TCPA Compliance Checklist for AI Voice Agents (2026)

TCPA compliance in 30 seconds. TCPA compliance means following a US law about phone calls: who you can call, when you can call, and what you must say. The FCC now counts an AI voice as a robot voice, so when an AI agent calls someone it follows the same rules as a robocall. The big four: get permission first, skip people on Do Not Call lists, call only between 8 a.m. and 9 p.m. their time, and stop when someone says stop. Get it wrong and it is $500 per call, up to $1,500 per call if a court thinks you did it on purpose.

In January 2024, thousands of people in New Hampshire picked up their phones. They heard what sounded like President Biden. The voice told them not to vote in the state's primary election.

It was not Biden. It was a fake voice made by AI. The calls also showed a fake caller ID: the phone number of a real local politician.

The FCC acted fast. Less than three weeks later, it ruled that AI voices count as "artificial" voices under phone law. Later that year, it fined the man behind the calls $6 million. The phone company that carried the calls agreed to pay $1 million.

Your business is not making fake election calls. But that case changed the rules for every company that uses an AI voice to make calls. This checklist shows you those rules in plain words, with real cases, so you can use AI calling without getting sued.

Note: This guide is general information, not legal advice. Phone rules changed twice in the last 18 months. Check your setup with a lawyer before you start making AI sales calls.

TCPA words, made simple

Before the checklist, here are the words you will see. Each one is explained like you would explain it to a friend.

Word	What it means	Everyday example
TCPA	Telephone Consumer Protection Act. A 1991 US law that protects people from unwanted calls and texts	The "rules of the road" for business phone calls
FCC	Federal Communications Commission. The US agency that makes and enforces phone rules	Like a referee for phone calls
Consent	Permission to call someone	A signed permission slip for a school trip
Prior express written consent	Signed permission, given before the call, that clearly says the business may call with a robot or AI voice	Ticking a box and signing a form that says "Yes, Zoxa Dental may call me with an automated voice"
Robocall	A call that uses a recorded or computer-made voice	"This is an important message about your car warranty..."
Telemarketing call	A call that tries to sell something	"We have a special offer on teeth whitening this month"
Informational call	A call that tells you something, without selling	"Your appointment is tomorrow at 3 p.m."
Do Not Call Registry	A free national list where people sign up to block sales calls	A "No Soliciting" sign on your front door
Opt-out	Saying "stop calling me"	Unsubscribing from an email list, but by phone

What is TCPA compliance?

TCPA compliance means making business calls and texts the way the Telephone Consumer Protection Act says you must. The law is 47 U.S.C. § 227, and the FCC's detailed rules are in 47 CFR § 64.1200.

Think of it like driving. You can drive anywhere you want, but you must have a license, stop at red lights, and follow the speed limit. The TCPA works the same way for phone calls. You can call customers, but you need:

1. Permission (your license)
2. The right time of day (the traffic lights)
3. Honest introductions (your license plate, so people know who you are)
4. A way out for anyone who says stop (the brakes)

Who enforces it? Three groups. The FCC makes and enforces the rules. State attorneys general can sue for people in their state. And any person who gets an illegal call can sue the business. That last one is where most of the money changes hands.

Why TCPA rules apply to AI voice agents

TCPA rules apply to AI voice agents because the FCC ruled on February 8, 2024, that AI-generated voices are "artificial" voices under the law. That puts AI calls in the same group as robocalls (FCC ruling).

It does not matter how real the AI sounds. Here is a simple way to think about it:

Example: A toy car that looks exactly like a real car is still a toy. An AI voice that sounds exactly like a person is still an artificial voice. The law looks at what it is, not how good it sounds.

So what does that mean for your business?

• AI sales calls need signed permission first. This is called prior express written consent.
• AI informational calls to cell phones need permission too, like when a customer gives you their number so you can remind them about appointments.
• States can go after AI calling directly, not only the scam behind it.

What about calls people make to you? Those are different. If a customer calls your business and an AI agent answers, you did not make the call. So the TCPA's calling rules do not apply to answering it. The rules come back the moment your AI agent calls someone, like a callback or a follow-up. (New to AI agents? Read our plain-English guide to AI voice agents.)

TCPA rules that changed in 2025 and 2026

Four things changed since January 2025. A court threw out one consent rule. The Supreme Court gave judges more say. The FCC changed its "stop calling me" rules. And an AI disclosure rule is waiting in line.

1. The "one company at a time" consent rule was thrown out

The FCC had planned a rule that said one permission form could only cover one company. On January 24, 2025, a federal appeals court threw that rule out. Permission still has to be clear and unmistakable. But one form can again name more than one company.

2. Judges can now read the law for themselves

On June 20, 2025, the Supreme Court decided McLaughlin Chiropractic v. McKesson by a vote of 6 to 3. It said judges do not have to follow the FCC's reading of the TCPA. That means a judge in Texas and a judge in New York could read the same rule differently.

What this means for you: Follow the strictest version of each rule. That way, you are safe no matter which court you end up in.

3. The FCC changed the "stop calling me" rules

On September 30, 2026, the FCC voted to change how opt-outs work (FCC fact sheet, summary). The changes start 30 days after they are published in the Federal Register.

• Sales calls: if someone says "stop" to one sales call, you must stop all sales calls and texts to them.
• Informational calls: if someone says "stop sending appointment reminders," you can stop just the reminders. You may keep sending, say, fraud alerts.
• One official "stop" method: you can pick one way for people to opt out (like pressing a key during the call or texting STOP). But you must clearly tell them that method on every call or text.
• Same deadline: you still have 10 business days to honor an opt-out. The FCC is asking whether that should be shorter.

4. An AI disclosure rule is waiting in line

In August 2024, the FCC proposed a rule that would make callers say "this call uses AI," both when asking for permission and at the start of AI calls. As of mid-2026, it was still only a proposal. Smart businesses are doing it anyway.

Bonus: some states are stricter than the US rules

Federal law allows sales calls until 9 p.m. But Florida stops them at 8 p.m. and allows only 3 sales calls in 24 hours about the same thing. Always check the rules for the states you call.

The 12-point TCPA compliance checklist

Use this TCPA compliance checklist before your AI voice agent calls anyone. Each step has the rule, a real-life example, and what to do.

1. Sort every call: selling or telling?

The rule: Sales calls (telemarketing) need signed permission. Informational calls need regular permission. So first, decide which kind each call is.

Real-life example: A gym calls members to say, "Your class moved to 6 p.m." That is telling (informational). If the same call ends with, "And sign up for personal training this week for 20% off!" it just became selling (telemarketing). Now it needs signed permission.

What to do:

• Label every campaign "selling" or "telling" before it starts.
• If a call does both, treat it as selling.

2. Get the right permission (TCPA consent)

The rule: AI sales calls need prior express written consent: signed permission, given before the call, that clearly allows calls with an artificial voice (§ 64.1200(f)(9)). Online signatures, like ticking a box and typing your name, can count.

Real-life example: In February 2026, a Michigan mortgage company, Mortgage One Funding, was hit with a class action lawsuit. The lawsuit says it used an AI voice to call people about refinancing without their permission, including a man whose number was on the Do Not Call Registry. The lawsuit says the money at stake could top $5 million. (These are claims in a lawsuit, not a final ruling.)

What to do:

• Never use bought or scraped phone lists for AI sales calls.
• Make your sign-up form say, in plain words, that you will call using an automated or AI voice.

3. Keep proof of every permission

The rule: If someone sues, you must be able to show they gave permission.

Real-life example: Think of a store receipt. If you return a jacket without a receipt, the store may say no. In a TCPA lawsuit, your consent record is the receipt. No receipt, no defense.

What to do: For each phone number, save:

• Who agreed
• When they agreed (date and time)
• The exact words they agreed to
• How they agreed (web form, signed paper, recorded call)

4. Check every Do Not Call list before you dial

The rule: Before a sales call, check the National Do Not Call Registry. Use a copy that is no more than 31 days old (§ 64.1200(c)(2)). The list holds about 258.5 million active phone numbers as of September 30, 2025. Also check the Reassigned Numbers Database, which tells you if a phone number now belongs to someone new (§ 64.1200(m)).

Real-life example: In 2017, a court ordered Dish Network to pay $280 million, the biggest Do Not Call penalty ever at that time. Dish and its sellers called people on the Do Not Call list, and the court found more than 66 million rule breaks.

Another real example: In September 2026, a Massachusetts car dealer, Cambridge Honda, faced a proposed class action. The lawsuit says it used an AI voice to make a sales call to a wrong number, and texted a number on the Do Not Call Registry. (Again, these are claims, not a ruling.) Phone numbers change owners all the time. The person who said yes last year may not own that number today.

What to do:

• Clean your list against the national registry at least every 31 days.
• Check the Reassigned Numbers Database before calling old numbers.
• Check state Do Not Call lists too.

5. Keep your own "do not call" list

The rule: Businesses that make sales calls must keep their own Do Not Call list. You need a written policy, trained staff, and you must keep each request for 5 years (§ 64.1200(d)).

Real-life example: The Dish case was not only about the national list. The court also found that Dish's sellers called people who had already asked Dish to stop calling (FTC).

What to do: Every time your AI agent hears "don't call me," that number goes on your list, for 5 years.

6. Call only at the right time, in their time zone

The rule: Sales calls can happen only between 8 a.m. and 9 p.m., in the local time of the person you call (§ 64.1200(c)(1)). Some states are stricter.

Real-life example: A dental office in New York starts its AI calls at 10 a.m. That feels fine in New York. But for a patient in California, it is 7 a.m. That call breaks the rule. And in Florida, a sales call at 8:30 p.m. breaks the state's 8 p.m. limit, even though federal law would allow it.

What to do:

• Set calling hours by the person's time zone, not yours.
• Use the strictest state rule for each area you call.
• Don't call too often. Some calls to home phones are limited to 3 calls in 30 days.

7. Say who you are, and show a real caller ID

The rule: Robot and AI calls must say the business name at the start and give a phone number people can call back (§ 64.1200(b)(1) and (b)(2)). Faking your caller ID to trick people can cost up to $10,000 per call (47 U.S.C. § 227(e)).

Real-life example: In 2023, the FCC fined an auto warranty robocall operation nearly $300 million, its biggest fine ever. The group made more than 5 billion robocalls to about 500 million phone numbers in just three months of 2021. Among the rules it broke: it did not say who was calling at the start, it did not give a callback number, and it used more than 1 million fake caller IDs. Remember the fake Biden calls too: they showed a real person's phone number to trick people.

What to do:

• Start every AI call with your business name. Example: "Hi, this is the assistant from Bright Smile Dental."
• Give a callback number during the call.
• Only use phone numbers you own. Phone companies check numbers using a system called STIR/SHAKEN.

8. Tell people they are talking to an AI

The rule: Federal law does not require this yet, but the FCC has proposed it, and honesty protects you.

Real-life example: In the Mortgage One Funding lawsuit, the man who got the call says he could tell right away it was a robot voice. He says it had odd pauses and did not sound human. The lawsuit also says the AI claimed it was "just giving a quick call back," even though he had never contacted the company (case summary). Pretending to be human, or pretending someone asked for a call, makes people angry and makes lawsuits more likely.

What to do:

• Say it early: "Hi, I'm an AI assistant calling for Bright Smile Dental."
• Add the same note to your permission forms.
• Never make up a reason for the call.

9. Let people say "stop" during the call

The rule: Robot and AI sales calls must have a built-in way to opt out, by voice or by pressing a key, during the call (§ 64.1200(b)(3)).

Real-life example: A customer says, "Please don't call me again, I'm not interested." A badly set up AI that only listens for the exact word "stop" might miss it and keep talking. A good AI agent hears the meaning, answers "Got it, I'll take you off our list. Have a good day," and ends the call.

What to do:

• Teach your AI many ways people say stop: "take me off your list," "don't call me," "remove my number," "not interested, stop calling."
• Have the AI confirm the opt-out out loud.
• Save the opt-out right away.

10. Honor every "stop" within 10 business days

The rule: People can cancel their permission any reasonable way: on the call, by text, by email, or by telling a staff member. You must honor it within 10 business days (§ 64.1200(a)(10)).

Real-life example: A customer replies STOP to your text on Monday. On Wednesday, your AI calls them with a sales offer, because your text tool and your calling tool don't share a list. That is a violation, even though nobody meant to break the rule.

What to do: Keep one master opt-out list that every tool (calls, texts, email, CRM) reads before contacting anyone.

11. Ask before recording the call

The rule: Some states require everyone on a call to agree before it is recorded. In California, recording a private call without everyone's consent is a crime with fines of up to $2,500 per violation.

Real-life example: Your AI calls a customer in Los Angeles and records the call for training, without saying so. Under California law, that recording is a problem.

What to do: Add one line near the start of every call: "This call may be recorded for quality."

12. Keep a record of every call and check it monthly

The rule: You can't prove you followed the rules if you have no records.

Real-life example: Think of a restaurant kitchen. Health inspectors don't just trust the chef. They check fridge temperature logs. Your call logs are your temperature logs.

What to do: For each call, keep the phone number, time, time zone, permission record, script version, transcript, and opt-out result. Once a month, read 20 random transcripts. Check that:

• The AI said the business name and that it is an AI
• Every "stop" was honored
• No call happened outside legal hours

Want to hear how this sounds on a real call? Try a live Zoxa demo and listen to the AI introduce itself and handle a "please stop calling" request.

TCPA rules at a glance

TCPA rule	What the law says	Real case that shows why	What your AI agent should do
AI voice counts as artificial	Robocall consent rules apply to AI calls	Fake Biden calls, $6M fine	Treat every AI outbound call as a regulated call
Signed permission for sales calls	Prior express written consent	Mortgage One Funding lawsuit, 2026	Don't dial without a saved consent record
National Do Not Call list	Check a copy no older than 31 days	Dish Network, $280M	Clean lists before every campaign
Wrong and reassigned numbers	Check the Reassigned Numbers Database	Cambridge Honda lawsuit, 2026	Re-check old numbers before calling
Calling hours	8 a.m. to 9 p.m. in the person's time zone	Florida stops at 8 p.m.	Use the caller's time zone and state rules
Say who you are	Business name at start, callback number	Auto warranty robocalls, ~$300M	Put both in the AI's opening lines
Opt-out in the call	Voice or key-press opt-out	Dish called people who had asked it to stop	Understand every way people say "stop"
Honor opt-outs	Any reasonable way, within 10 business days	September 2026 FCC update	One master opt-out list for all tools

TCPA fines: real cases and real numbers

A TCPA violation costs $500 per call. If a court finds you did it on purpose, it can triple to $1,500 per call (47 U.S.C. § 227(b)(3)).

The key word is per call. Here is how fast that adds up:

Calls without permission	Normal damages ($500 each)	On-purpose damages ($1,500 each)
10	$5,000	$15,000
100	$50,000	$150,000
1,000	$500,000	$1,500,000
10,000	$5,000,000	$15,000,000

An AI agent can make 1,000 calls in a single afternoon. That is why one small mistake in your list or your script can become a very big bill.

Lawsuits are going up, too. People filed 2,810 TCPA lawsuits in 2025. By the end of May 2026, filings were running 29.6% higher than the same time in 2025. And in May 2026, 80% of new TCPA cases were class actions, where one person sues for everyone who got the same call.

How Zoxa covers each checklist point

Staying compliant is a team effort. The calling platform gives you the tools. Your business brings the permission, the lists, and the rules. Here is how the checklist splits between a Zoxa voice agent and your team.

Checklist step	What Zoxa does	What your team does
8. Say it's an AI	Built in. You choose whether the agent introduces itself as an AI	Turn it on for every US outbound call
7. Say who you are	Built in. You write the agent's opening lines and callback details	Use a phone number you own (Zoxa connects to Twilio)
9 and 10. Handle "stop"	Can be set up. The agent reacts to keywords you choose and can update your CRM or send a webhook during the call	Map every "stop" phrase to "add to Do Not Call list"
12. Call records	Built in. Every call gets a transcript, plus analytics and sentiment scores	Read sample transcripts every month
Data safety	Built in. Built for HIPAA, SOC 2 and GDPR, with end-to-end encryption. Call data is never used to train outside AI models	Sign a BAA if you handle patient data
2 and 3. Permission and proof	Configured in setup	Collect signed permission and store proof in your CRM
4 and 5. Do Not Call lists	Configured in setup	Check the national list, the Reassigned Numbers Database and your own list
6. Calling hours	Configured in setup	Set hours by the person's time zone and state
11. Recording notice	Configured in setup	Add a recording line to the script

A real example: recall calls at HealthBridge

HealthBridge is a group of 5 outpatient clinics. It uses Zoxa voice agents to answer calls. It is also testing outbound recall calls: the AI calls patients who are due for their yearly check-up.

Here is what happened:

• AI recall calls: 34% of patients booked an appointment
• Old SMS reminders: only 8% booked

That means the AI calls booked more than 4 times as many patients as text reminders. This is exactly why AI calling is worth doing right.

Now let's run those calls through the checklist:

• Selling or telling? Telling. A check-up reminder is an informational call.
• Permission? The calls go to existing patients who gave their numbers to the clinic. For cell phones, the clinic needs that permission on record.
• Say who you are? The agent names the clinic at the start.
• Language? The agent speaks the patient's language: English, Hindi or Punjabi at HealthBridge.
• Stop? Any patient who says "no more reminders" comes off the reminder list.

HealthBridge also cut missed calls from 28% to 3%. See the full numbers in the HealthBridge case study.

Common TCPA mistakes with AI voice agents

• Thinking "it sounds human, so it's not a robocall." The FCC says AI voices count as artificial. Always.
• Buying a phone list. A list you bought is not permission to call with an AI voice.
• Using your own time zone. The clock that matters is the one on the other person's wall.
• Listening only for the word "stop." People say "please don't call me again" much more often.
• Keeping opt-outs in different tools. A STOP text that never reaches your calling tool still counts.
• Adding a sales pitch to a reminder call. One offer turns a "telling" call into a "selling" call.
• Making up a reason for the call. Saying "just calling you back" to someone who never called is how the Mortgage One Funding lawsuit started.
• Setting it and forgetting it. The rules changed in January 2025, June 2025 and September 2026.

AI agents that make outbound calls for hiring follow the same rules. See how AI recruiters screen candidates by phone. And if you are still choosing between people and AI for your phones, read telephone answering service or AI voice agent.

Frequently asked questions

What does TCPA stand for?

TCPA stands for the Telephone Consumer Protection Act. It is a US law from 1991 that protects people from unwanted calls and texts. It sets rules for robocalls, sales calls and the National Do Not Call Registry.

What is TCPA compliance?

TCPA compliance means following the Telephone Consumer Protection Act when your business calls or texts people. In simple terms: get permission first, skip people on Do Not Call lists, call only between 8 a.m. and 9 p.m. their time, say who you are, and stop when someone asks.

Does the TCPA apply to AI voice agents?

Yes. In February 2024, the FCC ruled that AI-generated voices count as "artificial" voices under the TCPA. That means an AI agent that calls people follows the same rules as a robocall. AI sales calls need signed permission first.

Do I need permission for an AI agent to answer calls?

No. The TCPA's calling rules cover calls your business makes. If a customer calls you and an AI agent answers, you did not make the call. You do need to follow the rules once the AI calls someone back or makes a follow-up call.

Is it legal to use AI for cold calling?

Not without signed permission. Cold calling means calling people who never asked to hear from you. AI sales calls need prior express written consent before the call, so true AI cold calling breaks the TCPA. Each illegal call can cost $500 or more.

Who enforces the TCPA?

The FCC makes and enforces the rules. State attorneys general can sue for people in their states. And any person who gets an illegal call can sue the business. The FTC runs the National Do Not Call Registry.

What is the fine for a TCPA violation?

A person can win $500 for each illegal call, or up to $1,500 per call if the business broke the rules on purpose. Because it is counted per call, 1,000 illegal calls can cost $500,000 or more.

Final takeaway: build TCPA compliance into your AI agent

TCPA compliance for AI voice agents comes down to five simple habits:

1. Ask first. Get permission and keep the proof.
2. Check the lists. Skip anyone on a Do Not Call list.
3. Watch the clock. Call only between 8 a.m. and 9 p.m. their time, or earlier in strict states.
4. Be honest. Say who you are and that you are an AI.
5. Stop means stop. Honor every opt-out, fast.

The fake Biden calls, the $280 million Dish penalty and the new AI lawsuits all teach the same lesson: the law cares about permission and honesty, not about how smart your technology is. Run this checklist before every new campaign, and again whenever the rules change.

Ready to hear a compliant AI call? Start free with Zoxa and build an agent that introduces itself, names your business, and logs every call.