Is it legal to use AI to call and text customers?

What law governs AI calls and texts?

This guide is general information as of October 12, 2026, not legal advice. Laws change and courts disagree. Talk to a lawyer about your specific situation.

The main federal law is the Telephone Consumer Protection Act (TCPA), 47 U.S.C. § 227, carried out through FCC rules at 47 CFR § 64.1200. The FCC treats text messages as calls under it. People can sue for $500 per violation, and a court can triple that for willful or knowing violations.

On February 8, 2024, the FCC issued a unanimous declaratory ruling (FCC 24-17) confirming that the TCPA's limits on "artificial or prerecorded voice" calls cover AI technologies that generate human voices. In practice, an outbound AI voice call is treated like a robocall: it needs the called person's prior express consent unless an exemption applies, and FCC identification rules apply. The message must state the business's identity at the beginning and give a callback number.

One 2025 change matters for how much weight FCC guidance carries. In McLaughlin Chiropractic v. McKesson (June 20, 2025), the Supreme Court held that district courts are not bound by the FCC's interpretations of the TCPA. Courts can now read the statute for themselves, which cuts both ways. Build your process on conservative practices, not on any one FCC interpretation surviving.

What kind of consent do you need?

It depends on what the call or text says and how it's made. Marketing needs the strongest consent.

The one-to-one consent rule is gone. The FCC adopted a rule in 2023 that would have required consent to one seller at a time, for topics logically related to the original interaction. On January 24, 2025, the Eleventh Circuit vacated it in Insurance Marketing Coalition v. FCC, holding that the FCC exceeded its authority. The court described prior express consent as clearly and unmistakably agreeing, before the call, to receive it. The FCC formally removed the rule in July 2025.

Can an AI call back someone who just called you?

Usually, if the caller had notice and the callback stays about what they called for. This is the most common AI use for small businesses, and the details matter.

• Answering inbound calls is different. The TCPA's robocall limits apply to calls you make. An AI that answers a call the customer placed isn't making a robocall, though AI disclosure and recording rules still apply.
• Giving a number is generally permission, with a catch. The FCC said in 1992 that people who knowingly release their phone numbers have in effect invited calls at that number, absent instructions otherwise. It also said a number captured by caller ID without notice to the caller is not permission for autodialed or prerecorded-voice calls.
• So give notice where you capture the number. For example, your greeting can say: "If we miss you, our virtual assistant will call or text you back at this number." No FCC rule spells out exactly what notice is enough, so ask your attorney to review the wording.
• Keep the callback on topic. Answer their question and book what they asked about. Florida's law, for one, excludes calls made in response to the person's express request from its definition of unsolicited sales calls.
• An inquiry isn't blanket consent. Federally, an inquiry in the last three months creates an "established business relationship" that takes a call outside the definition of telephone solicitation. That helps with Do Not Call and calling-hour rules, but the rule for artificial-voice calls to cell phones still requires prior express consent.

This is how Arifwork's AI receptionist is set up: it only calls people who contacted the business first or opted in.

What do the texting rules require?

Business texts need carrier registration, consent and fast opt-out handling. These come from different authorities.

• Registration. US carriers require A2P 10DLC registration for software-sent texts from 10-digit numbers. Twilio has fully blocked unregistered US-bound 10DLC messages since September 1, 2023.
• Consent. CTIA's Messaging Principles and Best Practices (updated May 2023) say all business senders should get opt-in consent before texting consumers and honor opt-outs.
• Autodialer scope. In Facebook v. Duguid (April 1, 2021), the Supreme Court held that equipment is an autodialer only if it can store or produce numbers using a random or sequential number generator. That narrowed federal autodialer claims, but Florida's law covers any "automated system for the selection and dialing" of numbers, and carrier consent rules apply either way.
• Revocation. Since April 11, 2025, FCC rules let people revoke consent by any reasonable method. Replies of "stop," "quit," "end," "revoke," "opt out," "cancel" or "unsubscribe" count automatically. You must honor revocations within 10 business days and can't require one exclusive opt-out method. One confirmation text with no marketing is allowed, presumed fine if sent within five minutes.
• Revoke-all, delayed. The part requiring an opt-out from one type of message to cover all your unrelated messages has been pushed back to January 31, 2027.

For the step-by-step setup, see how to set up missed-call text back.

What hours can you call or text?

Federally, telephone solicitations to residential subscribers are allowed only from 8 a.m. to 9 p.m. in the called person's local time. Several states are stricter:

A simple house rule covers most of the country: send automated follow-ups, reminders and anything promotional only between 8 a.m. and 8 p.m. in the recipient's time zone, and cap attempts at three per day on the same topic. Arifwork applies quiet hours to every account.

Do you have to tell people they're talking to an AI?

Often yes, and you should do it every time anyway. The rules come from several places:

• Federal identification rules. Artificial-voice messages must identify the business at the start and give a phone number. The FCC also proposed in August 2024 (NPRM FCC 24-84) to require callers to disclose AI-generated calls at the start of each call. That was a proposal, so check its status with your counsel.
• California. Business and Professions Code § 17941 (SB 1001) makes it unlawful to use a bot online to mislead a person in California about its artificial identity in order to drive a sale. A clear, conspicuous disclosure avoids liability. The law defines a bot as an automated online account, so it most clearly reaches web chat and social messaging.
• Utah. Since May 7, 2025, a business using generative AI in a consumer transaction must disclose it's AI if the person clearly asks. Licensed professions must disclose up front in high-risk interactions. Disclosing clearly at the outset and throughout the interaction gives a safe harbor.

Arifwork's AI introduces itself as your business's virtual assistant at the start of every conversation and never claims to be human.

Can you record AI calls?

Yes, if you tell people at the start. Recording consent is set by state law, and some states require every party's consent.

The Reporters Committee for Freedom of the Press lists 11 states that require all parties' consent in most circumstances: California, Delaware, Florida, Illinois, Maryland, Massachusetts, Michigan (at least for recordings by a non-party), Montana, New Hampshire, Pennsylvania and Washington. Connecticut and Nevada also require all-party consent for phone calls.

Because you often can't know where a caller is, the safe practice is to announce recording at the start of every call. When recording is on, Arifwork's AI says so before anything else.

What's a practical compliance checklist?

1. Capture consent where you capture the number: web forms, booking pages and your phone greeting. Log the time, method and wording.
2. Call and text only people who contacted you or opted in. Get written consent before anything promotional.
3. Disclose the AI and your business name at the start, and give a callback number.
4. Announce recording before the conversation starts.
5. Register for A2P 10DLC before sending a single text.
6. Put STOP opt-out in every text and honor any reasonable opt-out, well inside 10 business days.
7. Use quiet hours: 8 a.m. to 8 p.m. recipient time for follow-ups and reminders.
8. Cap attempts at three per day on the same subject.
9. Route complaints to a human with the transcript, and keep your own emergency number on your voicemail and website.
10. Have your attorney review your consent language, especially in a regulated industry.

Arifwork builds the AI-side steps into every setup. Ava doesn't handle emergencies differently yet, so the emergency number stays with you. See how it works or book a demo to walk through yours. Curious what the calls you're missing are worth first? Try the missed-call calculator.

Frequently asked questions