This guide is for informational purposes only and is not a comprehensive treatment of the law. It does not constitute legal advice.
The Telephone Consumer Protection Act (TCPA) and related federal and state regulations are complex, subject to interpretation, and change frequently through new rulemakings and court rulings. Consult qualified legal counsel to make sure your specific use of CloudTalk VoiceAgents for outbound calling complies with all applicable laws and regulations.
User level: Admin
AI-generated voices are classified as "artificial or prerecorded voices" under the TCPA, which means every outbound VoiceAgent call is subject to consent, disclosure, and opt-out requirements. This guide walks you through configuring a compliant outbound VoiceAgent using CloudTalk's existing tools. CloudTalk does not enforce compliance on your behalf. You are responsible for your outbound calling practices.
Types of consent required
The consent standard depends on whether your outbound VoiceAgent call is classified as marketing or non-marketing (informational).
Marketing calls: Prior Express Written Consent (PEWC)
If the purpose of the call is to encourage a purchase, advertise goods or services, or promote commercial availability, the TCPA requires Prior Express Written Consent. This means:
A signed written agreement from the recipient (electronic signatures under the E-SIGN Act are valid, including website form submissions and recorded telephone keypresses after clear disclosure).
The agreement must include a clear and conspicuous disclosure stating that:
The recipient authorizes your company to make automated calls using an artificial or AI-generated voice to the specific phone number provided.
Consent is not a condition of purchasing any goods or services.
Example consent language (illustrative):
"By checking this box and providing my phone number, I agree to receive automated calls from [Your Company Name], including calls using an AI-generated voice, at the number provided. Consent is not a condition of any purchase."
Non-marketing / informational calls: Prior Express Consent (PEC)
If the call is purely informational (appointment reminders, account updates, service notifications), the bar is lower but still requires express, affirmative permission. The recipient must have provided their phone number and agreed to receive informational calls at that number.
Example consent language (illustrative):
"Please provide your phone number if you'd like to receive appointment reminders and service updates from [Your Company Name], including automated calls using an AI-generated voice."
Compliance guidelines for VoiceAgent configuration
Below are the key requirements and how CloudTalk VoiceAgent features help you address each one. These are tools, not guarantees. Whether you are compliant depends on how you use them.
Opening disclosure and identification
The requirement: Several requirements apply to the opening seconds of every outbound AI call. The FCC's 2024 ruling requires identification of the entity responsible for initiating the call. The FCC has also proposed (but not yet finalized) a rule requiring callers to disclose AI use at the start of every AI-generated call, and multiple states have enacted or proposed their own AI disclosure requirements. The TCPA requires that the company name be clearly stated at the beginning of the call along with a callback number recipients can use to opt out. In practice, AI disclosure, company identification, recording notice, and opt-out can all be covered in a single opening statement.
How to configure it in CloudTalk:
In your VoiceAgent prompt, configure the agent's greeting to cover AI disclosure, company identification, recording notice, and opt-out in one opening statement. You can either create separate VoiceAgents per use case with the appropriate disclosure built into each greeting, or use a system prompt variable like
{{disclosure}}to pass the disclosure text dynamically from your CRM when triggering the call via the API.CloudTalk supports pause and resume recording, which can be useful when handling sensitive information during the call.
Do not configure your VoiceAgent to conceal or misrepresent its artificial nature under any circumstances.
Consent management
The requirement: You must obtain the appropriate level of consent (PEC or PEWC) before placing an outbound AI call, and you must be able to produce evidence of that consent. An existing business relationship alone does not exempt outbound AI calls from consent requirements.
How to manage it with CloudTalk:
CloudTalk does not manage or verify consent on your behalf. You are responsible for obtaining and documenting consent in your CRM or campaign management tool before triggering outbound VoiceAgent calls through the API.
Maintain records of who consented, when, how, and what the consent language said. The burden of proving consent is on you, the caller.
Opt-out and consent revocation
The requirement: Recipients can revoke consent at any time through any reasonable method, including a verbal request during the call, an email, or a text reply. For promotional calls, you must provide an automated opt-out mechanism within two seconds of identifying your company at the start of the call. Revocations must be honored promptly, and in all cases within 10 business days.
How to configure it in CloudTalk:
Configure your VoiceAgent prompt to recognize opt-out requests during the conversation (e.g., "stop calling me," "take me off your list," "I don't want these calls"). When the agent detects an opt-out, it should acknowledge the request, confirm removal, and end the call using the Call Hangup feature.
To capture opt-out signals after the call, configure the Extract Information skill with a field like
opt-outsaved as True/False, with instructions for the AI such as: "If the recipient explicitly asked not to be contacted again or requested removal from the call list, set the value to 'True', otherwise 'False'." Enable "Send via Webhook" to send the extracted data to your CRM or automation tool, so your system can automatically update the contact's consent status and exclude them from future outbound campaigns.Record every opt-out in your internal do-not-call/suppression list and make sure the contact is excluded from future outbound VoiceAgent campaigns.
Internal Do-Not-Call list and DNC registry
The requirement: You must maintain an internal do-not-call list of individuals who have asked not to be called. For marketing calls, you must also scrub your call lists against the National Do-Not-Call Registry, unless a valid exemption (such as PEWC) applies. The FTC provides a Q&A for telemarketers covering the DNC provisions in detail.
How to manage it with CloudTalk:
Maintain your DNC/suppression list in your CRM or campaign management tool and scrub contact lists before triggering outbound VoiceAgent calls through the API. Sellers and telemarketers can access the registry data at telemarketing.donotcall.gov.
When a recipient opts out during a VoiceAgent call, update your suppression list immediately and make sure the number is excluded from all future outbound AI campaigns.
Calling time restrictions
The requirement: Outbound calls to residential numbers in the United States are restricted to 8:00 a.m. to 9:00 p.m. in the recipient's local time zone under the FTC's Telemarketing Sales Rule and FCC rules. Some states impose tighter windows.
How to manage it with CloudTalk:
Implement time-zone awareness in your outbound campaign logic. Before triggering an outbound VoiceAgent call through the API, verify that the current time falls within permitted calling hours at the recipient's location.
If you operate across multiple time zones, your automation layer should calculate the recipient's local time and hold the call until the window opens.
If you need to stop calls immediately, for example when a campaign starts dialing outside permitted hours, use the Stop outbound VoiceAgent calls API endpoint. It cancels queued calls and ends calls in progress, either for your whole company or for a single VoiceAgent. Cancelled calls aren't redialed later, so trigger them again once the calling window opens.
Compliance record-keeping
The requirement: You must maintain records sufficient to demonstrate compliance with each of the requirements above. This includes evidence of consent or authorization for each contact, opt-out and suppression records, and enough information to identify which VoiceAgent or campaign was used to make each call. If a complaint, carrier inquiry, or regulatory request arises, you need to be able to produce these records promptly.
How to manage it with CloudTalk:
Store consent records in your CRM at the contact level: who consented, when, through which form or process, and the exact disclosure language they agreed to.
Log every opt-out with a timestamp and the method the recipient used (verbal request during the call, email, etc.), and confirm the contact was added to your suppression list.
Use CloudTalk's call logs and audit trails alongside your CRM records to create a clear chain from consent through to each outbound VoiceAgent call.
Treat record-keeping as ongoing, not one-time. If your consent language changes, your records should reflect which version each contact agreed to.
Need help or have a question? Just reach out through our Support portal — we’re here for you.