FCC declares AI-generated robocall voices fall under the TCPA

The Federal Communications Commission issued a Declaratory Ruling confirming that AI-generated voices used in robocalls count as an artificial or prerecorded voice under the Telephone Consumer Protection Act. The Commission announced the ruling on February 8, 2024, by unanimous vote.

What it is

This is a Declaratory Ruling in CG Docket No. 23-362, the FCC's proceeding on AI technologies and robocalls, issued by unanimous vote of the Commission. It followed a Notice of Inquiry the FCC released on November 16, 2023 seeking comment on how AI affects robocall rules. The ruling took effect immediately upon release.

What it requires

The ruling states that voice cloning and similar AI technologies fall within the TCPA's existing prohibition on artificial or prerecorded voice messages because they artificially simulate a human voice. Callers using such technologies must obtain the prior express consent of the called party before initiating a call, absent an emergency purpose or exemption. The Commission's rules also require identification and disclosure information about the entity responsible for the call, and specified opt-out methods when the message includes an advertisement or telemarketing. The Commission said this applies to any AI technology that initiates an outbound call using an artificial or prerecorded voice, whether the voice wholly simulates an artificial voice or resembles a real person taken from an audio clip. A law firm analysis noted the ruling itself does not make AI voice calls illegal outright, but places them under the TCPA's existing framework of consent, disclosure and opt-out requirements.

What security leaders should do

Security and compliance teams at any organization that places automated outbound voice calls should confirm whether AI-generated or cloned voices are involved and treat those calls as subject to the TCPA's consent, identification, disclosure and opt-out rules. Given the ruling gives state enforcement new tools against voice-cloning scams, teams should also treat inbound AI-voice-cloning fraud as a heightened threat vector and update employee awareness programs, verification procedures for urgent financial or family-emergency requests, and vendor contracts for any telephony or contact-center AI tools.