TCPA-compliant AI voice agents: the US operator checklist

Running AI voice agents in the US is not intrinsically risky, but there are 12 concrete things to have in place before you scale.

The checklist

1. Explicit call-recording consent — the AI agent must announce recording and processing at the start of every call. Required in "two-party consent" states (California, Florida, Illinois, and nine others). Callora does this automatically as the first line of every opening message.

1. TCPA compliance for outbound — no autodialing to mobile numbers without prior express written consent. Maintain an internal Do-Not-Call list and honor it in real time.

1. National DNC registry — scrub outbound lists against the FTC DNC registry every 31 days. Callora can gate outbound campaigns against your uploaded DNC list.

1. Data minimisation — do not extract or persist personal data you do not need. Configure the speech-analysis prompt to only extract required fields.

1. Right to erasure (CCPA / CPRA / VCDPA / CPA) — callers can request deletion. Callora exposes per-call and per-user delete endpoints.

1. State-level privacy laws — California, Virginia, Colorado, Connecticut, and Utah all impose data-subject rights. Callora exposes per-user delete and export endpoints.

1. HIPAA (healthcare) — sign a Business Associate Agreement with your voice-AI vendor and your telephony provider. Callora offers signed BAAs on Business.

1. PCI-DSS (payments) — if collecting payment information, offload to a PCI-compliant tokenisation flow. Do not have the agent read or repeat card numbers.

1. Retention policy — set a maximum retention. 30 to 90 days is typical. Longer requires stronger justification and stronger security.

1. Access controls — not every employee needs access to every call. Use role-based access.

1. Caller identification and authentication — for account-specific calls, do not rely on caller ID alone. Use knowledge-based authentication or a code sent via SMS.

1. AI disclosure (state laws emerging) — Utah, California, and Colorado now require AI disclosure at the start of certain calls. Callora automatically adds a disclosure line to opening messages when enabled.

What Callora handles for you - Automatic consent line in every opening message. - Per-call and per-user delete APIs. - Signed BAA available on Business. - Full sub-processor list in public docs. - Configurable retention (7 / 30 / 90 days). - DNC scrubbing on outbound campaigns (Pro and Business).

Read the platform docs or start a compliant deployment.