Compliance

AI Cold Calling Under UK PECR Rules

The marketing manager at a double glazing and conservatory company in Leicester had a list of eight thousand homeowners in the East Midlands and a plan for an AI agent to call through it in a fortnight, which is the kind of plan the Information Commissioner's Office publishes enforcement notices about. The first question worth asking was where the list came from, and the second was whether anybody on it had ever agreed to be called by the company, or by anything automated.

The businesses in this article are illustrative examples, not named StartAutomate clients.

Key takeaways

  • PECR requires prior, specific consent for automated marketing calls, and an AI voice making marketing calls is very likely to be treated as automated.
  • Live marketing calls must be screened against the TPS and CTPS unless the person has consented, and caller ID must always be shown.
  • AI calling works well and lawfully for people who asked to be contacted, and for service calls to existing customers.

PECR and automated marketing calls

The Privacy and Electronic Communications Regulations set the rules for marketing calls in the UK, and the ICO enforces them. Automated marketing calls, meaning calls made by a system rather than a person, need the recipient's prior consent specifically for automated calls from that organisation, and a general tick box on a comparison site does not provide it.

The ICO has not carved out any exception for AI voices. Because an AI agent is a system making the call without a person dialling or speaking, it is safest to treat AI marketing calls as automated calls and to get specific consent before making them.

TPS and CTPS screening

Live marketing calls, made by people, can be made without consent to numbers that are not on the Telephone Preference Service, or the Corporate TPS for companies, as long as the person has not told the caller not to ring. That route depends on a person making the call, and it does not fit an AI caller.

Sole traders and partnerships are protected by the TPS in the same way as individuals, so a list of small businesses is not automatically fair game either, even for a live caller.

Caller ID and fines

Every marketing call must display a valid caller ID number that the recipient can ring back to opt out, and the caller must say who is calling. Ofcom also treats repeated silent or abandoned calls as persistent misuse of the network.

The Data (Use and Access) Act 2025 brought PECR fines up to the same level as UK GDPR, so a serious breach can now cost up to seventeen and a half million pounds or four per cent of turnover. The ICO's past fines for nuisance calls were already in the hundreds of thousands.

Where AI calling fits in the UK

AI outbound calling works when the person has asked to hear from you. A homeowner who fills in a quote request on the company's own website, with clear wording that they agree to a call including an automated or AI call, can be called back within minutes to book a survey.

Service calls to existing customers, such as confirming an installation date, reminding them about a survey, or checking they are happy after the fitting, are not marketing and are a natural fit. The Leicester firm's list of eight thousand homeowners is better left in the drawer. This article is a practical summary rather than legal advice, and a campaign of any size should be checked by a lawyer who knows PECR.

Common questions

Is AI cold calling legal in the UK?

Automated marketing calls need prior specific consent under PECR, and AI marketing calls are very likely to be treated as automated. Calls to people who asked to be contacted, and service calls to existing customers, are where AI calling fits. Take legal advice before any campaign.

Do I need to screen against the TPS?

Live marketing calls must be screened against the TPS and CTPS unless the person has consented to your calls. Automated calls need specific consent regardless of TPS status.

What are the fines for breaking PECR?

Since the Data (Use and Access) Act 2025, PECR fines can reach the same level as UK GDPR, up to £17.5 million or 4% of global turnover.



Rather we built it for you

Tell us your stack and the workflow costing your team the most time. We'll map the first automation worth building.

Contact usEmail us
Call us now+1 (423) 487-1994