Consent, DNC and calling hours: a practical checklist for AI calls (not legal advice)

This checklist is general information, not legal advice. Rules differ by country and state, they change, and the details of your calls matter. Before you start outbound calls, talk to a lawyer who knows the rules where you and your contacts are.

Why AI calls need extra care

Outbound AI calls work well for appointment reminders, confirmations, delivery updates and callbacks that people asked for. They are a poor fit for cold calling. Unwanted calls are one of the most common consumer complaints, regulators treat automated calls strictly, and in the US damages can be counted per call.

In February 2024 the US Federal Communications Commission (FCC) confirmed that AI-generated voices count as an "artificial or prerecorded voice" under the Telephone Consumer Protection Act (TCPA). In practice, an AI agent calling a person is treated like a prerecorded message, and the same consent rules apply.

1. Give every campaign one purpose

The purpose of a call decides the consent you need, so decide it before you upload a single number:

• Informational calls: appointment reminders, confirmations, delivery or order updates, a callback the person asked for. In the US these generally need the person's prior express consent, typically given when they provided their number for that purpose.
• Telemarketing calls: anything that encourages a purchase. In the US these need prior express written consent: a signed agreement (electronic is fine) that names the phone number and the seller and makes clear that agreeing is not a condition of purchase.

A reminder that turns into a sales pitch becomes a telemarketing call. Keep each campaign, and each agent's instructions, to one clear purpose.

Checklist:

• The campaign's purpose is written down: informational or marketing.
• The agent's prompt sticks to that purpose.

2. Keep a consent record for every contact

"They're our customers" is not a consent record. For each contact, store:

• the type of consent (express, written, or consent to automated calls in the UK and EU);
• its purpose (which kinds of calls it covers);
• where and when it was given: the form or page, the date and time, and the IP address for web forms;
• the exact wording the person agreed to.

Checklist:

• Contacts are imported only with a consent record that fits the campaign's purpose.
• Contacts without suitable consent are skipped automatically at dial time, not by memory.
• Consent records are kept for as long as you may need to prove them.

3. Scrub against do-not-call lists, twice

• United States: each seller needs its own access to the National Do Not Call Registry, and the copy used must be no more than 31 days old. Several states have their own lists.
• Your internal do-not-call list: everyone who asked you not to call. In the US, requests must be honoured within a reasonable time, at most 10 business days, and kept for five years.
• United Kingdom: live marketing calls must be screened against the Telephone Preference Service (TPS).

Check the lists when you build a campaign and again right before each call: someone may have opted out an hour ago.

Checklist:

• National and internal lists are checked before the campaign and at dial time.
• Opt-outs from every channel (calls, email, forms, support) end up on the internal list.

4. Call only within the allowed hours, in the contact's time zone

US federal rules allow telephone solicitations only between 8 am and 9 pm in the called person's local time. Several states are stricter. Florida and Oklahoma, for example, allow 8 am to 8 pm and limit calls on the same subject to three in 24 hours, Texas starts at 9 am (noon on Sundays), and some states ban these calls on Sundays or public holidays.

Use the contact's time zone, not yours, and keep a holiday calendar. When the time zone is unknown, be conservative: use the latest start and the earliest end of the possible zones.

Checklist:

• Each contact has a time zone (from the address or the area code).
• Calling windows, state rules and holidays are enforced by software, not by hand.
• Retries are capped per day and per month.

5. Say who is calling, that it's an AI, and whether you record

Put these in the first sentences of every call:

• The name of the business responsible for the call. US rules also require a callback number during or after the message.
• That the caller is speaking with an AI. In the EU, Article 50 of the AI Act requires people to be told they are interacting with an AI system, at the latest at the first interaction (it applies from 2 August 2026). Several US states, such as Utah and California, have their own AI or bot disclosure rules. And it is simply honest.
• A recording notice if you record. Several US states, including California, Florida, Illinois, Maryland, Massachusetts, Pennsylvania and Washington, require the consent of everyone on the call, and calls often cross state lines.

Tell the agent never to claim to be human, and to say so honestly when asked.

Checklist:

• The first message names the business and says it's an AI assistant.
• Agents that record play a recording notice.
• A callback number is configured.

6. Make opting out easy, and honour it immediately

People can revoke consent by any reasonable means: saying "stop calling me" during a call, replying to a message, emailing you. For US telemarketing calls with an artificial voice, you must also offer an automated opt-out (by voice or key press) within two seconds of identifying the business.

A good AI agent recognises an opt-out request, confirms it politely, ends the call and records it, and the number is skipped from then on.

Checklist:

• The agent's instructions cover opt-out requests explicitly.
• Opt-outs said during a call are detected and added to the do-not-call list automatically.
• Opt-outs are kept even when the contact or the campaign is deleted.

7. Watch delays and abandoned calls

In the US, a telemarketing call counts as abandoned when the person answers and no message starts within two seconds of their greeting, and abandoned calls must stay under 3% of answered calls per campaign over 30 days. Slow AI responses and long answering-machine detection can count. Keep the first message short, keep latency low and pause a campaign when the rate climbs.

Checklist:

• The abandonment rate is measured per campaign.
• Campaigns pause automatically above a threshold you set.

8. Know the rules outside the US

• European Union: under the GDPR you need a legal basis for processing contacts' data, and people have an absolute right to object to direct marketing. Under the ePrivacy rules, automated calling systems used for direct marketing need prior consent; treat an AI agent as such a system. Rules for live marketing calls differ by country.
• United Kingdom: under PECR, automated marketing calls need the person's specific consent to automated calls, and the call must give your name and an address or freephone number. The Data (Use and Access) Act 2025 raises the maximum PECR fines to UK GDPR levels.
• India: TRAI's rules on commercial communications require registration on the DLT platform (entity, headers, templates and consent). Promotional calls must come from the 140 series and service or transactional calls from the 1600 series, not from ordinary 10-digit numbers.

9. Keep an audit trail

If a complaint arrives, you need to show what happened: which consent the contact had, which lists were checked, when the call was placed in the contact's local time, what the agent said at the start, and whether the person opted out.

Checklist:

• Consent checks, do-not-call checks, blocks, dial times, disclosures and opt-outs are logged.
• The log can't be edited after the fact, and can be exported.
• A person reviews a sample of transcripts every week.

The short version

1. One purpose per campaign, and consent that fits it.
2. Scrub against do-not-call lists before the campaign and again at dial time.
3. Call within the allowed hours of each contact's time zone, with sensible retry limits.
4. Start every call with the business name, the AI disclosure and, if you record, the recording notice.
5. Make opting out easy and honour it at once.
6. Keep the agent fast, and pause campaigns that abandon too many calls.
7. Log everything, and get legal advice before you start and whenever the rules change.

Software can enforce most of this for you: consent fields, do-not-call scrubbing, calling-hour rules and audit logs help a lot. But they are tools. The responsibility for each call stays with the business that makes it.