Is AI cold calling legal? A plain overview for the US, UK and EU

AI cold calling is not illegal in itself. Most places regulate telemarketing by who you call, how you call them, what you say and what you record, and those rules apply whether the voice is human or synthetic. What changes with AI is that some laws treat an artificial voice as a separate, stricter category, so the answer to "is AI cold calling legal" depends on your country, your list and your consent records.

This article is general information, not legal advice. Rules change and differ by region, so check current requirements, and take advice from a qualified lawyer, before you launch a campaign.

The short version

• Calls to people who have not agreed to be contacted are the riskiest part, in every region.
• Do-not-call registers apply to AI calls just as they do to human calls.
• An artificial voice often triggers a stricter consent standard than a live agent.
• Recording and storing calls brings in privacy law on top of telemarketing law.
• Telling people they are talking to an AI is increasingly expected and sometimes required.

If you only take one thing from this post: the technology is not what regulators care about. They care about whether the person you called had a fair chance to say no.

Why "cold" is the hard word

A cold call, by definition, goes to someone who did not ask for it. That is where most legal exposure sits. If your leads filled in a form asking to be called back, or you have a documented relationship and clear consent, you are in a very different place from someone buying a scraped list.

A useful way to sort your calls:

Call type	Typical risk	What helps
Lead filled in a form asking for a call	Lower	Keep the consent wording and timestamp
Existing customer, related offer	Lower to medium	Check consent and opt-out history
Purchased or scraped list, consumer numbers	High	Often should not be called by an automated voice at all
Business numbers, no relationship	Varies a lot	Check corporate registers and local rules

For many teams, the practical move is to point AI at warm and consented leads first. We cover that approach in AI cold calling: how it works and when to use it and in speed to lead with AI calling.

United States

Three layers matter in the US: federal law, state law and the registries.

The TCPA. The Telephone Consumer Protection Act restricts calls made with an automatic telephone dialling system or an artificial or prerecorded voice, especially to mobile phones, and sets a higher consent standard for marketing calls. In 2024 the FCC said that AI-generated voices count as an "artificial or prerecorded voice" for these purposes. In practice that means telemarketing with an AI voice generally needs prior express written consent from the person called, with narrow exceptions. Statutory damages per call are significant, which is why TCPA class actions are common. We go deeper in TCPA and AI voice calls.

The National Do Not Call Registry. Telemarketing calls to numbers on the registry are restricted unless an exemption such as an established business relationship or consent applies. You also need your own internal do-not-call list. See do-not-call lists and dialer hygiene.

State laws. Several states have their own telemarketing statutes, registries, registration rules and calling-hour limits, and some are stricter than federal law. Recording laws also differ: a number of states require every party to consent to a recording.

Calling hours. Federal telemarketing rules generally limit calls to between 8am and 9pm in the recipient's local time, and some states are tighter.

United Kingdom

In the UK, the two main sources are the Privacy and Electronic Communications Regulations (PECR) and UK GDPR, with the ICO enforcing data and marketing rules and Ofcom handling nuisance calls such as silent and abandoned calls.

• Automated marketing calls generally require the recipient's prior consent. That is a high bar for anything resembling cold calling with an AI voice.
• Live marketing calls must not go to numbers on the Telephone Preference Service (TPS) or, for companies, the Corporate TPS (CTPS), unless the person has consented to your calls.
• Caller identity. You must be able to say who you are, and you should present a valid caller line identity that people can call back.
• Silent and abandoned calls are policed separately by Ofcom, with limits on how many dialled calls can go unanswered by an agent.

The detail is in PECR and AI calls in the UK.

European Union

The EU has no single telemarketing law. Instead, GDPR sets the rules for processing personal data (lawful basis, transparency, rights), and the ePrivacy framework is implemented country by country, so some member states require opt-in for marketing calls and others allow opt-out regimes, often with national do-not-call lists.

The EU AI Act also adds transparency obligations for AI systems that interact directly with people, with phased dates. Check the current timetable and national guidance rather than relying on a summary written months ago.

If you record or transcribe calls, which most AI calling setups do, read GDPR and call recording.

What a lower-risk programme looks like

You do not need to be a lawyer to follow good habits. Teams that stay out of trouble tend to do the same boring things:

1. Start with consent. Keep a record of how and when each person agreed to be contacted, and what they agreed to.
2. Scrub every list against the relevant do-not-call registers and your own suppression list before each campaign, not once a year.
3. Respect calling hours in the recipient's timezone, not yours.
4. Identify yourself early: company name, purpose, and that the call is from an AI agent.
5. Honour opt-outs immediately and make sure they carry across every campaign and number.
6. Handle recordings deliberately: notice, lawful basis, access limits and a retention period.
7. Keep evidence: logs, transcripts and consent records you can produce if someone complains.
8. Review the prompt. An agent should not claim to be human, invent offers or push past a clear "no".

Where Purple Voice fits

Purple Voice runs outbound campaigns on your own phone numbers, with calling hours and retry limits you set per campaign, and a consent confirmation step when you launch one. It does not decide whether your list is lawful to call. That responsibility stays with you, so the sensible order is to fix your consent and list hygiene first, then automate.

Try it

If your leads have asked to hear from you, the Free plan is a low-risk way to test: one agent, one number, 100 contacts and 100 minutes a month, no card needed. Run a few test calls on your own phone first at voice.purplerocket.co, and see pricing for the larger plans.