Is AI Cold Calling Legal? It Depends on Whether They Asked You to Call

Is AI cold calling legal? The short answer, as of November 2026: cold calling strangers with an AI voice is heavily restricted in almost every major market, and in several of them it is effectively off limits without prior consent. The US and Canada already write synthesized voices into their rules for recorded and automated calls, UK and EU regulators point the same way, and those calls need the person’s agreement before you dial. Calling someone who filled your form and agreed to be called, saying who you are and that the caller is an AI, offering a human, and stopping the moment they say stop is a very different position, and in most places a workable one.

So the answer depends on three things: which country the person is in, what consent you hold, and what the caller discloses. Here is the map, country by country, with the main rule and the kind of consent each one expects.

A note before the details. I run a company that builds AI agents that make and take calls. I am not a lawyer, and this is not legal advice. Every legal statement below links to the regulator, the statute, the court, or a dated analysis, so you can check it yourself. Rules in this area changed several times between 2024 and 2026, so talk to counsel in each country you call before you scale anything.

Cold calls and warm calls are different legal questions

Most posts on this topic blur two very different calls. A cold call goes to someone who has never heard of you. You bought a list or scraped a number, and the person did not ask for anything. A warm call goes to someone who raised their hand: they filled your enquiry form, booked a demo, asked for a callback, and ticked a box saying you may call them.

Picture a parent who fills your form at 9:12 pm and gets a call two minutes later, next to a stranger whose number came from a list. The script can be identical. The legal position is not. Almost every rule below turns on consent, and several of them turn on whether the call was unsolicited. A cold AI call to a consumer starts with no consent at all, which in most of these countries is where the analysis ends. A warm call starts with a record that says this person asked to hear from you, when, and on what terms.

This is the line we chose at Tough Tongue AI. Our focus is calling warm leads before they go cold: the enquiry that came in at night, the demo request nobody picked up, the admissions form from a parent who is also talking to two other schools. I wrote about why minutes matter in speed to lead with AI. That focus does not make anyone compliant by itself. “Warm” is not a legal category, the wording of your consent matters, and some countries put a clock on how long an enquiry counts. The sections below show where. The same split answers the broader question of whether AI outbound calling is legal: it is the consent, not the dialing, that decides.

United States: TCPA rules for AI calls

The key document is the FCC’s AI robocall ruling, Declaratory Ruling FCC 24-17, adopted on 2 February 2024 and released on 8 February 2024. It confirmed that the Telephone Consumer Protection Act’s restrictions on “artificial or prerecorded voice” cover current AI technologies that generate human voices. Everything else in this section follows from that.

Under the FCC’s rules in 47 CFR 64.1200, as of November 2026:

• Consent. A call to a mobile number using an artificial voice needs the person’s prior express consent. A telemarketing call with an artificial voice, to a mobile number or a residential line, needs prior express written consent: a signed agreement, which can be electronic, that names the seller, authorizes calls using an artificial or prerecorded voice, and gives the number.
• Identification. At the start of the message, the call must state clearly who is responsible for it, and it must give a callback number. Telemarketing calls must offer an automated opt-out within two seconds of that identification.
• Hours and lists. Telephone solicitations to homes are limited to 8 am to 9 pm in the called person’s local time, and the National Do Not Call Registry applies.

Three changes from 2025 and 2026 matter. The FCC’s “one-to-one consent” rule, which would have limited each consent to a single seller, was vacated by the Eleventh Circuit in Insurance Marketing Coalition v. FCC on 24 January 2025, and the FCC restored the earlier rule text effective 29 August 2025. Revoking consent by any reasonable means has been the rule since 11 April 2025, with revocations honored within ten business days. And the FCC’s October 2026 order, FCC 26-67, effective 25 November 2026, lets callers designate an exclusive way to revoke consent and narrows how far a “stop” on one informational call reaches.

On saying “this is an AI”, there is no final federal rule. The FCC proposed one in August 2024 (FCC 24-84), and as of November 2026 it is still a proposal. States are moving on their own. California’s Public Utilities Code section 2874, amended by AB 2905 from 1 January 2025, requires calls placed through an automatic dialing-announcing device to tell the person if the message uses an artificial voice. Utah has a separate disclosure law for generative AI in consumer transactions. Several states, such as Florida with its Telephone Solicitation Act, add their own telemarketing rules and private lawsuits on top of the federal ones.

One more wrinkle. In June 2025 the Supreme Court held in McLaughlin Chiropractic v. McKesson that district courts are not bound by the FCC’s interpretations of the TCPA. In theory that reopens the question of whether an AI voice is “artificial”. I would not build a business on that argument.

If you call your own warm leads: put prior express written consent on the form, naming your business and calls with an AI or artificial voice to the number given; identify the business at the start; offer an opt-out; respect the hours. The operational side is on our AI outbound calling page.

United Kingdom: is AI calling legal under PECR?

The UK splits calls in two. Live marketing calls fall under regulation 21 of PECR: you can call a number that is not on the TPS (or the CTPS for businesses) unless the person has objected. Automated marketing calls fall under regulation 19, which needs prior consent. The ICO’s telephone marketing guidance is direct: general consent for marketing, or even consent for live calls, is not enough. It must specifically cover automated calls, and every automated call must give your name and a contact address or freephone number.

Is an AI agent an automated call? The guidance does not mention AI by name, and the ICO says it is under review after the Data (Use and Access) Act. But the signals point one way. In its innovation advice, the ICO said software that plays an AI-generated greeting in a call handler’s voice would not comply with regulation 19 unless the organisation had specific consent. In September 2025 it fined two energy firms £550,000 in total for automated calls that used avatar software, where agents abroad played recorded lines. My reading: if clips triggered by a human count as automated, a fully synthetic caller very likely does too. No ruling says so yet.

The cost of getting this wrong went up. Since 5 February 2026, the ICO can fine up to £17.5 million or 4% of global turnover under PECR, where the old cap was £500,000.

If you call your own warm leads: make the consent line cover automated or AI calls from your company specifically. Whether a callback the person requested sits outside regulation 19 is unsettled, so do not rely on it.

European Union: ePrivacy consent plus the AI Act

Two layers apply. The first is Article 13 of the ePrivacy Directive: automated calling systems without human intervention may be used for direct marketing only with the person’s prior consent, and for other marketing calls each member state chooses between opt-in and opt-out. So the national rules differ, and some are getting stricter. France is the clearest recent example. Since 11 August 2026, phone canvassing of consumers needs their prior consent, the Bloctel opt-out list has ended, consent lasts at most one year, and you may not call someone to ask for consent. Permitted calls are limited to weekdays from 10 am to 1 pm and 2 pm to 8 pm, with fines up to €375,000 for a company.

The second layer is new. Article 50(1) of the AI Act requires AI systems that interact directly with people to be designed so that the person is told they are dealing with an AI, at the latest at the first interaction, unless it is obvious. It has applied since 2 August 2026. Systems already on the market got until 2 December 2026 for the separate rule on marking AI-generated content, but the duty to tell people they are talking to an AI had no such grace period.

If you call your own warm leads: collect consent that covers AI calls, have the agent say it is an AI in its first sentence, and check the national rules in each country you call, including hours.

Canada: synthesized voices are already in the rules

Canada did not need a new ruling. The CRTC’s Unsolicited Telecommunications Rules define an automatic dialing-announcing device (ADAD) as equipment used to convey “a pre-recorded or synthesized voice message”. Telemarketing through an ADAD needs the consumer’s express consent, and the ADAD rules apply whether or not the call is exempt from the National Do Not Call List rules.

That last point matters for warm leads. The DNCL rules exempt calls to someone who made an inquiry or application in the last six months, which helps a human caller. It does not remove the express-consent requirement for an ADAD call. Telemarketing calls are limited to 9 am to 9:30 pm on weekdays and 10 am to 6 pm on weekends in the recipient’s time, and the CRTC can impose penalties of up to $15,000 per violation for a corporation. The CRTC opened a review of these rules in June 2026, so watch for changes.

If you call your own warm leads: an enquiry gets a live caller past the DNCL for six months, but an AI caller still needs express consent. Put it on the form.

Australia: synthetic voices count, and the Register applies

Australia’s Do Not Call Register Act 2006 bans telemarketing calls to registered numbers without consent, and its definition of a voice call includes a call that involves a recorded or synthetic voice. The ACMA says consent can be given directly or sometimes inferred, but you cannot infer it just because a number is published online.

The Telemarketing and Research Calls Industry Standard 2017 applies to every telemarketing call, registered number or not. It sets calling hours of 9 am to 8 pm on weekdays and 9 am to 5 pm on Saturdays, with no calls on Sundays or national public holidays unless the person agreed. Callers must say who they are as soon as the call starts and end it when asked, and a call with a synthetic voice must give the person a way, during the call, to request contact details. The ACMA enforces this: in July 2026 TAB paid $2.7 million for telemarketing and spam breaches.

If you call your own warm leads: express consent on the form is the clean path. Keep to the hours and build the identification and contact-details request into the agent.

India: TRAI’s 140 and 1600 series and AI calls

India regulates commercial calls through TRAI’s Telecom Commercial Communications Customer Preference Regulations, 2018 (TCCCPR), which require senders to register with their telecom operator. Promotional calls must come from the 140 series, and TRAI says those calls are checked against each customer’s DND preferences before delivery. Service and transactional calls belong on the 1600 series (sometimes written as 160), which TRAI has made mandatory first for banking, financial services and insurance senders.

Two amendments changed the picture. The February 2025 amendment restricted ordinary 10-digit numbers for telemarketing, made consent for an ongoing transaction valid for only 7 days, and required senders to disclose their use of auto-dialers and robo-calls. The September 2026 amendment, announced on 18 September 2026, goes further. It defines application-to-person calls to include calls made with pre-recorded or artificial voice technology, requires every business using them to declare that use and its calling numbers to its operator in advance, treats undeclared calls as spam, and adds a termination charge of up to 5 paise per minute. It also says a business may contact a customer on the basis of their inquiry for only seven days, and only if the inquiry was made in writing or digitally and is kept in a verifiable form.

TRAI and the RBI are also piloting digital consent acquisition, a shared platform where customers can review and revoke consents. As I noted in the admissions post, your telephony provider usually handles much of the registration and DND checking, but the obligations are yours.

If you call your own warm leads: store the enquiry, call within the seven-day window, declare your AI calling and numbers to your operator, and move longer relationships onto registered consent.

What changed between 2024 and 2026

If you read a guide from 2024, much of it is out of date. These are the dated changes I verified for this post.

The pattern is consistent across very different legal systems. Regulators are making the old rules for recorded and automated calls apply to AI, and adding a duty to say so. None of these six markets has banned AI calling outright.

What the first fifteen seconds should sound like

Disclosure and opt-outs are where a compliant setup is won or lost on the actual call. Most of the risk sits in the opening line and in the moment someone says no.

The weak version is riskier, and it also performs worse, because people hang up on calls that sound like they are hiding something. I go deeper on openings and pauses in 10 tips for better AI cold calling. If the call is recorded, add one short line saying so, such as “this call is recorded so a counselor can follow up”, and check the recording rules where you call.

A checklist that applies almost everywhere

Before an AI agent dials anyone, I would want four answers to be yes.

The practical list that follows from those rules:

• Get and store consent. Put a clear line on the form that names your business and says you may call, including with an AI assistant. Keep the wording, the timestamp, the page and the number.
• Say who you are and that it is an AI, at the start. Business name, the caller’s name, “an AI assistant”, and why you are calling.
• Offer a human. Every call should have a path to a person, and the agent should take it when asked.
• Honour opt-outs immediately. Stop the call, mark the number, and make sure no other campaign or tool calls it again.
• Respect calling hours and do-not-call lists. Use the strictest window among the places you call, and check the national lists where they apply.
• Record only with notice. Say so on the call and keep recordings only as long as you need them.
• Keep records. Consent, call logs, transcripts and opt-outs are your evidence if anyone complains.

None of this is exotic. It is what a careful human calling team should already do. The difference is that an AI agent does it on every call, at any hour, so a mistake in the setup repeats thousands of times.

Where Tough Tongue AI fits, and where it does not

At Tough Tongue AI we build agents that call warm leads: enquiries, admissions forms, demo requests and missed calls. You describe the conversation in plain language, including the opening, the AI disclosure, when to hand over to a person and what to do when someone opts out. The agent places calls through your own SIP trunk, and every call is transcribed and scored against a rubric you define, so you can check that the disclosure happened and the opt-out was honoured on every call instead of hoping it did.

What it does not do is make you compliant. Collecting and storing consent, scrubbing against do-not-call lists, registering as a sender with your carrier, and getting legal sign-off for each country are still yours. If you want to see how the opening and opt-out handling work on your own leads, book 15 minutes with me.

So, is AI cold calling legal?

The honest summary: cold calling strangers with an AI voice is restricted almost everywhere, and in the US, UK and Canada it needs consent you almost certainly do not have for a bought list. Calling people who asked you to call, with that consent on file, an honest first sentence and an opt-out that works, is a different question with a workable answer in most markets. Build for that, check each country with counsel, and treat every rule above as a floor rather than the goal.