Outbound AI calling can cut no-shows, chase quotes and collect feedback at a fraction of the cost of a call centre. It is also one of the most regulated things you can do with a phone line in the UK. This guide explains the rules in plain English so you can plan a campaign with your eyes open.
This guide is general information, not legal advice. For marketing campaigns in particular, check your approach with your data protection lead or a solicitor before you dial.
Start with one question: is it marketing?
The Privacy and Electronic Communications Regulations (PECR) control direct marketing by phone. Direct marketing is any communication that promotes your products, services, aims or ideals to a particular person. Whether a call counts depends on its content, not on what you call it.
Usually not marketing (service calls):
- Appointment reminders and confirmations
- Telling a customer an order has shipped or a repair is booked
- Collecting a payment that is genuinely due
- Asking about a service the customer has just received, with no sales content
Usually marketing:
- Offering a new product, upgrade or renewal deal
- Win-back calls to lapsed customers
- A “satisfaction survey” that ends with a sales pitch
Service calls still need a lawful basis under UK GDPR and must be made fairly, but the PECR marketing rules below do not apply to them. Keep service scripts free of promotional content so they stay that way.
Live marketing calls and the TPS
For a live marketing call to an individual, PECR says you must not call:
- a number registered with the Telephone Preference Service (TPS), unless that person has specifically told you they are happy to receive marketing calls from you; or
- anyone who has previously told you they do not want your calls.
Businesses can register with the Corporate TPS (CTPS), and the same screening applies to calls to company numbers.
In practice that means screening every list against the TPS and CTPS before each campaign, keeping your own suppression list of people who opted out, and recording where any specific consent came from.
Automated calls need prior consent
PECR treats automated marketing calls — calls made by an automated calling system rather than a person — more strictly. You can only make them to people who have given you specific prior consent to receive automated marketing calls from you. TPS screening is not enough on its own.
Whether a conversational AI voice agent counts as an “automated calling system” has not been tested in a UK court. The careful position, and the one we recommend, is to treat AI marketing calls as automated calls and only make them with clear, recorded consent. Use AI freely for service calls, where the consent rule does not apply.
Caller ID and how calls ring
Whatever the purpose, two technical rules matter:
- Show a number. PECR requires marketing callers to display a calling line identity, and Ofcom expects callers to present a number people can ring back to identify you and opt out.
- Let calls ring properly. Ofcom’s persistent misuse policy says calls that ring for less than 15 seconds before being ended — or ring for very long periods — are more likely to cause harm and face enforcement.
If a call is answered but your system cannot continue it, play a short information message that says who was calling, gives a number to opt out and contains no marketing.
The cost of getting it wrong
Since 5 February 2026, the Data (Use and Access) Act 2025 has raised the maximum PECR fine from £500,000 to UK GDPR levels: £17.5 million or 4% of global annual turnover, whichever is higher. The ICO also has stronger investigation powers. Marketing calls are one of its most common enforcement areas.
How to run a compliant AI campaign in Narvin
Narvin gives you the controls; you decide how to use them.
- Classify the campaign. Write down whether it is a service or marketing campaign, and keep sales content out of service scripts.
- Clean the list. Screen against TPS and CTPS for live marketing, remove opt-outs and only include people with recorded consent for AI marketing calls.
- Set the calling window. Each campaign has its own time zone, start and end time and a maximum number of calls per hour. Schedule it to run within sociable hours, and pause it if it would run into the evening.
- Identify yourself. Start every call with the business name and that the caller is speaking to an AI assistant, and offer a way to opt out.
- Record outcomes. Campaign outcomes and the activity log give you an audit trail of who was called, when and what happened.
Quick checklist
- Service or marketing? Decided and documented
- Lawful basis recorded under UK GDPR
- TPS and CTPS screening done (live marketing)
- Prior consent held for AI or automated marketing calls
- Opt-out list applied and kept up to date
- Opening line names the business and says it is an AI
- Caller ID shows a number people can call back
- Calling window set in the right time zone
Read more about how we handle data on our security page, or see how outbound AI calling works in Narvin.
