TCPA consent for AI voice agents

The Telephone Consumer Protection Act (TCPA), enacted in 1991, was designed to protect consumers from intrusive telemarketing — restricting unsolicited automated and prerecorded calls, faxes, and texts to personal phones. More than three decades later, it remains one of the most litigated federal statutes in the country.

At its center is a simple requirement: prior consent is required before placing calls to mobile phones using an autodialer or an artificial or prerecorded voice.

AI voice agents fall squarely into this category. The FCC has clarified that AI-generated speech constitutes an “artificial or prerecorded voice.” Deploying AI voice agents in collections and customer outreach is therefore subject to the same consent standards that have governed prerecorded calls for years.

The opportunity is significant. AI voice agents let organizations scale outreach without adding headcount — lowering cost per interaction while delivering a responsive, 24/7, on-demand experience. For lenders, debt buyers, and third-party agencies, this is about competitive positioning: those that deploy AI responsibly expand reach and operate more efficiently at scale, while those that hesitate risk ceding ground to faster, more disciplined competitors.

Scale multiplies exposure as easily as it multiplies efficiency.

For more than fifteen years, the industry has relied on the FCC’s January 2008 Declaratory Ruling (In the Matter of Rules and Regulations Implementing the Telephone Consumer Protection Act of 1991, 23 FCC Rcd 559).

The FCC concluded that when a consumer provides their cell phone number to a lender — for example, on a credit application — that act constitutes prior express consent to autodialed, artificial-voice, and prerecorded-message calls.

It further clarified that calls made by third-party debt collectors on the lender’s behalf are treated as if made by the original lender. This gave rise to what the industry calls “pass-through consent,” the backbone of TCPA compliance for third-party agencies and debt buyers for over fifteen years.

Entire compliance programs were built around it — contract drafting, assignment provisions, and placement files all evolved to align. That foundation still stands, but it is no longer as stable as it once was.

Two recent Supreme Court decisions materially altered the legal landscape. In Loper Bright Enterprises v. Raimondo (2024), the Court overturned the Chevron doctrine, eliminating the longstanding requirement that courts defer to reasonable agency interpretations of ambiguous statutes. In McLaughlin Chiropractic Associates v. McKesson Corp., the Court reaffirmed that district courts are not bound by the FCC’s interpretations of the TCPA.

While the 2008 ruling has not been overturned, courts are no longer required to defer to it. The practical consequences are greater uncertainty and litigation risk: district courts may interpret “prior express consent” differently, jurisdictional divergence is no longer theoretical, and plaintiffs’ attorneys are incentivized to test the boundaries of consent in new venues.

The original consumer agreement should explicitly authorize the use of artificial or prerecorded voice communications. Generic references to autodialed calls may not be sufficient in an AI-first environment — precision matters. If there is no artificial or prerecorded-voice authorization, new consent may be required.

The agreement must also clearly state that consent extends to affiliates, agents, service providers, successors, and assignees. Without assignment language, pass-through consent becomes vulnerable.

Strong drafting accomplishes more than compliance. It establishes an independent legal basis for consent that does not depend solely on the FCC’s interpretation. In a post-Chevron environment, that independence is strategic — protecting lenders even if the ruling is challenged in court.

Consent is tied to the phone number the consumer actually provided. Broad consent language does not extend to skip-traced numbers or third-party-sourced data. If a number was not provided directly by the consumer, consent should not be presumed.

For lenders with direct originations, this requires clear data lineage: the number in the dialing file must match the number provided in the original agreement.

Even valid consent is not static, because phone numbers can be reassigned. Best practice requires routine verification against the FCC’s Reassigned Numbers Database to reduce the risk of contacting a number that no longer belongs to the consumer.

Numbers should be “scrubbed” every 59 days if no right-party contact has been made in that timeframe, and confirmed numbers should be tracked for reporting. Numbers that cannot be verified as still belonging to the consumer should not be called with AI voice agents.

Consumers can revoke consent at any time (Gager v. Dell Financial Services, 727 F.3d 265, 3d Cir. 2013). When a consumer withdraws consent — through a live agent, an IVR interaction, a text reply, an email, or a written communication — that withdrawal must be captured immediately, logged, timestamped, and propagated across all relevant systems.

Voice AI is most vulnerable when used as a standalone tool, separate from core systems and customer data. It must be integrated into the organization’s consent-management infrastructure in real time. Reliance on batch processing or daily flat-file updates creates dangerous gaps. Any delay between withdrawal and suppression is a risk the organization is choosing to carry.

Maintaining a clean record of revocations pays off downstream: being able to confidently share up-to-date consent and revocation status improves the performance of third-party agencies and increases the value of accounts in debt sales.

In TCPA litigation, intent is secondary, but documentation is decisive. Organizations deploying AI voice agents should maintain an auditable trail and be prepared to produce:

Under the 2008 FCC ruling, third-party collectors calling on behalf of a lender could rely on the consumer’s original consent to the lender. In today’s legal environment, that assumption can no longer be taken for granted.

AI voice agents represent a structural shift in collections and customer engagement. They offer meaningful operational leverage, improved consistency, and the potential for better consumer experiences — but TCPA compliance is a prerequisite for realizing that opportunity.

The 2008 FCC ruling remains foundational, but it no longer carries automatic judicial deference. That change does not eliminate opportunity; it demands stronger internal architecture for consent management.

The strongest position combines solid contract language with operational rigor: explicit consent terms, pass-through provisions, original-number-only calling, reassigned-number checks, litigious-debtor scrubs, and real-time revocation tracking.