Consent & calling rules

A five-minute read that prevents a genuinely expensive mistake. This is not legal advice — rules differ by country and by industry — but these are the questions you must have answers to before an AI agent calls anybody.

The one principle

Regulators do not treat an AI call as a lesser thing than a human one. Everything that applies to your staff calling customers applies here — usually more strictly, because automated calling can be done at volumes a person cannot.

The practical version: if a member of your team could not lawfully make this call at this hour, neither can an agent.

Consent to call

Capture consent, do not assume it

If your form has a “you may contact me” checkbox, map it into your Lead Callback trigger and switch on Require consent evidence. Leads with no consent value are then never called — enforcement rather than intention. See Lead Callback.

Calling hours

Permitted hours are set by regulators, and they are measured on the recipient’s local clock, not yours. Calling a Lagos number at 9pm Nairobi time is judged in Lagos.

• Lead Callback enforces this for you. Set the window on the trigger, and it is applied in the lead’s own timezone where you have mapped one. A lead arriving at 3am is held and called when the window opens.
• Campaigns run when you schedule them. There is no automatic window, so choosing lawful hours is your responsibility. Schedule deliberately.
• Weekends and public holidays are restricted in many places. The day-of-week setting on a trigger exists for this.

Opt-outs and do-not-call

Someone asking not to be called again must be honoured immediately, permanently, and across every campaign — not just the one they were on.

If the caller asks not to be contacted again, or says to stop calling:
confirm that you will remove them, apologise for the disturbance, and end
the call. Do not ask why. Do not offer alternatives. Do not try to keep
them on the line.

• Vociply checks numbers against your do-not-call list before dialling a lead callback, and de-duplicates repeat submissions.
• Keeping your own lists clean is still on you — strip opt-outs before uploading a campaign list, every time.
• Cap retries. Three attempts is persistent; six is harassment, and in several jurisdictions it is also a breach.
• Many markets operate a national do-not-call register. Know whether yours does and what it obliges you to do.

Recording notice

Vociply records calls and produces transcripts. Most jurisdictions require notice to the participants; some require consent from all parties.

Where notice is needed, put it in the greeting, where it is heard before anything is said:

"Brightsmile Dental, this is Amara. This call is recorded for quality and
training - how can I help?"

This applies to Call IQ as well, where the calls are between two humans — and it covers your own staff, not only your customers. Agree the wording with them before switching a line on.

Disclosing that it is AI

A growing number of jurisdictions require you to say so. Even where it is not required, it is the better choice: people who are told adjust their expectations and stay on the line, while people who work it out mid-call often hang up feeling deceived.

"Hi, you're through to Brightsmile's virtual assistant - how can I help?"

One word does it. Never instruct an agent to deny being an AI if asked directly: in some places that is unlawful, and everywhere it is the kind of thing that ends up screenshotted.

Customer data

• Recordings and transcripts are personal data. They fall under GDPR and equivalent regimes. Know your lawful basis and your retention position.
• Access is account-wide. Anyone on your team can read every transcript. Grant team access accordingly.
• Do not have agents read records back at callers. Using CRM data to greet someone by name is helpful; reciting their history is unsettling and can be a disclosure problem.
• Gate anything financial or medical behind verification. Caller ID is not identity — it is spoofable, and phones get borrowed. The Business Central playbook shows what a properly gated flow looks like.
• Never collect card details on a call. Send a payment link instead.

Vociply’s own certifications, encryption and sub-processor details are on the security page. Data Processing Agreements are available.

Pre-launch checklist

Before an agent calls anyone who is not you or a colleague:

• I can explain, for every number on my list, why I am allowed to call it.
• My calling window is lawful in the recipient’s timezone, not mine.
• The agent has an explicit instruction to accept an opt-out immediately.
• Opt-outs and complainants are stripped from my list.
• Retries are capped at three or fewer.
• My greeting includes recording notice where required.
• My greeting discloses AI where required.
• The agent can transfer to a human, and that number is genuinely answered.
• The agent has an explicit rule never to invent prices, dates or policies.
• Anything financial, medical or account-specific is behind verification.

Compliance questions