TCPA compliance for voice appointment bots making outbound calls

Last updated 2026-07-09

What is the TCPA and why does it apply to voice appointment bots?

The Telephone Consumer Protection Act, codified at 47 U.S.C. § 227, passed in 1991. The FCC has updated it by rulemaking ever since. It restricts calls made with an automatic telephone dialing system (ATDS) or an artificial or prerecorded voice. Voice appointment bots trip both wires at once. They autodial contact lists, and they play a prerecorded or AI-synthesized voice. That combination puts them inside the statute's hardest restrictions.^[1]

The FCC has long held that any system with the capacity to store or produce telephone numbers using a random or sequential number generator, and then dial those numbers, qualifies as an ATDS. The Supreme Court narrowed that definition in Facebook, Inc. v. Duguid (2021), requiring the system to use a random or sequential number generator to produce or store the numbers it dials.^[2] Here is the practical reality for appointment bots. Even under the narrower Duguid standard, most modern predictive dialers and bot platforms still qualify, because they store numbers and dial them automatically from lists without a human touching each call. Courts are still sorting this out, and several circuits have found liability after Duguid.

The ATDS fight almost does not matter for a voice bot. Prerecorded or artificial voice calls to cell phones require prior express written consent whether or not the system is an ATDS. So even if your bot somehow dodged the ATDS label, the artificial voice keeps you inside the TCPA. There is no easy off-ramp.

Appointment bots also answer to the FCC's call-time rules (8 a.m. to 9 p.m. local time at the called party's location), the national Do Not Call registry, and state mini-TCPA statutes in places like Florida, Texas, and Oklahoma that often run stricter.^[3]

Does a voice bot count as a "prerecorded" or "artificial" voice under the TCPA?

Yes. AI-generated voices, text-to-speech engines, and any synthesized audio not spoken live by a human in real time to that specific called party qualify as an artificial or prerecorded voice under 47 U.S.C. § 227(b)(1). The FCC settled this directly in early 2024.^[4]

The question was not ambiguous even before large language models got popular. In February 2024, the FCC issued a Declaratory Ruling stating that calls using AI-generated voices fall under the TCPA's prerecorded voice provisions. That closed the argument that a bot with a realistically human-sounding AI voice might be exempt.^[4]

Some vendors sell their bots as "conversational AI" and hint that dynamic response capability lifts them out of the prerecorded voice rules. The argument has not held up. The FCC's position is straightforward: if the voice output is machine-generated rather than spoken live by a human present on the call, it is an artificial voice. Responding dynamically to the customer does not change the classification.

The rule is short. If a machine generates the voice on an outbound call, that call needs prior express written consent to reach a cell phone. No exceptions for how smart the bot sounds.

What consent is actually required before a voice bot can call someone?

The consent standard turns on two things: the type of number you are calling and the purpose of the call. For cell phones, the bar is high and it does not bend.

For calls to wireless numbers using an ATDS or artificial/prerecorded voice, the TCPA requires "prior express written consent." The FCC's 2012 rules define this as a signed written agreement (electronic signatures count) in which the person clearly authorizes calls to a specific number using an ATDS or prerecorded voice, the agreement carries a clear and conspicuous disclosure that they may get such calls, and the agreement is not a condition of purchase.^[5]

For calls to residential landlines using prerecorded voice for commercial purposes, the standard is also prior express written consent. For non-commercial landline calls (government health alerts, school notifications), prior oral consent or an established business relationship may work. Very few appointment bot use cases are genuinely non-commercial.

Here is what written consent must include, under 47 C.F.R. § 64.1200(f)(9):

• The consumer's signature (wet or electronic)
• The consumer's telephone number
• A clear and conspicuous disclosure that the consumer authorizes the seller to use an automatic telephone dialing system or prerecorded voice
• The name of the seller making the calls

Consent captured on a web form that buries the disclosure in size-6 font at the bottom does not clear the "clear and conspicuous" bar. Neither does a checkbox that is pre-checked by default. Neither does a line that says only "you may receive calls from our partners" without naming autodialed or prerecorded calls.^[5]

Consent is also purpose-specific. Consent to appointment reminders does not stretch to sales or upsell calls. And consent given to one seller does not travel to a lead buyer or affiliate. The FCC's one-to-one consent rule, adopted in December 2023, made that explicit: consent had to go to a single named company for a specific product or service, not a list of undisclosed third parties. That rule was later vacated in court, but the principle behind it is still driving plaintiffs' arguments.^[6]

What did the FCC's 2024 and 2025 rule changes do to appointment bot compliance?

Two FCC moves in 2024 and 2025 reshaped the ground under voice bots. One stuck. One got knocked down in court but still matters.

First, in February 2024, the FCC issued a Declaratory Ruling that AI-generated voice technology falls under the TCPA's existing ban on artificial or prerecorded voice calls. The ruling came out of worry about AI robocalls in political campaigns, but the legal interpretation covers every commercial use.^[4] If you were hoping for an "AI carve-out," it is not there.

Second, the FCC's one-to-one consent rule, adopted in December 2023 and set to take effect January 27, 2025, required TCPA consent for telemarketing calls to name a single seller at a time. In its order, the FCC framed the goal plainly: consumers who consent to hear from one seller should not get buried under calls from sellers they never agreed to. The Eleventh Circuit vacated the rule in late January 2025, finding the FCC had exceeded its authority under the statute. So as of mid-2025 the one-to-one rule is not in force federally. The idea behind it, that consent must name the caller and cannot be quietly handed to third parties, is still the FCC's stated view, and plaintiffs are already pressing similar arguments under existing law.^[6]

So what does this mean at the campaign level? If you buy leads from a data broker or a shared lead vendor, you almost certainly do not hold valid TCPA consent to run a voice bot against those contacts. You need consent your own company collected, naming your company, for the specific call you plan to make.

How much does a TCPA violation from a voice bot actually cost?

Statutory damages under 47 U.S.C. § 227(b)(3) run $500 per violation, trebled to $1,500 per violation for willful or knowing conduct. Each call is its own violation. That is the whole engine behind TCPA exposure.^[1]

The per-call number sounds small until you count the calls. A single voice bot campaign can fire off thousands of dials in a day. A 10,000-call campaign to numbers without proper consent, at $500 each, is $5 million in exposure. At $1,500 for willful conduct, it is $15 million. Class actions pool every call, so even a short campaign can draw settlement demands in the tens of millions.

Real settlements set the scale. UnitedHealthcare paid $2.5 million to resolve a TCPA class action over alleged robocall violations. Credit One Bank settled a TCPA case for $12.5 million. Truist Bank faced a TCPA class action over similar autodial claims. None of these are freak events. The Albertsons/Safeway TCPA settlement and Cash App's TCPA class action show the targets sit across every industry.

The private suits are only part of it. The FCC can issue forfeiture orders. The FTC can pursue Telemarketing Sales Rule violations, which overlap with the TCPA on telemarketing calls. State attorneys general can enforce both federal TCPA and state mini-TCPA statutes. Private plaintiffs never have to prove actual damages, which is a big reason the TCPA is one of the most litigated consumer statutes in the country.

Violation Type	Per-Call Penalty	Notes
Standard TCPA violation	$500	No proof of harm required
Willful/knowing violation	$1,500	Treble damages, plaintiff must show intent
FCC forfeiture	Up to $23,727 per violation	Separate from private suits
State mini-TCPA (e.g., Florida)	Up to $500 additional per call	Stacks on federal exposure	[7]

Which numbers are on the Do Not Call list and what does that mean for bots?

The national Do Not Call Registry, run by the FTC under 47 C.F.R. § 64.1200(c), bars telemarketing calls to registered numbers. You have to check the registry before each campaign and re-scrub at least every 31 days if the campaign runs on.^[8]

Voice bots used for telemarketing (which includes appointment setting for services or products you sell) have to scrub against the DNC list. The FTC charges for registry access. As of 2024, the fee is $70 per area code per year, capped at $21,225 for access to every area code nationwide.^[8]

Company-specific DNC requests sit on top of the national list. Under 47 C.F.R. § 64.1200(d), any company making telemarketing calls has to keep its own internal DNC list, honor opt-out requests within 30 days, and hold those requests on file for at least five years. A bot that re-dials someone who already asked to stop is close to an automatic willful violation.

Scrubbing the DNC list is not the same as having consent. The DNC list only strips out numbers people affirmatively registered. Cell phones still need prior express written consent even when the number never landed on the DNC list. These are two separate duties, and both apply at once.

To understand what the person on the other end of your bot actually experiences, how to stop robocalls covers the consumer-facing side of this.

What technical and operational safeguards do compliant voice bot programs use?

Compliance is more than a legal question. It is a systems question. Here is what a defensible voice bot program actually looks like on the ground.

Consent capture and storage. Every number in your dial list needs a consent record: the date and time consent was captured, the exact disclosure language shown, the URL or form where it was captured, the submitter's IP address, and the specific phone number consented to. That record has to survive discovery, so it should live in a database that gets backed up and cannot be edited without an audit log. Scanned paper PDFs are legally valid and operationally miserable.

Real-time DNC scrubbing. Before every campaign, scrub against the national DNC registry and your internal list. The better platforms scrub at the moment of dialing, which beats a one-time pre-campaign pass because numbers get added to the registry every day.

Call-time enforcement. Your platform should enforce the 8 a.m. to 9 p.m. window in the called party's local time zone, not yours. That means knowing their time zone from the area code or from registration data. Some states run narrower windows. Florida's mini-TCPA restricts calls to 8 a.m. to 8 p.m.^[7]

Opt-out handling during the call. Any prerecorded or artificial voice message has to include an automated opt-out that stays available for the whole call. The FCC requires a keypress or voice command to add the number to the company's DNC list, processed right away.^[5] A bot without that is non-compliant out of the box.

Caller ID accuracy. The caller ID you send has to reflect either the calling line or the company's customer service number. Sending a spoofed or random number stacks a Truth in Caller ID Act violation on top of your TCPA exposure.^[9]

Lead source verification. If you bought a contact list, you need real documentation, not a vendor's verbal promise, that each number carries valid TCPA consent for the call you plan to make. Ask for the consent records. If the vendor cannot or will not produce them, treat those numbers as unconsented. LeadCompliant's free TCPA compliance kit includes a lead vendor consent verification checklist that spells out exactly what to request.

Call recording and logging. Log every attempt: timestamp, called number, caller ID sent, outcome, and whether an opt-out came in. Keep the logs at least four years. The federal TCPA statute of limitations is four years under 28 U.S.C. § 1658, and some state claims can be filed later.

Can you use a voice bot to call existing customers without new consent?

Maybe, but the established business relationship (EBR) exception is narrower than most people assume, and it does nothing for cell phones dialed with an ATDS or artificial voice.

The EBR exemption originally let telemarketers call residential landlines of existing customers without fresh consent. It stops at landlines. For wireless numbers, prior express written consent is required even if you have done business with the person for a decade.^[5]

For landline calls, an EBR exists if the person made a purchase, transaction, or inquiry within the past 18 months, or submitted an application within the past three months. Even then, if they asked to be on your internal DNC list, the EBR does not override that request.

Appointment reminders get a bit more room than telemarketing. Healthcare providers can use prerecorded calls to deliver appointment reminders to cell phones if they have prior express consent (note: not prior express written consent) and the call is for a healthcare treatment purpose. The FCC carved out that healthcare exemption for purely informational calls.^[5] But the second that reminder mentions a service upgrade, a product, or anything commercial, the exemption is gone.

The practical answer for most appointment bots: get written consent at the time of scheduling. When someone books on your site, have them check a box (unchecked by default) agreeing to automated calls or texts about their appointment. That consent, documented properly, covers your reminders and protects you.

What state laws add extra requirements on top of federal TCPA rules?

Federal TCPA is the floor, not the ceiling. Several states run stricter rules that reach voice bots operating in or targeting their residents. Miss the state layer and you can be clean on federal law and still exposed.

Florida's Telephone Solicitation Act (FTSA), amended in 2021, catches the most companies off guard. It restricts calls made with an "automated system for the selection or dialing of telephone numbers" to Florida residents, a broader test than the federal ATDS standard. It applies to all phone numbers, more than cell phones, and damages run $500 per call.^[7] A 2023 amendment added a click-to-call or text requirement for initial consent in some cases, though the exact scope is still being fought over.

Texas Business and Commerce Code Chapter 305 restricts telemarketing calls and requires written consent for automated calls. Texas allows a private right of action with damages up to $10,000 per violation for calls to numbers on the Texas No-Call list.^[10]

The Oklahoma Telephone Solicitation Act adds its own state-level restrictions and a private right of action. Washington's Commercial Electronic Mail Act (CEMA) and its telephone solicitation rules pile more requirements on companies targeting Washington residents.

California has no separate mini-TCPA for voice calls as of mid-2025. But the California Consumer Privacy Act (CCPA) crosses into your consent records. Contact data collected for consent is personal data under the CCPA, which means your consent files double as records you must be able to produce or delete on request.

So compliance has to be state-aware. A campaign into Florida needs FTSA analysis on top of TCPA analysis. A campaign into Texas needs Texas No-Call scrubbing. Keeping current on TCPA news is not optional if you run national campaigns.

How should you vet a voice bot vendor for TCPA compliance?

The vendor will not stand next to you in court. Their terms of service almost certainly carry an indemnification clause that is either toothless or excludes your exact use case. So vetting a voice bot vendor is about protecting yourself, not about trusting the pitch.

Here is what to ask, and in what order.

First, ask whether the platform qualifies as an ATDS. Many vendors will say no because they do not use a random or sequential number generator. Get that in writing, with the legal analysis attached. Then hand it to your own counsel, because post-Duguid case law is still moving and the answer shifts by circuit.

Second, ask how the platform handles prerecorded and AI-generated voice. If they claim conversational AI voices are exempt from the prerecorded voice rules, they are wrong. Walk away, or get the indemnification in writing.

Third, check the DNC scrubbing. Does it scrub against the national registry before each campaign? Does it keep an internal DNC list at the account level? Does it suppress numbers in real time as opt-outs come in during calls?

Fourth, look at the in-call opt-out. FCC rules require an automated opt-out during every prerecorded call. Ask for a live demonstration and confirm it processes opt-outs immediately.

Fifth, check what records the platform stores and for how long. You need at least four years of retention. If the vendor purges after 90 days, that is a problem you will feel in discovery.

Last, read the terms of service on compliance responsibility. Most vendors put that responsibility squarely on you. That is standard and arguably fair, but it means you cannot hand your compliance duty to a tool.

What should a pre-launch TCPA checklist for a voice bot campaign include?

Before your bot makes its first call, work this list. These are the items that create the most litigation exposure when they are missing.

1. Consent verification. Do you have documented prior express written consent for every number on the dial list? Is it specific to your company and to autodialed/artificial voice calls? Is it reasonably fresh (five-year-old consent for a different product is legally shaky)?

2. DNC scrubbing. Have you scrubbed the national DNC registry within the last 31 days? Your internal DNC list? Any state do-not-call registries for the states you are targeting?

3. Call time window. Is the platform set to call only between 8 a.m. and 9 p.m. in the called party's local time zone? Have you handled narrower state windows like Florida (8 a.m. to 8 p.m.)?

4. Caller ID accuracy. Does the outbound caller ID show your real company number or customer service line? Can that number take return calls?

5. Opt-out mechanism. Does every call include an automated way for the called party to add themselves to your DNC list? Is that opt-out processed immediately and synced to suppression?

6. Message content review. Does the prerecorded message name the company and give the company's telephone number (both required by FCC rules for commercial calls)? Does it avoid tripping state-specific disclosure rules?

7. Lead source documentation. For every number from a third party, do you have written proof of the consent chain? Can you show exactly what disclosure the person agreed to, and when?

8. Wireless vs. landline segmentation. Have you sorted which numbers are wireless and which are landline? The consent rules differ, and calling a wireless number you mislabeled as a landline is still a violation.

LeadCompliant offers a free TCPA compliance kit with a pre-campaign checklist, a consent language template for web forms, and a lead vendor documentation request template, all downloadable without a sales call.

If you have already gotten a demand letter or are facing a suit, this same checklist works as a diagnostic. Which items can you document? Which can you not? That answer shapes your defense or your settlement position.

What do courts actually look for in TCPA voice bot cases?

Courts deciding TCPA voice bot cases circle a handful of questions. Knowing them tells you where your real exposure sits.

Was the system an ATDS? After Facebook v. Duguid, plaintiffs have to show the system used a random or sequential number generator to produce or store the numbers it dialed. Many cases now turn on the technical guts of the dialer. If your vendor uses a predictive dialer that pulls from a stored list and dials without a human starting each call, courts split on whether that qualifies. The Ninth and Eleventh Circuits have reached different conclusions on similar systems. This is genuinely unsettled as of mid-2025, and nobody has clean data on how it lands.^[2]

Was there valid consent? Defendants win TCPA cases most often by proving consent. That means producing the record: the date, the form, the disclosure language, the signature or electronic equivalent. Defendants lose when they cannot produce those records, when the consent language never mentioned autodialed or prerecorded calls, or when a third party obtained the consent without authority to grant it on the defendant's behalf.

Was the violation willful? Treble damages, the jump from $500 to $1,500 per call, require the plaintiff to show the defendant knew or should have known the conduct broke the TCPA. Courts have found willfulness where a company kept calling after a cease-and-desist, where a company had been sued for TCPA violations before, or where internal messages showed known compliance concerns getting ignored.

Class certification. Most TCPA suits arrive as class actions, because the statute gives a private right of action with no actual-damages requirement. Courts certify TCPA classes more readily than most other consumer classes, since the common question (did this ATDS call these numbers without consent) yields to common proof. Once a class is certified, the settlement math turns brutal for most defendants.

The Joseph Snyder v. Credit One TCPA case shows how certification and settlement dynamics play out in a real robocall dispute. The Kaiser TCPA settlement shows healthcare-adjacent callers carrying the same exposure despite the narrow healthcare exemption.

Frequently asked questions

Can I use a voice appointment bot to call cell phones if I have a prior business relationship with the customer?

No. The established business relationship exception does not reach cell phones called with an ATDS or artificial/prerecorded voice. For wireless numbers, the TCPA requires prior express written consent no matter how long you have done business with the customer. The EBR exception applies only to residential landlines for telemarketing, and even there it is subject to internal DNC list requests.

Does the TCPA apply to voice bots making appointment reminder calls, or only to sales calls?

The TCPA applies to any call using an ATDS or artificial/prerecorded voice to a wireless number, sales call or reminder alike. The FCC carved a limited exception for certain healthcare appointment reminders if prior express consent (not written consent) was obtained and the message is purely informational. Add any commercial or promotional element and the call falls back under the full written consent requirement.

What does 'prior express written consent' actually look like for a voice bot program?

It is a signed agreement (wet or electronic) that explicitly states the person authorizes autodialed or prerecorded calls to a specific phone number, names the company making the calls, and is not a condition of purchase. A pre-checked checkbox or a buried disclosure does not meet the FCC's 'clear and conspicuous' standard under 47 C.F.R. § 64.1200(f)(9).

Is a conversational AI voice bot treated differently from a simple prerecorded robocall under the TCPA?

No. The FCC ruled in February 2024 that AI-generated voices fall under the TCPA's ban on artificial or prerecorded voice calls. Responding dynamically to what the called party says does not change the classification. If the voice is machine-generated rather than spoken live by a human present on the call, it is an artificial voice subject to full TCPA consent requirements.

How often do I need to re-scrub my call list against the national DNC registry?

At least every 31 days for ongoing telemarketing campaigns, under 47 C.F.R. § 64.1200(c). Registry data updates continuously as new numbers register, so a scrub done 32 days ago could miss recently registered numbers. Many compliance platforms scrub in real time or near-real time at the point of dialing, which is safer than a single pre-campaign pass.

What happens if a voice bot calls a number that was reassigned to a new person after consent was obtained?

TCPA liability can attach even when the call was meant for someone who previously consented, if the number was since reassigned. The FCC built the Reassigned Numbers Database (RND) so callers can check whether a number changed hands after consent. Callers get a one-call safe harbor for reassigned numbers if they check the RND before calling; calls made after notice of reassignment are not protected.

Can I transfer TCPA consent from a lead vendor to my company?

Not reliably. The FCC's stated policy, and the effect of court decisions, is that consent must name the company making the calls. If a lead vendor's form obtained consent to calls from 'our marketing partners,' courts have generally found that does not count as valid consent for a specific buyer. You need records that name your company, or a disclosure broad enough that a court finds it covers you, which is a far harder standard than most lead vendor forms meet.

What are the TCPA call time restrictions for voice bots?

Federal TCPA and FCC rules bar calls before 8 a.m. or after 9 p.m. local time at the called party's location, under 47 C.F.R. § 64.1200(c). Several states are stricter: Florida limits telemarketing calls to 8 a.m. to 8 p.m. Your bot has to apply the called party's local time zone, not your own, and apply the most restrictive rule when state law is narrower than federal.

Does every prerecorded outbound call have to include an opt-out mechanism?

Yes. The FCC requires every prerecorded telemarketing message to include an automated interactive opt-out that stays available throughout the call and immediately processes a request to be added to the company's internal DNC list. A message-only call with no opt-out is non-compliant, even if you otherwise hold valid consent.

How long do I need to retain consent records and call logs for TCPA purposes?

The federal TCPA statute of limitations is four years under 28 U.S.C. § 1658, so records have to survive at least that long. Some state analogs run longer lookback periods. Best practice is five years of retention for consent records, call logs, DNC requests, and opt-out records, stored in a tamper-evident system with an audit trail.

What is the TCPA penalty for a voice bot calling a number on the Do Not Call list?

Calls to DNC-registered numbers in violation of 47 C.F.R. § 64.1200(c) carry $500 per violation, trebled to $1,500 for willful violations, under 47 U.S.C. § 227(c)(5). State DNC violations stack on top: Texas allows up to $10,000 per violation for calls to numbers on its state registry. Each call to each DNC-registered number is a separate violation.

Can my voice bot leave a voicemail without triggering TCPA requirements?

No. A ringless voicemail, or any prerecorded message dropped into a voicemail box, counts as a call under the TCPA. Courts and the FCC have consistently rejected the argument that ringless voicemails are not 'calls' because the phone never rings. Prior express written consent is required for cell phone voicemail drops using artificial or prerecorded voice, the same as for live calls.

What should I do if I receive a TCPA demand letter about my voice bot program?

Do not ignore it, and do not respond without counsel. Preserve all call records, consent records, DNC logs, and vendor contracts right away. Figure out which specific calls the demand covers and whether you can document valid consent for each. TCPA defense usually turns on whether consent records are complete and credible. Early case assessment with a TCPA-experienced attorney tends to produce better outcomes than waiting.

Is text message marketing with an appointment bot subject to the same rules as voice calls?

Largely yes. The TCPA applies to text messages sent via ATDS with the same prior express written consent requirement for wireless numbers. The FCC treats SMS as a 'call' under 47 U.S.C. § 227. If you run both voice and SMS appointment bots, both channels need compliant consent and DNC scrubbing. See more at our text message marketing guide.

Sources

1. Cornell Law School LII, 47 U.S.C. § 227 (TCPA statute text): TCPA statutory penalties are $500 per violation, trebled to $1,500 for willful violations; statute covers ATDS and artificial/prerecorded voice calls
2. U.S. Supreme Court, Facebook, Inc. v. Duguid, 592 U.S. 395 (2021) (opinion via Cornell LII): Supreme Court narrowed ATDS definition to require use of random or sequential number generator to produce or store numbers dialed
3. FCC, 47 C.F.R. § 64.1200 (TCPA implementing regulations, including consent and opt-out requirements): Prior express written consent must include signature, phone number, clear disclosure of ATDS/prerecorded calls, and seller name; opt-out mechanism required in all prerecorded calls
4. Florida Legislature, Florida Telephone Solicitation Act (FTSA), Section 501.059, Florida Statutes: Florida FTSA restricts automated calls to Florida residents, limits call hours to 8 a.m. to 8 p.m., and provides $500 per violation private right of action
5. FTC, National Do Not Call Registry information for businesses (ftc.gov): Telemarketers must scrub against DNC registry at least every 31 days; access fee as of 2024 is $70 per area code, capped at $21,225 for all area codes
6. Texas Legislature, Texas Business and Commerce Code Chapter 305 (Telemarketing): Texas telemarketing law allows damages up to $10,000 per violation for calls to numbers on the Texas No-Call list
7. FCC, Reassigned Numbers Database (reassigned.us): FCC Reassigned Numbers Database allows callers to check if a number has been reassigned; one-call safe harbor available for callers who check before dialing
8. FTC, Telemarketing Sales Rule, 16 C.F.R. Part 310: FTC Telemarketing Sales Rule overlaps with TCPA for commercial telemarketing calls and provides additional federal enforcement authority