There's a law most vendors aren't mentioning in their marketing. You should probably know about it before you sign.

What a non-compliant campaign could actually cost you.

Let's make this concrete. A mid-size dealership running an AI voice reactivation campaign might touch 500 to 2,000 contacts over a few weeks. If any portion of those contacts didn't provide prior express written consent for AI voice specifically — not just for SMS, not just for email, but for AI-generated voice calls — every one of those calls is a potential violation.

Source: FCC February 2024 declaratory ruling; Telephone Consumer Protection Act (TCPA)

And here's what most dealers assume: if something goes wrong, the vendor is responsible. Here's what's actually true: you're both potentially liable — and your vendor has almost certainly written their contract to make sure you absorb the bulk of it.

TCPA liability attaches to the caller — that's you. Vendors can be pursued for vicarious liability if they knowingly facilitated non-compliant campaigns, and the FCC has gone after them. But most vendor contracts include indemnification clauses that push exposure back to the dealer regardless. So you could end up fighting a TCPA violation and your vendor's contract at the same time.

Read the indemnification section of any AI voice contract before you sign it. Most dealers never do.

Two lists. Two completely different legal situations.

Here's the distinction most vendors will not volunteer — and it's the most important one in this entire conversation.

Your DMS customer list — people who have serviced with you, have a documented relationship, and whose consent status you can actually verify — is the defensible use case. With the right consent architecture in place, outreach to this list is legitimate. This is what real database reactivation looks like.

A purchased list, a conquest list, or an OEM-provided prospect list — people who have no prior relationship with your specific dealership — is a completely different situation. Calling those contacts with an AI voice without explicit written consent is where the $500-to-$1,500-per-call exposure lives. Every single call.

The informational vs. marketing distinction. Know it cold.

Some vendors will try to navigate around the consent requirement by leaning on an argument that sounds reasonable on the surface: "The customer gave us their phone number when they bought the car. We can call them about their car."

There's a narrow version of this that's technically true. When a customer provides their phone number during a vehicle purchase, that action does constitute prior express consent — but only for genuinely informational communications directly related to that vehicle. Think recall notices, safety alerts, or confirmations of appointments the customer themselves scheduled. That's the informational category.

Here's where it breaks down completely: the moment a call includes any promotional element — a service offer, a specific price, a discount, an incentive to book an appointment the customer didn't request — it legally becomes marketing. And marketing requires prior express written consent. That's a dramatically higher bar.

The distinction isn't just about what the call says. It's about what the caller is trying to accomplish. If the goal is to generate revenue, drive a service appointment the customer didn't ask for, or promote a product — it's marketing. Regardless of how it's framed.

There's also a separate EBR argument — the "established business relationship" exemption — that occasionally comes up. It doesn't apply here. An existing business relationship exempts dealers from Do-Not-Call rules for manual calls only. The moment AI voice is involved, that exemption disappears. Consent is required regardless of any prior relationship.

Not a checkbox in a purchase agreement.

When vendors talk about "prior express written consent" for marketing calls, they're describing a specific legal standard — not a general sense that the customer agreed to be contacted.

The FCC requires a clear and conspicuous written agreement that specifically authorizes the seller to deliver advertising or telemarketing messages using an artificial or prerecorded voice. It must include nine specific pieces of disclosable information. A phone number written on a service intake form doesn't meet this standard. A checkbox buried in a vehicle purchase agreement almost certainly doesn't either.

Here's the part that trips people up: digital consent does count as "written" — but not all digital consent is equal. Under the E-SIGN Act, an electronic signature carries the same legal weight as a handwritten one. That means a properly designed web form, a keyword text opt-in, or a digital signature can all qualify. But the key word is "properly designed." The consent form must clearly disclose that the customer is agreeing to receive AI-generated voice calls specifically for marketing purposes, identify the seller by name, and state that consent is not a condition of purchase. A generic "we may contact you" checkbox doesn't come close.

If a vendor tells you that the numbers in your DMS are fully consented for AI voice marketing calls, the follow-up question is simple: show me the consent language you're relying on. If they can't produce it quickly, or if it doesn't explicitly reference AI-generated voice outreach for marketing purposes, the consent isn't there.

Consent architecture isn't a checkbox. It's a system.

Having consent once isn't enough. A compliant AI voice outreach program requires all of the following — built in from the start, not bolted on after a compliance scare:

• Documented written consent for AI voice specifically — digital counts if it meets E-SIGN Act standards (a proper web form, keyword text opt-in, or e-signature), but a generic contact preference or a phone number on a purchase form does not
• Active DNC (Do Not Call) list scrubbing before every campaign
• Clear opt-out handling mid-call and post-call, with immediate honoring
• State-level compliance checks — several states have requirements stricter than federal TCPA
• Audit trail: who consented, when, to what channel, and how that was recorded

Any vendor selling you AI voice outreach should be able to walk you through their consent architecture before they show you the demo. If the demo comes first and the compliance conversation never happens — or if the answer is vague when you push — that's a signal worth taking seriously.

Five questions. Ask them all.

We're not saying don't use voice. We use it too. We're saying know exactly what you're signing up for before you sign. A vendor who can answer all of these confidently and in plain English is worth talking to. A vendor who pivots back to the demo — keep walking.

• Is this call informational or marketing? Be specific. What exactly will the AI say? Does it include any offer, price, or incentive? If yes, it's marketing — and requires written consent.
• What consent do you have on file for the numbers you're calling? Where did that consent come from, and does it explicitly cover AI-generated voice for marketing purposes?
• Where did those numbers come from — the DMS, a purchased list, or somewhere else? Your liability exposure is very different depending on the answer.
• What happens if we get sued? Who is liable? Read the indemnification section of the contract before you sign it — not after.
• Can you show me the written consent language your platform captures? Not a description of it. The actual language, and confirmation it meets the FCC standard for marketing calls using artificial voice.