Is AI follow-up legal? The contractor's TCPA guide

Yes — with the right consent and the right guardrails. Nothing in federal law bans AI agents from following up with your leads. What the law regulates is how the contact happens: what consent you captured, when you call, whether the number is on a Do Not Call list, and how you handle opt-outs. Contractors get in trouble not because they used AI, but because they texted a list without documented consent or kept dialing after someone said stop. Build for the rules and AI follow-up is as legal as a phone call from your office.

For marketing calls and texts made with an autodialer, artificial voice, or prerecorded message, the TCPA standard is prior express written consent: a signed, written agreement (electronic counts under the E-SIGN Act) in which the homeowner agrees to receive those calls and texts from your company at the number they provided. Capture it at lead opt-in and keep the receipts — the timestamp, the IP address, and the exact language they agreed to. Scope matters too: if the consent language covers follow-up after the appointment, scheduling, install updates, and referral asks, you never have to interrupt a live deal to re-ask permission.

Yes, explicitly. In February 2024 the FCC issued a declaratory ruling that AI-generated voices count as "artificial or prerecorded voice" under the TCPA. That means an AI voice call sits in the most regulated category of outbound contact: prior express written consent for marketing, required identity disclosures on the call, and an automated opt-out mechanism. Treat every AI voice call like the law's strictest case, because it is.

Disclose it. The FCC's 2024 ruling pulls AI voice under the prerecorded-call disclosure rules — the call must identify who's calling — and several states have their own bot-disclosure laws. Beyond the legal floor, it's the right trade: homeowners who feel tricked hang up and report; homeowners who hear "this is the AI assistant from [your company] about your roof estimate" mostly just keep talking about the roof. Honesty costs nothing and a deception complaint costs plenty.

Marketing calls to numbers on the National Do Not Call Registry are off-limits unless you have the homeowner's prior express written consent or an established business relationship — and the safe operating rule is simpler: scrub every number against the national registry and your own internal DNC list before every outbound contact, not just once at import. Your internal list matters as much as the national one: anyone who has asked you to stop must stay stopped, forever, across every channel.

The federal telemarketing window is 8am to 9pm in the homeowner's local time — the called party's time zone, not your office's. Several states draw the window tighter or add their own telemarketing rules on top (Florida, Oklahoma, Washington, and Texas among them), so a system working leads across markets needs per-homeowner timezone handling, not one company-wide clock. This is a place software should be strict for you: the correct behavior is that an 8:47pm text in the homeowner's timezone simply cannot be sent at 9:13.

Every channel stops, immediately. The FCC's revocation rules let consumers revoke consent by any reasonable means — not just the literal word STOP — and require honoring revocations promptly, with a hard outer limit measured in business days. The right engineering target is instant: "don't text me anymore," "take me off your list," "quit calling" all count, and a revocation heard on a phone call stops the texts and emails too. A system that only recognizes the exact keyword STOP is a lawsuit generator.

All of them. For every contact: who was contacted, when, on which channel, from which number, and what was said (recordings and transcripts for voice). For every consent: the timestamp, IP, and exact opt-in language. For every opt-out: when it came in and when it took effect. TCPA cases are won and lost on documentation — the company that can produce a complete audit trail for any phone number on demand settles from strength or doesn't get sued at all.

The TCPA carries statutory damages of $500 per violating call or text, up to $1,500 for willful violations — per message, with no cap, and it's a favorite of class-action lawyers because every recipient of a bad campaign is a plaintiff. A single blast to a few thousand stale contacts can create seven-figure exposure. That math is why compliance can't be a setting someone remembers to turn on; it has to be the architecture.

Age isn't the legal issue — consent is. An unsold estimate from last quarter where you captured written consent covering post-appointment follow-up is fine to work. A five-year-old list with no consent records is not fine, no matter who does the dialing, human or AI. Before reactivating anything old, audit it: documented consent covering marketing texts and calls, a fresh DNC scrub (numbers get reassigned), and the discipline to drop every contact you can't prove. The unsold-estimate pile usually survives that audit; the ancient inquiry list usually doesn't.

We treat compliance as foundation, not a feature tier: consent scope captured at opt-in with timestamp, IP, and exact language; a DNC scrub before every single outbound contact; quiet hours enforced in the homeowner’s local time; opt-out on any stop language across every channel, instantly; AI disclosure on calls; and a full audit trail of every touch and every override. None of it is optional, on any plan, because one bad TCPA suit erases a year of rehash wins — ours or yours. See how the product works, or start with what is rehash? if the term is new.