice consent requirement. Your own customers on a quarterly plan still need written consent before an AI calls their cell phones about an add-on.
A note on the one-to-one rule: the FCC adopted a stricter rule in late 2023 requiring consent to name one seller at a time, which would have made most shared-lead forms non-compliant. The Eleventh Circuit vacated it on January 24, 2025, days before it took effect, holding that the FCC exceeded its authority (2025). The pre-existing written-consent standard above is what applies today.
Identification and the do-not-call list
Under 64.1200(b), an artificial or prerecorded message must state the identity of the business at the beginning of the call and provide a callback number. Under 64.1200(d), anyone making such calls must keep a written do-not-call policy, maintain an internal do-not-call list, and honor a request to stop within a reasonable time, which the rule caps at 10 business days (2026). The national registry, run by the FTC, is separate and has to be scrubbed as well; consent and an established business relationship are the exemptions, and both have to be documented.
Calling windows
Federal law bars telephone solicitations before 8 a.m. or after 9 p.m. local time at the called party's location (64.1200(c)(1)). Several states set narrower windows or add Sunday and holiday restrictions, so the window has to be computed per state, not per office.
State disclosure laws
Two states are worth naming for an AI voice product.
Utah's Artificial Intelligence Policy Act, in force since May 1, 2024 and amended in 2025, requires a clear and conspicuous disclosure that a consumer is interacting with generative AI when the consumer clearly and unambiguously asks (2025).
California's bot disclosure law, Business and Professions Code 17940 and following, makes it unlawful to use a bot to communicate with a person in California with intent to mislead them about its artificial identity to incentivize a purchase, and provides that disclosure of the bot's identity is a defense. The statute is written for online interactions, and 2025's AB 410 tightens it (2025). Whether it reaches a phone call is a question for counsel. The safe answer is to disclose anyway, which is the default most of our customers choose. Either way, the agent never claims to be human.
Recording consent
Thirteen states require all parties to consent to a recording: California, Connecticut, Delaware, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Pennsylvania and Washington (Reporters Committee for Freedom of the Press, current guide). In most of those, an announcement at the top of the call that it is recorded satisfies the requirement. Every call on our platform is recorded for the customer's audit trail, and the recording notice is a per-account setting.
What "calling your own inbound leads" has to look like
Put together, a compliant AI call to an inbound lead requires:
- A form, ad or vendor lead that captured prior express written consent for automated and AI-voice calls on behalf of your company, with the language and timestamp stored.
- A do-not-call scrub, internal and national, before every dial.
- A dial inside the called party's local calling window.
- The company's name in the first sentence, and a disclosure that the caller is an AI where state law or your policy requires it.
- A recording notice where the called party's state requires all-party consent.
- Immediate honoring of any opt-out, on the call.
That's the checklist we walk through with every customer before launch. Where a list can't meet item 1, we say so before the first dial, not after. The full posture is on trust, and the planned TCPA and AI calling page will keep this current as the rules move.