Is AI Cold Calling Legal? What Business Owners Need to Know in 2026

AI cold calling is legal in the United States when you have prior express written consent, and illegal when you robocall people who never opted in, under the TCPA and FTC rules explained below.

AI cold calling is legal in the United States when the business owners placing the calls have prior express written consent, and illegal when you robocall people who never opted in, under the TCPA. AI-powered phone calls are growing rapidly. The global conversational AI market reached $13.2 billion in 2024, according to Precedence Research, with voice-based AI accounting for a significant share. But as the technology has scaled, so has regulatory scrutiny. The Federal Trade Commission (FTC) and Federal Communications Commission (FCC) have both taken aggressive action against illegal robocalling, and AI-generated calls have become a specific enforcement target.

This guide covers the current legal landscape for AI phone calls in the United States, breaks down the critical difference between AI cold calling and AI appointment setting, and provides a compliance checklist that keeps your business on the right side of federal and state law.

Cold vs. Warm vs. Inbound: the line that decides legality

Nearly every legal question about AI phone calls comes down to one thing: who started the conversation, and did they consent? The same AI voice is perfectly legal on one call and a TCPA violation on the next, purely based on how the contact began. Here is the framework in one picture, followed by what each category actually means under the law.

Embed this chart (free, attribution required)

<a href="https://callsetter.ai/blog/ai-cold-calling-legal"><img src="https://callsetter.ai/charts/csai-legal-risk-ladder.png" alt="Legal risk of AI phone calls by call type, per CallSetter AI" width="1200" height="675" style="max-width:100%;height:auto"></a> <p>Chart: <a href="https://callsetter.ai/blog/ai-cold-calling-legal">CallSetter AI</a></p>

Federal Law: The TCPA

The Telephone Consumer Protection Act of 1991 (47 U.S.C. Section 227) is the primary federal law governing automated phone calls. Originally written to address recorded-message telemarketing, the TCPA has been repeatedly updated and reinterpreted to cover modern AI calling technology.

What the TCPA Prohibits

• Automated calls to cell phones without prior express consent: Any call using an automatic telephone dialing system (ATDS) or prerecorded/artificial voice to a mobile number requires the called party's prior express consent. For marketing calls, this must be prior express written consent.
• Calls to numbers on the National Do Not Call Registry: Telemarketers must scrub their call lists against the DNC registry. Violations carry penalties of up to $51,744 per call (as adjusted for inflation by the FTC in 2024).
• Calls before 8 AM or after 9 PM local time: All telemarketing calls must fall within the 8 AM to 9 PM window in the called party's time zone.

The February 2024 FCC Ruling on AI Voices

On February 8, 2024, the FCC issued a Declaratory Ruling that AI-generated human voices in phone calls qualify as "artificial or prerecorded voice" under the TCPA. This was a landmark decision. Before this ruling, there was ambiguity about whether AI-generated speech (which is synthesized in real time, not "prerecorded") fell under the TCPA's robocall restrictions.

The ruling eliminated that ambiguity. Any AI-generated voice call that mimics human speech is now subject to the same TCPA restrictions as prerecorded robocalls. This means prior express consent is required for AI calls to cell phones, and prior express written consent is required for AI marketing calls.

FTC Enforcement: The Telemarketing Sales Rule

The FTC enforces the Telemarketing Sales Rule (TSR), which adds additional requirements on top of the TCPA. Under the TSR, telemarketers must disclose the identity of the seller and the nature of the call promptly at the beginning of the conversation. AI calls that fail to make these disclosures violate the TSR regardless of consent status.

In February 2024, the FTC proposed an updated rule specifically addressing AI-generated calls, seeking to prohibit the use of AI to impersonate individuals or organizations. The proposed rule also targets AI "cloning" of voices without consent. As of March 2026, enforcement actions under these updated guidelines are actively proceeding.

AI Calling Laws by State: All 50 States + DC

Federal law sets the floor. Many states stack stricter rules on top, and they fall into two buckets that matter for AI calls: call-recording consent (does the state require all parties to agree before you record?) and AI-disclosure statutes (does a specific law require telling people they are talking to AI?). Very few states have the second kind yet; most rely on the federal TCPA, which after the February 2024 FCC ruling already treats AI voices as "artificial." Search your state below.

† Genuinely disputed or pending in current case law/legislation, treat cautiously and verify for your situation. All-party recording states shown are the defensible core; on any multi-state call the strictest applicable law controls, so the safe default is to announce recording and get consent. This table is a general reference, not legal advice. Sources: FCC, FTC, state statutes, and the Justia 50-state recording survey (listed at the end).

The states with actual AI-disclosure laws

Only a handful of states have passed laws specifically about disclosing AI on a call, as opposed to the general TCPA robocall rules that apply everywhere:

• California is the strictest. AB 2905 (effective January 1, 2025) requires disclosure when an AI or automated voice is used in an autodialed call, and SB 1001 (the "Bot Disclosure" law) requires bots to identify themselves in commercial and electoral contexts. California is also an all-party recording state, so the AI must announce recording too.
• Utah passed the AI Policy Act (AIPA), which requires businesses to disclose they are using generative AI when a consumer asks, and to disclose proactively in regulated professions.
• Colorado enacted the Colorado AI Act requiring disclosure of AI in consumer-facing interactions, with its main obligations phasing in around 2026 (confirm the current effective date before relying on it).
• Adjacent laws: Tennessee's ELVIS Act protects against unauthorized voice cloning (not a call-disclosure rule), and New Jersey has advanced bot-disclosure legislation. Every other state defaults to the federal TCPA plus the FCC's 2024 AI-voice ruling.

Can You Cold Call With AI in California?

Short answer: yes, but California stacks three extra layers on top of federal TCPA rules, and all three bite. First, disclosure: the call must reveal it's an AI or automated system (AB 2905 / SB 1001). Second, recording: California is an all-party consent state, so the AI must announce recording at the start of every recorded call. Third, the CCPA/CPRA gives California consumers the right to opt out of automated decision-making, which can cover AI lead qualification. Full detail on all three layers is in our dedicated guide: can you cold call with AI in California.

What that means in practice: cold-calling a purchased list of California cell numbers with an AI voice and no prior express written consent violates the TCPA, same as anywhere in the country. But calling YOUR leads in California (people who filled out your form, requested a quote, or asked for a callback) is legal when the AI discloses itself, announces recording, and honors opt-outs. That's the inbound-and-opted-in model CallSetter runs, and it's why the legal exposure question mostly disappears when you stop buying lists and start answering your own demand.

Call-Recording Consent: the all-party states

If your AI agent records calls for quality assurance or training, you need to know which states require all-party consent to record. The defensible core of all-party (two-party) states is: California, Connecticut, Delaware, Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Oregon, Pennsylvania, and Washington. Nevada and Michigan are commonly added but genuinely disputed in the case law. Because the strictest applicable law controls on any interstate call, the only safe rule is universal: have your AI announce that the call is recorded at the very start, every time.

Where AI Appointment Setting Falls Legally

Here is why the inbound versus outbound distinction matters so much. 85% of callers who reach voicemail never call back (Invoca), and companies that respond within an hour are 7x more likely to qualify the lead (Harvard Business Review). When a potential customer initiates contact with your business by filling out a form, calling your number, or clicking a "request callback" button, they have provided implied consent for your business to respond. An AI appointment setter that responds to these inbound inquiries is not making an unsolicited call. It is returning a requested contact.

The TCPA's consent requirements apply primarily to outbound, unsolicited calls. When someone dials your business phone number, you are answering their call. When someone submits a web form requesting a callback, they have provided prior express consent for that callback. This is the legal framework within which AI appointment setting services like CallSetter AI operate.

Penalties for Non-Compliance

The financial risk of illegal AI calling is severe and personal, making a compliant inbound AI approach far more profitable than risking penalties. TCPA violations carry statutory damages of $500 per call, and $1,500 per call for willful violations. In class action lawsuits, these per-call damages multiply across every affected consumer. A campaign of 10,000 illegal calls could generate liability of $5 million to $15 million.

Recent enforcement examples illustrate the scale. In August 2024, the FCC proposed a $6 million fine against a political consultant who used AI-generated voice calls impersonating a public figure to discourage voting in the New Hampshire primary. In 2023, a home warranty company agreed to pay $7.2 million to settle TCPA claims involving automated calls. These are not theoretical risks. They are active, well-funded enforcement actions.

Your Compliance Checklist

Whether you are using AI for inbound appointment setting or considering outbound AI calling, this checklist covers the requirements you need to meet.

The Safe Path Forward

The safest and most effective use of AI voice technology for most businesses is inbound appointment setting. You are not cold-calling strangers. You are responding to people who have already expressed interest in your services. This model provides the speed to lead advantages of AI (responding in under 60 seconds, 24/7 availability, consistent qualification) while staying firmly within the legal boundaries established by the TCPA, FTC, and state regulators. See our pricing to learn what compliant AI appointment setting costs.

For businesses that want to pursue outbound AI calling, the compliance burden is substantial but manageable with proper legal counsel and thorough consent management systems. The key is to never cut corners on consent, disclosure, and DNC compliance. The penalties are too severe and the enforcement too active to treat compliance as optional.

This article provides general information about telecommunications law and should not be construed as legal advice. Consult with a telecommunications attorney for guidance specific to your business and jurisdiction. For industries like dental practices, insurance agencies, and law firms, industry-specific regulations add additional layers to consider.

Primary Sources

Every legal claim on this page traces to a federal agency, a state statute, or a reputable telecom-compliance source. Key references: