Is AI Cold Calling Legal? TCPA, GDPR & B2B Compliance Guide 2026

Using AI to make B2B cold calls is generally lawful in the United States. What makes a specific call unlawful is the circumstances around it, not the fact that a machine placed it. Calling a number on the Do Not Call Registry, using an artificial voice to reach a mobile without prior express consent, calling outside permitted hours, ignoring an opt-out, or failing to disclose where your state requires it — those are the violations.

The second thing to be clear about is who is on the hook. Liability attaches to the caller, not to the software vendor. If a platform tells you it makes you compliant, it is describing something it is not able to do.

In February 2024 the FCC issued a declaratory ruling that AI-generated voices count as an artificial or prerecorded voice under the TCPA. That single classification is the most important fact on this page, because the TCPA already had a well-developed set of restrictions on artificial and prerecorded voice calls — and AI calling inherited all of them at once.

The practical consequence is about mobile numbers. The artificial-voice restriction turns on prior express consent for calls to mobile numbers, and it is a separate provision from the Do Not Call Registry rules. It is not limited to residential lines. Since a large share of B2B direct-dial numbers are mobiles, “we only call businesses” does not answer the question by itself.

Not a single blanket one, and believing otherwise is the most expensive misunderstanding in outbound. There are two separate sets of rules and they have different scopes.

The Do Not Call Registry protects residential subscribers. Calls to genuine business lines generally sit outside it, which is the grain of truth the “B2B exemption” idea grew from.

The artificial and prerecorded voice restrictions are a different provision with a different scope, and they are not limited to residential numbers. A business contact reached on their mobile is not automatically fair game because the call is commercial.

Handle them as two questions rather than one. State registries add a third layer, and some are stricter than the federal baseline.

This is the part most vendor pages leave vague, so here it is as a table. On any plan where you provide the list, you are the caller of record and the data controller. That is a contractual position, not a marketing one, and it is set out in full in our TCPA Compliance Policy.

Several US states require a caller to disclose that it is not human, and the number requiring it has been growing. The requirements are not uniform — they differ on wording, on timing, and on which kinds of calls are covered — so the honest instruction is to check the states you actually call into rather than to trust any vendor’s blanket assurance, including ours.

On DialsDone the disclosure lives in the script you write, and the platform does not insert one for you. That is deliberate: the wording that satisfies a given state is a legal judgement about your campaign, not a default we can safely choose on your behalf.

Worth saying separately: even where nothing requires it, disclosing early tends to improve calls rather than end them. A prospect who works out mid-sentence that they have been talking to a machine reacts to the concealment, not to the technology.

There is no single European answer, and anyone offering one is simplifying something that is genuinely fragmented.

Under GDPR you need a lawful basis for processing the personal data on your list. Some member states accept legitimate interest for B2B outreach, subject to a balancing test you should be able to evidence. Others are markedly stricter. Several maintain corporate opt-out registers you are expected to screen against before calling, and the penalties for skipping that step are not theoretical.

In the UK, PECR sits alongside GDPR and draws a distinction between corporate subscribers and individuals — including sole traders and many partnerships, who get treated closer to individuals than the word “business” suggests. Screening against the Corporate Telephone Preference Service is part of the baseline.

If your list spans several countries, the practical approach is to segment it by jurisdiction and get advice per market, rather than to run one campaign against the loosest rule you can find.

None of this is onerous once it is a routine. In order, before a single call goes out:

• Scrub the list first — national registry, then any state registries that apply. Before upload, not after.
• Know which numbers are mobiles and hold consent for those. This is the step most campaigns skip, and it is the one the artificial-voice rule turns on.
• Put disclosure in the script where your states require it, at the top of the call.
• Set calling hours to the prospect’s local time, not your own. A compliant hour in your timezone can be an unlawful one in theirs.
• Honour opt-outs immediately and across every channel. An opt-out on a call has to suppress the contact in your email tool too, which means the suppression list cannot live inside one vendor.
• Keep the records — consent, opt-outs, and when each was captured. Disputes turn on what you can evidence, not on what you did.

Most of the risk is decided before you dial, in the quality and provenance of the list. That is the subject of our guide to building a B2B calling list, and the compliance obligations differ by channel too — see cold email vs cold calling for how the email rules diverge from these.