State-by-State Guide to AI Calling Laws (2026)

Running outbound phone campaigns in the United States means navigating two layers of law simultaneously: federal rules under the TCPA and state-specific requirements that often go further. The most consequential state-level variations are recording consent requirements, separate state DNC registries, and — increasingly — AI-specific disclosure mandates. This guide covers all of them.

This is a reference document, not legal advice. Laws change. Before deploying any outbound calling program at scale, consult legal counsel familiar with telecommunications law in your target states.

The federal baseline

The Telephone Consumer Protection Act (TCPA) establishes the national floor for outbound calling. The core requirements that apply to every dial regardless of state:

• No calls before 8 AM or after 9 PM in the recipient's local time zone — not yours
• All numbers must be scrubbed against the National Do Not Call Registry before dialing
• AI-generated calls must disclose the artificial nature of the voice at the start of the call
• Any call recipient who requests removal must be added to your internal DNC list within 30 days and never re-dialed
• Calls to cellular numbers using an automated dialing system require prior express written consent

For a full breakdown of TCPA requirements and how they apply to AI calling specifically, see the TCPA compliance guide for AI outbound calls.

Recording consent: one-party vs. all-party states

Federal law (the Electronic Communications Privacy Act) requires consent from at least one party to a call before recording — meaning in federal law, the person doing the recording can be the consenting party and no disclosure is required. Most states follow this one-party standard. Twelve states do not.

In all-party (also called two-party) consent states, every participant must consent before a call is recorded. In practice for outbound calling, this means a recorded disclosure must play before any substantive conversation begins. The disclosure cannot be buried at the end or delivered after the conversation starts.

All-party consent states — full list

The remaining 38 states and the District of Columbia follow the federal one-party consent standard. If you are calling only into those states, a recording disclosure is not legally required — though including one is considered best practice and builds caller trust.

State DNC registries

The National Do Not Call Registry covers all states. Scrubbing against it is required for every outbound campaign. However, several states maintain separate registries that must be checked in addition to the federal list. Calling a number on a state DNC list while complying with the federal list is not a defense in state court.

States with active separate DNC registries include Indiana, Colorado, Florida, Louisiana, Mississippi, Missouri, Oklahoma, Tennessee, Texas, and Wyoming, among others. The registry landscape changes — the most reliable source for current state DNC status is the attorney general's website for each state you're dialing into.

For any outbound program targeting multiple states, the safest posture is to run a dual scrub: federal registry plus a vendor that aggregates state registries. The marginal cost is low; the downside of missing a state list is not.

Calling hours — state variations

Federal TCPA sets 8 AM to 9 PM in the recipient's local time zone as the permitted window. Several states have enacted stricter windows:

Time zone gating must use the recipient's local time zone, not the caller's. If a number has a California area code but is physically located in Nevada, the Nevada time zone applies. In practice, reliable timezone gating uses the physical location of the number, not the area code — area codes no longer reliably indicate geography.

AI-specific requirements

Federal FCC rules require that AI-generated calls disclose the use of artificial intelligence at the start of the call — before any substantive content. Several states are moving toward their own AI disclosure requirements at the state level, and legislation is advancing in California, Illinois, and Texas specifically around AI voice agents used for commercial purposes.

The direction of state AI calling legislation is toward more disclosure, not less. Building AI disclosure into the first three seconds of every call is the correct long-term posture regardless of which states you're currently dialing into. Retrofitting disclosure language into an existing call flow is technically straightforward; retrofitting consent from people who were already called is not.

Illinois — the highest-risk state

Illinois deserves a separate note. It is the highest-risk state for AI outbound calling programs for two reasons that compound each other.

First, Illinois has the Biometric Information Privacy Act (BIPA), which regulates the collection of biometric identifiers including voiceprints. There is active litigation over whether AI voice analysis — scoring tone, sentiment, detecting emotion — constitutes biometric data collection under BIPA. No court has definitively resolved this as of mid-2026. Any AI calling program that captures voice characteristics beyond the transcript itself carries BIPA exposure in Illinois calls.

Second, Illinois allows individuals to sue under BIPA without demonstrating actual harm — statutory damages of $1,000 to $5,000 per violation. That class action exposure is why companies have paid nine-figure settlements on relatively small programs.

Practical posture for Illinois: apply all-party consent disclosure, do not collect or retain voice biometrics, and if your program involves any voice characteristic analysis (not just transcription), get Illinois-specific legal review before you dial.

California — the regulatory precedent state

California's combination of all-party consent, CCPA, and an aggressive AG enforcement posture means it sets compliance precedents that other states eventually follow. The CCPA applies to the contact data you're dialing — names, phone numbers, any associated data — if you're calling California residents. This means you must have a disclosed basis for processing that data, and consumers have the right to request deletion.

For outbound programs targeting California: all-party consent disclosure at call start, CCPA-compliant data handling for your contact lists, opt-out processing within 45 business days of request, and a clear record of where each contact's data came from.

The practical compliance checklist

• Scrub every list against the National DNC Registry before dialing — not once at import, but immediately before each batch
• Scrub against applicable state DNC registries for every state in your call list
• Apply all-party consent disclosure to every call — not just when you know you're in a two-party state
• Enforce calling hours using recipient timezone based on physical number location, not area code
• Include AI voice disclosure in the first three seconds of every call
• Process opt-out requests within 24 hours and never re-dial that number
• For Illinois calls: confirm you are not collecting or retaining voice biometrics
• For California calls: confirm your contact data has a CCPA-compliant source and handling process
• Maintain call logs and consent records for a minimum of four years

What's changing in 2026

The most significant regulatory movement in 2026 is at the state level. Florida passed a bill in early 2026 tightening AI disclosure requirements for telemarketing calls. California's legislature has multiple active bills addressing AI in commercial calling. The FCC's proceeding on AI-generated calls is ongoing, with further rulemaking expected in Q3–Q4 2026.

The practical implication: compliance postures built for 2024 rules may not be sufficient by the end of 2026. The trend is toward more disclosure, shorter opt-out windows, and explicit AI labeling — not less. Build for where the law is going, not where it was.

This guide will be updated as significant rulings or state legislation passes. Check the date at the top before relying on it for compliance decisions.