Cold Calling Laws in Ireland: Mobiles Need Consent First

November 2, 2026. In Ireland a sales call to a mobile phone needs the person's prior consent, and the text of the rule is not limited to private individuals, so we read it as covering business mobiles too. A sales call to a landline is allowed unless the line is on the National Directory Database (NDD) opt-out register or the person has told you no. On our reading, an AI voice agent that dials and talks with no human involved is an automated calling machine, which needs prior consent before it calls an individual. Every unlawful call is a separate criminal offence, punishable by up to €5,000 on summary conviction and up to €250,000 for a company convicted on indictment.

What Regulation 13 says about sales calls

The rules sit in Regulation 13 of S.I. No. 336 of 2011, Ireland's ePrivacy Regulations, read here in the text as made. Five parts matter for outbound campaigns:

1. Mobiles are opt-in. Regulation 13(6) bars a direct marketing telephone call or automated call to the mobile telephone of a "subscriber or user" unless that person has told the caller they consent, or their consent to marketing calls is recorded in the NDD. Unlike Regulation 13(1), it is not limited to natural persons. The Data Protection Commission (DPC) adds that the mobile operators have opted out all their subscribers by default, though that is "not an NDD opt-out".
2. Landlines are opt-out. Under Regulation 13(5) you may not make a marketing call to any subscriber who has told you they do not consent, or whose line is recorded on the NDD opt-out register. The DPC says both residential and business numbers can carry that preference, ex-directory numbers are included automatically, and listing "should only stop unsolicited marketing calls made from within the Republic of Ireland". A caller has 28 days after a preference is recorded before it bites (Regulation 13(9)).
3. Automated calls split by who is called. Regulation 13(1) requires prior consent before an automated calling machine contacts an individual. For a subscriber that is not a natural person, such as a company, Regulation 13(3) applies the opt-out test instead, although an automated call to any mobile still falls under the consent rule in 13(6).
4. Say who is calling. Regulation 13(10) requires a call to include the caller's name and, if applicable, the name of the person it is made for. An automated call must give the name, address and telephone number of the caller and, if applicable, of the person it is made for.
5. The defendant carries the proof. If consent is disputed in a prosecution, Regulation 13(14) puts the burden on the defendant to show the person "unambiguously consented".

One limit on "unsolicited": the DPC says that where a person has "an ongoing, or recent, relationship" with a business, contact from it "might not be deemed to be unsolicited, as implied consent may be in place". That depends on the circumstances, so we would not build a calling list on it.

Does an AI voice agent count as an automated calling machine?

The Regulations define an automated calling machine as "an automatic calling machine or system which, when activated, operates to make calls without human intervention". An AI agent that dials a list and holds the conversation on its own matches those words, so on our reading it needs prior consent before calling an individual under Regulation 13(1). A call placed by a person with AI help on screen is an ordinary telephone call under 13(5) or 13(6). For a mobile number the distinction changes nothing, because both kinds of call need consent first. That is our reading of the text.

A second rule now applies on top. Article 50(1) of the EU AI Act, which applies from 2 August 2026, requires providers to design AI systems that interact with people so that the person is told they are dealing with an AI, unless that is obvious. Whoever builds the agent carries that duty, and a business deploying one should check it is met.

Fines, prosecutions and what the DPC has done

Breaking Regulation 13(1), (3), (5) or (6) is an offence, and Regulation 13(13) makes "the making of each unsolicited call" a separate one. On summary conviction the penalty is a class A fine, which section 3 of the Fines Act 2010 sets at up to €5,000. On indictment it is up to €250,000 for a company and up to €50,000 for an individual. As a hypothetical, 50 unlawful calls to Irish mobiles would be 50 separate offences, each carrying up to €5,000 on summary conviction.

In the two DPC releases we read, the outcomes were far below those ceilings:

1. October 2024, phone calls. Google Ireland pleaded guilty to two charges of making unsolicited phone calls to a customer who had said he did not want them. The court directed each of the three companies prosecuted in that round to give €1,500 to a charity and pay the DPC's legal costs, in place of a conviction and fine. The DPC had warned each company first, Google in July 2023 (DPC release).
2. 7 September 2026, marketing emails. Brown Thomas Arnotts pleaded guilty to 5 sample charges out of 21 under Regulation 13, after a technical issue at its software provider caused "an intermittent inability to unsubscribe". The court applied the Probation of Offenders Act and ordered a €1,000 charity donation and €1,000 towards the DPC's legal fees. The DPC had warned it in March 2022 (DPC release).

In 2024 the DPC also noted that all three companies had used third-party processors for the marketing and remained responsible for the actions of those processors. A business that hires an agency or a dialer vendor stays responsible for the calls made for it.

ComReg's scam call blocking and your outbound numbers

Separately from the DPC, the telecoms regulator ComReg works with operators on fraud. Its nuisance communications page lists fixed and mobile CLI blocking "to stop fraudsters abroad spoofing Irish" numbers, a Do-Not-Originate list for numbers that never call consumers, and a voice firewall to block spam calls "wherever they arise". ComReg research in 2022 conservatively estimated the harm from scam calls and texts at about €309 million a year. If your dialer runs on a platform outside Ireland and presents an Irish number, we suggest asking your carrier how those calls will be treated before a campaign starts.

What it means for operators

1. Split the list by line type. Mobiles need recorded consent before any sales call, from a person or an agent. Landlines need an NDD opt-out check and a refusal log.
2. Keep consent you can produce. The burden of proof is on the defendant, so store who agreed, when, how, and to calls from whom.
3. Point the AI agent at consent. On our reading, calls a person asked for or consented to are where an AI agent belongs; a cold AI dial to an individual needs prior consent under Regulation 13(1).
4. Open every call the same way: your name, the business you call for, and for an AI agent, that it is an AI.
5. Write it into vendor contracts. The 2024 cases show the business stays responsible for calls its processor makes for it.

If you want AI calls designed this way, see AI calling built around consent and our AI call answering agent for inbound demand. For vendors, read our AI voice agents comparison and the AI answering service for HVAC example. For email to Irish inboxes, read cold email laws in Ireland; compare the UK calling rules, South Africa's POPIA calling rules and the cold calling laws by country table. This is general information, not legal advice.