Voice AI Compliance: Consent, Recording and Calling Rules
What you must get right before an AI agent calls anybody — consent, calling windows, recording notice, AI disclosure — across the US, UK, EU, Kenya and Nigeria.
On this page
Telecoms and privacy rules differ by jurisdiction and by industry, and they change — the AI-specific ones are changing quickly. What follows is a map of the questions you must have answers to, with the current shape of the rules in five markets. If you are calling at volume, in a regulated sector, or across borders, take proper advice for those markets.
The single most expensive mistake in voice AI is not a bad prompt. It is calling people you were not entitled to call, at hours you were not entitled to call them, and recording it without saying so.
The principle that covers most of it
Regulators do not treat an AI call as a lesser thing than a human one. In several respects they treat it as more restricted, because automation makes volume possible that a person could never reach.
The working version: if a member of your staff could not lawfully make this call, at this hour, to this person, then neither can your agent. That single test resolves the large majority of questions before you have to look anything up.
Consent to call
| Situation | Generally | Watch out for |
|---|---|---|
| They just submitted your form asking to be contacted | The strongest position. They gave you the number and asked. | Keep the evidence — which form, when, and the exact consent wording. |
| Existing customer, about their own booking or account | Usually fine as a service call. | Do not let a service call become a sales pitch. That changes its legal character. |
| Past customer you want to re-engage | Often permitted within limits. | Time limits since last purchase, and any opt-out they gave earlier. |
| Purchased or scraped list | The riskiest thing you can do with this technology. | You cannot usually evidence consent, and “the vendor said it was opt-in” is not a defence anywhere. |
If a complaint arrives, “they must have opted in” is worth nothing. What you need is the record: the form, the timestamp, the wording. Capture it at the point of collection — reconstructing it afterwards is not possible.
Calling hours
Permitted hours are set by regulators and measured on the recipient’s local clock. This is the detail most systems get wrong, because it is easier to apply the account’s timezone than the lead’s.
| Market | Typical window | Notes |
|---|---|---|
| United States | 8am – 9pm, called party’s local time | Set by the TCPA. Some states are stricter. |
| United Kingdom | Broadly 8am – 9pm | Ofcom guidance, alongside PECR obligations. |
| EU member states | Varies by member state | Several set explicit windows; check per country. |
| Kenya | No single statutory window in the same form | Reasonableness and data protection obligations still apply; treat business hours as the norm. |
| Nigeria | No single statutory window in the same form | Same approach — business hours, and honour objections immediately. |
The lead is hot at midnight and cold by nine, and the temptation is obvious. It is also how accounts collect complaints. Hold the lead and call when the window opens — a 9am call to someone who enquired at midnight still beats every competitor who calls on Tuesday.
Opt-outs and do-not-call
Someone asking not to be called must be honoured immediately, permanently, and across every campaign — not only the one they were on.
If the caller asks not to be contacted again, or says to stop calling: confirm that you will remove them, apologise for the disturbance, and end the call. Do not ask why. Do not offer alternatives. Do not try to keep them on the line.
- National registers. The US has the National Do Not Call Registry; the UK has the TPS and CTPS. Know whether your market operates one and what it obliges you to do.
- Your own suppression list matters as much. Strip opt-outs and complainants before every upload, every time.
- Cap retries. Three attempts, spread across different times of day. Six is harassment.
- An opt-out on one channel is usually an opt-out on all of them. Do not email someone who asked you to stop phoning.
Recording notice
Voice AI platforms record calls — that is how you get transcripts, and it is how you tune an agent. Most jurisdictions require notice to participants; some require consent from everyone on the call.
Around a dozen US states require all-party consent, including California, Florida, Illinois, Massachusetts, Pennsylvania and Washington. With an inbound call you usually cannot know where the caller is, which makes the practical rule simple:
"Brightsmile Dental, this is Amara. This call is recorded for quality and training — how can I help?"
Six words, said before anything else, and the question is closed. Put it in the greeting rather than the instructions, because the greeting is the only part you can guarantee is spoken on every call.
If you record calls your own salespeople make — for example with Call IQ, where an analysis line records human-to-human conversations — the notice obligation applies to both sides. Agree the wording with your team before switching a line on, not after.
Disclosing that it is AI
This is the fastest-moving area on the page. The direction of travel across jurisdictions is consistently towards mandatory disclosure.
- California has a bot disclosure law requiring bots to identify themselves in certain commercial and political contexts.
- The EU AI Act carries transparency obligations for systems that interact with people, pointing squarely at disclosure.
- Other jurisdictions are legislating in the same direction. Assume this becomes the norm rather than the exception.
"Hi, you're through to Brightsmile's virtual assistant — how can I help?"
Even where not required, disclose. People who are told adjust their expectations and stay on the line; people who work it out mid-call feel deceived and say so publicly. And never instruct an agent to deny being an AI when asked directly — in some places that is unlawful, and everywhere it is the kind of thing that ends up screenshotted.
United States
| Rule | What it means for an AI agent |
|---|---|
| TCPA applies to artificial voices | The FCC ruled in February 2024 that AI-generated voices count as "artificial" under the TCPA. The existing restrictions on artificial and prerecorded voice calls apply to your agent. |
| Prior express written consent | Required for marketing calls to mobile numbers using an autodialer or artificial voice. This is a high bar and it must be evidenced. |
| Calling window | 8am to 9pm in the called party’s local time zone. |
| National Do Not Call Registry | Scrub against it for marketing calls, and maintain your own internal suppression list. |
| Statutory damages | TCPA claims carry per-call statutory damages and are actively litigated, including as class actions. This is why US outbound deserves genuine legal review. |
| State law on top | Several states add their own requirements, including all-party recording consent and mini-TCPA statutes. |
Inbound answering, service calls to existing customers about their own accounts, and calling people who just submitted a form are all substantially lower risk. Cold outbound marketing to US mobiles with an AI voice is the scenario to take advice on before you run a single call.
United Kingdom and EU
United Kingdom
- PECR governs direct marketing by phone, alongside UK GDPR for the underlying personal data.
- TPS and CTPS screening is required for marketing calls to numbers registered on them.
- Ofcom’s persistent misuse rules cover abandoned and silent calls — relevant if your dialling ever connects a call nobody is ready to take.
- The ICO enforces, and issues fines for unsolicited marketing calls.
EU
- GDPR requires a lawful basis for processing the personal data involved, and the recording is personal data too.
- ePrivacy and national implementations govern the marketing call itself, and they differ meaningfully between member states.
- The AI Act adds transparency obligations for systems that interact with people.
- Data residency questions arise if recordings leave the EU. Ask where they are stored before you commit.
Kenya and Nigeria
Both markets now have substantive data protection regimes, and the assumption that they are unregulated is out of date by several years.
Kenya
- The Data Protection Act 2019 governs the processing of personal data, with the Office of the Data Protection Commissioner enforcing it.
- Registration obligations apply to many data controllers and processors. Check whether yours is one.
- Consent and purpose limitation apply to the numbers you call and the recordings you keep.
- Data subject rights — access, correction, deletion — extend to call recordings and transcripts.
Nigeria
- The Nigeria Data Protection Act 2023 replaced the earlier NDPR framework and established the Nigeria Data Protection Commission.
- Lawful basis, consent and data subject rights follow broadly familiar principles.
- Compliance filing obligations apply to organisations above certain thresholds.
Call people who asked to be called, during business hours, say who you are, say the call is recorded, stop when they ask you to, and be able to produce what you hold about someone if they ask. That posture satisfies the substance of both regimes and is not onerous to operate.
Recordings are personal data
This is the obligation people forget, because it arrives after the call rather than during it.
- Recordings and transcripts fall under GDPR and its equivalents. Know your lawful basis and your retention period, and be able to state both.
- Access is usually account-wide. Anyone on your team who can open call history can read everything every caller has said. Grant team access on that basis rather than by seniority.
- Do not have agents recite records back at callers. Greeting someone by name from your CRM is helpful; reading their history aloud is unsettling and can itself be an unlawful disclosure — particularly if the person holding the phone is not the account holder.
- Gate anything financial, medical or account-specific behind verification. Caller ID is not identity. It is spoofable, and phones get borrowed, lost and stolen.
- Never collect card details on a call. Send a payment link.
For what a properly gated flow looks like in practice — identity verification enforced server-side rather than by the model deciding it is satisfied — see the member self-service playbook.
Building the rules into the system
Policy that lives in a document gets forgotten. Policy that the platform enforces does not. Four things are worth configuring rather than remembering:
| Rule | How to enforce it rather than intend it |
|---|---|
| Calling hours | Set the calling window on the trigger. It is applied in the lead’s own timezone where known, so an overnight lead is held rather than dialled — see lead callback. |
| Consent | Map your form’s consent checkbox and switch on the requirement. Leads arriving without consent evidence are then never called at all. |
| Do-not-call | Numbers are checked against your suppression list before a call is placed, and repeat submissions are de-duplicated. |
| Recording and AI notice | Put both in the greeting rather than the instructions, so they are spoken on every call without depending on the model. |
The operational detail for each of these is in the compliance documentation, and Vociply’s own certifications, encryption and processing terms are on the security page.
Pre-launch checklist
Before an agent calls anyone who is not you or a colleague:
- I can explain, for every number on my list, why I am entitled to call it.
- I hold evidence of that entitlement, not just a belief in it.
- My calling window is lawful in the recipient’s timezone, not mine.
- The agent accepts an opt-out immediately and without argument.
- Opt-outs and complainants are stripped from my list before upload.
- Retries are capped at three or fewer, spread across the day.
- My greeting carries recording notice where required.
- My greeting discloses AI where required — and by preference anyway.
- The agent can reach a human, and that number is genuinely staffed.
- Anything financial, medical or account-specific sits behind verification.
- I know my retention period for recordings and can honour a deletion request.
Record test calls where the agent should decline — a caller who cannot verify, a request to discuss someone else’s account, a demand to skip the disclosure. Play those to whoever signs off compliance. Approval comes far more easily when somebody has heard the agent refuse a plausible, sympathetic-sounding request than when they have read a policy about it.
If you are writing the prompt that encodes these rules, the prompt guide covers how to phrase hard rules so they hold, and our compliance overview covers HIPAA and SOC 2 specifically.
Frequently asked questions
Do AI voice calls count as robocalls?
In the United States, the FCC ruled in February 2024 that AI-generated voices in calls are "artificial" for the purposes of the TCPA. That means the existing restrictions on artificial and prerecorded voice calls apply to AI agents, including the consent requirements. Treat an AI outbound call as at least as regulated as a prerecorded one, not as equivalent to a human dialling manually.
Is calling someone seconds after they submit a web form legal?
Generally yes, and it is the strongest consent position available — the person gave you their number and asked to be contacted. The obligations that still apply are calling hours, honouring opt-outs, recording notice where required, and any AI disclosure requirement in your jurisdiction. Keep evidence of the consent: which form, when, and the exact wording they agreed to.
Do I have to tell callers they are speaking to an AI?
In a growing number of jurisdictions, yes. California’s bot disclosure law and the EU AI Act’s transparency obligations both point that way, and more are following. Everywhere else it remains optional and is still advisable: people who are told adjust their expectations and stay on the line, while people who work it out mid-call often feel deceived. It costs one word in the greeting.
What are the legal calling hours?
They vary, and they are measured on the recipient’s local clock rather than yours. In the United States the TCPA window is 8am to 9pm local to the called party. The UK follows a similar convention under Ofcom guidance. Because the standard is the recipient’s time zone, a platform that enforces the window in the lead’s own timezone rather than your account’s is doing something materially different from one that does not.
Do I need consent from both parties to record a call?
It depends where both parties are. Around a dozen US states require all-party consent, including California, Florida, Illinois, Massachusetts, Pennsylvania and Washington. Because you often cannot know where an inbound caller is, the safe operational rule is to give recording notice on every call regardless. It costs six words in the greeting and removes the question entirely.
How many times can I retry a lead that does not answer?
There is rarely a single hard number, but regulators across markets treat repeated calling as harassment, and several set explicit limits on attempts within a period. Three attempts, spread across different times of day, is persistent without being abusive. Six attempts to the same person is a complaint waiting to happen and, in some jurisdictions, a breach.