Independent: no vendor pays for coverage · Checked against legislation.gov.uk and ico.org.uk · Not legal advice · AI-assisted research, human-checked · How we test · Edited by Annie Vane
Using AI to make sales calls in the UK is legal only in narrow cases. Under the Privacy and Electronic Communications Regulations (PECR), automated marketing calls that play "sounds which are not live speech" need the person's prior consent, and that applies to business numbers as well as consumers. Live calls by a person are allowed unless the number is on the TPS or Corporate TPS or has objected. An AI voice that holds a conversation sits between the two, and the ICO hasn't said which side it falls on, so the careful assumption is that it needs consent. Since 5 February 2026 the maximum PECR fine is £17.5 million or 4 per cent of worldwide turnover.
Last checked: 31 October 2026 · Written by Annie Vane, editor · Evidence: Documentation review + worked example
Prepared with AI assistance for research and drafting; every legal reference and date was checked by me before publishing. How we test
Key facts
- Automated calls (PECR regulation 19): prior consent needed, for individuals and businesses.
- Live calls (regulation 21): allowed unless the number has been on the TPS or CTPS for 28 days or more, or the person told you not to call.
- Every call: say who is calling and show a number people can call back.
- AI voice agents: no ICO guidance deals with them directly (as of 31 October 2026). The ICO has fined firms for "avatar" calls, recorded lines played by agents, treating them as automated.
- Fines: up to £17.5m or 4 per cent of global turnover, for breaches on or after 5 February 2026 (Data (Use and Access) Act 2025).
- Inbound is different: an AI receptionist answering calls to you isn't marketing. See AI receptionists in the UK.
Live vs automated calls under PECR
PECR has two very different rules for phone marketing.
| Live call (reg. 21) | Automated call (reg. 19) | |
|---|---|---|
| What it is | A real person speaking to the person called | An automated calling system playing sounds that aren't live speech |
| Consent needed? | No, unless they're on TPS/CTPS or have objected | Yes, prior consent specifically to automated marketing calls from you |
| Applies to businesses? | Yes: screen against CTPS (companies) and TPS (sole traders, most partnerships) | Yes, business numbers too |
| Must identify yourself? | Yes, and give an address or freephone number if asked | Yes, name and an address or freephone number |
The ICO describes a live call as one "where a live person is speaking to the person they are calling". That definition is the problem for AI.
Where does an AI voice agent fit?
An AI agent that listens and replies in real time isn't a recording played at someone. But it isn't a live person either. As of 31 October 2026 I could find no ICO guidance that deals specifically with AI or synthetic voices in marketing calls.
What is known: in September 2025 the ICO fined two energy firms a combined £550,000 (Green Spark Energy £250,000; Home Improvement Marketing £300,000) for "avatar" calls, where call-centre staff played pre-recorded voice-actor lines. The ICO treated them as automated calls that needed consent, and used the case to warn about "robo calls". If recorded lines played by a human count as automated, a fully synthetic voice is unlikely to get gentler treatment.
The practical reading: treat an outbound AI voice agent as an automated call and get prior consent, unless a lawyer advising on your specific campaign tells you otherwise. The lack of AI-specific guidance isn't an exemption.
Consent for B2C and B2B calls
For automated calls, consent must be specific (to automated marketing calls), from you (not "selected partners"), freely given and recorded. A ticked box in your terms won't do. B2B is no easier: PECR's automated-call rule covers corporate subscribers too, so buying a list of company phone numbers doesn't help.
Worked example: consent wording (adapt, don't copy blindly)
☐ Yes, [Company] may call me on the number above with automated or AI-voice calls about [specific products or services]. I can say "stop" on any call, or tell you at [email/phone], and you'll stop straight away.
Keep a record of who agreed, when, what wording they saw, and where (form URL or call recording). Refresh consent if you change what you're calling about.
TPS and CTPS: the duty that catches people out
Even for live calls, you must screen every UK number against the Telephone Preference Service and the Corporate TPS, and keep your own do-not-call list. A number that's been registered for 28 days or more is off limits unless that person has told you specifically that they're happy to be called. Failing to screen is a common reason firms get fined for live calls.
Should an AI caller say it's AI?
No UK law yet requires a marketing call to announce that the voice is AI. But PECR requires you to say who is calling. Pretending to be a person when someone asks could also be a misleading practice under consumer protection law (the Digital Markets, Competition and Consumers Act 2024). The simple rule: name the company at the start and answer honestly if asked "am I talking to a real person?". Ofcom also expects callers to show a valid, diallable caller ID and treats repeated silent or abandoned calls as persistent misuse.
What it costs to get it wrong
From 5 February 2026, the Data (Use and Access) Act 2025 raised PECR's maximum fine from £500,000 to £17.5 million or 4 per cent of worldwide annual turnover, whichever is higher. Some older ICO pages still quote £500,000. The legislation applies. Since 30 September 2026 the regulator is formally the Information Commission, still known as the ICO.
Checklist: a lawful AI calling set-up
- Decide: outbound marketing or inbound service? Inbound isn't PECR marketing.
- For outbound AI voice: get prior, specific, recorded consent to automated calls.
- Screen every number against TPS and CTPS and your own suppression list before each campaign.
- Show a caller ID people can ring back. Say the company name at the start.
- Honour "stop" immediately, on every channel.
- Log where each number came from, when consent was given and when it was screened.
- Cover the AI in your privacy notice and, if it records or analyses calls, your DPIA (free template).
- Get legal advice on regulation 19 for your own campaign before switching on.
Frequently asked questions
Can I use AI to cold call businesses in the UK?
Only with prior consent if it counts as an automated call, and the ICO hasn't confirmed AI voices are anything else. Live human calls to businesses are allowed if you screen against the CTPS and TPS.
Is AI cold calling the same as robocalling?
Legally, possibly. PECR's automated-call rule covers "sounds which are not live speech". The ICO has treated recorded lines played by agents as automated, and hasn't said a synthetic voice is different.
What's the fine for illegal marketing calls in the UK?
Up to £17.5 million or 4 per cent of worldwide turnover for breaches from 5 February 2026.
Does PECR apply to AI emails and texts too?
Yes, with different rules: consumers usually need consent or a "soft opt-in"; limited companies can be emailed without consent if you identify yourself and offer an opt-out. See our UK GDPR guide.
Sources
- PECR 2003, regulations 19, 21 and 24, legislation.gov.uk (read 31 October 2026)
- The Data (Use and Access) Act 2025 (Commencement No. 6) Regulations 2026, SI 2026/82
- ICO, "Warning over robo calls as energy firms fined half a million pounds for unlawful marketing calls" (September 2025), ico.org.uk
- ICO guidance on live and automated marketing calls, ico.org.uk
- Related: ICO AI guidance tracker · UK AI enforcement tracker
This page explains UK law and regulator guidance in plain English, checked against legislation.gov.uk and ico.org.uk on 31 October 2026. It is general information, not legal advice, and the law may have changed since. Whether your campaign is lawful depends on who you call, where your list came from and what you say: for a decision that matters, speak to a solicitor. Spotted something out of date? Tell me.
