TCPA Compliance for AI Voice and SMS Agents: The 2026 Plain-English Guide

If you’re using AI voice agents or automated texting to reach US prospects, one law decides whether your outreach is an asset or a liability: the Telephone Consumer Protection Act (TCPA). The rules moved a lot between 2024 and 2026 — an FCC ruling pulled AI voices squarely under the statute, a federal appeals court threw out the FCC’s biggest consent change the day it took effect, and new revocation rules landed in stages. This guide walks through what actually applies in 2026, in plain English.

Educational content, not legal advice. TCPA compliance depends on your specific facts, and the rules change. Before launching any calling or texting program, have a telecom attorney review it. LeadsNow AI is a lead generation agency, not a law firm.

At a glance

Yes, the TCPA applies to AI agents. Since the FCC’s February 2024 ruling, AI-generated and cloned voices count as “artificial or prerecorded voice” — so AI voice calls to cell phones need prior express consent, and AI telemarketing calls need prior express written consent. Violations cost $500–$1,500 per call or text, which makes consent records, DNC scrubbing, and fast opt-out handling non-negotiable.

• AI voice calls: regulated as artificial/prerecorded voice under the TCPA (FCC, February 8, 2024).
• Marketing texts: treated like calls — consent and opt-out rules apply.
• One-to-one consent rule: vacated by the Eleventh Circuit in January 2025; formally removed by the FCC in September 2025. Consent is still required — the one-seller limit is gone.
• Revocation rules: “any reasonable means” opt-outs and the 10-business-day honor window took effect April 11, 2025; the “revoke-all” portion is delayed to January 31, 2027.
• Exposure: $500 per violation, up to $1,500 if willful, no cap, plus a private right of action that fuels class actions.

What the TCPA is

The TCPA is a 1991 federal law (47 U.S.C. § 227) that restricts calls and texts made with autodialers and artificial or prerecorded voices, plus telemarketing to numbers on the National Do Not Call Registry. The FCC writes and enforces the implementing rules.

Three things make it unusually dangerous for outbound teams:

• A private right of action. Any consumer can sue directly — no regulator needed. That’s why the TCPA is one of the most heavily litigated federal consumer statutes, and why plaintiff firms actively recruit robocall and robotext plaintiffs.
• Per-violation statutory damages. $500 per call or text, trebled up to $1,500 for knowing or willful violations. There is no cap. A campaign that sends 10,000 non-compliant texts has created up to $15 million in theoretical exposure.
• It covers texts. Courts and the FCC treat SMS messages as “calls” under the TCPA. An AI SMS sequence is regulated the same way an AI voice campaign is.

Does the TCPA apply to AI voice agents? Yes — here’s how

On February 8, 2024, the FCC issued a unanimous declaratory ruling confirming that AI technologies that generate human-sounding voices — including voice cloning — are “artificial or prerecorded voice” under the TCPA. The ruling didn’t create a new law; it confirmed that the existing artificial-voice restrictions, which have been on the books since 1991, cover modern AI voice tech.

The practical consequences for anyone running AI voice agents:

• Consent before the call. An AI voice call to a cell phone requires the called party’s prior express consent. If the call is telemarketing — promoting a product or service — it requires prior express written consent (more on the tiers below).
• Identification. Artificial and prerecorded voice calls must disclose the identity of the business responsible for the call at the start, and provide the caller’s telephone number.
• Opt-out mechanics. Telemarketing calls using an artificial or prerecorded voice must offer an automated opt-out mechanism the recipient can use during the call.

In short: an AI voice agent isn’t a loophole. It’s the most regulated category of outbound calling there is. That doesn’t make AI calling a bad idea — it makes consent-first program design the whole game. (If you want the commercial side of this, see our guide to AI voice agents for sales in the USA.)

The consent tiers, compared

TCPA consent isn’t one thing. The level you need depends on what kind of call or text you’re making and to what kind of number.

Two working rules keep this simple. First, if an AI agent speaks on the call, assume the artificial-voice rules apply. Second, if the message promotes anything commercial, assume you need the written tier. When a lead fills out your form and checks a properly worded consent box, an AI agent can call and text them. Without that, it can’t.

What changed, 2024–2026: the timeline

The one-to-one saga deserves one extra sentence, because it’s widely misreported. The Eleventh Circuit’s ruling did not deregulate lead generation. You still need valid prior express written consent for AI telemarketing calls — the court only struck the extra requirement that each consent name a single seller. A lead form can once again cover multiple clearly disclosed partners, but “clear and unmistakable” consent language, sensible partner lists, and airtight records are still what separates a defensible program from a lawsuit.

DNC, quiet hours, and state mini-TCPAs

Federal consent rules are only layer one. Three more layers sit on top.

The National Do Not Call Registry

Telemarketing calls can’t go to numbers on the National DNC Registry (protected 31 days after registration) unless you have the person’s prior express written consent or an established business relationship. Compliant operators scrub lists against the registry at least every 31 days, and also maintain an internal do-not-call list of everyone who has asked them specifically to stop.

Calling-time windows

Federal rules bar telemarketing calls before 8:00 a.m. or after 9:00 p.m. in the called party’s local time. With mobile numbers that ported across time zones, “what time is it where this person actually is” is a real engineering problem — one reason area-code-based scheduling alone isn’t safe.

State mini-TCPA laws

More than a dozen states have passed their own telemarketing statutes since 2021, several stricter than federal law. Examples worth knowing:

• Florida (FTSA): written consent for autodialed marketing calls and texts, a tighter 8 a.m.–8 p.m. window, a three-call-per-24-hours cap per subject matter, and its own private right of action. 2023 amendments (HB 761) narrowed it somewhat and added a 15-day safe harbor for text solicitations after a stop request.
• Oklahoma (OTSA): largely mirrors Florida — prior express written consent for automated solicitation calls and texts, plus a three-call daily cap.
• Washington: expanded its robocall and commercial-solicitation laws in 2023 with the Robocall Scam Protection Act, broadening what counts as a regulated automated call and adding a private right of action.
• Texas: extended its telemarketing law to text messages in 2025 (SB 140, effective September 1, 2025), with a direct private right of action for consumers.

The operational takeaway: a national AI outreach program has to comply state by state, not just federally. The strictest applicable rule wins.

Why this matters: the litigation environment

TCPA suits didn’t slow down when the one-to-one rule died — if anything, plaintiff firms shifted focus to revocation handling, DNC violations, and the state statutes. The math is what drives it: $500–$1,500 per call or text, no damages cap, and class certification across an entire campaign. Settlements regularly run into seven and eight figures. For a business buying leads or running AI outreach, the cheapest compliance program is the one you build before the first call, not the one you build in discovery. If outbound calling is part of that program, our companion guide to AI cold calling and the TCPA for US businesses covers the calling-specific rules in detail.

Compliance checklist for AI outreach in 2026

Here’s what a defensible AI calling and texting program looks like in practice:

• Capture prior express written consent at the point of lead capture: clear disclosure that the person agrees to marketing calls/texts using automated technology or an artificial voice, that consent isn’t a condition of purchase, with named seller(s) and a signature or e-signature.
• Keep consent records — timestamp, IP, form language, page URL — for at least four years (the TCPA’s federal statute of limitations), retrievable per contact.
• Only call leads who opted in. No purchased lists of “aged” leads without verifiable consent to be called by you or a named partner.
• Scrub against the National DNC Registry at least every 31 days, plus applicable state DNC lists, plus your internal do-not-call list before every campaign.
• Identify the business at the start of every AI voice call and include an in-call automated opt-out on telemarketing calls.
• Honor every opt-out fast: recognize STOP, QUIT, END, REVOKE, OPT OUT, CANCEL, UNSUBSCRIBE — and reasonable variants and plain-language requests on voice calls — and suppress the contact well inside the 10-business-day maximum. Best practice is same-day.
• Treat opt-outs broadly. The “revoke-all” rule is delayed to January 31, 2027, but building one company-wide suppression list now costs little and removes the risk.
• Respect quiet hours — 8 a.m.–9 p.m. in the recipient’s local time federally, tighter where states require (e.g., Florida’s 8 p.m. cutoff), with frequency caps where they apply.
• Layer in state rules for every state you call into, especially Florida, Oklahoma, Washington, and Texas.
• Get legal review of your consent language, scripts, and data flows before launch, and re-review when the rules move — as this timeline shows, they move.

How LeadsNow runs compliant AI campaigns

LeadsNow AI builds and runs AI sales agents for US businesses on a pay-per-result model, and the compliance posture follows directly from the business model: we get paid on booked, qualified appointments, so burned numbers, spam complaints, and legal exposure hurt us as much as they’d hurt you.

In practice, that means our US campaigns are consent-first. The AI agents work leads who have raised their hand — form fills, ad responses, inbound inquiries — where consent is captured and logged at the source. Every agent identifies the business it’s calling for, opt-outs are recognized in plain language and suppressed immediately, lists are scrubbed before campaigns run, and contact windows respect the called party’s local time and state rules. That consent-first approach has delivered 50,769+ AI-booked sales appointments since 2017 and 1M+ leads generated — proof you don’t need gray-area calling to fill a calendar.

If you want to see how a compliant AI outreach program would run for your business, book a call and we’ll walk through your lead flow and consent capture together. And if you’re still mapping the basics, start with what an AI sales agent actually is.

Frequently asked questions

Are AI voice calls legal under the TCPA?

Yes, with consent. The FCC’s February 2024 ruling classified AI-generated voices as “artificial or prerecorded voice,” so AI voice calls to cell phones require prior express consent, and AI telemarketing calls require prior express written consent. With valid consent, proper identification, and opt-out handling, AI voice calling is legal.

Do TCPA rules apply to AI-generated text messages?

Yes. The FCC and courts treat text messages as “calls” under the TCPA. Autodialed marketing texts require prior express written consent, opt-out keywords like STOP must be honored within 10 business days at most, and DNC and state rules apply just as they do for voice.

What happened to the FCC’s one-to-one consent rule?

It never took effect. On January 24, 2025 — days before the compliance deadline — the Eleventh Circuit vacated it in Insurance Marketing Coalition v. FCC, ruling the FCC exceeded its authority. The FCC formally deleted the rule in September 2025. Prior express written consent is still required for AI telemarketing; only the one-seller-per-consent limit is gone.

What are the penalties for TCPA violations?

Statutory damages of $500 per violating call or text, up to $1,500 for knowing or willful violations, with no cap. Because each message is a separate violation and consumers can sue directly, class actions over large campaigns routinely reach seven- and eight-figure settlements.

What is the “revoke-all” rule and when does it take effect?

Part of the FCC’s 2024 revocation order: one opt-out would revoke consent for all future calls and texts from that company, across business lines. It was delayed from April 2025 to April 2026, then further extended in January 2026 to January 31, 2027. The rest of the revocation rules — any-reasonable-means opt-outs and the 10-business-day window — have been in force since April 11, 2025.

Do I need consent to have an AI agent call leads who filled out my form?

You need consent captured on that form. A properly worded, signed consent disclosure — stating the person agrees to marketing calls and texts using automated technology or an artificial voice, and that consent isn’t required to purchase — generally satisfies the written-consent tier. Keep the proof: form language, timestamp, and source.

Are state laws stricter than the federal TCPA?

Often, yes. Florida’s FTSA and Oklahoma’s OTSA require written consent for automated marketing contact and cap solicitation calls at three per 24 hours; Florida also cuts calling off at 8 p.m. Washington broadened its robocall laws in 2023, and Texas extended its telemarketing rules to text messages in 2025. A national program must satisfy the strictest rule that applies to each contact.