TCPA rules for AI calls and texts

What the TCPA covers

The TCPA regulates how businesses can use phone systems to contact consumers. It was originally written to address the flood of robocalls that were annoying people at dinner time in the early 1990s. Since then, FCC rulings, court decisions, and state-level additions have expanded its scope. It now covers modern automated calling systems, including AI voice agents and predictive dialers.

The statute carries penalties of $500 per violation for negligent infractions and up to $1,500 per violation for willful ones. A "violation" is counted per call, not per campaign. If you run an outbound campaign that calls 5,000 people without proper consent, your potential exposure is $2.5 million to $7.5 million. Class action attorneys regularly pursue cases in this range. Settlements frequently run into the tens of millions for larger operations.

Calls are allowed from 8 AM to 9 PM local time

The time-of-day restriction is the most straightforward TCPA requirement. Outbound calls to consumers are permitted only between 8 AM and 9 PM in the recipient's local time zone. That means the time zone of the person being called, not your time zone or your server's. For a campaign that covers contacts across the continental United States, your calling window opens at 8 AM Eastern. Your last calls go out at 9 PM Pacific. Each individual contact is governed by their own local clock.

The rule is simple to state and takes care to implement. You need to resolve each contact's time zone from their phone number area code or their address on file. Your dialing system needs to refuse to start a call outside that window, regardless of how many contacts are sitting in the queue. A call dispatching system handles this automatically. It holds calls that would land outside the permitted window and schedules them for the next available period.

Some states impose narrower windows. Connecticut restricts calls to 9 AM to 9 PM. Washington state requires 8 AM to 8 PM for certain types of solicitation. If you're operating at national scale, your system needs to account for these state-level variations.

Consent requirements

TCPA consent requirements vary depending on the type of call and how it's being placed. The rules are more restrictive for calls made using an automatic telephone dialing system (ATDS) or a prerecorded or artificial voice. That's where AI calling comes in.

For calls to cell phones using an ATDS or artificial voice, you generally need prior express written consent. Most regulators consider AI voice agents to fall in that category. Prior express written consent means the person must have provided their phone number through a clear and conspicuous disclosure that they consent to receive autodialed or prerecorded calls. That consent must be documented.

A web form that says "By submitting this form, you consent to receive calls from [Company] using automated technology at the phone number provided" satisfies this requirement if the person affirmatively opts in. Checking a box or clicking a button counts. Consent buried in terms and conditions doesn't. The consent must be voluntary. It cannot be a condition of purchasing a product or service.

Which standard applies depends on the call:

• Prior express written consent is required for marketing calls to cell phones using automated technology, which covers most AI outreach scenarios.
• Prior express consent (verbal is sufficient) covers non-marketing calls like appointment reminders, delivery notifications, or account updates.
• An established business relationship provides limited consent for manual calls (no ATDS) to landlines, but this exception is narrow and does not apply to most AI calling use cases.

National and internal Do Not Call lists

Beyond individual consent, you need to maintain and honor two types of Do Not Call (DNC) lists. The first is the National Do Not Call Registry, maintained by the FTC. It contains over 240 million phone numbers. Before making outbound calls, you're required to scrub your contact list against this registry. You're also required to update your copy of the registry at least every 31 days.

The second is your company's internal DNC list. When someone tells you to stop calling them, you're required to add them to your internal list and honor that request within a reasonable time frame. That applies whether they say it on a call, reply to a text, submit a web form, or use any other communication channel. The FCC has indicated that 30 days is the outer limit. Best practice is to honor the request immediately.

Your call dispatching system needs to check every contact against both lists before initiating a call. The check should happen at the moment of dialing, not at the time of list upload. A person can add themselves to the DNC registry or request removal after you load the list and before you call them.

Caller ID and number reputation

The TCPA requires that outbound calls transmit accurate caller ID information. You cannot spoof or manipulate the caller ID to show a number you do not control. The number displayed must be one where someone can reach your organization if they call back. Violations of caller ID rules fall under both the TCPA and the Truth in Caller ID Act, which carries its own penalties.

Caller ID reputation also has a practical effect on your answer rates. Carriers maintain reputation databases for phone numbers. Numbers that generate complaints, get reported as spam, or show calling patterns consistent with robocalling will be flagged. The recipient's phone then shows a label like "Spam Likely" or "Scam Likely." Once a number is flagged, your answer rates drop sharply.

Protecting your caller ID reputation takes the same kind of call dispatching that enforces the calling window. It rotates across a pool of numbers and respects per-number daily and hourly caps. It also watches for numbers whose answer rates start to degrade. Some carriers also offer STIR/SHAKEN attestation, a protocol that cryptographically verifies that the caller ID is legitimate. Registering your numbers for STIR/SHAKEN attestation gives them a higher trust score with carriers.

State telemarketing laws

The federal TCPA sets a minimum. Several states have passed their own telemarketing laws that impose additional requirements:

• Florida, under the Florida Telephone Solicitation Act, restricts automated calls to consumers without prior express written consent and has its own state-level DNC list.
• California layers CCPA privacy requirements on top of the TCPA, which means you may need to provide data deletion capabilities for call recordings and transcripts.
• Oklahoma has particularly strict rules about calling windows and consent for commercial solicitation.
• New York requires registration with the state before conducting telemarketing and mandates specific disclosures during the call.

If your outreach covers contacts in multiple states, you need to comply with the most restrictive rule that applies to each individual contact. Automated compliance checks pay for themselves here. Tracking by hand which rules apply to which contacts across 50 states is error prone at exactly the scale where the penalties become meaningful.

Building compliance into your outreach infrastructure

Getting TCPA compliance right takes more than a lawyer reviewing your practices once a year. Build compliance into the infrastructure itself, so avoiding violations doesn't depend on individual reps remembering the rules. An outreach system that enforces the TCPA at the infrastructure level should:

• check every call against the national and internal DNC lists before dialing
• hold every call to the permitted calling window in the recipient's local time zone
• transmit accurate caller ID on every call
• log consent records with timestamps and source attribution
• provide an immediate opt-out mechanism that updates the internal DNC list in real time

When these checks are automated in the dispatching layer, your team can focus on outreach strategy and the conversations themselves. The checks run the same way however fast you scale.