Can an AI Voice Agent Make Outbound Calls in the UK? PECR, TPS and Consent Explained

What does this guide cover, and what does it not?

General information, not legal advice. This guide explains the UK rules that apply when a business uses an AI voice agent to make outbound calls. Every point links to the Information Commissioner's Office (ICO) or Ofcom page it comes from, and each was checked on 15 October 2026. The ICO says its PECR guidance is under review following the Data (Use and Access) Act, so check the linked pages before you rely on any point, and take legal advice for your own campaign.

Two sets of rules matter most. The Privacy and Electronic Communications Regulations (PECR), enforced by the ICO, govern marketing calls. Ofcom's persistent misuse powers cover the way calls are made, including silent and abandoned calls. UK GDPR applies to the personal data involved in either case.

Is it legal to use an AI voice agent for outbound calls in the UK?

Yes, but what you may do depends on the purpose of the call and who you are calling. A call that only deals with an existing appointment, order or account is treated very differently from a call that promotes something. The table summarises how the rules apply; the sections below explain each one with its source.

Is your call a service call or a marketing call?

The ICO's guidance on identifying direct marketing describes service messages as messages that are not promotional but are for administrative or customer service purposes, such as confirming an appointment or updating terms. PECR does not stop you sending them.

The line is crossed easily. The ICO says that if a message includes promotional content, it counts as direct marketing even if that is not its main purpose. Its own example is a gym calling about a failed payment that also promotes personal training. A neutral tone does not by itself keep a message out of marketing.

For a voice agent, that means the script matters. An agent that confirms appointments is doing a service job. The same agent adding "while I have you, can I tell you about our new plan" is making a marketing call, and the marketing rules then apply to every call it makes that way.

Does an AI voice call count as a live call or an automated call?

This matters because PECR treats the two very differently. The ICO's guidance on live marketing calls defines a live call as one where a live person is speaking to the person they are calling, and describes automated calls as those made by an automated dialling system that plays a recorded message.

An AI voice agent sits awkwardly between those definitions. It does not play a fixed recording, but no live person is speaking either. The ICO pages we checked do not address AI voice agents directly. The cautious reading, and the one we design to, is that an AI marketing call should be treated as an automated call, because nobody is on the line. If your plan depends on treating AI calls as live calls, take legal advice first.

What consent do you need for automated marketing calls?

The ICO's telephone marketing guidance says you must not make an automated marketing call unless the person has specifically consented to receive this type of call from you. General consent to marketing is not enough, and nor is consent to live calls: the consent must specifically cover automated calls.

In practice that means:

• The consent names your business and covers automated calls, not just "marketing".
• You keep a record of when and how each person gave it.
• You stop calling as soon as someone withdraws consent.
• A bought-in list described as "consented" is only usable if that consent is valid for your automated calls, which is rarely the case.

Calling businesses does not change this. The ICO's section on marketing calls to businesses opens by saying the rules are the same as for calls to individuals, so treat an automated call to a company the same way as one to a consumer.

How do the TPS and CTPS apply?

The Telephone Preference Service (TPS) and Corporate TPS (CTPS) are the registers people and organisations join to opt out of unsolicited live marketing calls. According to the ICO's telephone marketing guidance:

• You must not make live marketing calls to a number registered with the TPS or CTPS unless the person has specifically consented to your calls, even if they are an existing customer.
• You must not call anyone who has told you they do not want your calls.
• Sole traders and some partnerships register with the TPS; companies and other corporate bodies register with the CTPS. For calls to businesses you need to screen against both.

The ICO's guidance on complying with the live call rules adds that it can take 28 days for a TPS or CTPS registration to become active, so a list screened more than 28 days ago may be out of date. It also says you should keep your own do-not-call list and check against it, and that a number appearing in a directory does not override a TPS registration.

For automated calls, TPS screening is not the main safeguard. Specific consent is required whether or not the number is registered. Screening still makes sense as a second check.

What must every outbound call say and show?

The ICO's telephone marketing guidance sets out what marketing calls must include:

• Who is calling. On live calls you must always say who is calling and give a contact address or freephone number if asked.
• Automated calls. All automated calls must include your name and a contact address or freephone number.
• Caller ID. You must allow your number, or an alternative contact number, to be displayed to the person receiving the call.

Ofcom's persistent misuse statement of policy goes further on caller ID. It lists as misuse withholding the caller ID on marketing calls, showing a number that is not authentic or valid, and showing a number that does not connect to an agent or an automated message when called back.

Separately from PECR, we recommend every AI voice agent says at the start that it is an AI assistant. The ICO pages above do not require that wording, but telling people how their information is collected is part of UK GDPR transparency, and callers who discover it later tend to feel misled.

What does Ofcom's persistent misuse policy mean for AI calling?

Ofcom can act against anyone who persistently misuses a phone network or service in a way that causes unnecessary annoyance, inconvenience or anxiety. Its statement of policy, which has applied since 1 March 2017, says it can impose penalties of up to £2 million. Silent and abandoned calls are its main examples. The points most relevant to a voice agent are:

• Silent calls. A call where the recipient hears nothing is treated as misuse where it is caused by something within the caller's control, including the calling technology. A voice agent that is slow to speak when the call is answered, or that drops the call, can create exactly that.
• Answer machine detection. Ofcom notes that this technology can cause silent calls by mistaking a person for an answer machine and disconnecting.
• Information messages. Where a call is abandoned, Ofcom expects a message that identifies who the call was made for, explains they tried to make contact, gives a basic rate number to call to decline further calls, and contains no marketing. It may consider whether that message plays within two seconds.
• Ringing time. Calls ended in under 15 seconds of ringing, or left ringing for very long periods, are more likely to face enforcement.
• Repeat calls. Repeating a silent or abandoned call to the same number within 72 hours, without a guaranteed live agent, is likely to be treated as aggravating.
• Time of day. Misuse at unsociable hours is treated as more harmful. Ofcom does not set those hours, but gives ringing for marketing in the middle of the night as an obvious example.

How does UK GDPR apply to AI calls?

An AI call collects personal data: the number dialled, what the person says and often a recording or transcript. You need a lawful basis for the call and for what you do with the conversation, a privacy notice that covers it, retention rules for recordings and transcripts, and agreements with the telephony and AI providers who process the data for you. The ICO's guidance on AI and data protection covers the AI-specific points.

How do we build outbound voice agents to these rules?

We build custom AI voice agents for UK businesses, inbound and outbound. For outbound work the checks are designed in from the start, so they do not depend on someone remembering them:

• Calls are only placed to numbers that pass your consent records, TPS and CTPS screening where relevant, and your do-not-call list.
• The opening line names your business and says it is an AI assistant.
• Calls show a number that is answered or plays a message when called back.
• Opt-outs said during a call are recorded and stop further calls.
• Calling hours are set by you, and the agent is tuned to speak promptly when a call connects.
• New campaigns start on a small, consented list before any wider rollout.

We do not build cold calling to bought-in lists without consent. A voice agent starts from £3,000 to set up, with optional support from £300 a month, excluding VAT; call minutes, numbers and AI usage are extra. Responsibility for the campaign stays with the business making the calls, so we recommend legal advice on your consent wording. If you only need incoming calls answered, an AI receptionist is simpler. To see where AI could help across your business, start with a free AI automation audit or browse our AI services.

What should you check before the first outbound campaign?

1. Write down the purpose of each call type and whether any part of it promotes something.
2. For any marketing call, confirm you hold specific consent to automated calls from your business, with a record of it.
3. Screen live-call lists against the TPS and CTPS, recently, and against your own do-not-call list.
4. Check the caller ID number is valid and is answered, or plays a message, when called back.
5. Script an opening that names your business and says the caller is an AI assistant.
6. Test the start of the call for silence, and the handling of answer machines.
7. Set calling hours and limits on repeat attempts.
8. Update your privacy notice and agree data processing terms with every provider involved.
9. Take legal advice on anything you are unsure about.