TCPA

The Telephone Consumer Protection Act (TCPA) governs how businesses may place calls and send messages to consumers. As of an FCC ruling on February 8, 2024, AI-generated voices are treated as an “artificial or prerecorded voice” under the statute, which places real-time conversational agents, cloned voices, and LLM-driven dialers within the existing restrictions of 47 U.S.C. § 227(b). TCPA obligations (consent, disclosure, calling hours, and revocation) are deterministic and auditable. The proper way to meet them is to enforce each obligation in code rather than relying on the language model to honor instructions in its prompt.

Compliance is a state machine, not a system prompt. Each obligation is a gate with a definite answer: Is consent on file? Are we operating inside calling hours? Has the customer opted out? Each must be checked and recorded the same way on every call. A prompt can only ask the model to behave; a state machine guarantees the behavior and leaves a record. Treat the law’s requirements as code your agent runs inside of, not as instructions you hope it follows.

Overview

The TCPA applies to the entity on whose behalf a call is placed, regardless of which downstream vendor, lead generator, or agent actually dials. A single non-compliant call carries statutory damages of $500, tripled to$1,500 for willful or knowing violations, with no aggregate cap, so liability scales with call volume and with class size.

A voice AI program has to be able to produce, on demand, the record proving it had the right to place a specific call, to a specific number, at a specific time. A language model cannot reliably produce that record by being instructed to in its prompt: asked the same thing across thousands of calls, a probabilistic system will occasionally do something else, and a rare deviation that is a minor defect in most software is a per-call statutory violation here.

Thus programmatic enforcement is the only reliable approach, with the model handling the conversation and the code handling the compliance.

Shared responsibility model

TCPA obligations, expressed as gates

AI voice calls are regulated calls under § 227(b), so each TCPA obligation becomes a gate the call must pass before it connects. Each gate is either enforced in code or it is an unverified assumption.

Consent

Consent and Do Not Call disputes are the major drivers of the current wave of TCPA litigation, which surged roughly 95% through mid-2025. Two federal standards apply, and your system must know which one attaches to each number.

The FCC reads the purpose of a call, rather than its opening line. A call whose purpose includes selling something is a marketing call, and therefore requires PEWC, even when nothing is ultimately sold. A number captured under PEC for one purpose does not extend to PEWC for unrelated marketing later; reusing a transactionally-captured number for a marketing campaign is a common way enterprise programs cross the line.

For a multi-state program the practical rule is the same: capture written consent, and let the system determine which standard governs each number based on where the called party lives. The consent standard is a function of the called party’s jurisdiction, so it must be evaluated per number, per call type, per state, before every dial, not applied as a single global rule.

What a consent record must contain

Whichever standard applies, the record you rely on at dial time must carry enough to reconstruct the consent on demand:

• The timestamp of capture.
• The capture channel: web form, IVR, signed document, or recorded call.
• The exact disclosure language the consumer saw or heard.
• The affirmative action the consumer took: the checked box, the signature, the spoken “yes.”
• A device or IP identifier, where applicable.

This is the record the pre-dial consent check reads, and the identifier the audit log cites at dial time.

AI disclosure

The TCPA has required artificial-voice calls to identify the caller and provide a callback contact since 1991. A growing layer of state law adds AI-specific disclosure duties on top, and these are not waiting on further FCC action.

A single, clear disclosure in the opening turn satisfies most of these at once. In practice, an upfront disclosure tends to raise completion and satisfaction rather than lower them, because callers react more poorly to discovering a deception mid-call than to being told plainly at the start.

Enforcing disclosure as an unskippable first state

Do not rely on the prompt to include the disclosure. Deliver it as a static_greeting with static_greeting_no_barge set to true, which plays the full message before the caller can interrupt and before the model takes any turn. The disclosure is then identical on every call and is captured in the transcript.

1
from signalwire import AgentBase
2
3
class OutboundAgent(AgentBase):
4
    def __init__(self):
5
        super().__init__(name="outbound-agent")
6
        self.add_language("English", "en-US", "rime.spore")
7
8
        # Guaranteed AI disclosure, played in full before the model can speak
9
        self.set_params({
10
            "static_greeting": (
11
                "Hello, this is an automated AI assistant calling on behalf of "
12
                "Example Company. This call may be recorded."
13
            ),
14
            "static_greeting_no_barge": True,
15
        })

Calling hours and call frequency

Federal law confines telemarketing calls to 8:00 a.m. through 9:00 p.m. in the called party’s local time. For a multi-state campaign, this requires computing local time per number from the called party’s time zone, not from wherever your dialer is hosted. Several states narrow the window further, and many treat three or more calls in a short span to a number that never engages as evidence of willful conduct, which triples damages.

These are arithmetic and policy decisions, and they belong in your origination service as a pre-dial check, not in the model’s running sense of what time it probably is. Compute the called party’s local time and apply the strictest applicable window and frequency cap before requesting the call.

Revocation and opt-outs

Consumers may revoke consent through any reasonable means. Opt-out keywords still work, but so does any plain-language statement carrying the intent, because the FCC ended keyword-only opt-out systems. Three rules bind every program:

• Honor opt-outs within 10 business days, across every channel. A revocation on a voice call also silences SMS, email, and retargeting from the same caller.
• Permit one confirmation message and no more, and keep marketing out of it.
• Prepare for the revoke-all rule under 47 CFR § 64.1200(a)(10), which would treat a single opt-out as opting out of all unrelated communications from the same caller. After two delays it is currently set to take effect January 31, 2027; a pending Further Notice signals the FCC may narrow it first, so build for the principle without hard-coding the final text.

A conversational agent has a genuine advantage over an SMS keyword filter here: it can recognize “take me off your list” where a filter scanning for STOP hears nothing. That advantage is worth nothing unless the agent classifies the revocation as a structured event, writes it to suppression in real time, and propagates it across systems before the next dial. Understanding the opt-out is only the trigger; the recorded suppression event is the compliance.

Capturing an opt-out as a structured event

Detect opt-out intent with a SWAIG function (see the Server SDK guide) whose handler writes the revocation to your suppression store before returning. Mark it secure and serve its web_hook_url over authenticated HTTPS, as with any function that mutates state.

1
from signalwire import AgentBase, FunctionResult
2
3
class OutboundAgent(AgentBase):
4
    def __init__(self):
5
        super().__init__(name="outbound-agent")
6
        self.define_tool(
7
            name="process_opt_out",
8
            description="Call when the contact asks to stop being called or contacted.",
9
            parameters={"type": "object", "properties": {}},
10
            handler=self.process_opt_out,
11
            secure=True,
12
        )
13
14
    def process_opt_out(self, args, raw_data):
15
        # Write the revocation to suppression synchronously, across all channels,
16
        # before acknowledging it to the caller. Propagate to CRM/SMS/email feeds.
17
        phone_number = raw_data.get("caller_id_num")
18
        self.suppress_across_channels(phone_number)  # your implementation
19
20
        return FunctionResult(
21
            "You've been removed from our contact list. You will not be called again. "
22
            "Thank you, and goodbye."
23
        ).hangup()

Exemptions that do not apply to AI calls

Several exemptions that justify human outbound dialing do not apply to AI calls, because the artificial voice itself is the trigger.

Penalties and enforcement

Two cases show where enforcement stands today:

• QuoteWizard settled at $19 million and showed what happens when a company cannot trace consent through its vendor chain.
• Lamb v. Mortgage One Funding (filed February 24, 2026, E.D. Mich.) concerns an AI agent cold-calling about refinancing. The proposed class reaches everyone who received an artificial-voice call from the company or from any of its vendors, lead generators, or agents. Liability attaches to the entity on whose behalf calls are made, regardless of which downstream party pressed the dial, which makes vendor selection part of your compliance posture.

Implementing TCPA controls on SignalWire

A defensible outbound system is a governed state machine: the model is confined to the conversation, and code holds every boundary the law cares about. The table maps each obligation to where it is enforced in a SignalWire-based program.

Gate the dial on consent

Consent must be verified before you request origination, because once SignalWire places the call the dial has already occurred. Check consent and suppression in your dialer, then originate the call (for example with calling.dial, pointing url at your agent’s SWML) only when every check passes.

1
from signalwire.rest import RestClient
2
3
client = RestClient(
4
    project="your-project-id",
5
    token="your-api-token",
6
    host="your-space.signalwire.com",
7
)
8
9
CALLER_ID = "+15551234567"                        # a number you own, shown as the caller ID
10
AGENT_SWML_URL = "https://example.com/agent.swml"  # URL that returns your agent's SWML
11
12
# Pre-dial gate in your origination service.
13
def place_call(number, call_type):
14
    # 1. Consent: per number, per call type, per called-party state.
15
    state = lookup_state(number)  # derive the called party's jurisdiction
16
    if not consent_store.has_valid_consent(number, call_type, state):
17
        audit.log("dial_blocked", number, reason="no_consent")
18
        return
19
20
    # 2. Suppression: DNC + internal opt-outs across all channels.
21
    if suppression.is_suppressed(number):
22
        audit.log("dial_blocked", number, reason="suppressed")
23
        return
24
25
    # 3. Timing: 8am-9pm in the called party's local time, plus stricter
26
    #    state windows and frequency caps.
27
    if not calling_window.is_open(number) or frequency.exceeded(number):
28
        audit.log("dial_blocked", number, reason="outside_window_or_capped")
29
        return
30
31
    # Only now request origination from SignalWire, pointing at the agent SWML.
32
    client.calling.dial(to=number, from_=CALLER_ID, url=AGENT_SWML_URL)
33
    audit.log("dialed", number, consent_id=consent_store.citation(number, call_type, state))

Record the audit artifact

Enable record_call and a post_prompt summary so each call produces a transcript and a structured summary alongside the consent citation logged at dial time. Store recordings encrypted at rest with access logs, retained a minimum of four years (the TCPA statute of limitations), and longer where an FDCPA or HIPAA overlap imposes its own retention period.

Evaluating a platform or vendor

Because liability follows the entity on whose behalf calls are placed, the platform you build on is part of your compliance posture. Useful questions to put in writing before you get to pricing and latency:

• Can consent be verified as a pre-dial check that gates the dial, or is it only logged after the call already happened?
• When a revocation is captured on a call, what propagates, to which systems, and on what latency?
• Are calling-hour and frequency limits enforced per called-party time zone, or left to your integration code?
• Is a BAA self-service or a sales negotiation, and is a current SOC 2 Type II report available under NDA?
• How is PII handled in stored transcripts, and what are the retention defaults?

On SignalWire, consent, suppression, and timing are easy to implement: origination is an explicit calling.dial call, and there’s no fixed calling window baked in, so you can enforce them to your own standards. You can also catch opt-outs mid-conversation with SWAIG functions and handle them accordingly. SignalWire is SOC 2 Type II attested, signs BAAs for qualifying customers (sales@signalwire.com), and keeps recordings opt-in, encrypted, and access-controlled, with logs and media you can delete on your own schedule.

Create a SignalWire account to start building standards-compliant, production-ready intelligent agents today.

Looking ahead

Summary

A voice AI program is defensible when its compliance controls are enforced and recorded in code on every call (consent gating, real-time suppression, a guaranteed disclosure state, calling-hour arithmetic, and structured opt-out propagation), independent of what the model says on any given turn.

SignalWire provides the building blocks for the in-call portion of that system: an unskippable AI disclosure via static_greeting_no_barge, SWAIG functions for structured opt-out capture, and recording and post-prompt transcription for the audit trail. Your responsibility is to gate origination on consent, suppression, and timing before the dial; to propagate revocations across every channel; and to retain the records that prove each call was authorized. A practical sequence is to audit your consent records first, then suppression, then disclosure, and to pilot the AI layer only once those controls hold. Always consult qualified telecom counsel to ensure your specific implementation meets all applicable requirements.

Resources

SignalWire resources:

• SWML AI reference
• SWML ai.params reference
• SWAIG functions reference
• Server SDK: building AI agents guide
• Server SDK: defining functions guide
• REST: initiate an outbound call (calling.dial)
• HIPAA compliance guide

TCPA resources:

• 47 U.S.C. § 227 (TCPA statute text)
• FCC: AI-generated voices are “robocalls” under the TCPA
• FTC: Fair Debt Collection Practices Act text