Are AI Voice Robocalls Illegal? The FCC AI Voice Ruling and the TCPA

What did the FCC AI voice TCPA ruling decide?

The Federal Communications Commission adopted Declaratory Ruling FCC 24-17 on 2 February 2024 in CG Docket No. 23-362 and released it on 8 February 2024, effective on release. It answers a question the Commission had raised in a November 2023 Notice of Inquiry: whether AI-generated voices count as an "artificial or prerecorded voice" under the Telephone Consumer Protection Act of 1991. The answer is yes. The ruling confirms that the TCPA's restrictions encompass current AI technologies that resemble human voices or generate call content using a prerecorded voice.

The ruling names voice cloning directly. Voice cloning falls within the existing prohibition because it artificially simulates a human voice; such calls are artificial because no person is speaking them. The Commission also applied its earlier Soundboard Ruling, which held that a live agent selecting prerecorded clips does not take a call outside the TCPA. The same logic covers AI that wholly synthesises a voice and AI that imitates a real person from an audio sample, and the ruling states that the TCPA allows no carve-out for technologies that claim to be the equivalent of a live agent.

No commenter opposed the conclusion. State attorneys general had asked for it: Chairwoman Jessica Rosenworcel's statement notes that 26 of them wrote in support, and that the FCC has a memorandum of understanding with 48 state attorneys general on robocall enforcement.

Are AI voice robocalls illegal, and what does a lawful call need?

An AI voice call to a residential line or a mobile number is illegal unless one of the TCPA's conditions is met. Under the ruling, callers using AI-generated voices must obtain the prior express consent of the called party before initiating the call, absent an emergency purpose or an exemption the Commission has adopted by rule. If the call contains an advertisement or telemarketing, the FCC's rules require prior express written consent.

Consent is not the whole requirement. Every artificial or prerecorded voice message must state clearly, at the start, the identity of the business, person or entity responsible for initiating the call, and must provide identification and contact information. Telemarketing messages must also offer an automated opt-out mechanism. These duties apply to any AI technology that initiates an outbound call using an artificial or prerecorded voice, including conversational AI agents.

Who enforces the rules against AI voice calls, and what are the penalties?

Three groups can act. The FCC can issue forfeitures; in September 2024 it imposed a $6 million forfeiture on political consultant Steve Kramer over the January 2024 New Hampshire robocalls that used an AI voice imitating President Biden and misleading caller ID. State attorneys general can sue under the TCPA, which the ruling makes easier for cloned-voice cases. Private individuals can sue too: the TCPA provides $500 in statutory damages per violation, which a court can triple to $1,500 for willful or knowing violations.

The New Hampshire case also shows the limits of network controls. The calls went out on 21 January 2024, two days before the state's primary. Lingo Telecom, the provider that transmitted them, agreed on 21 August 2024 to pay a $1 million civil penalty. The FCC alleged that Lingo signed some of the calls with A-level STIR/SHAKEN attestation, the highest level, without independently checking that its upstream customers could legitimately use the caller ID number. The calls carried authentication, yet the voice on them was synthetic. Authentication answers who is responsible for a number. It says nothing about whether the speaker is a person.

Where does voice deepfake detection fit under the TCPA?

The TCPA governs outbound callers, so its main compliance tools are consent records, disclosures and opt-outs, not detection. A business that uses AI voices lawfully needs the paperwork, and no detector supplies consent. Detection becomes useful on the receiving side of the call, where the risk is fraud rather than a TCPA breach.

Banks, telecom operators and contact centres receive cloned-voice calls that try to authorise payments, reset accounts or socially engineer staff. Voice biometrics that match a caller to an enrolled voiceprint can be fooled by a good clone, and caller ID can be spoofed. Analysing the audio itself for synthesis artefacts adds an independent signal. It needs care: phone codecs, background noise and short utterances reduce the evidence available, so scores should feed a step-up or review decision rather than an automatic block.

• For outbound programmes, keep consent records per number, log the disclosure script and test opt-outs before any AI voice campaign.
• For inbound channels, treat voice as one factor and never the sole authenticator for high-risk actions such as payee changes or account recovery.
• Add synthetic-voice analysis to calls that request money movement or credential changes, and route high scores to callback on a known number.
• Retain the audio and call metadata under an approved retention policy when a call is flagged, for investigation and possible referral.

How does NeuroCall help contact centres facing cloned voices?

NeuroCall (Beta) is Neural Defend's voice and call deepfake detection product, built for the inbound side of this problem: contact centres, bank phone channels and telecom operators that need to know whether the voice on a call is synthetic. Because it is in Beta, evaluate it on your own call audio, codecs and languages before relying on it for decisions, and pair it with callback and knowledge checks.

For recorded audio, NeuroVerify accepts audio in the same single API call used for face images and video and returns one unified risk score with signal-level evidence, with your policy deciding the outcome. For investigations of a specific incident, such as a fraudulent payment authorised by phone, NeuroDetect lets an analyst examine the recording in a case, with attention views down to audio segments, model and version context and a downloadable forensic report.

Neural Defend deploys as a managed cloud API, in a private cloud or VPC, as a secure container, on-premises or air-gapped, which matters for call recordings that carry personal and financial data, and holds ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 42001 and SOC 2 Type II certifications.