Compliance tool · Updated 24 Oct 2026
AI calling rules by country
For businesses that place AI or automated calls. The table sets out 8 rules for each of 18 countries, and the check below shows whether the calling hours allow a call now.
Calling-hours check
India · Asia/Kolkata
Checking the time…
No fixed calling hours in law for this type of call. Consent, do-not-call and fairness rules still apply.
A 9 am to 9 pm promotional window is widely quoted but we did not find it in the TRAI texts read. Customers can block promotional calls by time band and day type through DND. Loan-recovery calls have separate RBI windows (see sector rules).
Public holidays are not checked. Hours are a minimum: consent, do-not-call lists and call-frequency limits apply separately.
Rules by country
| Country | AI disclosure | Consent | Calling hours | Do-not-call list | Recording | Caller ID / numbers | Data law | Penalties |
|---|---|---|---|---|---|---|---|---|
| IndiaFull guide | No AI-specific call disclosure rule foundWe found no rule that a call must say it is an AI. TRAI's 2026 amendment treats a call placed by software or an automated platform without a person dialling, including one using pre-recorded or artificial voice, as an A2P call, which the sender must declare to its operator; it does not prescribe a spoken AI line. MeitY's 2026 IT Rules amendment on labelling synthetic content binds intermediaries; whether it reaches outbound voice calls is not settled.TRAI TCCCPR (Third Amendment) Regulations, 2026, reg. 2(ea) and 4; IT Rules amendment G.S.R. 120(E) | Consent or DND for promo; declare A2P callingPromotional calls need the customer's consent registered on the operators' DLT platform, or must respect their DND choices, and must come from a 140 number. Service calls to your own customers about something they bought need no explicit consent. From 28 Oct 2026, a call based on an enquiry is allowed for only 7 days and the enquiry must be written or digital and verifiable (applications still count for 3 months). From 27 Nov 2026, every sender whose software places calls must declare A2P calling and its caller-number ranges to its operator in advance, or the calls are treated as unsolicited commercial communication. Both dates run from the amendment's publication in the Gazette of India on 28 Sep 2026 (CG-DL-E-28092026-276548).TCCCPR (Third Amendment) Regulations, 2026, regs 1(3), 2(y), 4 and explanatory memorandum; TRAI PR 119/2026 | No general statutory window foundA 9 am to 9 pm promotional window is widely quoted but we did not find it in the TRAI texts read. Customers can block promotional calls by time band and day type through DND. Loan-recovery calls have separate RBI windows (see sector rules).Being verifiedTCCCPR 2018 as amended | DND / NCPR via 1909 and the DND appCustomers block promotional communications by category, mode, time band and day type. Service and transactional calls cannot be blocked. Complaints go through the TRAI DND app, operator apps or 1909; from 27 Dec 2026 appeals to the operator's Appellate Authority can be filed the same ways.TRAI PR 119/2026; TCCCPR (Third Amendment) Regulations, 2026 | No general consent statute; tell the callerWe found no general Indian law requiring consent to record a call or fixing one retention period. In our reading a recording that identifies a person is personal data under the DPDP Act (s.2(n), 2(t)); from 13 May 2027 any consent request must come with a notice (s.5). RBI-regulated recovery calls must be recorded from 1 Jan 2027 (see sector rules).DPDP Act 2023, ss. 2, 5; DPDP Rules 2025, rule 1(4) | 140 promo; 1600 / 1601 service and transactionalSenders may not use normal 10-digit numbers for telemarketing (PR 11/2025). 140 is for promotional calls from any sector. 1600 is mandated for service and transactional calls by RBI-, SEBI-, IRDAI- and PFRDA-regulated entities to their existing customers, and for government-to-citizen calls (PR 91/2026). 1601 is for utilities, courier and logistics firms; operators should finish moving them by about 8 Nov 2026 (90 days from the 10 Aug 2026 Direction). Calls from 140, 1600 and 1601 numbers may not be flagged as spam to the people called (reg. 21A) and are exempt from the A2P termination charge of up to ₹0.05 a minute, which operators charge each other.TRAI PR 11/2025; PR 91/2026; PR 113/2026; TCCCPR (Third Amendment) 2026, regs 21A, 35A | DPDP Act 2023 + DPDP Rules 2025Rules notified 13 Nov 2025 (G.S.R. 846(E)). Only the Data Protection Board rules apply now; consent-manager registration starts 13 Nov 2026; notice, consent, security, breach reporting, erasure and rights duties start 13 May 2027 (rule 1(4)).MeitY, DPDP Rules 2025, rule 1(4) | Telecom barring and disconnection; DPDP up to ₹250 croreTRAI: a sender's outgoing telecom resources can be barred for 15 days, and repeat cases end in one-year disconnection across operators and blacklisting. Under the 2026 amendment, from 28 Oct 2026, five AI-flagged numbers in 10 days start KYC re-checks and can lead to the same barring. DPDP Act: penalties per type of breach, the highest up to ₹250 crore (Schedule), applying with the core duties from 13 May 2027.TRAI PR 11/2025; TCCCPR (Third Amendment) 2026, reg. 21A; DPDP Act 2023, Schedule |
| United StatesFull guide | AI voice = 'artificial voice'; must identify callerFCC Declaratory Ruling FCC 24-17 (adopted 2 Feb, released 8 Feb 2024) confirms the TCPA's 'artificial or prerecorded voice' rules cover AI-generated voices. Every artificial or prerecorded message must state the identity of the business at the start and give its phone number. There is no federal rule to say 'I am an AI': the FCC proposed one in August 2024 (FCC 24-84), and no final rule had been adopted as of 24 Oct 2026. Some states have their own bot-disclosure laws (not checked).FCC 24-17; 47 CFR 64.1200(b) | Prior express written consent for AI telemarketingCalls using an artificial or prerecorded voice that include an advertisement or telemarketing need prior express written consent (to mobiles and residential lines). Non-marketing calls to mobiles with an autodialer or artificial voice need prior express consent. Emergency calls and some exempt calls are carved out.47 CFR 64.1200(a)(1) to (3) | 08:00 to 21:00 recipient local timeNo telephone solicitation to a residential subscriber before 8 a.m. or after 9 p.m. at the called party's location. Many states set narrower windows or ban Sunday and holiday calls; check the state.47 CFR 64.1200(c)(1) | National Do Not Call RegistryNo telephone solicitation to a residential number on the national registry; registrations last until cancelled. A seller must also keep its own company-specific do-not-call list. Several states run their own lists.47 CFR 64.1200(c)(2), (d) | Federal one-party consent; some states all-partyFederal wiretap law lets a party to the call (or someone with one party's consent) record it. Some states, such as California, require every party's consent; the state list was not re-checked in this pass, so treat any multi-state calling as all-party and announce the recording.18 U.S.C. 2511(2)(d) | STIR/SHAKEN call signing by carriersVoice service providers must authenticate caller ID with STIR/SHAKEN on IP networks. Telemarketers must also transmit caller ID (47 CFR 64.1601(e)), which was not re-checked in this pass.47 CFR 64.6301 | No federal privacy law; TCPA, FDCPA, state lawsThere is no general federal data protection law. Sector laws (TCPA, FDCPA, GLBA, HIPAA) and state privacy laws (for example California's CCPA/CPRA) apply.Being verified | $500 per call, up to 3x if wilful (TCPA private suits)A person may sue for actual loss or $500 per violation, whichever is greater, and a court may increase the award to up to three times that if the violation was wilful or knowing. FCC and state penalties are separate.47 U.S.C. 227(b)(3) |
| United Kingdom | No AI rule; automated calls must name the callerWe found no UK law that requires a caller to say it is an AI. Automated marketing calls must say who is calling and give an address or freephone number (ICO guidance on regulation 19). The EU AI Act does not apply in the UK.ICO, Guide to PECR: Telephone marketing | Automated: opt-in. Live: opt-out (TPS)Regulation 19: recorded-matter direct marketing by an automated calling or communication system needs the subscriber's prior consent to such calls from that caller. Regulation 21: live marketing calls are allowed unless the person objected or the number is on the TPS/CTPS. Claims management and pension calls need specific consent.PECR 2003, regs 19 and 21 | No statutory calling hoursPECR sets no calling window. Ofcom's persistent-misuse policy (abandoned and silent calls) applies to dialler campaigns; its current thresholds were not confirmed in this pass.Being verifiedOfcom persistent misuse policy | TPS and Corporate TPSNo unsolicited live marketing calls to numbers on the TPS or CTPS unless the person has told you they do not object to your calls. A newly listed number is protected after 28 days.PECR reg 21(1)(b), 21(3); ICO guidance | Notice needed; business-recording rules applyRecording by a business is generally allowed for lawful business purposes if callers are told. Based on the Investigatory Powers Act 2016 and UK GDPR transparency rules; not re-checked in this pass.Being verified | Must not withhold caller ID on marketing callsAnyone making direct marketing calls, solicited or not, must present their calling line identity or a number they can be contacted on (reg 21(A1)). Automated calls under reg 19 have the same condition.PECR reg 21(A1), reg 19(2)(b) | UK GDPR + Data Protection Act 2018 + PECRThe Data (Use and Access) Act 2025 became law on 19 June 2025 and amends PECR. The ICO says its PECR guidance is under review because of those changes.ICO, Guide to PECR | ICO fines; being raised by the 2025 Data ActPECR fines were capped at £500,000. Law firms report that the Data (Use and Access) Act 2025 raises them to UK GDPR levels (up to £17.5 million or 4% of worldwide turnover). We did not confirm in the legislation when that change took effect.Being verifiedMayer Brown, The Data (Use and Access) Act: PECR reform, 1 Jul 2025 |
| GermanyFull guide | Yes: EU AI Act Art. 50(1), since 2 Aug 2026Providers must design AI systems that talk to people so the person is told they are interacting with an AI system, unless that is obvious from context. Art. 50(5): the information must be clear and distinguishable, at the latest at the first interaction. The duty has applied since 2 August 2026, and the Digital Omnibus (Regulation (EU) 2026/1744) did not delay it. Breaches can be fined up to €15 million or 3% of worldwide annual turnover, whichever is higher (Art. 99(4)(g)); for SMEs the lower of the two applies.Regulation (EU) 2024/1689 (AI Act), Arts. 50(1), 50(5), 99(4)(g), 113 | Opt-in: prior express consent (UWG §7)Telephone advertising to a consumer without prior express consent is always an unreasonable nuisance (§7(2) Nr. 1). Advertising with an automatic calling machine needs prior express consent from any recipient (§7(2) Nr. 2). §7a: the consent must be documented and kept for five years after it was given and after each use.UWG §7(2), §7a | No statutory calling hoursNo general calling window was found in the UWG. Not otherwise checked.Being verified | No state DNC register (opt-in regime)Because consent is required, there is no official do-not-call list. Private 'Robinson' lists exist.Being verified | All-party consent; criminal offenceRecording someone's privately spoken words without authorisation, or using such a recording, is punishable by up to three years' prison or a fine. Get consent from the person called before recording.StGB §201(1) | No number suppression on advertising callsTelecommunications law bars suppressing the caller's number on advertising calls. Section number and current wording not confirmed in this pass.Being verified | GDPR + BDSGThe EU General Data Protection Regulation applies, alongside the national implementing law named here. The national law was not re-checked in this pass.Being verifiedRegulation (EU) 2016/679 (GDPR) | UWG fines up to €300,000; §201 StGB up to 3 yearsTelephone advertising without prior express consent can be fined up to €300,000, and missing consent documentation up to €50,000 (§20(2)). The Federal Network Agency (BNetzA) enforces both. The §201 StGB prison term is separate.UWG §20(1), (2), (3) |
| FranceFull guide | Yes: EU AI Act Art. 50(1), since 2 Aug 2026Providers must design AI systems that talk to people so the person is told they are interacting with an AI system, unless that is obvious from context. Art. 50(5): the information must be clear and distinguishable, at the latest at the first interaction. The duty has applied since 2 August 2026, and the Digital Omnibus (Regulation (EU) 2026/1744) did not delay it. Breaches can be fined up to €15 million or 3% of worldwide annual turnover, whichever is higher (Art. 99(4)(g)); for SMEs the lower of the two applies.Regulation (EU) 2024/1689 (AI Act), Arts. 50(1), 50(5), 99(4)(g), 113 | Opt-in since 11 Aug 2026 (Bloctel ended)From 11 August 2026 a consumer may only be canvassed by phone after giving prior consent that is free, specific, informed, unambiguous and revocable. Consent lasts one year at most and proof (date, time, information given) must be kept at least three years. Exceptions: calls about an ongoing contract on its subject, and newspaper or magazine subscriptions. Energy renovation, home adaptation for loss of autonomy and CPF training calls are banned outright.Code de la consommation L223-1 as rewritten by Loi n° 2025-594 of 30 June 2025, art. 13; DGCCRF fact sheet, 27 Jul 2026 | Mon to Fri 10:00 to 13:00 and 14:00 to 20:00Canvassing is allowed Monday to Friday only, never on public holidays, from 10:00 to 13:00 and 14:00 to 20:00 in the consumer's time zone, unless the consumer agreed to a specific date and time. No more than four calls to the same consumer in 30 days; if the consumer refuses during a call, stop and do not call again. The windows below do not exclude public holidays.Décret n° 2022-1313 of 13 Oct 2022; DGCCRF fact sheet, 27 Jul 2026 | Bloctel closed 11 Aug 2026; consent replaces itThe Bloctel opposition list was ended when the opt-in regime started. Callers now need proof of consent instead of screening against a list.DGCCRF fact sheet, 27 Jul 2026 | Tell the caller; have a GDPR lawful basisNo French-specific recording rule was confirmed in this pass. Under the GDPR a recording of an identifiable person is personal data, so the caller must be told (Art. 13) and the business needs a lawful basis (Art. 6). Check national law and the data protection authority's guidance.Being verifiedGDPR Arts. 6, 13 | No 06/07 mobile numbers from autodiallers; no hidden IDSince 1 January 2023, platforms using automated calling systems may not call or text consumers from numbers starting 06 or 07 (ARCEP decision 2022-1583). Calling from a masked number is also banned.DGCCRF fact sheet; ARCEP décision n° 2022-1583 | GDPR + Loi Informatique et LibertésThe EU General Data Protection Regulation applies, alongside the national implementing law named here. The national law was not re-checked in this pass.Being verifiedRegulation (EU) 2016/679 (GDPR) | Up to €375,000 per call (company)Unlawful canvassing: up to €75,000 per call for an individual and €375,000 for a company, with sanctions published. Abuse of weakness by phone canvassing: up to 5 years' prison and €500,000 or 10% of turnover.DGCCRF fact sheet, 27 Jul 2026 |
| SpainFull guide | Yes: EU AI Act Art. 50(1), since 2 Aug 2026Providers must design AI systems that talk to people so the person is told they are interacting with an AI system, unless that is obvious from context. Art. 50(5): the information must be clear and distinguishable, at the latest at the first interaction. The duty has applied since 2 August 2026, and the Digital Omnibus (Regulation (EU) 2026/1744) did not delay it. Breaches can be fined up to €15 million or 3% of worldwide annual turnover, whichever is higher (Art. 99(4)(g)); for SMEs the lower of the two applies.Regulation (EU) 2024/1689 (AI Act), Arts. 50(1), 50(5), 99(4)(g), 113 | Opt-in, or another GDPR basis (since 29 Jun 2023)Art. 66.1.a: no automated calls without human intervention for commercial purposes without prior consent. Art. 66.1.b: no unwanted commercial calls unless the user consented or another lawful basis under GDPR Art. 6.1 applies (for example legitimate interest). Art. 66.1.b took effect one year after the law's publication.Ley 11/2022 General de Telecomunicaciones, art. 66.1 and final provision 6 | No calling window confirmedNot confirmed in this pass. The 2025 customer-service law (Ley 10/2025) changed how commercial calls are numbered (see caller ID); whether it or other rules set calling hours was not checked.Being verified | Lista Robinson (Adigital)Spain's advertising exclusion system is run by the industry body Adigital and recognised in data protection law (LOPDGDD art. 23). Callers relying on legitimate interest should screen against it. Legal status not re-checked.Being verifiedLista Robinson | Tell the caller; have a GDPR lawful basisNo Spanish-specific recording rule was confirmed in this pass. Under the GDPR a recording of an identifiable person is personal data, so the caller must be told (Art. 13) and the business needs a lawful basis (Art. 6). Check national law and the data protection authority's guidance.Being verifiedGDPR Arts. 6, 13 | Commercial calls on 400 numbers (reported)Reported, not confirmed in the BOE text: Ley 10/2025 of 26 December 2025 on customer-service requires a separate number range for commercial calls, and resolutions of 14 April 2026 assigned nine-digit numbers starting 400, which commercial calls from covered companies (basic-services firms and large companies) must use from 17 October 2026. Operators may block commercial calls from other numbers.Being verifiedFinreg360, 'Los números de teléfono que empiezan por 400 son obligatorios para las llamadas comerciales' | GDPR + LOPDGDD 3/2018The EU General Data Protection Regulation applies, alongside the national implementing law named here. The national law was not re-checked in this pass.Being verifiedRegulation (EU) 2016/679 (GDPR) | LGT and GDPR finesBreaches of art. 66 are sanctioned under the telecoms law and by the data protection authority (AEPD). Amounts not checked.Being verified |
| ItalyFull guide | Yes: EU AI Act Art. 50(1), since 2 Aug 2026Providers must design AI systems that talk to people so the person is told they are interacting with an AI system, unless that is obvious from context. Art. 50(5): the information must be clear and distinguishable, at the latest at the first interaction. The duty has applied since 2 August 2026, and the Digital Omnibus (Regulation (EU) 2026/1744) did not delay it. Breaches can be fined up to €15 million or 3% of worldwide annual turnover, whichever is higher (Art. 99(4)(g)); for SMEs the lower of the two applies.Regulation (EU) 2024/1689 (AI Act), Arts. 50(1), 50(5), 99(4)(g), 113 | Automated: opt-in. Operator calls: opt-out (RPO)Automated calls without an operator need consent. Calls by a human operator are allowed unless the number is on the Registro pubblico delle opposizioni. Based on Codice privacy art. 130; not re-checked in this pass.Being verified | No statutory calling hours confirmedWe did not confirm any statutory calling hours, or whether the telemarketing code of conduct sets them.Being verified | Registro pubblico delle opposizioni (RPO)Covers all national fixed and mobile numbers. Registering cancels consents given earlier, except those given after registration and those with companies the person has a contract with. Operators must check the register monthly and before every campaign.Ministero delle Imprese e del Made in Italy, RPO | Tell the caller; have a GDPR lawful basisNo Italian-specific recording rule was confirmed in this pass. Under the GDPR a recording of an identifiable person is personal data, so the caller must be told (Art. 13) and the business needs a lawful basis (Art. 6). Check national law and the data protection authority's guidance.Being verifiedGDPR Arts. 6, 13 | Identifiable caller ID requiredNot confirmed in this pass.Being verified | GDPR + Codice privacy (D.Lgs. 196/2003)The EU General Data Protection Regulation applies, alongside the national implementing law named here. The national law was not re-checked in this pass.Being verifiedRegulation (EU) 2016/679 (GDPR) | GDPR-level fines by the GaranteNot checked in this pass.Being verified |
| NetherlandsFull guide | Yes: EU AI Act Art. 50(1), since 2 Aug 2026Providers must design AI systems that talk to people so the person is told they are interacting with an AI system, unless that is obvious from context. Art. 50(5): the information must be clear and distinguishable, at the latest at the first interaction. The duty has applied since 2 August 2026, and the Digital Omnibus (Regulation (EU) 2026/1744) did not delay it. Breaches can be fined up to €15 million or 3% of worldwide annual turnover, whichever is higher (Art. 99(4)(g)); for SMEs the lower of the two applies.Regulation (EU) 2024/1689 (AI Act), Arts. 50(1), 50(5), 99(4)(g), 113 | Opt-in for calls to individualsAutomated calling systems need the recipient's prior consent (art. 11.7(1)). Para 2 applies the same rule to other means, including live calls, to natural persons, and each call must offer a free, easy opt-out. Para 4 has an exception for a company's own customers using contact details from a sale; how ACM applies it to phone calls was not checked.Telecommunicatiewet art. 11.7 | No statutory calling hoursNone found in art. 11.7. Not otherwise checked.Being verified | Bel-me-niet Register ended with opt-in (Jul 2021)The opt-in rule for calls to individuals started on 1 July 2021 and replaced the Bel-me-niet opt-out register. Dates not re-checked in this pass.Being verified | Tell the caller; have a GDPR lawful basisNo Dutch-specific recording rule was confirmed in this pass. Under the GDPR a recording of an identifiable person is personal data, so the caller must be told (Art. 13) and the business needs a lawful basis (Art. 6). Check national law and the data protection authority's guidance.Being verifiedGDPR Arts. 6, 13 | Caller ID must be shownNot confirmed in this pass.Being verified | GDPR + UAVGThe EU General Data Protection Regulation applies, alongside the national implementing law named here. The national law was not re-checked in this pass.Being verifiedRegulation (EU) 2016/679 (GDPR) | ACM finesThe Authority for Consumers and Markets enforces art. 11.7. Amounts not checked.Being verified |
| IrelandFull guide | Yes: EU AI Act Art. 50(1), since 2 Aug 2026Providers must design AI systems that talk to people so the person is told they are interacting with an AI system, unless that is obvious from context. Art. 50(5): the information must be clear and distinguishable, at the latest at the first interaction. The duty has applied since 2 August 2026, and the Digital Omnibus (Regulation (EU) 2026/1744) did not delay it. Breaches can be fined up to €15 million or 3% of worldwide annual turnover, whichever is higher (Art. 99(4)(g)); for SMEs the lower of the two applies.Regulation (EU) 2024/1689 (AI Act), Arts. 50(1), 50(5), 99(4)(g), 113 | Opt-in for automated calls and calls to mobilesAutomated calling machines need the individual's consent (reg 13(1)). Marketing calls to a mobile need the person's consent (reg 13(6)). Live calls to landlines are allowed unless the person objected or is opted out on the National Directory Database (reg 13(5)). The burden of proving consent is on the caller (reg 13(14)).S.I. No. 336/2011, reg 13 | No statutory calling hoursNone found in S.I. 336/2011. Not otherwise checked.Being verified | National Directory Database (NDD) opt-outLandline subscribers can record that they do not want marketing calls on the NDD; callers have 28 days after a listing before it binds them.S.I. No. 336/2011, regs 13(5), 13(9), 14 | Tell the caller; have a GDPR lawful basisNo Irish-specific recording rule was confirmed in this pass. Under the GDPR a recording of an identifiable person is personal data, so the caller must be told (Art. 13) and the business needs a lawful basis (Art. 6). Check national law and the data protection authority's guidance.Being verifiedGDPR Arts. 6, 13 | Name the caller; automated: name, address, phoneA marketing call must give the caller's name and, if different, the name of the business it is made for. An automated call must give the name, address and telephone number.S.I. No. 336/2011, reg 13(10) | GDPR + Data Protection Act 2018The EU General Data Protection Regulation applies, alongside the national implementing law named here. The national law was not re-checked in this pass.Being verifiedRegulation (EU) 2016/679 (GDPR) | Up to €250,000 per offence (company)Each unsolicited call is a separate offence. On indictment: up to €250,000 for a company and €50,000 for an individual.S.I. No. 336/2011, reg 13(13), 13(15) |
| United Arab EmiratesFull guide | Name company and purpose; no express AI ruleThe call must start by naming the company and the purpose (Art. 4(11)), say it is recorded (Art. 4(7)) and ask whether the person wants to continue before any pitch (Art. 5(7)). Automated systems may be used only within the rules (Art. 5(6)); breaching that is a separate fine. Neither Resolution 56 nor the Central Bank regulation expressly requires an 'I am an AI' statement, but the Central Bank regulation makes customers' consent record whether they accept AI agents (CBUAE Art. 7.2), and the Central Bank's AI guidance note of 11 February 2026 says licensed firms should be transparent when customers are interacting with an AI application (para 4(a)).Cabinet Resolution No. 56 of 2024, Arts. 4(7), 4(11), 5(6), 5(7); Resolution No. 57 of 2024, Table 1 | Licence approval + opt-in channel + DNCR; no repeat callsCompanies need prior approval from their licensing authority to telemarket (Art. 4(1)) and should market only to people who asked for it through the company's own channel (Art. 4(4)). No marketing calls to numbers on the DNCR (Art. 4(5)). If the person says no on the first call, do not call back about it; after no answer or a hang-up, retry at most once a day and twice a week (Art. 5(4), 5(5)).Cabinet Resolution No. 56 of 2024, Arts. 4 and 5 | 09:00 to 18:00 UAE time, every dayMarketing calls are allowed only from 9:00 am to 6:00 pm (Art. 5(3)). Neither Resolution 56 nor the Central Bank regulation limits calls to weekdays or rules out public holidays; weekend and holiday limits were only in the Central Bank's draft. Use UAE time (GST, UTC+4); the UAE has no daylight saving.Cabinet Resolution No. 56 of 2024, Art. 5(3); CBUAE Telemarketing Regulation, Art. 15.1 | Do Not Call Registry (DNCR)Calling numbers on the DNCR to market products or services is fined AED 50,000 / 75,000 / 150,000 for first, second and third violations. Callers must be trained on the DNCR (Art. 4(2)). People join by texting "DNCR" to 2211 or 1012 (TDRA).Cabinet Resolution No. 56 of 2024, Arts. 4(2), 4(5); Resolution No. 57 of 2024, Table 1 | Must record marketing calls; tell the person at the startCompanies must record marketing calls and tell the person at the start of the call that it is recorded (Art. 4(7)). They must also keep a register of all marketing calls in the authority's form (Art. 4(6)) and send periodic reports within one month of the due date (Art. 4(8)).Cabinet Resolution No. 56 of 2024, Arts. 4(6) to 4(8) | Numbers registered to the company's trade licenceMarketing calls must come from local numbers registered under the commercial licence of the company (Art. 4(3)). Individuals may not market from numbers registered in their own name (Art. 3(2)) and face fines and line cuts (Resolution 57, Table 2).Cabinet Resolution No. 56 of 2024, Arts. 3(2), 4(3); Resolution No. 57 of 2024, Table 2 | Federal Decree-Law 45/2021 (PDPL)In force since 2 January 2022. We found no published executive regulations as of 24 October 2026 (the official legislation portal lists none), so check before relying on a specific PDPL deadline. Free zones such as DIFC and ADGM have their own laws.UAE Legislation portal, Federal Decree-Law No. 45 of 2021 | AED 10,000 to 150,000 per violation; suspensionGraded penalties: a warning, fines by violation type (up to AED 150,000 for a third offence), suspension of all or part of the activity for 7 to 90 days, and licence cancellation with numbers removed; a repeat within six months can go straight to the most severe penalty.Cabinet Resolution No. 57 of 2024, Art. 3 and Table 1 |
| Saudi ArabiaFull guide | State reason and entity, ask to continue; no express AI ruleEvery promotional, awareness or service call must start by giving its reason and the entity the caller represents, and asking whether the person wants to continue; calls must come from the official numbers shown on the entity's website or other official channel (CST para 5-2-2). No CST or PDPL rule requires an 'I am an AI' statement. SDAIA's Generative AI Guidelines for Public (May 2025, s. 4.3) say developers and users should clearly communicate when generative AI is used in interactions with the public: guidance, not a binding rule.CST Regulations for Curbing SPAM Messages and Calls (decision 493/1444), para 5-2-2; SDAIA-P115E | Express, provable opt-in for promotional calls (CST); PDPL arts. 25 and 26Promotional calls need the person's express consent; consent buried in privacy policies or service contracts does not count, and the caller must be able to prove it. Stop within 24 hours of an opt-out request and confirm it (CST para 5-2-1). Under the PDPL a controller may not use a person's means of communication for advertising without prior consent and a clear way to stop (art. 25); the Implementing Regulation adds documented consent, the sender's name and an opt-out as easy as the opt-in (arts. 28 and 29). Calls from outside the Kingdom must be service or personal calls only (CST para 5-4-4).CST para 5-2-1 and 5-4; PDPL arts. 25 and 26; Implementing Regulation arts. 28 and 29 | No promotional calls 22:00 to 09:00 Saudi time; Ramadan 01:00 to 12:00Promotional and awareness calls are not allowed from 10:00 pm to 9:00 am every day, and during Ramadan from 1:00 am to 12:00 pm, Saudi time (UTC+3) (CST para 5-2-4). The rule does not cover service calls. The calling window below is the non-Ramadan one.CST Regulations for Curbing SPAM Messages and Calls, para 5-2-4 | No national do-not-call register for calls; report via 330330The CST rules set no national register for voice calls. People opt out with each caller, and can report promotional calls made without consent to 330330 or through their operator's app or website. Ten or more reports from different numbers within 60 days get a mobile number suspended until its owner verifies their identity within 30 days, or cancelled (CST Appendix 6).CST Regulations for Curbing SPAM Messages and Calls, para 5-1-3 and Appendix 6 | Treat recordings as personal data: tell the caller, have a legal basisA call recording identifies a person, so the PDPL applies: a legal basis (consent unless an exception in art. 6 applies) and notice of who is collecting, why and for how long, before or at collection (PDPL arts. 5, 6, 13; Implementing Regulation art. 4). Voiceprints used to identify people are sensitive data and need explicit consent. We found no Saudi rule specific to recording calls you take part in.Being verifiedPDPL arts. 1, 5, 6, 13; Implementing Regulation arts. 4 and 11 | Call from your official numbersCalls must be made through the official contact numbers shown on the entity's website or other official channel (CST para 5-2-2). Only private entities may make promotional calls; individuals may make only personal calls (CST para 5-4).CST Regulations for Curbing SPAM Messages and Calls, paras 5-2-2 and 5-4 | Personal Data Protection Law (PDPL)Applies to processing in the Kingdom and to processing of residents' data from outside it (art. 2(1)). Published by SDAIA (Saudi Data & AI Authority) with its Implementing Regulation.PDPL (Royal Decree M/19, amended by M/148) | PDPL: up to SAR 5 million, doubled on repeatA warning or a fine of up to SAR 5 million per violation; it can be doubled for a repeat violation (art. 36). Disclosing or publishing sensitive data to harm someone or for personal gain carries up to two years' prison or a SAR 3 million fine (art. 35). The CST rules leave enforcement to CST's own regulations (para 6.4) and set no fine amounts.PDPL arts. 35 and 36 |
| Singapore | No AI rule; must identify sender and contactA specified (marketing) message, including a voice call, must clearly identify who sent or authorised it and how to contact them, valid for at least 30 days. We found no rule requiring an AI disclosure.PDPA 2012, s.44 | Opt-out: check DNC unless clear consentYou may not send a marketing message, including a voice call, to a Singapore number unless you have valid confirmation that the number is not on the DNC Register. Clear and unambiguous consent in written or other accessible form is an exception (s.48), which was not re-read in this pass. Consent cannot be made a condition of supplying goods or services (s.46).PDPA 2012, ss.43, 46 | No statutory calling hoursNone found in PDPA Part 9. Not otherwise checked.Being verified | Do Not Call Registry (voice, SMS, fax)Check the register with the PDPC, or through a registered checker, within the prescribed period before calling.PDPA 2012, s.43 | Notify and get consent under the PDPAA recording is personal data, so the PDPA's notice and consent rules apply. Not re-checked in this pass.Being verified | Must not hide caller IDA marketing voice call must not conceal or withhold the calling line identity, and you must not take steps that have that effect.PDPA 2012, s.45 | Personal Data Protection Act 2012Includes the DNC provisions in Part 9. The Spam Control Act covers unsolicited bulk SMS and email, not voice calls.PDPA 2012 | DNC breaches: financial penalties (caps reported)Statute reproductions and law-firm notes give the cap for Part 9 (DNC) breaches as S$200,000 for an individual and S$1 million for others (s.48J(4)), since 1 October 2022. We could not open the official text to confirm it.Being verifiedPDPA 2012, s.48J(4), via Allen & Gledhill note, 2 Nov 2022 |
| Australia | No AI rule; caller must give required informationThe Industry Standard requires callers to give certain information during the call, such as who they are and the purpose. The exact list and timing were not re-read; we found no AI disclosure rule.Being verifiedACMA, Industry Standards (Do Not Call Register site) | Opt-out: Do Not Call RegisterTelemarketing calls are allowed to numbers not on the register. Numbers on the register may be called only with consent or under an exemption (for example registered charities). The Industry Standard applies to all telemarketing and research calls, including exempt callers.Do Not Call Register Act 2006; ACMA Industry Standards page | Weekdays 09:00 to 20:00, Sat 09:00 to 17:00, no SunTelemarketing calls: weekdays 9am to 8pm, Saturday 9am to 5pm, no calls on Sundays or national public holidays, unless the consumer consented to that time. Times are at the person's usual residential address; if they are elsewhere and it is outside the window there, end the call unless they want to continue.Telecommunications (Telemarketing and Research Calls) Industry Standard 2017 | Do Not Call RegisterRun for the ACMA. Wash calling lists against the register before calling.Do Not Call Register Act 2006 | State and federal laws varyRecording rules come from the federal interception law and state surveillance-device laws, which differ. Not checked in this pass.Being verified | CLI must be enabled; return number live 30 daysCalling line identification must be enabled. The number must stay able to take return calls for at least 30 days, and a caller must be able to learn the employer, purpose and who caused the call.Telecommunications (Telemarketing and Research Calls) Industry Standard 2017 | Privacy Act 1988 (Australian Privacy Principles)Not re-checked in this pass.Being verified | Up to $250,000 for Standard breachesACMA options range from formal warnings to penalties of up to $250,000 for breaches of the Industry Standards. Do Not Call Register Act penalties are separate.ACMA, Industry Standards page |
| Canada | ADAD calls must open with an identification messageAn ADAD is equipment that conveys a pre-recorded or synthesized voice message. Such calls must begin with a clear message naming who the call is for and its purpose, with an email or postal address and a local or toll-free number; repeat it at the end if the message runs over 60 seconds. We found no AI-specific rule.CRTC Unsolicited Telecommunications Rules, Part IV (ADAD Rules) | ADAD telemarketing: express consent. Live: DNCLTelemarketing using an ADAD needs the consumer's express consent, whether or not the call is exempt from the DNCL Rules. Live telemarketing to numbers on the National DNCL needs express consent that names the caller and the number.CRTC Unsolicited Telecommunications Rules, Parts II and IV | Weekdays 09:00 to 21:30; weekends 10:00 to 18:00Telemarketing is limited to 9:00 a.m. to 9:30 p.m. Monday to Friday and 10:00 a.m. to 6:00 p.m. Saturday and Sunday, in the consumer's time. Stricter provincial hours apply where they exist.CRTC Unsolicited Telecommunications Rules, Part III | National Do Not Call List (DNCL)Telemarketers must register with the DNCL operator and pay fees before calling, and must not call listed numbers without express consent. Some calls are exempt under s.41.7 of the Telecommunications Act.CRTC Unsolicited Telecommunications Rules, Part II; Telecommunications Act s.41.1 to 41.7 | One-party consent; PIPEDA noticeThe Criminal Code lets a party record, and privacy law (PIPEDA) expects notice of recording. Not checked in this pass.Being verified | Display originating or reachable numberTelemarketing and ADAD calls must display the originating number or an alternate number where the caller can be reached. Sequential dialling is prohibited. Contact numbers must work for 60 days.CRTC Unsolicited Telecommunications Rules, Parts III and IV | PIPEDA (Quebec: Law 25)Not re-checked in this pass.Being verified | CRTC administrative monetary penaltiesThe CRTC fines breaches of the Unsolicited Telecommunications Rules per violation. Caps of $1,500 for individuals and $15,000 for corporations per violation are reported in commentary; we could not open the Telecommunications Act text to confirm them. CRTC decisions often set lower amounts per violation.Being verifiedCRTC compliance and enforcement decisions (example: CRTC 2019-318) |
| Brazil | No AI call disclosure rule foundWe found no Anatel or ANPD rule requiring an AI disclosure on calls in this pass.Being verified | LGPD lawful basis; opt-out via Não Me PerturbeMarketing calls need an LGPD lawful basis (consent or legitimate interest). Consumers opt out of telecom and payroll-loan telemarketing through Não Me Perturbe. Not confirmed in the primary texts.Being verified | No national window confirmedSome states and municipalities set their own telemarketing hours. Not checked in this pass.Being verified | Não Me Perturbe (industry-run block list)A free block list run by the telecom operators and payroll-loan (consignado) banks under self-regulation. It covers those sectors' telemarketing only.Não Me Perturbe | One-party recording generally allowedCourts generally accept recordings by a participant. LGPD notice still applies. Not checked in this pass.Being verified | 0303 prefix now optional; call authentication (reported)Press reports (August 2025) say Anatel made the 0303 telemarketing prefix optional and moved callers making more than 500,000 calls a month to mandatory call authentication, with 'Origem Verificada' showing the caller's name, logo and reason. Not confirmed in an Anatel text.Being verifiedExame, 'Anatel deixa de exigir uso do prefixo 0303 em ligações de telemarketing', Aug 2025 | LGPD (Lei nº 13.709/2018)Enforced by the ANPD.Lei nº 13.709/2018 | LGPD: up to 2% of revenue, max R$50m per breachFines up to 2% of the company's revenue in Brazil in the last financial year, limited to R$50 million per infraction, plus daily fines and publication.LGPD art. 52 |
| NigeriaFull guide | No AI call disclosure rule foundWe found no NCC or NDPC rule on disclosing AI callers in this pass.Being verified | Consent for any direct marketing (GAID 2025)The NDPC's General Application and Implementation Directive (GAID) lists direct marketing as the first case where consent is required (Art. 18(1)(a)); keep a record of it (Art. 17(6)). Consent may be written, oral or electronic, but silence is not consent (NDPA s.26(3), (7)), and people can object to direct marketing at any time (s.36). The GAID states no start date; DLA Piper reports a six-month transition ending on 19 September 2025, which we did not find in an NDPC notice.GAID 2025, Arts. 17(6), 18(1)(a); NDPA 2023, ss.26, 35, 36 | None found in current official textsWe found no calling hours in the data law or the NCC's DND pages. 2016 press reports described an NCC rule allowing operators' marketing contact only from 8am to 8pm for subscribers who had not opted out; we could not confirm it in an NCC text or that it still applies.Being verifiedITWeb Africa, 'Mobile spam irks Nigeria's NCC' (2016 report) | DND via short code 2442The NCC's Do-Not-Disturb service: text STOP to 2442 to block all unsolicited calls and texts, or HELP to choose the categories you still want. Check numbers against your carrier's DND data before calling. Which NCC regulation now governs telemarketing calls (the 2007 Consumer Code of Practice or newer 2024 rules) was not confirmed.NCC consumer portal, Do-Not-Disturb (DND) service in Nigeria | Notify before collecting data; NDPA appliesTell the person who you are, why you collect their data and their rights before collecting it (NDPA s.27). We found no specific call-recording consent rule.Nigeria Data Protection Act 2023, s.27 | UnclearNot checked in this pass.Being verified | Nigeria Data Protection Act 2023 + GAID 2025Enforced by the Nigeria Data Protection Commission (NDPC).NDPA 2023; GAID 2025 | NDPA: up to ₦10m or 2% of annual gross revenueFor a data controller or processor of major importance, the greater of ₦10 million or 2% of annual gross revenue in the preceding financial year; for others, the greater of ₦2 million or 2%.Nigeria Data Protection Act 2023, s.48 |
| KenyaFull guide | No AI call disclosure rule foundWe found no ODPC or Communications Authority rule on disclosing AI callers in this pass.Being verified | Express consent; prior consent for automated callsPersonal data may not be used for commercial purposes without the person's express consent, unless a written law allows it (DPA s.37(1)). Using 'automated calling systems without human intervention' for direct marketing without the subscriber's prior consent is an offence under the 2010 telecom consumer rules (reg. 17(1)). Every marketing message must give a free way to opt out (2021 regs, reg. 15(2)). A draft Consumer Protection Regulations, 2026, put to a validation forum on 17 September 2026, would replace the 2010 rules and ban any direct marketing sent without prior consent; we found no gazetted version as of 24 Oct 2026.Data Protection Act 2019, s.37(1); Consumer Protection Regulations 2010, reg. 17(1); Data Protection (General) Regulations 2021, reg. 15(2) | No statutory calling hours foundNone in the data protection law or the 2021 regulations. Communications Authority rules on hours not checked.Being verified | No national register found; honour each opt-outWe found no national do-not-call register. On a marketing call, one way to meet the opt-out duty is to tell the person they can opt out verbally (reg. 17(2)(d)). After an opt-out, stop using their data for direct marketing (reg. 16(2)); stop sharing it with third parties for marketing within seven days of a request (reg. 18).Data Protection (General) Regulations 2021, regs 16 to 18 | Notify before collecting dataNotify the person before collecting their data (DPA s.29). No specific call-recording rule was checked.Being verified | UnclearNot checked in this pass.Being verified | Data Protection Act 2019Enforced by the Office of the Data Protection Commissioner (ODPC).Data Protection Act 2019 | KES 5m or 1% (ODPC); offences under the regulationsThe Data Commissioner can fine up to KES 5 million or 1% of turnover, whichever is lower (DPA s.63). Using data for commercial purposes without consent is an offence: up to KES 20,000, six months' prison, or both (2021 regs, reg. 15(4)). Under the 2010 telecom rules, the general penalty is up to KES 300,000, three years' prison, or both (reg. 23(3)); the 2026 draft would set up to KES 1 million, six months' prison, or both.Data Protection Act 2019, s.63; Data Protection (General) Regulations 2021, reg. 15(4); Consumer Protection Regulations 2010, reg. 23(3) |
| South AfricaFull guide | No AI rule; must identify sender and opt-outAny direct marketing communication must give the sender's identity (or who it is sent for) and an address or contact details for opting out. We found no AI disclosure rule.POPIA s.69(4) | Opt-in, or own customer with opt-out (POPIA s.69)Direct marketing by electronic communication, including automatic calling machines, needs consent unless the person is a customer whose details came from a sale, the marketing is for your own similar products, and they were given an opt-out at collection and each time. You may ask a non-customer for consent once. The Information Regulator's Guidance Note on Direct Marketing (3 Dec 2024) says ordinary phone calls count as electronic communication; the note is advisory, and law firms say that view is open to challenge. An AI agent that dials automatically is closer to an 'automatic calling machine', so get consent first.POPIA s.69(1) to (3); Information Regulator Guidance Note on Direct Marketing, para 7.1.1 | Mon to Fri 08:00 to 20:00, Sat 09:00 to 13:00, no SunNo direct marketing to a consumer at home on Sundays or public holidays, on Saturdays before 09:00 or after 13:00, or on other days between 20:00 and 08:00. The exception where the consumer expressly or implicitly asked or agreed otherwise is worded as part of the weekday rule; on our reading it is unclear whether it covers Saturdays, Sundays and holidays. The windows below do not exclude public holidays.Consumer Protection Act s.12 and the notice on prohibited times, via Acts Online | National Opt-Out Registry (launched 7 Oct 2026)Created by the Consumer Protection Act Amendment Regulations, 2026 (gazetted 15 April 2026) and run by the National Consumer Commission. Marketers register from 15 September to December 2026, free list cleaning runs from December 2026 to April 2027, and on the Commission's timetable consumers can block marketers from May 2027; lists must be cleaned monthly. Not being on the registry is not consent under POPIA (Information Regulator, 21 April 2026).National Consumer Commission, NCC launches the National Opt-Out Registry, 7 Oct 2026 | One-party consent (RICA s.4)A party to a call may record it under RICA. POPIA notice still applies. If you ask for marketing consent by phone, the Regulator's guidance says to read out Form 4 and record the call. RICA not checked in this pass.Being verified | UnclearNo specific caller ID rule was checked in this pass.Being verified | POPIA (Act 4 of 2013)Enforced by the Information Regulator. The Consumer Protection Act, enforced by the National Consumer Commission, adds calling hours and the opt-out registry.Protection of Personal Information Act 4 of 2013 | CPA: R1m or 10% of turnover; POPIA: up to R10mConsumer Protection Act administrative fines: up to R1 million or 10% of annual turnover, whichever is higher (s.112). Under POPIA the Information Regulator can impose an administrative fine of up to R10 million (s.109(2)(c), text as reproduced on popia.co.za).Consumer Protection Act s.112, via Acts Online; POPIA s.109 |
This page summarises public rules and is not legal advice. Where an official source is online, the entry links to it; check the source before you rely on it. More tools and guides are in Resources.