Cold Calling Laws in the UK: CTPS, AI Voices and the New Fine Ceiling

September 5, 2026. Cold calling a UK business is legal. Cold calling it with an AI voice is, on the regulator's own enforcement record, not legal without that business's prior consent. That distinction decides more outbound strategy than the whole of the rest of the rulebook, and it comes from three cases decided in 2025 and 2026 in which the Information Commissioner treated calls where a human agent played pre-recorded clips in reply to the recipient as automated calls needing consent. Since February 5, 2026 the ceiling for those breaches is 17.5 million pounds or 4 percent of worldwide turnover, and every unanswered dialler attempt now counts as a call. Here is the UK regime for live calls, automated calls and AI voices, from the Privacy and Electronic Communications Regulations, the ICO and Ofcom.

Live calls: TPS, CTPS and the 28-day rule

Regulation 21(1) of PECR prohibits unsolicited marketing calls to a subscriber who has told you not to call, or whose number is on the register kept under Regulation 26. That register is one register covering both individuals and corporate subscribers, run as the TPS and the CTPS, and the ICO's guidance says you must screen against both. A number listed for fewer than 28 days is not yet protected. A listed subscriber can tell a named caller it does not object, and can withdraw that at any time. Two definitions matter for B2B teams. Corporate subscribers are companies, LLPs and Scottish partnerships. Sole traders and ordinary English, Welsh and Northern Irish partnerships are individuals, register on the TPS and get the individual protections. The ICO also reads "instigate" in Regulation 21 to catch the client of an outsourced call centre, so agency and client are both exposed.

The rules every marketing call must follow

1. Present a valid calling line identity. Regulation 21(A1), in force since May 2016, bans withholding CLI on marketing calls and requires a number on which the caller can be contacted.
2. Give your name every time, and an address or freephone number on request. Regulation 24 for live calls; automated calls must carry both in every message.
3. Screen against TPS and CTPS, then honour direct objections, which override any registration status.
4. Claims management calls need consent from everyone, corporate subscribers included, under Regulation 21A; pension cold calls to individuals are banned unless the caller is FCA-authorised or a scheme trustee with consent or an existing relationship, under Regulation 21B.
5. An attempt is a call. Since February 5, 2026, Regulation 2 provides that a reference to making a call includes attempting to establish a connection, and the intended recipient is treated as the recipient of an unsuccessful attempt. A dialler that rings a CTPS-listed company and hangs up has made a prohibited call.

Automated calls and AI voices

Regulation 19 prohibits transmitting communications comprising recorded matter through an automated calling system unless the subscriber has previously notified the caller that it consents. There is no TPS exemption and no B2B exemption, and the ICO reads consent to the UK GDPR standard, specific to automated calls from that caller. Regulation 19(4) defines the system as one that can automatically initiate a sequence of calls and transmit "sounds which are not live speech". PECR never uses the phrase "live call"; the ICO's guidance says a live call is one where a live person is speaking.

The ICO has not published guidance on AI-generated voices. It has done something more decisive. In September 2025 it fined Home Improvement Marketing 300,000 pounds for 2,449,380 calls and Green Spark Energy 250,000 pounds for about 9.5 million calls, and in July 2026 it fined Thermotech Wall and Loft Surveys 240,000 pounds for 575,062 calls. In each, a human agent sat on the line and chose which pre-recorded clip to play in response to the person who answered, so-called avatar software. The ICO classed every such call as a Regulation 19 automated call requiring prior specific consent and published a checklist on how to spot robo-calls. If a clip selected by a human in real time is not live speech, a synthesised voice generated by a model is not live speech either. The consequence for outbound teams is stark: a human SDR may call any UK company not on the CTPS, but an AI voice agent needs each business's prior consent before it dials.

Penalties since February 5, 2026

The Data (Use and Access) Act 2025, commenced for this purpose on February 5, 2026, applied the Data Protection Act 2018 penalty regime to PECR. Breaches of Regulations 19 to 24 now attract the higher maximum: 17,500,000 pounds or 4 percent of total annual worldwide turnover, whichever is higher. The Commissioner may also issue a penalty notice to an officer of the body, a director, manager or secretary, where the failure occurred with their consent or connivance or through neglect. New interview and assessment powers came with it. Every fine listed above was issued under the old regime, so the new ceiling is untested, and the ICO said in June 2026 that separate guidance on the higher fines is in development.

The B2B case

Energy Prices Direct, a Glasgow energy broker, was fined 160,000 pounds in a notice dated March 30, 2026 for more than 700,000 calls to TPS and CTPS numbers between January 2024 and January 2025, to individuals and businesses. It had bought lists without checking whether they had been screened, and staff denied on the line that they were making a sales call. The fine was paid. It is the clearest recent statement that the CTPS is a statutory opt-out for companies and that "we bought the list" is not a defence.

Ofcom, caller ID and overseas diallers

Ofcom's General Condition C6 requires calling line identification to be a valid, dialable number that uniquely identifies the caller. Since January 29, 2025, providers must identify and block calls from abroad that falsely display a UK landline number. From July 15, 2027, calls from abroad presenting UK mobile numbers will be shown as withheld, because no UK provider can verify them. Put those together with Regulation 21(A1): an overseas dialler presenting a UK number will be blocked or stripped to withheld, and a withheld CLI on a marketing call is itself a breach. The Treasury's 2023 consultation on banning all consumer financial cold calls still reads "we are analysing your feedback" as of today, three years on.

What it means for operators

The UK rewards a specific outbound architecture. Live human calls to companies remain the least regulated channel, provided you screen both registers, present a real UK number you can be reached on, name yourself, and keep a suppression list that outranks any register. Every attempt counts, so dialler pacing that rings and abandons is now a compliance event as well as a nuisance. AI voice sits on the other side of a line the ICO has already drawn in enforcement, which means the honest use of AI voice agents in the UK is inbound, consented follow-up, and calls to your own customers who agreed to automated contact, not first-touch prospecting. If your calling runs from outside the UK, your presentation number will fail Ofcom's checks unless you carry genuine UK numbering through a UK provider.

Checklist for UK calling

1. Screen against TPS and CTPS, re-screening within the register's 28-day cycle.
2. Present a valid UK CLI you can be reached on; never withhold.
3. Human voice for prospecting; consent on file before any automated or AI voice.
4. Name the company on every call, address or freephone number on request.
5. Count attempts as calls in your dialler reporting.
6. Document officer oversight. Directors are now personally fineable.

The email side of the same regime is in our guide to UK cold email laws, the US position on AI callers in is AI cold calling legal, and the French ban in France's cold calling ban. If you want the consent capture and the human-first sequencing designed so that voice AI does the compliant part of the job, that is how we scope compliant AI calling programmes for UK and US clients.