Guides
A practical guide to the federal and state laws that require AI disclosure on phone calls—what teams deploying AI voice agents need to say, when to say it, and how to build compliant disclosure into their call flows.
Last updated
When a caller reaches your company and an AI voiceAI voiceAn artificially generated, natural-sounding voice produced by a TTS model. Thoughtly supports a library of AI voices and brand-specific cloning. agent picks up instead of a human, what are you legally required to say? The answer depends on where your callers are, what industry you operate in, and whether your calls are inbound or outbound—and the regulatory picture is changing fast.
This guide breaks down the current federal and state disclosure requirements that apply to AI-powered phone calls, explains what the proposed rules would add, and gives revenue and operations teams a practical framework for building disclosure into their call flows without killing conversion rates.
Three developments have moved AI call disclosure from a nice-to-have to a compliance priority:
First, the FCC's February 2024 Declaratory Ruling confirmed that AI-generated voices qualify as "artificial or prerecorded voice" under the Telephone Consumer Protection ActTCPAUS federal law governing telemarketing calls and SMS. Thoughtly enforces consent capture, time-of-day windows, and DNC scrubbing automatically. (TCPA). That means outbound calls using AI-generated speech require the same level of prior express consent as traditional robocalls—no regulatory gray area remains.
Second, the FCC followed up in August 2024 with a Notice of Proposed Rulemaking (NPRM) that would go further: requiring callers to explicitly disclose AI use in consent forms, potentially requiring separate consent for AI-generated calls, and defining "AI-generated call" for regulatory purposes.
Third, states are moving independently. California, Utah, and Colorado already have bot-disclosure laws on the books, and more states introduced AI-related legislation in 2025 than in any prior year.
For teams running AI voice agents at scale—insurance lead follow-up, mortgage pre-qualificationPre-qualificationCapturing the qualifying details — income, credit-score range, LTV, timeline — before a licensed officer engages. Thoughtly automates this., healthcare appointment scheduling, education enrollment—getting disclosure right protects both your compliance posture and your ability to keep running these campaigns.
The Telephone Consumer Protection Act (47 U.S.C. § 227) restricts the use of "artificial or prerecorded voice" calls. The FCC's February 2024 Declaratory Ruling (FCC 24-17) clarified that AI-generated voices—including real-time conversational AI, not just pre-recorded clips—fall under this definition.
Practical implications:
The FTC's Telemarketing Sales Rule (16 CFR Part 310) requires that telemarketers disclose the identity of the seller, the purpose of the call, and the nature of what is being sold—promptly at the beginning of the call. While the TSR does not yet have AI-specific language, the FTC has made clear through enforcement actions (including the September 2024 "Operation AI Comply" sweep) that using AI to deceive consumers—including failing to disclose that an interaction is AI-driven—can constitute an unfair or deceptive practice under Section 5 of the FTC Act.
California's bot disclosure law, effective since 2019, requires businesses to disclose when consumers are interacting with a bot if the bot is used to "knowingly deceive" a person for the purpose of incentivizing a commercial transaction or influencing an election. The disclosure must be "clear, conspicuous, and reasonably designed to inform persons" that they are communicating with a bot. Violations are enforceable by the state attorney general, with fines up to $2,500 per violation. A $56 million settlement in the Noom case demonstrated that private claims based on undisclosed bot interactions can carry serious financial consequences.
Utah requires that consumer-facing bots disclose—upon being asked—that the consumer is interacting with "generative artificial intelligence and not a human." For regulated occupations (licensed professionals, certified services), proactive disclosure is required without waiting for the consumer to ask. Violations carry administrative fines of up to $2,500 per violation, enforced by the attorney general and the Division of Consumer Protection.
Colorado's law requires consumer-facing AI deployers to disclose when consumers are interacting with an AI system. Disclosure is not required if it would be obvious to a reasonable person that they are interacting with a bot. Violations are treated as unfair trade practices, with civil penalties of up to $20,000 per violation, enforceable by the attorney general.
The FCC's August 2024 NPRM (adopted August 7, 2024) proposed several additional requirements that could become final rules. While these are not yet law, they signal the regulatory direction and are worth preparing for:
Public comments on these proposals were due in October 2024, and the FCC is reviewing feedback. Revenue teams should monitor FCC docket CG 23-362 for final rule adoption.
The following checklist covers what teams deploying AI voice agents should implement today, based on current law, plus recommended steps to prepare for the proposed rules.
| Requirement | Status | What to do |
|---|---|---|
| Identify the caller and purpose | Required (TCPA/TSR) | State the company name, agent identity, and reason for the call in the opening script |
| Disclose AI use on outbound calls | Required in CA, UT (on request); proposed federally | Add a clear disclosure statement to the Start node or first Speak node |
| Obtain prior express consent for outbound AI calls | Required (TCPA/FCC 2024) | Collect and log written consent before outbound AI voice calls |
| Include AI-specific language in consent forms | Proposed (FCC NPRM) | Update consent forms now to mention AI-generated calls explicitly |
| Offer human handoff option | Best practice; recommended by FCC, Thoughtly docs | Build a transfer node into every agent flow for callers who request a human |
| Proactive AI disclosure for regulated professions | Required in UT | Auto-disclose AI usage for licensed/regulated industry calls |
| Disclose for commercial bot interactions in CA | Required (CA Bot Law) | Disclose bot/AI nature when the interaction incentivizes a transaction |
| Honor opt-out requests | Required (TCPA/TSR) | Process opt-outs immediately and propagate across channels |
| Maintain consent records | Required (TCPA) | Log consent with date, method, and language in your CRM |
| Monitor for new state laws | Ongoing | Track NCSL and state AG announcements for new AI disclosure requirements |
Thoughtly's Agent Builder includes several features that make it practical to build disclosure into your call flows without adding friction that tanks conversion rates.
The Start node speaks its content exactly as written on every call. This is the right place for legally required disclosure language—your AI identification statement, company name, and purpose of call. Because it runs verbatim, there is no risk of the AI paraphrasing or skipping a required phrase.
For disclosure statements that need to appear later in the call—such as recording consentRecording consentState-by-state legal requirement to disclose call recording. Some states require all-party consent; Thoughtly enforces the right script per state. or a mid-call compliance notice—Message Speak nodes support a Verbatim setting that locks the wording. Combined with the Uninterrupted setting, this ensures the caller hears the full disclosure before the conversation continues.
Thoughtly agents are designed to identify as AI when asked. As of the February 2026 platform update, agents clearly identify as AI when a caller directly asks whether they are speaking with a person or a machine. This behavior is built into the platform and does not require custom configuration.
Every Thoughtly agent flow can include Transfer nodes—either Phone Router (to an external number) or Agent Transfer (to another Thoughtly agent)—to route callers to a human representative on request. Building this path into every flow satisfies the recommended practice of offering a human alternative.
Thoughtly's automation layer can log consent events—including the specific language the caller agreed to—directly to your CRMCRMThe system of record for leads, contacts, deals, and activity. Thoughtly reads from and writes to your CRM continuously. (Salesforce, HubSpot, GoHighLevel, Zoho, and others) with a timestamped record. This creates the audit trail regulators expect.
Thoughtly enforces state-specific recording-consent scripts automatically. For a full breakdown of which states require all-party vs. one-party consent, see Call Recording Consent for AI Voice Agents: A State-by-State Guide.
Placing your AI disclosure 30 seconds into the call, after you have already asked qualifying questions, defeats the purpose. Regulators and state AGs expect disclosure at the beginning of the interaction—not after the caller has already provided personal information.
Consent forms that say "you may receive automated calls" without mentioning AI-generated voice content may not satisfy the FCC's proposed separate-consent standard. Update your forms to explicitly reference AI-generated or AI-powered calls.
The current FCC Declaratory Ruling focuses on outbound calls. However, California's bot disclosure law, Utah's AI Policy Act, and the FTC's unfair-practices authority apply regardless of call direction. If an inbound caller asks whether they are speaking with a bot and your agent does not disclose, you may still face liability in those jurisdictions.
Even where not strictly required by current law, failing to offer a path to a human representative when a caller requests one creates legal risk under the FTC's unfair-practices framework and damages consumer trust. Build the transfer path and make it accessible.
Without a timestamped, auditable record of what the caller consented to, your defense in a TCPA complaint collapses. Automate consent logging from the first deployment—retrofitting is harder and more expensive than getting it right initially.
It depends on the jurisdiction. California's bot disclosure law requires disclosure when a bot is used to incentivize a commercial transaction. Utah requires disclosure if the caller asks (or proactively for regulated professions). Even where not strictly required, transparent disclosure builds consumer trust and reduces legal risk. Thoughtly agents already identify as AI when asked.
There is no single mandated script, but a compliant disclosure should be clear and upfront. An example: "Hi, this is [Company Name]. You're speaking with an AI-powered assistant. I can help you with [purpose]. If you'd like to speak with a person at any time, just let me know." Place this in your Start node using verbatim mode.
No. The FCC's 2024 Declaratory Ruling explicitly states that AI-generated voice content is an "artificial voice" under the TCPA regardless of whether the AI responds dynamically. A conversational AI agent and a static pre-recorded robocall message have the same consent requirements for outbound calls.
Penalties vary by jurisdiction and statute. Under the TCPA, statutory damages are $500 per violation (trebled to $1,500 for willful violations), and the FCC can propose forfeitures up to $16,000 per violation. California's bot law allows fines up to $2,500 per violation. Colorado's AI Act carries up to $20,000 per violation. The FCC's proposed $6 million fine in the New Hampshire AI robocall case illustrates the scale of potential enforcement.
As of mid-2026, the FCC's August 2024 NPRM proposals—including separate AI consent and mandatory real-time AI disclosure—are still in the proposed stage. The comment period closed in October 2024, and the Commission is reviewing feedback. Monitor FCC docket CG 23-362 for final rule adoption. In the meantime, the existing TCPA consent and disclosure requirements already apply to AI voice calls based on the February 2024 Declaratory Ruling.
This article is informational and does not constitute legal advice. Consult qualified legal counsel for compliance decisions specific to your organization.
