Global compliance matrix

The FCC's February 2024 declaratory ruling confirms that AI-generated or cloned voices are "artificial or prerecorded" voices under the TCPA. Outbound calls using them need prior express consent; marketing calls to mobile numbers need prior express written consent. Inbound calls initiated by the consumer are outside this consent rule.

No federal statute yet requires an agent to announce that it is AI. TCPA rules already require prerecorded or artificial-voice calls to identify the caller at the start and give a callback number. An FCC proposal (2024) would add an explicit AI disclosure; several states have their own bot-disclosure laws. Disclose by default.

Telephone solicitations only between 8 a.m. and 9 p.m. in the called party's local time (47 CFR 64.1200(c)(1)).

Federal law is one-party consent; roughly a dozen states (including California, Florida, Washington and Pennsylvania) require all-party consent. Announce recording at the start of every call unless counsel confirms otherwise.

No general federal residency rule; sector rules (HIPAA, GLBA) govern safeguards rather than location.

Watch: FCC AI-disclosure rulemaking; state bot-disclosure and recording-consent laws.

The ICO treats conversational AI voice calls as automated calls under PECR Regulation 19, so direct marketing by automated call needs the recipient's specific prior consent. Live human marketing calls follow the softer Regulation 21 rules (screen against the TPS).

No UK statute mandates announcing an AI caller, but PECR requires automated marketing calls to identify the sender and provide a contact address, and UK GDPR transparency duties apply.

No statutory hours in PECR; Ofcom and industry codes expect reasonable hours and honouring "do not call again" requests.

Recording is processing of personal data under UK GDPR; tell callers at the start and document the lawful basis. Financial firms have additional FCA recording duties.

Transfers outside the UK need an adequacy decision or appropriate safeguards; UK-hosted processing is a common procurement requirement rather than a legal one.

Watch: ICO direct-marketing guidance updates following the Data (Use and Access) Act 2025.

Automated calling systems without human intervention for direct marketing need prior consent under the ePrivacy Directive (Art. 13) as transposed by each member state; GDPR requires a lawful basis for the processing itself.

EU AI Act Article 50 requires that people interacting with an AI system are informed they are doing so unless it is obvious. Transparency obligations apply from 2 August 2026. Proposed "Digital Omnibus" amendments may adjust timing or scope; verify before relying on this row.

Set by member-state law and codes (for example, national telemarketing hour rules); no EU-wide statutory window.

Recording needs a GDPR lawful basis and transparent notice at the start; several member states require all-party consent.

Personal data may leave the EU only with an adequacy decision or appropriate safeguards; many public and regulated buyers require EU hosting as a procurement condition.

Watch: Digital Omnibus amendments to AI Act timelines; member-state AI Act enforcement bodies.

Commercial communication is governed by TRAI's TCCCPR framework: senders and telemarketers register on the Distributed Ledger Technology (DLT) platform, promotional calls go out on the 140-number series and transactional or service calls on the 1600 series, and recipients' DND preferences must be scrubbed. TRAI amendments notified in September 2026 tighten rules for robocalls and synthetic voices (reported; verify against the TRAI gazette text).

A draft TRAI requirement to declare AI or synthetic voice at the start of a call has been reported; treat disclosure as required by default.

Promotional calls only between 9 a.m. and 9 p.m. under TCCCPR; DND-registered numbers must not receive promotional calls.

No standalone all-party consent statute; the DPDP Act treats voice recordings as personal data requiring notice and a lawful purpose.

The DPDP Act permits transfers except to countries the government restricts; RBI directions require payment-system data to be stored in India, and regulated banks and lenders commonly demand in-country or on-premises deployment.

Watch: TRAI September 2026 amendment text and enforcement dates; DPDP Rules notification schedule.

The Data Privacy Act of 2012 requires a lawful basis (usually consent or legitimate interest) for processing; the National Privacy Commission expects clear notice for marketing calls.

No statute requires announcing an AI caller. Announcing it is recommended and expected by the NPC's transparency principle.

No statutory window; BSP consumer-protection rules for financial institutions prohibit harassment and unreasonable hours in collections.

The Anti-Wiretapping Act (RA 4200) makes recording a private communication without the consent of all parties a crime; announce and obtain consent at the start of every call.

No localisation mandate; cross-border transfers are permitted with accountability under the DPA. BSP-supervised institutions face outsourcing and cloud rules.

Watch: NPC guidance on AI and automated decision-making; proposed AI regulation bills in Congress.

Telemarketing voice calls to Singapore numbers must be checked against the Do Not Call Registry unless the organisation has clear and unambiguous consent (PDPA Part 9).

No statutory AI-caller disclosure; the PDPC's Model AI Governance Framework recommends transparency.

No statutory hours; PDPC guidance and industry codes expect reasonable hours.

Recording is personal-data collection under the PDPA and requires notification of purpose; no all-party consent statute.

Transfers abroad require comparable protection (PDPA Transfer Limitation Obligation); MAS outsourcing guidelines apply to financial institutions.

Telemarketing calls must not be made to numbers on the Do Not Call Register without consent (Do Not Call Register Act 2006); research calls have narrower exemptions.

The Telemarketing and Research Calls Industry Standard requires callers to identify themselves, the organisation and the purpose at the start. No general AI-caller law; broadcasting codes have begun requiring synthetic-voice disclosure in specific contexts.

Telemarketing calls only Monday to Friday 9 a.m. to 8 p.m. and Saturday 9 a.m. to 5 p.m. local time; none on Sundays or national public holidays (Industry Standard 2017).

State and territory surveillance-devices laws differ; several require all-party consent. Announce recording at the start.

The Privacy Act 1988 (APP 8) regulates overseas disclosure rather than mandating local storage; many buyers still specify onshore hosting.

Watch: Privacy Act reform tranches; ACMA guidance on synthetic voices.

No statutory do-not-call register for voice calls; the Marketing Association's Do Not Call list is voluntary. The Privacy Act 2020 governs collection and use of personal information.

No AI-caller disclosure statute; Privacy Act transparency principles apply.

Industry code expectations only.

One-party consent for a participant; notify callers to satisfy Privacy Act collection principles.

Overseas disclosure requires comparable safeguards (IPP 12); no localisation mandate.

The Act on Specified Commercial Transactions regulates telemarketing: the caller must state the business name, the person's name and the purpose up front, and must not re-solicit after a refusal. No general opt-in register.

No AI-caller disclosure statute; identification duties above apply regardless of who or what is speaking.

No statutory hours; industry guidance discourages early-morning and late-evening calls.

Recordings are personal information under the APPI; specify the purpose of use and notify the caller.

APPI requires informing individuals about the destination country and its safeguards for cross-border transfers; many enterprises require domestic hosting and a "no training on customer data" clause.