Quick answer: AI cold calling is not banned in the UK. Live marketing calls (PECR regulation 21) need no consent for most subjects if the number is screened against the TPS and CTPS and has not objected. Recorded-matter calls (regulation 19) need specific prior consent. No ruling or guidance we found decides whether AI speech is live, so the defensive course treats AI marketing calls as regulation 19. Maximum fine for calls made since 5 February 2026: £17.5m or 4% of an undertaking’s turnover, whichever is higher.
Is AI cold calling legal in the UK?
AI cold calling means an unsolicited marketing call in which the voice the recipient hears is produced by software, not by a person speaking. In the UK it is governed by the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), enforced by the Information Commissioner’s Office (ICO), with UK GDPR covering any personal data you use. The ICO notes that other regulators’ rules can also apply to marketing calls, for example the Financial Conduct Authority’s rules banning certain types of cold-calling. None of PECR regulations 2, 19, 21, 21A, 21B or 24 mentions artificial intelligence. What PECR does is split marketing calls into two regimes with very different entry conditions.
Most live marketing calls can be made without consent to numbers that are not on the Telephone Preference Service (TPS) or Corporate TPS (CTPS) and have not objected, with stricter rules for claims management and pensions; an automated call carrying recorded matter cannot be made to anyone who has not specifically agreed to receive that kind of call from you. Which side an AI voice agent sits on is not settled by any statute, guidance page or penalty notice we could find. For the multi-country picture (Spam Act, TCPA, GDPR), see our AI outreach compliance overview across Australia, the US and the UK; this page goes deep on UK voice only.
Regulation 19 vs regulation 21: the two rules, in their own words
Regulation 19 (automated calls). Regulation 19(1): “A person shall neither transmit, nor instigate the transmission of, communications comprising recorded matter for direct marketing purposes by means of an automated calling [or communication] system except in the circumstances referred to in paragraph (2).” Paragraph (2) has two limbs, both required: (a) the subscriber has previously notified the caller that for the time being they consent to such communications on that line; and (b) the caller does not prevent presentation of its calling line identity, or presents the identity of a line on which it can be contacted.
Regulation 19(4) defines an automated calling system as one “capable of— (a) automatically initiating a sequence of calls to more than one destination in accordance with instructions stored in that system; and (b) transmitting sounds which are not live speech for reception by persons at some or all of the destinations so called.” Both limbs are joined by “and”, the test is what the system is capable of, and regulation 19(1) separately requires “recorded matter”.
Regulation 21 (live calls). Regulation 21(1) bars unsolicited marketing calls where (a) the subscriber has previously told the caller not to call that line, or (b) the number is on the register kept under regulation 26, which is the TPS and CTPS. Regulation 21(3) excuses a number listed “for less than 28 days preceding that on which the call is made”. Regulation 21(4) and (5) let a registered subscriber tell a particular caller they do not object, and withdraw that at any time. Regulation 21(A1) applies to every marketing call, solicited or not: display your number, or present a line on which you can be contacted. Regulation 21(6) hands claims management services (regulation 21A) and pension schemes (regulation 21B) to stricter rules.
The ICO’s telephone marketing guidance states the practical difference: “General consent for marketing, or even consent for live calls, is not enough – it must specifically cover automated calls.” That page carries a banner saying it is under review following the Data (Use and Access) Act 2025.
Is AI-generated speech “live speech”? The open question
No primary source we read answers it. The PECR text does not, and the three ICO guidance pages cited here, read 24 September 2026, do not mention AI, synthesised speech or artificial voices (each saved page was checked against its own headings, so the fetches were real). The answer has to be reasoned from three textual hooks, each of which could go either way.
Hook one: “sounds which are not live speech” (regulation 19(4)(b)). An LLM-driven agent composes its words during the call, which argues “live”; no person is speaking, which argues not. The ICO’s live-calls guidance says PECR does not use the terminology of “live” calls (regulation 19(4)(b) does use the phrase “live speech”), that the ICO uses the term to distinguish “automated calls (ie those made by an automated dialling system that plays a recorded message)”, and that “A live call is therefore a telephone call where a live person is speaking to the person they are calling.” That sentence explains terminology rather than classifying AI, but it is the closest thing to a regulator’s definition, and an AI agent has no live person speaking.
Hook two: “recorded matter” (regulation 19(1)). Speech synthesised during the call is not a recording in the everyday sense, the strongest textual argument that a fully generative agent sits outside regulation 19. It weakens if any audio is prepared in advance (a fixed greeting replayed, pre-generated clips, a voicemail drop), which looks much more like the recorded clips in the Green Spark case below.
Hook three: “capable of” (regulation 19(4)). A platform that can dial a list from stored instructions and play non-live sounds may meet regulation 19(4) even on a call where a person pressed the dial button, so keeping a human on the button is a weak way out.
Practitioner commentary sees the same gap. Handley Gill, a UK legal and regulatory consultancy, wrote after the Green Spark penalty: “While we anticipate that the ICO would want to apply the law restrictively so as to avoid the creation of a loophole whereby AI driven artificial calls are permissible, it remains to be seen, however, whether the use of more sophisticated AI software which is trained on content but does not involve pre-recorded information could be considered to constitute live speech and therefore to fall outside the scope of the restriction under PECR.” That is commentary, not authority, and it cuts both ways.
The defensive reading: treat an outbound AI marketing call as a regulation 19 call. Get specific prior consent to automated calls from you, give your name and an address or freephone number on every call, and display a contactable number. If the call turns out to be live, you lost only the ability to call without consent; if you relied on regulation 21 and the ICO disagrees, every unconsented call is a regulation 19 contravention. This is a risk position, not a legal conclusion: it is a question for a lawyer or the ICO.
What the Green Spark penalty shows, and what it does not
The ICO issued Green Spark Energy Ltd with a monetary penalty notice dated 28 August 2025 for contravening regulations 19 and 24. It finds that between May 2023 and May 2024 the company instigated 9,587,050 communications comprising recorded matter for direct marketing by means of an automated calling system, resulting in 497 complaints to the TPS and the ICO. The penalty was £250,000, which the notice says would be reduced by 20% to £200,000 if paid in full by 29 September 2025.
The notice says “the automated calls were activated by call agents based in the Philippines or Pakistan using Avatar software”; the ICO’s announcement of 25 September 2025 calls the audio “scripted lines recorded by voice actors and played by call agents abroad”. The same announcement warns of delays “as the agent selects the next pre-recorded clip”. On the ICO’s description, a human chose in real time which clip to play, and the ICO still treated every call as regulation 19 recorded matter.
What that shows: a person in the loop and a responsive conversation did not turn recorded audio into live speech. What it does not show: anything about speech generated fresh on each call, because every sound had been recorded beforehand. The notice quotes regulation 19(4) in full but contains no separate discussion of “live speech” and does not mention artificial intelligence. It does not settle the AI question either way.
Two further findings apply to any deployment: recipients were not given the identification regulation 24 requires, and the company was the instigator even though overseas call centres placed the calls, because, the notice found, all three directors were actively involved in how the call centres operated, including deciding which areas to contact, managing the Avatar software, reviewing call scripts and considering regulatory risks. If a vendor runs your AI calls, you can still be the instigator.
The Live-Speech Test: which PECR rule your call falls under
The rule column decides the other three. Rows F and G are the AI cases no primary source we found has decided; the cells give the defensive reading and label it as such.
| Row | What happens on the call | Who starts the dialling | What the recipient hears | PECR rule | Consent before calling | TPS/CTPS screening | Identification and number display |
|---|---|---|---|---|---|---|---|
| A | Salesperson dials and talks (marketing) | Human | Live human speech | Reg 21 | Not required; do not call a line whose subscriber has told you not to (reg 21(1)(a)) | Required: TPS; both TPS and CTPS for B2B; plus your own do-not-call list. Exception: a registered subscriber who has told you they do not object to your calls (reg 21(4)) | Name; address or freephone if asked (reg 24(1)(b)); do not withhold your number, or present a contactable line (reg 21(A1)) |
| B | Dialler places calls, answered calls go to a live salesperson, nothing recorded is played | System | Live human speech | Reg 21 (no recorded matter, so reg 19(1) is not met) | As row A | As row A | As row A |
| C | Recorded marketing message or voicemail drop | System | Recorded audio | Reg 19 | Required: specific prior consent to automated calls from you, on that line | Does not make the call lawful; only consent does | Name plus address or freephone on every call (reg 24(1)(a)); do not withhold your number, or present a contactable line (reg 19(2)(b)) |
| D | Operator plays pre-recorded clips in response to the recipient (the Green Spark “Avatar” set-up) | Activated by call agents | Recorded clips chosen live | Reg 19, as the ICO treated it on 28 August 2025 | As row C | As row C | As row C |
| E | AI agent plays any audio prepared in advance: fixed greeting, pre-rendered clips, voicemail drop | System | Synthetic audio prepared before the call | Treat as reg 19: closest to row D | As row C | As row C | As row C |
| F | AI agent generates every reply during the call, system dials a list | System | Synthetic speech, no person speaking | Undecided. Defensive reading: reg 19 | Defensive: as row C | Defensive: as row C; if you rely on reg 21 instead, screening becomes mandatory | Defensive: as row C, which also satisfies the reg 21 duties |
| G | Person clicks to place each call, AI agent does the talking | Human | Synthetic speech, no person speaking | Undecided. Reg 19(4) tests what the system is capable of, not how one call was placed. Defensive reading: reg 19 | Defensive: as row C | As row F | As row F |
| H | Salesperson talks; AI transcribes or prompts silently | Human or system | Live human speech | Reg 21 | As row A | As row A | As row A |
| I | Any live call marketing claims management services | Any | Live human speech | Reg 21A (reg 19 if automated) | Required for every unsolicited call | Not the test: consent is required regardless, per the ICO | Name; address or freephone if asked (reg 24(1)(b)); do not withhold your number, or present a contactable line (reg 21(A1)) |
| J | Live call to an individual marketing occupational or personal pension schemes | Any | Live human speech | Reg 21B (reg 19 if automated) | Caller must be an authorised person under the Financial Services and Markets Act 2000 (the ICO says authorised by the FCA) or a scheme trustee or manager, AND have consent or meet both further conditions of reg 21B(3): a qualifying existing client relationship, and a simple means of refusing offered at collection and in every later communication | Not the test: the ICO says there is no TPS requirement because the criteria are strict | Do not withhold your number, or present a contactable line (reg 21(A1)); reg 24 as published names regs 19, 20, 21 and 21A but not 21B, and the ICO still tells pension callers to provide information |
| K | Administrative or service call with no promotional content | Any | Any | Neither reg 19 nor reg 21: not direct marketing | Not required by these rules | Not required by these rules | Not required by these rules; add promotional content and the call becomes marketing |
The Live-Speech Test in one sentence: if the recipient of a marketing call does not hear a person speaking live, assume regulation 19 and get specific consent, until the ICO or a court says otherwise.
How to run the Live-Speech Test on your own AI calls
Work through these five questions for each call type your AI agent makes, in order.
- Is it direct marketing? PECR regulation 2(1), in force from 20 August 2025, defines it as “the communication (by whatever means) of advertising or marketing material which is directed to particular individuals”. An appointment reminder with no upsell is row K; add “have you seen our new plan?” and it is marketing. Test transcripts, not intentions.
- Is the subject claims management or pensions? Then row I applies, and row J if you are calling an individual about pensions, even for a human caller.
- Does the recipient hear anything not spoken by a person live? A cached greeting or voicemail drop counts. If yes, you are in rows C to G.
- Can the platform dial a list on its own? That is regulation 19(4)(a). If your platform can run a campaign from an uploaded list, the answer is likely yes.
- What consent do you hold, for which line, from whom? Regulation 19(2)(a) needs the subscriber to have “previously notified the caller” of consent to communications “by, or at the instigation of, the caller on that line”. Our guide to consent wording for AI calls and the records to keep covers phrasing and evidence.
The ICO says PECR takes its consent standard from UK GDPR; pre-ticked boxes, silence and inactivity do not count.
TPS and CTPS screening: the 28-day arithmetic
For any unsolicited call under regulation 21, the register check is mandatory (unless the subscriber has told you they do not object to your calls, regulation 21(4)), and a listing takes effect after 28 days on the register (regulation 21(3); the ICO says the same). The arithmetic, counting days as PECR regulation 2(5) requires, so the day a number is listed is not counted: screen a list against register data current on day S, and even a number added later that same day is not protected until day S+29. Calls up to and including day S+28 are covered by that screen; later calls may not be. A screening file dated earlier than day S moves every date earlier. Screen no more than 28 days before the call.
Business-to-business calls are not exempt. The ICO’s telephone marketing guidance says sole traders and some partnerships register with the TPS, and companies, some partnerships and government bodies with the CTPS, so “For business-to-business (B2B) calls, you will therefore need to screen against both the TPS and the CTPS registers, as well as your own ‘do not call’ list.” Regulation 19 has no B2B carve-out either: it protects any “subscriber”.
What an AI call has to say about who is calling
Regulation 24 differs by rule. For a regulation 19 call, provide “with that communication” the name of the person and “either the address of the person or a telephone number on which he can be reached free of charge”. For a regulation 21 or 21A call, the name is required, and the address or freephone number if the recipient asks. Regulation 19(2)(b) and 21(A1) separately require you to display your number or a contactable line.
The Green Spark callers identified themselves only as a “local energy advisor”, according to the ICO’s announcement. For an AI agent, put the legal name and a contact route in the opening turn of every call, not in a fallback branch. Our AI agent disclosure scripts for live calls have opening lines to adapt.
None of the regulations read for this page requires you to announce that the caller is an AI. But the Green Spark calls gave “the impression that they are talking to a person from the UK”, in the notice’s words, and the ICO’s Head of Investigations, quoted in its announcement, said “the robo call technology is making it harder for the public to spot automated calls”. If your agent uses a cloned voice, the consent position for the voice itself is covered in our guide to consent rules for voice cloning on business calls.
How much can the ICO fine for an unlawful AI marketing call?
The maximum changed on 5 February 2026, and which regime applies depends on when the call was made, not when the ICO acts.
| When the contravening call was made | Regime | Maximum penalty | Source |
|---|---|---|---|
| Before 5 February 2026 | PECR as it had effect immediately before that date (S.I. 2026/82, reg 11(1) and (3)) | £500,000 | Green Spark notice, para 14, citing the Data Protection (Monetary Penalties) (Maximum Penalty and Notices) Regulations 2010 |
| On or after 5 February 2026, caller is an undertaking | PECR Schedule 1 as substituted by Data (Use and Access) Act 2025 Sch 13; DPA 2018 s157 as modified (S.I. 2026/82, reg 11(2)) | The higher of £17,500,000 or 4% of total annual worldwide turnover in the preceding financial year | DPA 2018 s157(5)(a); Sch 13 para 18 |
| On or after 5 February 2026, any other case | As above | £17,500,000 | DPA 2018 s157(5)(b) |
Schedule 13, paragraph 18 applies the “higher maximum amount” to PECR “regulation 5, 6, 7, 8, 14, 19, 20, 21, 21A, 21B, 22, 23 or 24”, so it covers the automated-call rule, the live-call rules and the identification duty. S.I. 2026/82, made 29 January 2026, commenced Schedule 13 on 5 February 2026 (reg 2(z14)).
£17,500,000 ÷ 4% = £437,500,000, so the percentage sets the maximum only where the preceding year’s worldwide turnover exceeds £437.5m. These are ceilings; the Green Spark penalty of £250,000 was set under the old £500,000 cap.
When this is a question for a lawyer or the ICO
This page reads the regulations; it is not legal advice. The classification of generative AI speech is unresolved and the ICO’s PECR guidance is under review. Ask a UK solicitor who handles PECR, or the ICO, before you:
- rely on regulation 21 (no consent, screening only) for calls an AI agent speaks, rows F or G;
- market claims management services or pension schemes by phone;
- call a list whose consent was collected by someone else, because regulation 19(2)(a) consent runs to “the caller”;
- let a vendor place calls for you, since you can still be the instigator.
Saying a question is open is not saying it is safe. If the ICO reads the rule as restrictively as the Handley Gill commentary anticipates, rows F and G become row C.
Frequently asked questions
Is AI cold calling legal in the UK?
Yes, on PECR’s terms. A live marketing call under regulation 21 needs no consent for most subjects if the number is screened against the TPS and CTPS and has not objected. A call carrying recorded matter under regulation 19 needs specific prior consent. Whether AI speech is live speech is undecided, so the defensive reading treats AI marketing calls as regulation 19 calls.
Do I need consent to make AI sales calls in the UK?
On the defensive reading, yes: specific prior consent to automated marketing calls from you, on that line, under regulation 19(2)(a). The ICO says general marketing consent or consent to live calls is not enough. If a lawyer advises that your agent’s speech is live, regulation 21 applies instead and consent is not required for most subjects.
Does the ICO treat AI voice agents as automated calls?
No ICO statement we could find says so either way. The telephone marketing and live-calls guidance pages read on 24 September 2026 do not mention AI or synthesised speech. The ICO’s live-calls guidance does define a live call as one where a live person is speaking to the person they are calling, and in the Green Spark penalty it treated human-triggered recorded clips as automated calls under regulation 19.
Do I have to screen against the TPS for B2B calls?
Yes, against both registers. The ICO’s telephone marketing guidance says sole traders and some partnerships register with the TPS, while companies, some partnerships and government bodies register with the CTPS, so B2B callers need to screen against both, as well as their own do-not-call list. A number is protected once it has been listed for 28 days, under regulation 21(3).
How much can the ICO fine for nuisance calls now?
For calls made on or after 5 February 2026, up to £17,500,000 or 4% of an undertaking’s total annual worldwide turnover in the preceding financial year, whichever is higher. That follows from Data (Use and Access) Act 2025 Schedule 13, commenced by S.I. 2026/82. Calls made before that date stay under the old regime, where the maximum was £500,000.
Can I use an AI voice agent for appointment reminders without consent?
PECR’s marketing call rules do not apply to a purely administrative call with no promotional content, because the ICO says such service messages are not direct marketing. Add promotional content and the call becomes direct marketing. UK GDPR still applies to the personal data the agent uses.
Does PECR require an AI caller to say it is an AI?
None of regulations 19, 21, 21A, 21B or 24 mentions AI or requires an automated-caller announcement. Regulation 24 requires your name on calls under regulations 19, 21 and 21A, and on a regulation 19 call an address or freephone number too. Whether presenting an AI as a person raises issues under other UK law is a question for a lawyer.
Where every figure on this page comes from
| Figure | Who published it | Link | Date read |
|---|---|---|---|
| Regulation 19(1), (2)(a) and (b), (3) and (4)(a) and (b) wording, including “recorded matter” and “not live speech” | legislation.gov.uk (The National Archives) | PECR regulation 19 | 24 September 2026 |
| Regulation 21(A1), (1)(a) and (b), (3) 28-day exception, (4), (5), (6) | legislation.gov.uk (The National Archives) | PECR regulation 21 | 24 September 2026 |
| Claims management consent rule | legislation.gov.uk (The National Archives) | PECR regulation 21A | 24 September 2026 |
| Pension scheme call conditions (paragraphs (2) and (3)) | legislation.gov.uk (The National Archives) | PECR regulation 21B | 24 September 2026 |
| Identification particulars for regs 19, 20, 21 and 21A | legislation.gov.uk (The National Archives) | PECR regulation 24 | 24 September 2026 |
| Definition of direct marketing, inserted 20 August 2025; day-counting rule in regulation 2(5) | legislation.gov.uk (The National Archives) | PECR regulation 2 | 24 September 2026 |
| Automated calls need specific consent; B2B screening against both TPS and CTPS; guidance under review | Information Commissioner’s Office | Telephone marketing | 24 September 2026 |
| “A live call is therefore a telephone call where a live person is speaking”; service messages are not direct marketing | Information Commissioner’s Office | What are live direct marketing calls? | 24 September 2026 |
| 28 days on the register before it takes effect; UK GDPR consent standard; other regulators’ rules (FCA cold-calling bans) may also apply; instigator responsibility; claims management and pension scheme screening position | Information Commissioner’s Office | What are the rules on live direct marketing calls? | 24 September 2026 |
| Green Spark Energy: notice dated 28 August 2025; 9,587,050 calls, May 2023 to May 2024; 497 complaints; £250,000, or £200,000 if paid by 29 September 2025; Avatar software; regs 19 and 24; old £500,000 cap (para 14) | Information Commissioner’s Office | Monetary penalty notice | 24 September 2026 |
| “scripted lines recorded by voice actors”; “as the agent selects the next pre-recorded clip”; “local energy advisor”; “the robo call technology is making it harder for the public to spot automated calls” | Information Commissioner’s Office | News release, 25 September 2025 | 24 September 2026 |
| Schedule 13 in force 5 February 2026; para 18 list of PECR regulations attracting the higher maximum | legislation.gov.uk (The National Archives) | Data (Use and Access) Act 2025, Schedule 13 | 24 September 2026 |
| Commencement on 5 February 2026 (reg 2(z14)); made 29 January 2026; old or new regime by date of conduct (reg 11) | legislation.gov.uk (The National Archives) | S.I. 2026/82, Commencement No. 6 Regulations | 24 September 2026 |
| £17,500,000 or 4% of total annual worldwide turnover, whichever is higher | legislation.gov.uk (The National Archives) | Data Protection Act 2018, section 157 | 24 September 2026 |
| “it remains to be seen” whether AI speech could constitute live speech (commentary, not authority) | Handley Gill Limited | Robocop, 9 October 2025 | 24 September 2026 |
| £437.5m turnover crossover; day S+28 screening window | Zian AI | Calculated on this page from s157(5) and reg 21(3); every step is shown | 24 September 2026 |
What this means if you run an AI voice agent in the UK
Classifying your call types against the Live-Speech Test is an afternoon with the transcripts. Keeping it true is the ongoing cost: re-screening within 28 days, consent records tied to line and caller, and re-reading transcripts whenever prompts change.
Zian AI builds autonomous phone, SMS, email and WhatsApp sales agents (see Zian’s agent features and integrations), with SmartReach AI™ orchestrating message, channel and timing by country, industry and profile. We have run outbound acquisition since 2017, and the lesson that holds in every jurisdiction is the one on this page: which channel you may use is decided before the first word is spoken. Zian AI is in partnership-application beta.