FDCPA & TCPA Compliance for AI Voice Agents
AI does not create exceptions to consumer protection law. Every FDCPA provision, TCPA consent requirement, and Regulation F frequency limit applies to your AI voice agent exactly as it applies to a human collector.
This guide covers what you must configure before deploying AI for US debt collection.
Four Layers of US Regulation
AI debt collection in the US operates under four overlapping regulatory frameworks. Non-compliance with any single layer exposes you to lawsuits, fines, and operational bans.
Fair Debt Collection Practices Act
The baseline federal law. Governs how, when, and where collectors can contact consumers. Mini-Miranda disclosures, calling hours, harassment limits, validation of debt, and third-party disclosure rules.
Telephone Consumer Protection Act
Regulates the technology used to make calls. Prior express consent for automated calls, ATDS restrictions, DNC registry compliance, and revocation of consent. Statutory damages of $500-$1,500 per call.
CFPB Regulation F
The 2021 implementation of the FDCPA. Adds the 7-in-7 call frequency rule, limited-content message provisions, electronic communication rules, and harassment presumptions.
State-Level Laws
Most states have their own debt collection and telecom laws that exceed federal protections. All-party consent states, mini-TCPAs, broader ATDS definitions, and additional licensing requirements.
FDCPA Requirements for AI Voice Agents
Six FDCPA provisions that directly impact how your AI voice agent operates. Each must be programmed into the system - not left to chance.
Harassment & Abuse Prohibition
AI voice agents must never use threatening language, profanity, or intimidation. The system cannot call repeatedly to annoy or harass. Under Regulation F, this means no more than 7 call attempts per debt within a 7-day period, and no calls within 7 days of a live conversation. Your AI must track every attempt across all channels and enforce these limits automatically.
Mini-Miranda Warning
Every call must include the Mini-Miranda disclosure: the AI must identify the caller as a debt collector, state that the call is an attempt to collect a debt, and that any information obtained will be used for that purpose. This disclosure must happen at the start of every call - not buried in a fast-paced script. The AI voice must deliver it clearly and at a natural pace.
Calling Hours & Contact Restrictions
AI agents can only call between 8:00 AM and 9:00 PM in the consumer's local time zone - not the collector's. This means your AI must resolve the debtor's time zone from their area code or address before dialing. If the consumer is represented by an attorney, the AI must contact the attorney instead. Calls to the consumer's workplace are prohibited if the employer disapproves.
Cease-and-Desist Compliance
If a consumer requests in writing (or verbally during a call) that the collector stop contacting them, the AI must immediately flag the account and suppress all future automated contact. The system may only send one final notice confirming cessation or advising of specific remedies. Your AI must be trained to recognize cease-and-desist requests in natural conversation - not just keyword matching.
Validation of Debt
Within 5 days of initial contact, the consumer must receive a written notice containing: the amount of the debt, the name of the creditor, a statement that the debt will be assumed valid unless disputed within 30 days, and the right to request verification. If the AI makes the first contact, it must either deliver this information verbally and follow up in writing, or ensure the written notice is sent within the 5-day window.
Third-Party Disclosure
AI voice agents must never disclose the existence of a debt to third parties. If someone other than the consumer answers the phone, the AI must only identify itself and request a callback - never mention debt collection. This requires sophisticated speaker identification or verification questions before any debt-related discussion begins.
TCPA: The High-Stakes Law for AI Callers
AI voice agents use "artificial or prerecorded voice" technology by definition. That triggers TCPA consent requirements regardless of whether your system qualifies as an ATDS.
Prior Express Consent
The TCPA requires prior express consent before placing automated or prerecorded voice calls to any telephone number. For debt collection calls, this means "prior express consent" (not written consent) for informational calls, but "prior express written consent" for calls that include marketing content. AI voice agents are unambiguously "prerecorded or artificial voice" technology - there is no gray area here.
ATDS Definition & Implications
The Supreme Court's 2021 ruling in Facebook v. Duguid narrowed the ATDS (Automatic Telephone Dialing System) definition to systems that generate random or sequential numbers. However, many state TCPAs use broader definitions. If your AI system auto-dials from a list, it may not be an ATDS under federal law, but could be under California, Florida, or Washington state law. Always analyze both federal and state ATDS definitions.
DNC Registry Compliance
Before any outbound call, the AI must scrub numbers against the National Do Not Call Registry (updated every 31 days), your internal DNC list (immediate effect), and any state-specific DNC lists. Calls to numbers on the DNC registry can result in fines of $500-$1,500 per violation. Your system must maintain real-time DNC checking with zero tolerance for stale data.
Safe Harbor Provisions
The FCC provides limited safe harbor protections for collectors who can demonstrate: the number was provided by the consumer, the caller had no reason to know it was reassigned, and a single call was made after discovering reassignment. To benefit from safe harbor, maintain detailed logs of how each number was obtained, when consent was given, and implement reassigned number databases (like the FCC's Reassigned Numbers Database).
Cell Phone vs. Landline Rules
The TCPA applies stricter rules to cell phone calls than landlines. Automated or prerecorded calls to cell phones require prior express consent even for non-marketing calls. Since most consumers now use cell phones as their primary number, AI voice agents must treat every outbound call as a cell phone call unless you can verify the number type. Use carrier lookup APIs to confirm before dialing.
Revocation of Consent
Consumers can revoke consent at any time through any reasonable means - including verbally during an AI call. The FCC has ruled there are no magic words required. Your AI must recognize phrases like "stop calling me," "take me off your list," "don't call again," and similar natural language variations. Once revoked, all automated contact must cease immediately. Log the revocation with a timestamp and audio reference.
Regulation F: Frequency Limits & Electronic Rules
The CFPB's Regulation F modernized the FDCPA for digital communication and established concrete call frequency limits. These rules directly constrain AI voice agent behavior.
7-in-7 Rule
Regulation F limits debt collectors to 7 telephone call attempts per debt within a 7-consecutive-day period. After a live telephone conversation, no further calls for 7 days. This applies per debt, not per consumer - if a consumer has 3 debts, the collector could theoretically make 21 calls in 7 days (though this invites harassment claims). Your AI must track attempts at the individual debt level.
Communication Frequency
Beyond the 7-in-7 phone limit, Regulation F caps total communications. Emails, text messages, and social media messages each count. The regulation creates a "rebuttable presumption" of harassment if you exceed the limits. Your AI system must aggregate contact attempts across all channels - phone, email, SMS - and enforce a unified frequency cap.
Electronic Communications
Regulation F permits debt collection via email, text, and social media, but with strict requirements: every electronic message must include an unsubscribe mechanism for that specific channel, the collector must not communicate via a medium visible to the general public (no Facebook wall posts), and the consumer must have used the email or phone number for the specific channel. AI systems sending follow-up texts or emails after calls must comply with these channel-specific rules.
Limited-Content Messages
Regulation F created "limited-content messages" - voicemails that contain only: a business name (that does not indicate debt collection), a request to reply, the name of a natural person to contact, and a phone number. These are not considered "communications" under the FDCPA, so they do not trigger the Mini-Miranda requirement. Your AI can leave limited-content voicemails without disclosing the debt collection purpose.
Time and Place Restrictions
Regulation F reaffirms the 8 AM - 9 PM calling window in the consumer's local time and adds that collectors must not contact consumers at times or places known to be inconvenient. If a consumer says "don't call me at work" or "don't call before noon," the AI must log and respect that preference. These per-consumer overrides must be stored and enforced in real time.
“No Exceptions for New Technologies”
The Consumer Financial Protection Bureau has made its position unambiguous: AI-powered debt collection must comply with every existing consumer protection law. There is no innovation exception, no technology safe harbor, and no grace period for novel approaches.
In its 2023-2024 guidance, the CFPB specifically addressed AI in financial services, stating that companies are responsible for the actions of their AI systems just as they would be for human employees. If your AI violates the FDCPA, your company violated the FDCPA. If your AI makes a TCPA-noncompliant call, the statutory damages apply to your company.
The Bureau has also targeted “dark patterns” in AI communications - systems designed to confuse consumers about their rights, pressure them into payments, or obscure required disclosures. AI that speaks too fast during the Mini-Miranda, buries opt-out language, or fails to recognize cease-and-desist requests is a CFPB enforcement target.
Key takeaway for AI deployers:
Your AI vendor's compliance claims are not your shield. The CFPB holds the deploying company responsible. You must independently verify that your AI voice agent complies with FDCPA, TCPA, Regulation F, and all applicable state laws before making a single call.
How to Configure AI Voice Agents for Compliance
Six systems your AI platform must implement before making a single collection call. If any is missing, you are not ready to deploy.
Timezone-Aware Calling Engine
Map every consumer phone number to a time zone using area code databases and carrier lookups. Enforce 8 AM - 9 PM windows in the consumer's local time. Account for daylight saving transitions. Block calls automatically outside permitted hours - no manual override possible.
Real-Time DNC Scrubbing
Integrate the Federal DNC Registry (refreshed every 31 days), state-specific DNC lists, and your internal suppression list. Check every number against all lists before the AI dials. Implement webhook-based updates for internal DNC additions - zero latency between consumer request and suppression.
Consent Management Platform
Track consent status per consumer, per channel, per debt. Record how consent was obtained (written, verbal, web form), when, and the exact language used. Support instant revocation through any channel. Maintain audit-ready consent records with immutable timestamps.
Call Recording & Disclosure
Record every AI call for compliance and quality purposes. Implement call recording disclosure at the start of each call - required in all-party consent states (California, Florida, Illinois, and 8 others). Store recordings encrypted with role-based access. Retain per your document retention policy (typically 3-7 years for debt collection).
Frequency Cap Enforcement
Track every contact attempt - calls, voicemails, emails, texts - at the per-debt level. Enforce Regulation F's 7-in-7 rule automatically. After a live conversation, block further calls for 7 days on that debt. Aggregate cross-channel contacts to avoid harassment presumptions.
Complete Audit Trail
Log every AI decision: when the call was attempted, what disclosures were made, what the consumer said, how the AI responded, and the outcome. Store call transcripts, recordings, consent records, and DNC checks in a single queryable system. This is your defense in any TCPA or FDCPA lawsuit.
State-Level Regulations Snapshot
Federal law is the floor, not the ceiling. These four states illustrate how state regulations add layers of complexity that your AI must handle per-jurisdiction.
California
- Rosenthal Fair Debt Collection Practices Act extends FDCPA protections to original creditors
- All-party consent for call recording (Cal. Penal Code 632)
- CCPA/CPRA grants consumers right to know what data is collected and right to delete
- California mini-TCPA (broader ATDS definition than federal)
- No calls before 8 AM or after 9 PM Pacific Time
- Debt collection licensing required (California DFPI)
New York
- NYC Department of Consumer and Worker Protection licensing required
- NYC rules prohibit deceptive, unconscionable, or threatening practices
- One-party consent for call recording (NY Penal Law 250.00)
- New York City has additional calling hour restrictions
- AG enforcement of debt collection practices under GBL 349/350
- Written validation notice requirements beyond federal standard
Texas
- Texas Debt Collection Act (TDCA) - third-party collectors must be licensed
- One-party consent for call recording
- Texas DTPA provides consumer remedies for deceptive collection tactics
- Surety bond required for third-party collection agencies
- No specific state TCPA equivalent - federal TCPA applies
- AG can pursue violations under Texas Finance Code Chapter 392
Florida
- Florida Consumer Collection Practices Act (FCCPA) - broader than FDCPA
- All-party consent for call recording (Florida Statute 934.03)
- Florida mini-TCPA (Florida Telephone Solicitation Act) with broad ATDS definition
- Registration required with Florida OFR for consumer collection agencies
- No calls before 8 AM or after 9 PM (consumer's time)
- FCCPA applies to original creditors - not just third-party collectors
Why European-Built AI Is Inherently More Privacy-Forward
US Approach
EU Approach (GDPR + EU AI Act)
AI systems built under GDPR and the EU AI Act come with consent management, data minimization, audit trails, human oversight, and mandatory transparency as foundational architecture - not afterthought features. When deployed in the US market, these systems naturally satisfy most FDCPA and TCPA requirements because the European standard is higher.
Related Resources
Frequently Asked Questions
Common questions about FDCPA, TCPA, and Regulation F compliance for AI voice agents.
Deploy Compliant AI Collections With Confidence
Built under GDPR and the EU AI Act - the strictest privacy frameworks in the world. When you deploy AInora for US debt collection, FDCPA and TCPA compliance is not an add-on. It is the architecture.