TCPA-safe outbound with AI voice: what changed in 2024 and what most vendors still get wrong · NeuraVoice

A Series B SaaS company spins up an AI voice agent for outbound. The pitch from the vendor: warm leads, mobile dials, AI handles objections, human takes over on yes. Five thousand numbers loaded from a purchased intent list. Campaign goes live on a Monday. By week six, a class-action complaint lands in the Northern District of Illinois. Statutory damages claim: $500 per call, trebled to $1,500 for willful violations. The math is unfriendly.

This is the TCPA outbound problem nobody on the buying side fully reads before they sign. The 2024 FCC ruling reshaped what counts as a regulated voice call, and most AI voice vendors are quietly assuming buyers will figure out the consent and DNC infrastructure on their own. They will not.

This is a working overview, not legal advice. Run anything load-bearing past your own counsel, especially for state-specific exposure.

The February 2024 FCC ruling put AI voice inside the pre-recorded-voice bucket

On February 8, 2024, the FCC issued a Declaratory Ruling clarifying that calls made with AI-generated voices are "artificial or prerecorded voice" calls under the Telephone Consumer Protection Act. The plain-language read: if you are using a synthesized voice to deliver content on an outbound call, the TCPA treats that call the same as if you were playing back a recording.

That distinction matters because the TCPA at 47 USC § 227(b)(1)(A) restricts the use of artificial or prerecorded voice for calls to mobile numbers without prior express consent. The ruling did not invent a new category of liability. It closed a door that some vendors were trying to walk through, the argument that AI voice is "real-time generated" and therefore neither autodialed nor pre-recorded. That argument is gone.

What this means in practice: every outbound AI voice call to a mobile number now sits squarely inside the part of the statute that requires consent. The strictness of the consent depends on the call's purpose.

Express written consent is the bar for telemarketing or solicitation

For any outbound call to a mobile number that contains telemarketing or advertising content using artificial or prerecorded voice, the TCPA requires "prior express written consent." That is defined at 47 CFR § 64.1200(f)(9) and is a higher bar than people assume.

Express written consent requires:

A signed agreement (electronic or wet signature both count)
Clear disclosure that the consumer is authorizing telemarketing calls using an autodialer or artificial/prerecorded voice
The specific seller's name (not "our partners")
A statement that consent is not a condition of purchase

If you bought a list, the list almost certainly does not carry valid express written consent for your specific company. Lead-gen aggregators have been the subject of repeated FCC enforcement actions for misrepresenting the chain of consent. Treat any "TCPA-compliant" list with skepticism until you can produce the actual signed disclosure for the specific consumer being called.

For non-telemarketing outbound calls (informational, transactional, account-related), the bar drops to "prior express consent," which can be implied from the consumer giving you their number for that purpose. Mobile numbers given on a registration form for transactional updates qualify. Mobile numbers scraped, enriched, or purchased from a B2B data provider do not.

The Facebook v. Duguid carve-out is narrower than vendors imply

In Facebook, Inc. v. Duguid (2021), the Supreme Court narrowed the definition of "automatic telephone dialing system" (ATDS) to require a random or sequential number generator. A lot of AI voice vendors lean on this case to suggest their predictive or list-based dialer "is not an ATDS, so TCPA does not apply."

This is half-true and dangerous. Duguid narrowed the ATDS definition. It did not touch the artificial-or-prerecorded-voice prong of § 227(b)(1)(A). Those are two separate statutory triggers. An AI voice call made from a manually loaded list might dodge the ATDS definition, but if the call uses synthesized voice to a mobile number without consent, it still violates the prerecorded-voice prong. The 2024 FCC ruling removed any ambiguity on that point.

Plaintiffs' firms know this. Defense counsel that relies only on the Duguid argument tends to have a bad year.

The established business relationship exception is real but cramped

The "established business relationship" (EBR) exception at 47 CFR § 64.1200(f)(5) exists, but it is narrower than most sales ops teams think. EBR applies when a consumer has either:

Made a purchase or transaction within the last 18 months, or
Made an inquiry or application within the last 3 months

EBR does not override the express written consent requirement for prerecorded-voice or AI-voice telemarketing to mobile numbers. The FCC has been explicit on this. EBR is more useful for the do-not-call registry analysis and certain landline contexts than it is for AI-voice outbound to mobile.

EBR also evaporates the moment a consumer makes a do-not-call request to your specific company. Verbal revocation counts. Once revoked, you have a 30-day window under federal rules to update internal lists and stop calling.

Federal and state DNC checking is non-negotiable before solicitation calls

Before any outbound solicitation call, the National Do Not Call Registry must be scrubbed. Internal company-specific DNC lists must be checked separately. Operating without DNC scrubbing is per-se actionable, and statutory damages stack: $500 per call under TCPA, plus state penalties.

State DNC layers add cost and risk:

Florida Telephone Solicitation Act (FTSA) has been the most actively litigated mini-TCPA in 2024 and 2025. After the 2023 amendments narrowed some private right of action, plaintiffs' firms shifted to consent-defect theories. Still active.
Washington's CEMA (Commercial Electronic Mail Act, extended to voice in 2018) restricts unsolicited commercial calls and creates state-level liability.
Oregon ORS 646.553 layers state DNC rules on top of federal.
New York, New Jersey, and Indiana each maintain state-specific registries that sit alongside the federal registry.

The vendor question: when your AI voice platform initiates an outbound dial, does it scrub the federal DNC, your internal DNC, and the relevant state DNCs in real time? If the answer is "we assume the customer has done that," you have a buyer-side responsibility problem.

Revocation must be recognized in real time during the call itself

A consumer can revoke consent through any "reasonable means." The FCC's April 2024 revocation order (effective April 2025) made this rule explicit and broader than a lot of vendors had implemented. Verbal revocation during a call counts. Saying "stop calling me" or "take me off your list" or "I am not interested, do not call again" all qualify.

For an AI voice agent, this creates a hard requirement:

The agent must detect revocation language in real time
The call must end promptly after the request
The number must be added to the internal DNC list
No retry attempt may be made, including no re-dial within the same campaign

If your AI voice vendor cannot show you the intent classifier, the DNC write-back path, and the campaign-level retry suppression, you are exposed. We covered the recording side of this in state call recording laws and AI voice agents. Revocation handling sits in the same operational tier.

B2B outbound has carve-outs but they are narrower than the sales pitch

Pure business-to-business outbound calling to a published business landline is generally outside the consumer-protection scope of the TCPA's prerecorded-voice rules. The complications:

Mobile numbers used as business numbers (extremely common since 2020) sit inside the consumer rules even if the user is acting in a business capacity.
Calls that mix B2B prospecting with eventual consumer-facing solicitation can flip categorization.
Many states (Florida, Washington) extend mini-TCPA protections beyond the federal consumer/business line.
Wireless number portability means you cannot reliably tell from the number itself whether you are dialing a mobile or a landline. You need a real-time line-type lookup before each call.

The "we only call businesses" defense gets weaker every year as the line-type distinction erodes.

Five questions to ask any AI voice vendor before signing for outbound

Most vendors will not surface this on a sales call. Ask anyway.

How do you scrub the federal DNC, internal DNC, and state DNCs before each outbound call, and can you show me the audit log?
What is your real-time revocation detection? Can you produce a transcript example where the agent recognized "stop calling me" and ended the call within one turn?
Do you provide line-type lookups (mobile vs landline vs VoIP) at dial time, and is the result logged for the compliance trail?
What is the consent intake flow you require on my side, and do you store the signed disclosure linked to the dialed number?
In the event of a TCPA complaint, what records can you produce on my behalf, and what is your indemnification posture?

A vendor that handles all five of these well is rare. A vendor that handles none of them and still pitches outbound is selling you a future legal bill.

The contrarian close

The right read on AI-voice outbound in 2026 is not that it is uniquely dangerous. It is that the regulatory framework has finally caught up to what the technology actually does, and the buying side is the last to update its assumptions. The 2024 FCC ruling did not create new risk. It removed the gray area that was letting some vendors and some buyers operate as if AI voice was a different category. It is not. It is prerecorded voice with better latency.

The companies that will run profitable AI outbound through 2026 and 2027 are the ones that built consent capture, DNC scrubbing, revocation detection, and audit logging before they wrote the dialer. Not the ones that bought a "TCPA-compliant list" and a flashy voice and assumed the vendor's marketing copy would hold up in front of a magistrate judge.