Rules and risks

How the rules work

The FCC's ruling. On February 8, 2024 the FCC ruled unanimously that AI-generated and cloned voices are "artificial" under the TCPA. Outbound AI calls need prior express consent, written and naming the seller for telemarketing; they must identify the caller at the start and, for telemarketing, offer an automated opt-out. The FCC refused any carve-out for technology that claims to work like a live agent, and the 26 state attorneys general who asked for the ruling can sue under the TCPA too. Private damages are $500 per call, $1,500 if wilful, with a four-year limitation period. Since a June 2025 Supreme Court decision, courts read the TCPA for themselves without deferring to the FCC; an appeals court had already read "artificial voice" to include AI in 2023, so I'd treat the question as settled.

The FCC's direction has turned since. Its August 2024 proposal to require AI disclosure at consent and at the start of each call hasn't been adopted, the one-to-one consent rule was deleted in 2025, and in September 2026 it asked for comment on letting political AI-voice calls reach mobile phones without consent.

Plaintiffs do the enforcing. A litigation tracker counted 1,052 TCPA class actions from January to June 2025, against 539 a year earlier. The AI-voice suits I found turn on consent, ignoring "no", wrong numbers and state registration rather than model quality: a February 2026 suit against a mortgage lender alleges more than $5 million in damages, and a 2026 Texas suit says an AI agent kept selling after the person said no. The suit against OpenAI and Twilio tests whether model and communications providers can count as callers, and I found no ruling yet.

Fake-Biden robocall. On January 21, 2024, calls with a cloned Biden voice told New Hampshire Democrats not to vote in the primary. A political consultant commissioned them, paying a magician $150 to make the clip in under 20 minutes. Lingo Telecom, which signed the spoofed calls with the highest level of caller-ID attestation, paid $1 million under an August 2024 consent decree. The consultant was fined $6 million by the FCC, still refused to pay as of November 2025, and was acquitted of all 22 criminal counts in June 2025. The penalty that landed hit the carrier's attestation.

Disclosure. Maine's law, in force since September 2025, covers chatbots that talk as well as type and requires a clear notice wherever a reasonable consumer could think they're talking to a person. Utah requires disclosure when asked, and up front in high-risk interactions, until July 2027, and California requires prerecorded calls to say if the voice is artificial. Since August 2, 2026 the EU AI Act has required that people are told they're dealing with AI unless it's obvious, and that providers mark synthetic audio, with fines up to €15 million or 3% of turnover. Disclosure has a measured cost: in a 2019 field experiment with more than 6,200 customers of a financial firm, telling people up front that a sales call came from a bot cut purchases by more than 79.7%. That was pre-LLM technology in one market, and I found no newer replication.

Recording and wiretaps. About 11 states require every party's consent to record. The sharper risk is California's wiretap law. In February 2025 a court let a suit proceed against Google over its contact center AI on Verizon support calls, holding that a vendor capable of using call data for its own purposes counts as an eavesdropper whether or not it actually does, and an August 2025 ruling did the same for an AI pizza-ordering vendor. At $5,000 per violation, zero-retention and no-training settings and a greeting that names the vendor are worth their price.

Biometrics, health and cards. BIPA pays $1,000-5,000 per person for voiceprints collected without written consent; voice-authentication vendors serving financial firms won two appeals in 2026 under its exemption for financial institutions, which doesn't cover a vendor serving a clinic or a retailer. Under HIPAA a voice platform handling patient data is a business associate, and compliance becomes a price tier: Vapi charges $2,000 a month for HIPAA and $1,000 for zero data retention, and ElevenLabs signs BAAs only on its enterprise tier. Under PCI DSS, a card number spoken to the agent pulls the transcription, the model's context, logs, recordings and eval sets into scope, which is why card capture moves to the keypad.

Canada. The CRTC's rules on automated calls already cover "synthesized" voices and require express consent for telemarketing. A review opened in June 2026 asks whether to require AI disclosure and whether the rules should reach a consumer's own AI assistant making a booking.

What mistakes cost

Let's say a mortgage lender runs an outbound AI campaign to 100,000 leads. About 30-40% connect, for 2.5 minutes on average, so the AI minutes cost about $7,500-30,000 at $0.10-0.30 a minute. If the consent behind 5% of those dials is defective, that's 5,000 calls at $500 each, a $2.5 million statutory floor, or $7.5 million if a court finds it wilful, before defence costs and state claims. One bad source of leads can cost 100 to 1,000 times the AI minutes, and the platform's terms make sure the lender carries it.

The fraud numbers keep growing. The FBI's crime complaint center counted $893 million of losses in 2025 complaints that cited AI, out of $20.9 billion in total, with no split for voice. And the bank cases show voice ID itself under pressure: a journalist used a cloned voice to get into a Lloyds account in 2023, the BBC passed Santander's and Halifax's voice ID with a clone in 2024, and OpenAI's chief executive told a Federal Reserve conference in July 2025 that it was "crazy" for institutions still to accept voiceprints.