The UK rules for AI calls, texts, WhatsApp and email, in plain English

Search for whether AI calling is legal in the UK and you will find pages that flatly contradict each other. Some say the ICO applies the same rules to AI and human callers. Others say the ICO classes AI calls as automated calls needing consent. Neither cites an ICO document, because there isn't one that says either.

What follows is what the rules do say, quoted from source, and an honest account of the gap.

Who makes the rules

The distinction that matters most: marketing or service?

PECR's calling and messaging rules apply to direct marketing: promoting your products, services or aims. They do not apply in the same way to service communications: confirming an appointment, answering a question the customer asked, telling someone their engineer is running late, returning a call.

The line is easy to cross. An appointment reminder is service. An appointment reminder that adds "and ask about our autumn offer" is marketing. A call returning a quote request is a response to the customer; a call three months later to see if they want anything else is marketing.

UK GDPR applies to both, so you still need a lawful basis, transparency and security for the personal data involved.

Live marketing calls

For a marketing call made by a person, the ICO's guidance says you:

• "must not call someone who told you they do not want your marketing calls";
• must not call numbers registered with the Telephone Preference Service or the Corporate TPS unless that person has consented to your calls. You "must check phone numbers against these registers before you make the calls", and a number counts once it has been on the register for 28 days;
• "must display your number (or a valid alternative contact number)";
• must say who is calling, and give contact details if asked.

Some sectors are stricter: claims management calls need consent, and cold calls about pensions are banned in almost all cases.

Calls to businesses are not exempt. In the ICO's words, "The rules are the same as for calls to individuals." Screen against both registers.

Automated calls, and the unanswered question about AI

Regulation 19 of PECR sets a much higher bar for automated marketing calls. You may make them only where the person "has specifically consented to receive this type of call from you". The ICO is explicit that "general consent for marketing, or even consent for live calls, is not enough".

So is a conversational AI call an automated call? Here is the text. Regulation 19 prohibits "communications comprising recorded matter for direct marketing purposes by means of an automated calling or communication system", and defines such a system as one capable of:

"(a) automatically initiating a sequence of calls to more than one destination in accordance with instructions stored in that system; and (b) transmitting sounds which are not live speech for reception by persons at some or all of the destinations so called."

There are two readings.

• It applies. A synthetic voice is plainly "not live speech", and a platform that dials a list is initiating a sequence of calls.
• It doesn't. The prohibition is on "recorded matter". A model generating a fresh reply to what the caller just said is not playing a recording, and the rule was written in 2003 with recorded-message diallers in mind.

The ICO has not published a view. The nearest signal is its 2025 enforcement against two home-improvement firms, fined £300,000 and £250,000 over about 12 million calls in which overseas agents triggered pre-recorded clips with "avatar" software. The ICO treated those as automated calls even though a human was involved in each. Lawyers commenting on the case expect the regulator to resist any reading that creates a loophole for AI.

Texts and emails

Under regulation 22, marketing by text or email to an individual needs consent, unless the soft opt-in applies. That requires all of the following:

• you got their details when they "bought (or negotiated to buy) a similar product or service from you";
• you are marketing your own similar products or services;
• you gave them a simple way to opt out when you collected the details, and in every message since.

It never covers bought-in lists. In January 2026 the ICO fined one company £120,000 for four million texts where the opt-out wasn't simple enough, and another £105,000 for emails sent on "consent" spread across 361 partner companies.

You can email or text corporate bodies without consent, provided you identify yourself and offer an opt-out. But "sole traders and some partnerships are treated as individuals", and UK GDPR still applies to named people at work.

WhatsApp

WhatsApp messages are electronic messages, so the same PECR rules apply to marketing sent that way. On top of that, Meta's own policy requires that people have opted in to receive messages from your business on WhatsApp, and that automated conversations offer "prompt, clear, and direct escalation paths" to a person.

Ofcom: diallers, silent calls and caller ID

Ofcom can fine up to £2 million for persistent misuse of a phone network. Its policy has no safe harbour: the old 3% abandoned-call tolerance was removed in 2017. Among the things it treats as aggravating:

• calls left to ring for less than 15 seconds;
• abandoned calls with no information message;
• inaccurate answering-machine detection that hangs up on real people;
• caller ID that isn't a real number people can ring back.

An AI agent that speaks the moment a call is answered doesn't produce silent or abandoned calls in the way a predictive dialler does. But the rules on caller ID, ring time and voicemail detection apply to any system that dials.

On texts, Ofcom's July 2026 rules require messaging providers to check who their business senders are and that sender names match, from 15 July 2027 for business messaging. There is no mandatory sender ID register: Ofcom rejected that on cost grounds.

Do you have to say it is an AI?

• UK: no AI-specific statute requires it, as of November 2026. But you must identify who is calling, consumer law prohibits misleading people, and Ofcom said in September 2026 that it "should be very clear to telecoms customers when they are interacting with a GenAI application".
• EU: Article 50 of the AI Act has applied since 2 August 2026. People must be informed they are interacting with an AI system, at the latest at the first interaction, unless it is obvious. It reaches UK firms dealing with people in the EU.

Customers want it too: 71% in Five9's 2026 survey said it was very or extremely important to know, rising to 76% in the UK. Say it in the first sentence, and offer a person. For example: "Hello, this is the AI assistant at Hartley Heating, calling about the quote you asked for. I can pass you to one of the team at any point."

Recording, and decisions made by AI

Recording and transcripts. Tell people at the start of a call that it is recorded and why, cover it in your privacy notice, keep recordings only as long as you need them, and be ready to delete on request.

Automated decisions. Since February 2026, UK law allows significant decisions to be made solely by automated means on more grounds than before, but with safeguards: people must be told, be able to make representations, obtain human intervention and contest the decision. The ICO's draft guidance says "human intervention cannot be tokenistic". If an AI agent can refuse a claim, decline a customer or set a price, this applies to you. If it books appointments and takes messages, it probably doesn't.

What it costs to get wrong

Fines actually issued in 2026 have been in the range of £100,000 to £300,000, for campaigns of hundreds of thousands to millions of calls or messages to people who hadn't agreed. We found none yet at the new maximum. The increase signals intent.

A summary by channel

A checklist before you switch anything on

1. For each flow, decide whether it is marketing or service, and write down why.
2. Record where each contact's details and permission came from, per channel.
3. Make enquiry forms say you may call, including by AI assistant, and may text.
4. Screen marketing call lists against the TPS and CTPS before every campaign.
5. Show a real, returnable number on every call.
6. Set calling hours, and limits on attempts per person.
7. Make one opt-out stop every channel, at once and for good.
8. Open every AI call by saying who it is from and that it is an AI, and offer a person.
9. Announce recording, and set a retention period.
10. Keep the rules in the system, not in the AI's instructions.

The last point is why we built Unibound the way we did: opt-outs, calling hours, daily limits and spend are checked in code before every call and message, and can't be talked round by a prompt. Software can enforce the limits you set. Deciding who you are permitted to contact, and for what, remains your decision.

Related: lead reactivation in the UK, where permission matters most, and choosing between WhatsApp, SMS, email and a call.

Questions people ask