FDCPA & TCPA Compliance for AI Voice Agents
AI does not create exceptions to consumer protection law. Every FDCPA provision, TCPA consent requirement, and Regulation F frequency limit applies to your AI voice agent exactly as it applies to a human collector.
This guide covers what you must configure before deploying AI for US debt collection.
Four Layers of US Regulation
AI debt collection in the US operates under four overlapping regulatory frameworks. Non-compliance with any single layer exposes you to lawsuits, fines, and operational bans.
Fair Debt Collection Practices Act
The baseline federal law. Governs how, when, and where collectors can contact consumers. Mini-Miranda disclosures, calling hours, harassment limits, validation of debt, and third-party disclosure rules.
Telephone Consumer Protection Act
Regulates the technology used to make calls. Prior express consent for automated calls, ATDS restrictions, DNC registry compliance, and revocation of consent. Statutory damages of $500-$1,500 per call.
CFPB Regulation F
The 2021 implementation of the FDCPA. Adds the 7-in-7 call frequency rule, limited-content message provisions, electronic communication rules, and harassment presumptions.
State-Level Laws
Most states have their own debt collection and telecom laws that exceed federal protections. All-party consent states, mini-TCPAs, broader ATDS definitions, and additional licensing requirements.
FDCPA Requirements for AI Voice Agents
Six FDCPA provisions that directly impact how your AI voice agent operates. Each must be programmed into the system - not left to chance.
TCPA: The High-Stakes Law for AI Callers
AI voice agents use "artificial or prerecorded voice" technology by definition. That triggers TCPA consent requirements regardless of whether your system qualifies as an ATDS.
Prior Express Consent
The TCPA requires prior express consent before placing automated or prerecorded voice calls to any telephone number. For debt collection calls, this means "prior express consent" (not written consent) for informational calls, but "prior express written consent" for calls that include marketing content. AI voice agents are unambiguously "prerecorded or artificial voice" technology - there is no gray area here.
ATDS Definition & Implications
The Supreme Court's 2021 ruling in Facebook v. Duguid narrowed the ATDS (Automatic Telephone Dialing System) definition to systems that generate random or sequential numbers. However, many state TCPAs use broader definitions. If your AI system auto-dials from a list, it may not be an ATDS under federal law, but could be under California, Florida, or Washington state law. Always analyze both federal and state ATDS definitions.
DNC Registry Compliance
Before any outbound call, the AI must scrub numbers against the National Do Not Call Registry (updated every 31 days), your internal DNC list (immediate effect), and any state-specific DNC lists. Calls to numbers on the DNC registry can result in fines of $500-$1,500 per violation. Your system must maintain real-time DNC checking with zero tolerance for stale data.
Safe Harbor Provisions
The FCC provides limited safe harbor protections for collectors who can demonstrate: the number was provided by the consumer, the caller had no reason to know it was reassigned, and a single call was made after discovering reassignment. To benefit from safe harbor, maintain detailed logs of how each number was obtained, when consent was given, and implement reassigned number databases (like the FCC's Reassigned Numbers Database).
Cell Phone vs. Landline Rules
The TCPA applies stricter rules to cell phone calls than landlines. Automated or prerecorded calls to cell phones require prior express consent even for non-marketing calls. Since most consumers now use cell phones as their primary number, AI voice agents must treat every outbound call as a cell phone call unless you can verify the number type. Use carrier lookup APIs to confirm before dialing.
Revocation of Consent
Consumers can revoke consent at any time through any reasonable means - including verbally during an AI call. The FCC has ruled there are no magic words required. Your AI must recognize phrases like "stop calling me," "take me off your list," "don't call again," and similar natural language variations. Once revoked, all automated contact must cease immediately. Log the revocation with a timestamp and audio reference.
Regulation F: Frequency Limits & Electronic Rules
The CFPB's Regulation F modernized the FDCPA for digital communication and established concrete call frequency limits. These rules directly constrain AI voice agent behavior.
Powered by leading AI infrastructure
Powered by industry-leading technology
“No Exceptions for New Technologies”
The Consumer Financial Protection Bureau has made its position unambiguous: AI-powered debt collection must comply with every existing consumer protection law. There is no innovation exception, no technology safe harbor, and no grace period for novel approaches.
In its 2023-2024 guidance, the CFPB specifically addressed AI in financial services, stating that companies are responsible for the actions of their AI systems just as they would be for human employees. If your AI violates the FDCPA, your company violated the FDCPA. If your AI makes a TCPA-noncompliant call, the statutory damages apply to your company.
The Bureau has also targeted “dark patterns” in AI communications - systems designed to confuse consumers about their rights, pressure them into payments, or obscure required disclosures. AI that speaks too fast during the Mini-Miranda, buries opt-out language, or fails to recognize cease-and-desist requests is a CFPB enforcement target.
Key takeaway for AI deployers:
Your AI vendor's compliance claims are not your shield. The CFPB holds the deploying company responsible. You must independently verify that your AI voice agent complies with FDCPA, TCPA, Regulation F, and all applicable state laws before making a single call.
How to Configure AI Voice Agents for Compliance
Six systems your AI platform must implement before making a single collection call. If any is missing, you are not ready to deploy.
Timezone-Aware Calling Engine
Map every consumer phone number to a time zone using area code databases and carrier lookups. Enforce 8 AM - 9 PM windows in the consumer's local time. Account for daylight saving transitions. Block calls automatically outside permitted hours - no manual override possible.
Real-Time DNC Scrubbing
Integrate the Federal DNC Registry (refreshed every 31 days), state-specific DNC lists, and your internal suppression list. Check every number against all lists before the AI dials. Implement webhook-based updates for internal DNC additions - zero latency between consumer request and suppression.
Consent Management Platform
Track consent status per consumer, per channel, per debt. Record how consent was obtained (written, verbal, web form), when, and the exact language used. Support instant revocation through any channel. Maintain audit-ready consent records with immutable timestamps.
Call Recording & Disclosure
Record every AI call for compliance and quality purposes. Implement call recording disclosure at the start of each call - required in all-party consent states (California, Florida, Illinois, and 8 others). Store recordings encrypted with role-based access. Retain per your document retention policy (typically 3-7 years for debt collection).
Frequency Cap Enforcement
Track every contact attempt - calls, voicemails, emails, texts - at the per-debt level. Enforce Regulation F's 7-in-7 rule automatically. After a live conversation, block further calls for 7 days on that debt. Aggregate cross-channel contacts to avoid harassment presumptions.
Complete Audit Trail
Log every AI decision: when the call was attempted, what disclosures were made, what the consumer said, how the AI responded, and the outcome. Store call transcripts, recordings, consent records, and DNC checks in a single queryable system. This is your defense in any TCPA or FDCPA lawsuit.
State-Level Regulations Snapshot
Federal law is the floor, not the ceiling. These four states illustrate how state regulations add layers of complexity that your AI must handle per-jurisdiction.
Why European-Built AI Is Inherently More Privacy-Forward
US Approach
EU Approach (GDPR + EU AI Act)
AI systems built under GDPR and the EU AI Act come with consent management, data minimization, audit trails, human oversight, and mandatory transparency as foundational architecture - not afterthought features. When deployed in the US market, these systems naturally satisfy most FDCPA and TCPA requirements because the European standard is higher.
Related Resources
Frequently Asked Questions
Common questions about FDCPA, TCPA, and Regulation F compliance for AI voice agents.
Jessica·EnglishClick to start a conversation
Deploy Compliant AI Collections With Confidence
Built under GDPR and the EU AI Act - the strictest privacy frameworks in the world. When you deploy AInora for US debt collection, FDCPA and TCPA compliance is not an add-on. It is the architecture.
Founder & CEO, AInora
Building AI digital administrators that replace front-desk overhead for service businesses across Europe. Previously built voice AI systems for dental clinics, hotels, and restaurants.
View all articles