Consent, disclosure, and trust: the ground rules for AI phone calls

A voice agent can be fast, accurate, and pleasant to talk to, and still fail if the person on the other end doesn't trust it. People have spent decades learning to hang up on robocalls and ignore texts from numbers they don't know. Any business putting AI on its phone line is starting from that baseline.

The good news is that the practices that build trust are mostly the same ones regulators are asking for. Here's a practical view of the ground rules, and where they're heading.

Say what it is, up front

The single most effective trust practice is also the simplest: tell callers at the start that they're speaking with an automated assistant. It sounds like it might put people off. In practice, most callers care far more about getting helped quickly than about who helps them. What upsets people is discovering halfway through that they weren't told.

Disclosure is also increasingly expected by law. Some US states already have rules about bots that don't identify themselves in certain contexts, and more proposals are in progress. Building disclosure into every agent by default means you're not scrambling to add it later.

Always leave a way to reach a person

A caller who asks for a human should get one, or a clear alternative: a transfer, a callback at a specific time, or a message that will definitely be seen. An agent that refuses, loops, or pretends not to understand the request does more damage to trust than any wrong answer.

The same goes for situations the agent isn't equipped for. Good agents recognize when a call has gone beyond what they should handle, say so plainly, and hand it off with the details attached so the caller doesn't have to start over.

Outbound calls: consent comes first

In the US, the Telephone Consumer Protection Act (TCPA) sets rules for calls made with artificial or prerecorded voices. In 2024, the FCC confirmed that AI-generated voices count as artificial voices under that law. In plain terms, the consent requirements that already applied to prerecorded calls apply to AI voice calls too.

What that means in practice depends on the kind of call, but a few habits keep most businesses on solid ground:

• Call people who expect to hear from you: customers confirming an appointment they booked, applicants following up on a form they submitted, clients you have an existing relationship with.
• Keep a record of how and when consent was given.
• Honor opt-outs immediately and across every channel.
• Respect calling hours in the recipient's time zone.
• Say who you are and why you're calling in the first sentence.

We go deeper on the practical side of this in outbound voice agents done right.

Texts: ask on the call, make stopping easy

Voice agents are increasingly moving parts of a conversation to text: a link to upload a document, a confirmation, a place to type an email address instead of spelling it. That's great for callers, but business texting has its own rules.

In the US, texts sent from ordinary local business numbers generally go through A2P 10DLC, a registration system run with the mobile carriers. Businesses register who they are and what their messages are for, and carriers filter traffic that doesn't match. Toll-free numbers have a separate verification process. Either way, the expectations are consistent: only text people who agreed to it, say who the message is from, and make it easy to stop by replying STOP.

A clean pattern for voice agents is to ask during the call ("Can I text you a link to upload that?") and send only after a clear yes. You can see how we handle this in our SMS terms.

Handle personal data like it's borrowed

• Ask only for what the next step needs. Every extra field is extra risk.
• Avoid reading sensitive details back in full. Confirming the last four digits is usually enough.
• Offer a safer channel for sensitive items, such as a secure link rather than reading a card number aloud.
• Be clear about recording and how long recordings and transcripts are kept.
• Limit who on your team can see what.

Our security page covers how HiloVoice approaches data handling, access controls, and credentials.

Where the rules are heading

• More disclosure requirements. Expect clearer, broader rules about telling people when they're talking to AI.
• Stronger caller identity. Caller ID authentication (known as STIR/SHAKEN in the US) and branded calling make it easier for people to see who's really calling, and harder for spoofed calls to get through.
• Tighter consent records. Regulators and carriers are pushing for consent that is specific to the business that collected it, not shared across a list.
• Trust as a buying criterion. Businesses will choose voice tools partly on how well they protect callers, because their own reputation is on every call.

None of this should slow a good business down. Clear disclosure, a path to a person, consent before calls and texts, and careful data handling are simply what a well-run phone line looks like. AI just makes them easier to apply consistently.