TCPA, A2P 10DLC and Consent for AI Calls and SMS: An Agency Checklist

Before an AI agent calls or texts anyone for a client, you need three things on file: proof of consent that covers that exact use, a working opt-out, and a registered texting campaign. The FCC confirmed in February 2024 that AI-generated voices count as an "artificial or prerecorded voice" under the TCPA. That puts consent in front of every outbound AI call. On October 26, 2026, a new FCC order on consent revocation was published in the Federal Register, and it takes effect 30 days later. This checklist walks through each step, with the primary source for each one.

This is not legal advice. We are a software company, not your lawyer. The rules differ by state and by the type of call, and they change. Use this checklist to prepare questions for counsel, not to replace counsel.

Key Takeaways

• The FCC's February 2024 ruling says AI technologies that generate human voices are covered by the TCPA's "artificial or prerecorded voice" rules. Consent is required before the call.
• Marketing calls and texts need prior express written consent. Informational ones need prior express consent. Keep the proof either way.
• A revocation rule change was published October 26, 2026, and takes effect 30 days after publication. Callers can designate one exclusive way to opt out, but must disclose it on every call or text.
• US texting from 10-digit numbers requires A2P 10DLC registration of your brand and campaign.
• No platform can create your consent records for you. Collect them at the point of sign-up and store them where you can export them.

Who is responsible when an agency runs the campaign?

The TCPA's duties attach to the party that initiates the call or text. When you build the agent, load the list and press start for a client, it is not obvious from the statute alone how responsibility splits between you and the client. That is a question for your lawyer and your contract. What you can do without a lawyer is settle in writing who collects consent, who stores the records and who handles opt-outs. Do that before the first call.

Step 1: Know what the FCC said about AI voices

In its Declaratory Ruling FCC 24-17 (adopted February 2, 2024 and released February 8, 2024), the Commission wrote that it confirms "that the TCPA's restrictions on the use of 'artificial or prerecorded voice' encompass current AI technologies that generate human voices." Calls using them "require the prior express consent of the called party to initiate such calls absent an emergency purpose or exemption."

The ruling also says there is no carve-out for technology that "purports to provide the equivalent of a live agent." A voice agent that sounds natural gets no exemption for sounding natural.

Two practical reads of this ruling:

• An outbound AI call to a mobile number or a residential line needs consent before it is placed, with the exemptions the rules list.
• The ruling is about consent, not about a script line. It does not give you a phrase that cures a missing consent.

Step 2: Match the consent level to the message

The FCC's rules at 47 CFR 64.1200 split calls into two groups. Calls that include or introduce an advertisement, or that constitute telemarketing, to the covered lines need "prior express written consent." Other autodialed or prerecorded calls need prior express consent.

Section 64.1200(f)(9) defines prior express written consent as an agreement in writing, bearing the signature of the person called, that clearly authorizes the seller to deliver the messages. It must also include the phone number and a clear disclosure that signing is not a condition of purchase. Have counsel check your sign-up form against that definition.

The table is a starting point. The rules also list exemptions, for example some health care messages, and each has conditions. Take each campaign to your lawyer with the exact message text.

Step 3: Respect calling hours and the Do Not Call list

For telephone solicitations to residential subscribers, 64.1200(c)(1) bars calls "before the hour of 8 a.m. or after 9 p.m." in the local time of the person called. Section 64.1200(c)(2) bars solicitations to numbers on the National Do Not Call Registry, and registrations "must be honored indefinitely, or until the registration is cancelled."

Build both into the campaign, not into the script:

• Set the dial window by the called number's time zone, not yours or the client's.
• Scrub every list against the registry before upload, and keep the date of the scrub.
• Keep an internal do-not-call list per client, and check it on every dial.

Step 4: Plan for the new revocation rule

Consumers can revoke consent to calls and texts. The current rule at 64.1200(a)(10) says revocation must be honored within a reasonable time not to exceed ten business days. The FCC's Report and Order FCC 26-67, adopted September 30, 2026, was published in the Federal Register on October 26, 2026. The order says it becomes effective 30 days after publication. It replaces the January 31, 2027 date that had been set for the earlier "revoke-all" provision. Confirm the exact date on the Federal Register page.

As the order describes it, callers may designate an exclusive revocation method, from three types:

1. An automated, interactive voice or key-press opt-out in response to a robocall.
2. Specific standardized words in response to an incoming text.
3. A website or telephone number the caller provides to process opt-outs.

The caller must "clearly and conspicuously" disclose the chosen method on the call or in the text. For texts, naming even one of the standardized words, such as "stop," satisfies the disclosure, but every standardized word must still be honored. A caller that does not designate a method must honor revocation made in any reasonable manner. A revocation in response to a marketing call or text covers all future marketing calls and texts from that caller.

The Commission also asked for comment on shortening the ten-day window, requiring a way to revoke all robocalls, and two-way texting requirements. Those are proposals, not rules. Watch the docket.

What to do now:

• Pick the opt-out method for each campaign and say it at the top of every message or call.
• Make the opt-out automatic. A person reading a mailbox is the slow path the FCC is trying to remove.
• Test it. Reply STOP to your own number and check the contact stops within minutes, not days.

Step 5: Don't build around the one-to-one consent rule

The FCC had adopted a "one-to-one" consent rule for lead generators. On January 24, 2025, the Eleventh Circuit vacated it in Insurance Marketing Coalition v. FCC, as Morrison Foerster and Reed Smith reported. If you read older guides that tell you to get consent for one seller at a time, that rule is gone. The sound habit remains: your consent form should name the business that will contact the person, and your records should show it.

Step 6: Register for A2P 10DLC before you text

A2P 10DLC is the US carrier standard for application-to-person texting from 10-digit local numbers. Twilio's documentation says that anyone sending messages from an application over a 10DLC number to US recipients must register. Registration has two parts:

• Brand: who is sending. Standard brands need a tax ID.
• Campaign: what you send and how people opt in, opt out and get help.

Twilio says unregistered traffic gets filtered more and may carry extra carrier fees. Fees differ by campaign type and carrier, so read your provider's current fee page. We don't quote fee amounts here because they change.

Ask your messaging provider whether each client should register under its own brand or under yours. Registering each client separately is a common practice, but follow your provider's rules.

Step 7: Follow the carriers' own consent guidance

The wireless industry group CTIA publishes Messaging Principles and Best Practices (May 2023 edition). It is industry guidance, not law, but carriers use it. Among its points:

• Message senders should obtain a consumer's consent to receive messages generally, and express written consent for marketing messages.
• Consent is not transferable. An opt-in applies "only to the campaign(s) and specific Message Sender for which it was intended."
• Do not use opt-in lists that were rented, sold or shared.
• State in the message how to opt out. Standardized "STOP" wording should be used, and requests in normal language, such as "unsubscribe" or "please opt me out," should also be acted on.
• Send one final confirmation message after an opt-out, then no more.

CTIA also lists the consent data to retain: a timestamp, the medium used to obtain consent, the language the person saw, the specific campaign, the IP address, the phone number and the identity of the person who consented. Copy that list into your own consent log. Check CTIA's site for newer editions.

The agency checklist

Before you sign the client

• Write down who collects consent, who stores it and who handles opt-outs.
• Ask the client how its list was built. Reject rented, purchased or scraped lists.
• Ask for the sign-up forms and the exact consent wording.
• Have counsel review the consent text and your contract.

Before launch

• Confirm each contact has consent matching the message type (Step 2).
• Scrub against the National Do Not Call Registry and your internal list.
• Set dial windows by recipient time zone.
• Register the 10DLC brand and campaign, and wait for approval.
• Choose and disclose your opt-out method.
• Run test calls and texts, including a STOP reply.

During the campaign

• Honor opt-outs fast. The outer limit in the rule is ten business days, and the aim should be minutes for automated channels.
• Keep a log of consent, opt-outs and scrubs that you can export.
• Watch message delivery and complaint rates for signs of filtering.

Every month

• Review a sample of calls and texts against the consent on file.
• Check the FCC docket and the Federal Register for rule changes.
• Refresh the registry scrub.

Where does PulsyAI fit?

PulsyAI is a white-label AI voice platform. Our features page lists inbound and outbound voice calling and SMS agents, and our homepage says the platform is "TCPA compliant." Read that as a statement about the platform. Your campaign's compliance depends on your consent records, your lists and your messages, which no software can supply for you.

Our public pages do not describe consent capture, Do Not Call scrubbing or opt-out handling in detail. Ask any vendor, including us, exactly how each works before you build a campaign on it. If you only need compliance tooling and have no plan to resell voice agents, a specialist compliance vendor may serve you better.

PulsyAI publishes this post and sells an AI voice platform. This article is general information, not legal advice. Rules cited were checked in October 2026 and may have changed.