Is AI Cold Calling Legal in 2026? FTC Rules, State Laws

Your sales team makes 200 calls a day. An AI system makes 10,000. The technology isn't the question. What decides whether those 10,000 calls land you in federal court is whether you got consent from each person, disclosed that it's AI, and scrubbed your list against the Do Not Call registry.

Is AI cold calling legal? Yes. But only when you follow the TCPA, the FCC's updated rules, and the state laws that go further than federal requirements. Get any of these wrong and you're looking at $500 to $1,500 per call in penalties with no cap on class action exposure.

This guide breaks down what's actually required in 2026: the consent rules that changed in January, the B2B exemptions most platforms don't explain clearly, and a checklist you can use before your first campaign goes out.

1. What Makes AI Cold Calling Legal (or Illegal)

The core rule is the Telephone Consumer Protection Act of 1991. TCPA prohibits automated calls to cell phones without prior express consent for most marketing calls. It was written before AI existed, but it applies.

In February 2024, the FCC extended TCPA explicitly to AI-generated voices. The ruling confirmed that AI voice calls count as "artificial or prerecorded voices" under the law. That closed the loophole some platforms used to argue their conversational AI wasn't technically a robocall. It doesn't matter how natural the voice sounds. If it's AI-generated, TCPA applies.

Three things determine whether an AI call is legal:

• Consent: Did the person agree to receive calls from your company specifically?
• Disclosure: Does the call identify itself as AI at the start?
• DNC compliance: Has the number been scrubbed against the National Do Not Call Registry?

All three. Not two of three.

2. TCPA, the FCC, and the 2026 One-to-One Consent Rule

The FCC's January 27, 2026 one-to-one consent rule is the most significant change to telemarketing compliance in years. It rewrites how lead-generated consent works.

Under the old rules, a consumer could check one box on a comparison website to consent to calls from "marketing partners." Lead generators sold those consents to dozens of companies. One checkbox, many companies calling. The new rule ends that.

Under one-to-one consent, every company must obtain consent specifically for itself. If you're buying leads from a provider, you need proof that each person consented to receive calls from your company, not just "affiliated companies" or "partners." "We got the data from a list provider" isn't a defense anymore.

The FTC's Telemarketing Sales Rule covers pre-recorded commercial messages separately. TSR violations are distinct from TCPA violations. Both agencies are running enforcement programs, and both can fine you. A single AI campaign can trigger violations from both.

3. B2B vs. B2C: The Rules Aren't the Same

TCPA's strictest requirements apply to residential and personal cell phones. B2B calling operates under different rules. But different doesn't mean no rules.

Here's what changes for B2B:

• Business landlines: Prior express written consent isn't required under TCPA. But the DNC Registry still applies, and company-specific do-not-call requests must be honored.
• Business numbers routed to cell phones: If the number reaches a mobile, TCPA applies. The law doesn't care whether the phone is used for work.
• State-level B2B rules: Florida, California, and Washington have extended consumer-style protections to some business contacts. Don't assume B2B means zero compliance burden in those states.

The practical problem: you usually can't tell whether a business number is a landline or a VoIP/mobile line from the number itself. A phone lookup service before uploading your list can identify mobile numbers that need written consent. Numbers flagged as mobile need documentation regardless of whether they're used for business purposes.

Want to see the math on compliant AI campaigns? Run the ROI numbers for your team at our AI calling ROI calculator — it shows cost per meeting vs. human reps for your current call volume.

4. Prior Express Written Consent: What It Actually Looks Like

For calls to cell phones, written consent must meet the FCC's specific requirements. Verbal consent doesn't count.

Written consent must be:

• Written or electronic: A web form submission counts. So does an SMS opt-in. Verbal agreement during a call doesn't.
• Unambiguous: The person understood they were agreeing to receive AI calls from your company specifically, not just "promotions" in general.
• Company-specific: As of January 2026, consent from a lead aggregator that covers "marketing partners" doesn't satisfy this requirement.
• Documented: You need records you can produce in litigation. Timestamp, IP address, and the consent language shown.

What valid consent language looks like: "By submitting this form, you agree to receive automated marketing calls and text messages from [Company Name] at the phone number provided. Consent is not required to make a purchase."

Two requirements there: the company must be named, and consent can't be conditioned on purchasing. Both are required.

Keep records for at least four years. TCPA class actions regularly go back years, and the burden shifts to you once the plaintiff shows a call occurred. TopCalls' secure infrastructure logs consent verification and call recordings automatically with a full audit trail.

5. You Have to Say It's AI

Federal law doesn't yet require universal AI disclosure on every commercial call. But several states already do, and the FCC has proposed requiring it at the start of any AI-generated call. The gap between where things are now and where they're heading is small.

Where you must disclose as of 2026:

• California (AB 1936): Disclosure required at the start of any interaction with an automated system when asked. Failing to disclose when asked is a violation.
• Florida: The Florida Telephone Solicitation Act requires identifying as a solicitor immediately upon connection.
• New York and Texas: Both require identifying as an automated system during the opening of the call.
• Upcoming FCC rules: Federal rules are expected to require upfront disclosure within the first 30 seconds for any AI-generated voice call.

Don't wait for the federal rule to finalize. Disclosing upfront in every call is better compliance, and it's better selling. It filters out people who won't engage with AI and focuses your follow-up on those who will. "Hi, I'm an AI calling from [Company Name]" costs you nothing, and protects you from state-level violations in four major states today.

For the full TCPA framework, our TCPA compliance guide for AI cold calling covers federal requirements in detail.

6. Penalties: $500 to $1,500 Per Call

TCPA violations don't get resolved administratively. They become lawsuits. And they add up fast.

• $500 per call for negligent violations
• $1,500 per call for willful violations
• No cap on class actions: A campaign that calls 50,000 people without valid consent creates 50,000 separate violations

Real enforcement: the FTC's Operation AI Comply, launched in 2024, specifically targets companies using AI voice calls to evade consumer protection laws. The FCC fined Lingo Telecom over $1 million for AI-generated robocalls. Commercial campaigns face the same legal framework.

State penalties stack on top. California's automated dialing law allows $1,000 per violation. Washington and Florida have their own fine structures. The federal baseline isn't the ceiling.

This is why documented consent matters. Once a plaintiff shows a violation occurred, the burden shifts to you to prove consent was valid. "We had it somewhere" won't hold up.

7. A Compliance Checklist for 2026

Work through this before any AI campaign launches:

• Consent documentation: Can you produce written consent for every number? Does it name your company specifically, with a timestamp and IP?
• DNC scrubbing: Have you run your list against the National DNC Registry within the last 31 days? A scrub older than 31 days doesn't protect you.
• Mobile number identification: Have you flagged mobile numbers in your list that require documented written consent before calling?
• AI disclosure script: Does your AI identify itself as AI within the first 30 seconds of every call?
• Opt-out mechanism: Does the call offer a clear way to opt out? Is that request logged and honored within 24 hours across all future campaigns?
• Call recording storage: Are recordings stored for at least four years and accessible if you receive a litigation hold?
• State law review: Have you checked specific requirements for Florida, California, New York, and Washington? These states have additional requirements beyond federal law.

TopCalls handles several of these steps automatically. The AI lead qualification system includes built-in DNC checking, consent logging, and opt-out handling so your campaigns stay compliant without manual tracking.

8. Where AI Calling Works (and Where It Doesn't)

Compliant AI calling is legal and it scales. These use cases work cleanly from a compliance standpoint:

• Inbound callback requests: Someone submits a form requesting a call. Consent is built into the action. AI can follow up in under 500ms with full documentation in place.
• Existing customers: Where consent was captured during onboarding and is documented. Reactivation campaigns work well here.
• Verified B2B landlines: With DNC scrubbing and company-specific opt-out tracking in place.
• Appointment reminders: Where consent was given at booking. Clear consent context, clear purpose.

Where it doesn't work:

• Purchased lists without documented company-specific consent
• Any number on the DNC Registry
• High-ticket enterprise deals where a cold AI call is the wrong first impression regardless of legality
• Healthcare outreach without HIPAA-compliant consent processes in place

For a detailed walkthrough of building a high-volume compliant campaign, see our guide on how to run 1,000 AI sales calls per day.

Frequently Asked Questions

Is AI cold calling legal in the US?

Yes, with conditions. You need prior express written consent for calls to cell phones under TCPA, AI disclosure at the start of the call, and your list must be scrubbed against the National DNC Registry. Miss any of these and you're in violation, with penalties starting at $500 per call.

What happens if I make illegal AI calls?

TCPA allows $500 per call for negligent violations and $1,500 per call for willful violations. Class actions have no cap, so 50,000 unconsented calls is 50,000 individual violations. The FTC's Operation AI Comply is actively running enforcement actions against AI-powered telemarketing campaigns.

Do I need written consent for B2B AI calls?

For calls to verified business landlines, no. For business numbers that route to cell phones, yes. TCPA doesn't distinguish between personal and business use of a mobile number. After January 27, 2026, any consent must be company-specific, not blanket third-party consent from a lead aggregator.

How do I disclose that my caller is AI?

Have the AI system identify itself at the start of the call, within the first 30 seconds. A simple line works: "Hi, I'm an AI calling from [Company Name]." This is already required in California, Florida, New York, and Texas. The FCC has proposed making it federal.

What changed with the FCC's one-to-one consent rule?

Before January 27, 2026, a consumer could check one box on a comparison website and consent to calls from all "marketing partners." After that date, consent must be given specifically to each company. Lead lists collected under the old model may no longer satisfy current legal requirements.

AI cold calling isn't inherently illegal. Get consent documented before the first call, disclose the AI upfront, and scrub your lists. Do those three things and you can run a compliant campaign that scales to thousands of calls per day without legal exposure.

If you want to walk through your specific use case before launch, the TopCalls team is available for a 30-minute compliance and setup call. Or start with our guide to AI cold calling fundamentals to understand the full picture before your first campaign.