Your AI SDR Is a TCPA Nightmare

Let me get the disclaimer out of the way first, because this is the one article where it actually matters: I am not a lawyer. Nothing here is legal advice. This is a software guy who builds AI calling agents for a living reading a government ruling and getting a little nervous on your behalf. Talk to an actual attorney before you point a robot at a phone list.

Okay. Now let me tell you why I'm nervous.

The ruling everybody selling you an AI SDR forgot to mention

In February 2024 the FCC issued a declaratory ruling, FCC 24-17, and the headline is one sentence long: an AI-generated voice counts as an "artificial or prerecorded voice" under the Telephone Consumer Protection Act.

Translation for humans: if your AI calls somebody, the law treats it exactly like a robocall. Same rules, same consent requirements, same penalties.

That matters because a whole industry sprang up in the last two years selling "AI SDRs." If you don't know the term, an SDR is a sales development rep, the person whose job is to cold call and book meetings. An AI SDR is a voice agent that does that job instead. And the pitch, which I've seen in a hundred ads, is some version of "our AI cold-calling team will replace your sales reps."

Which sounds great right up until you read the statute. And here's the thing that should bother you before we even get to the law: in two years of watching those ads, I have never once seen the words "prior express written consent" in any of them. Not in the landing page. Not in the demo. Not in the onboarding. A product whose entire function is regulated, sold by people who never mention the regulation.

That's not an oversight. That's the business model.

TCPA in plain English

The Telephone Consumer Protection Act is a 1991 law that exists because people were sick of robocalls. Here's the part you need:

• If you're making a telemarketing call to a cell phone using an autodialer or an artificial or prerecorded voice, you need the person's prior express written consent. Not "they're on a list I bought." Not "they visited my website once." Written consent, on record, that they agreed to get calls like this from you specifically.
• Prerecorded and artificial voice calls also have disclosure rules. The message has to identify who's calling at the start, give a callback number, and offer a way to opt out.
• If you break it, the statutory damages are $500 per call. If a court finds you did it willfully or knowingly, that gets tripled to $1,500 per call.

Now the part that should make you sit up. Those damages are per call, and there is no cap. It's not "up to $1,500." It's $1,500, times however many calls you made, forever. An AI dialer that rips through 5,000 numbers in an afternoon has just generated up to $7.5 million in exposure before lunch. And the plaintiff's bar knows this. TCPA class actions are an entire cottage industry. There are law firms whose whole business model is waiting for you to do exactly this.

Worth noting who eats that. Not the vendor. You. You're the one whose brand is on the caller ID, whose business made the call, whose name is on the complaint. The platform that sold you the dialer has a terms-of-service page that says, in polite legal language, that compliance was always your problem. Go read it. It's in there. It's always in there.

Why "our AI will replace your cold callers" is a dangerous sentence

Here's the trap, and it's a two-parter.

Part one: most of these setups skip the disclosures. Go listen to a demo. Notice how it opens: "Hey, this is Jessica from Acme, do you have a quick second?" No mention that Jessica is software. No callback number. No opt-out. The whole product is designed to sound as human as possible, which means it's designed to fail the exact requirement the law imposes on artificial voices. The FCC ruling didn't create that problem. It just took away the excuse.

Part two: if you DO add the disclosures, the call dies anyway. Let's be honest with each other. If you pick up and hear "This call is recorded. This is an automated AI agent calling on behalf of Acme," what do you do? You hang up. Everyone hangs up. So the compliant version of the cold-call AI SDR is a product that legally announces itself and then gets hung up on, and the non-compliant version is a lawsuit with a countdown timer. There's no third door.

Sit with that for a second, because it's the tell. If the compliant version of your product doesn't work, you don't have a product. You have a demo.

The snake oil problem, which is bigger than this one law

I need to widen the lens here, because the TCPA thing isn't an isolated problem. It's a symptom. This industry has a snake oil problem, and it is worse than almost anyone selling into it will admit.

Here's the pattern. Somebody spins up a demo in a weekend. The UI is gorgeous. There's a little animated orb that pulses while the agent "thinks." There are badges, streaks, a progress ring, a dashboard with numbers going up and to the right. It is gamified and cute and it demos beautifully, because a demo is a controlled environment where nothing goes wrong and nobody asks what happens on call number four thousand.

And look, I like gamification. Genuinely. Done right it's great product design. That's not my complaint. My complaint is that the gamified front end has become a substitute for the unglamorous work underneath it, and buyers can't tell the difference because they're only ever shown the front.

Underneath a lot of these products there's no consent ledger. No opt-out handling that actually writes back to a database. No call recording retention policy. No audit trail for who agreed to what and when. No rate limiting, no do-not-call scrubbing, no state-level rules (several states have their own mini-TCPAs with their own damages, by the way). None of the boring, load-bearing plumbing that makes a calling system legal to operate at scale. Because none of that shows up in a thirty-second product video, and all of it takes months.

I get why it happens. Marketers chase the hot new thing, that's the job, and AI is the hottest thing any of us have seen in a decade. The incentive is to ship the flashy layer and let the customer discover the missing floor. But "I get why" and "it's fine" are different sentences.

And when it breaks, it doesn't break on the vendor. Their demo still works great. It breaks on the small business owner who trusted a slick deck, blasted a purchased list, and got a certified letter.

Who actually wins with this technology

Here's my real position, and it's less exciting than either side of this argument wants.

The people who win with AI are not going to be the ones with the flashiest gamified UI and the boldest replacement claim. They're going to be the ones who point AI at genuinely boring work so humans can spend their hours on the white glove treatment.

Concrete example. Somebody emails your support inbox asking a question that is answered verbatim in your FAQ, for the nine hundredth time this year. Let the AI answer that. Instantly, at 2am, perfectly, forever. That is a fantastic use of the technology and nobody's day is made worse by it.

Now the same inbox, different email: somebody wants to cancel their account. AI should absolutely not be handling that. That is a human moment. There's a reason they're leaving, that reason is worth more to your company than the ticket, and there is a real chance a person who cares can save the relationship. Hand a cancellation to a bot and you've automated away the single most informative conversation you'll have all month.

Same principle on the phone. Same principle everywhere. The dividing line is: is this tedious, or is this the relationship? Automate tedious. Never automate the relationship.

My honest prediction (which I reserve the right to eat)

This is one of my older calls and I'll say it plainly: I don't think AI voice agents fully replace human sales reps in the near future. I've been wrong before, I'll be wrong again, move fast and eat your words. But cold-blasting a purchased list with a robot is not where this technology wins, and it's definitely not where it wins after February 2024.

Where it does win is narrower, and a lot more useful.

Where an AI caller is actually worth the money

1. Database reactivation, on people who already said yes. You've got a CRM full of leads who filled out a form, asked for a quote, or bought something years ago and gave you written consent to be contacted. Those people went cold because you didn't have the hours to follow up, not because they said no. An AI agent working that list is a fantastic use of the tech. It's also the version where the consent question is already answered, assuming you actually recorded it.

Quick plug, and I mean this one: HyppoCRM, which is free, records consent per contact automatically. If somebody opts in through a form, the record is there. If they text STOP, it's there. That's not a feature we built because it was fun, and it will never be the thing that makes a demo pop. We built it because "we think they opted in" is not a sentence you want to say in a deposition. That's the boring plumbing I'm talking about. Ask whoever's pitching you whether they have it.

2. Backup for the form fill your team can't get to. Somebody submits a request on your website at 8pm. Your sales rep is asleep, or on another call, or it's Saturday. That lead has a shelf life measured in minutes. An AI agent that calls back within sixty seconds, confirms the details, and books a time with a human is doing exactly the job it should be doing: catching the thing that would otherwise leak. And because the person just asked you to contact them, you're in a very different consent posture than a cold list.

That second one is the whole philosophy I laid out in Where to Plug AI Into Your Business (and Where Not To). AI kills the tedious manual work so the human can spend their time on the white-glove part.

The cabinet shop version

My client Shane runs a cabinet shop. When we started with him he was doing around $700K a year. He's on pace for $1.3 million now. Part of that is an AI receptionist that catches the after-hours calls his ads generate, grabs the caller's details, and hands them to Shane to follow up personally.

Notice what it did not do. It did not replace Shane. It didn't cold call a single stranger. It answered the phone when he couldn't, on calls people made to him, and then got out of the way so the human could close a $40,000 kitchen. Zero TCPA exposure, because nobody got an unsolicited robocall. Real revenue, because nobody's lead leaked at 8pm.

There is no pulsing orb in that story. Nobody earned a badge. It's an extremely boring piece of software doing an extremely boring job, and it's worth several hundred thousand dollars a year. That's what winning actually looks like, and it's why it never goes viral.

The short version

Not a lawyer. But here's what I'd tell a friend:

1. As of FCC 24-17, an AI voice on a phone call is a robocall. Full stop.
2. Robocall telemarketing to cell phones needs prior express written consent, plus disclosures. No list-buying shortcut exists.
3. Violations run $500 to $1,500 per call, uncapped, and the liability lands on you, not the vendor.
4. So anyone selling you "AI cold callers to replace your reps" is either non-compliant or selling a product that gets hung up on. Ask them which. Watch what they say.
5. Judge these tools by their plumbing, not their UI. Consent records, opt-out handling, DNC scrubbing, audit trail. If the demo can't show you those, the product doesn't have them.
6. Use the tech where it actually belongs: the boring stuff. Reactivating people who already consented, catching inbound leads your humans can't reach in time, answering the FAQ for the nine hundredth time. Never the cancellation, never the complaint, never the close.

The robot is great at answering the phone. Be very careful about letting it pick the phone up first.