TCPA Compliant AI Calling: What 5 Platforms Actually Enforce

October 11, 2026. Which AI calling platforms are TCPA compliant? None of them, in the sense buyers usually mean, and the vendors say so in their own documentation. HighLevel states that it "does not perform platform-level contact consent validation before placing outbound Voice AI calls". ElevenLabs publishes a TCPA guide that assigns time-zone awareness, do-not-call scrubbing and consent records to the business placing the calls. What actually differs between platforms is which guardrails they enforce for you, which ones they offer but leave switched off, and which ones they do not have at all. We read the outbound calling documentation of Retell AI, Vapi, Bland, ElevenLabs and HighLevel (read 11 October 2026) and sorted their controls against the four parts of the rule that decide most TCPA claims. If you would rather have the whole stack built for you, that is what our TCPA-compliant AI calling service does.

A note on scope: this is a feature comparison, not legal advice, and features change. Every claim below links to the vendor page it came from.

The four controls that decide a TCPA claim

1. Consent. Since the FCC's February 2024 ruling, an AI-generated voice is an artificial voice (FCC-24-17), so any call to a cell phone needs prior express consent, and any call that sells needs prior express written consent (47 CFR 64.1200(a)(1) to (a)(3)).
2. Calling hours. Telephone solicitations may only be made between 8 a.m. and 9 p.m. local time at the called party's location (64.1200(c)(1)). The key words are "called party's location", not your office's time zone.
3. Do-not-call lists. Two of them: the national registry, which a seller must check using a copy no more than 31 days old to keep its safe harbor (64.1200(c)(2)(i)(D)), and your own internal list of people who asked you to stop, honored within ten business days and kept for five years (64.1200(d)(3) and (d)(6)).
4. Opt-out mechanics. An artificial-voice telemarketing call must identify the business at the start and offer an automated voice or key-press opt-out within two seconds of that identification, which adds the number to your list and ends the call (64.1200(b)). Consent can also be revoked by any reasonable means, including saying so (64.1200(a)(10)).

Calling hours: one time zone per batch is the norm

Most platforms let you schedule a calling window, but almost all of them apply one time zone to the whole batch.

• Retell AI batch calls accept a call_time_window of allowed minutes in local time with a single timezone and a list of days; windows cannot cross midnight (Create Batch Call).
• Vapi campaigns are explicit about it: "A campaign uses one time zone and calling window for every contact." Its documentation tells you to split audiences into separate campaigns by time zone, not to infer local time from an area code, and to exclude contacts whose location you cannot determine (Campaign scheduling and lifecycle).
• Bland sets a time zone per call, defaulting to America/Los_Angeles and handled automatically for US numbers, and lets you schedule a start_time; it does not document an enforced calling window (Send Call).
• ElevenLabs added time zone selection to batch scheduling in January 2026, and its TCPA guide tells developers to implement 8 a.m. to 9 p.m. time-zone awareness themselves (TCPA Compliance).
• HighLevel is the one that enforces a window per contact: outbound Voice AI calls are scheduled between 8:00 AM and 8:00 PM "based on the contact's phone-number timezone", and calls outside the window move to the next eligible time (Voice AI Outbound Calling Compliance Checks).

Notice the tension between the last two approaches. HighLevel derives local time from the phone number; Vapi's documentation warns against exactly that, because mobile numbers move with their owners. A 312 number belonging to someone who moved to Los Angeles is a 6 a.m. call if you trust the area code. The safest pattern is a time zone taken from the customer's service or billing address, stored in your CRM, with a conservative window for contacts you cannot place.

Do-not-call: internal lists are not the national registry

Retell has the most developed internal do-not-call handling, and it is off by default. With Do-not-contact Handling enabled, the agent confirms the request once, ends the call and marks the contact do-not-call. But marking does not block calls by itself: the Create Phone Call API only refuses a marked number when you pass honor_internal_dnc: true, which defaults to false, and the documentation states plainly that "Batch calls and inbound calls don't check do_not_call" (Retell do-not-call requests). Its dashboard dialer and campaigns can be set to honor the flag.

Vapi offers a different tool: a pre-dial webhook that can check consent and suppression status in your own system immediately before each call and return eligible: false to skip a contact. Bland's API documents an error for numbers found on its own do-not-call list. HighLevel limits each number to one Voice AI call per day and fourteen in fourteen days, and tells businesses to keep honoring opt-outs and DND preferences themselves.

In the documentation we read, none of the five says it scrubs your list against the national Do Not Call Registry for you. That check, against a registry download no more than 31 days old, stays in your pipeline.

Consent: nobody checks it for you

HighLevel is the most explicit. Its outbound terms are accepted once per location, and the help center warns that accepting them "does not establish permission to call an individual contact". It used to validate consent on forms, surveys and calendars before dialing; its current Flexible Outbound Calling Framework removed that platform-level check and leaves consent records to you (we wrote about the change in does GoHighLevel check consent before an AI call). ElevenLabs gives sample consent language and says the burden of proving consent is on the caller. Retell, Vapi and Bland document no consent verification at all in the pages we read, and their contracts put compliance on the customer, as we found when we read them for AI voice agent liability.

What each platform enforces, in one list

• Retell AI: calling window per batch in one time zone; internal DNC detection and marking, off by default; API dialing honors DNC only when told to; batch calls skip the check.
• Vapi: calling window per campaign in one time zone; pre-dial eligibility webhook you wire to your CRM; no built-in registry scrub.
• Bland: per-call time zone and scheduled start; its own DNC list error; content guard rails that can end or transfer a call; no enforced window.
• ElevenLabs: batch scheduling with a time zone; an end-call tool for opt-outs; a detailed TCPA guide that leaves enforcement to you.
• HighLevel Voice AI: enforced 8 a.m. to 8 p.m. window per contact by phone-number time zone; per-number frequency caps; 5,000 calls per location per day at up to 10 a minute; domestic calls only; no consent validation.

What a compliant stack looks like

A platform is one layer. The compliance comes from what you put around it:

1. Consent captured at the source with the exact disclosure text, timestamp and number, stored in the CRM.
2. A pre-dial check against that record, your internal list and a national registry copy no older than 31 days.
3. Local time from the customer's address, with separate batches per time zone.
4. An opening line with your registered business name and an automated opt-out within two seconds, plus handling for spoken opt-outs that writes back to the CRM.
5. Recordings and logs retained, because the caller has to prove consent, not the consumer.

That is the layer we build when we deploy AI voice agents for outbound work, whichever platform runs the calls.

Regulated industries add their own layer

Insurance and lending carry rules beyond the TCPA. Medicare sales calls face CMS marketing restrictions that ban cold calling outright, covered in our guide to what CMS lets an AI voice agent do during AEP and built into our AI calling for insurance agencies. Mortgage teams must keep the agent away from anything that looks like quoting or negotiating terms, which we explain in your AI agent can call your mortgage leads, it cannot quote them; our mortgage AI calling setup is designed around that line.

The bottom line

Pick a platform for voice quality, latency and price, then assume it will not keep you compliant. HighLevel enforces the most by default, Retell has the best internal do-not-call tooling once you switch it on, and Vapi gives developers the cleanest hook for a real consent check. The registry scrub, the consent records and the time zone data are yours in every case. Our TCPA-compliant calling build puts those pieces in place before the first call, and our comparison of the best AI voice agents on real cost covers what each platform charges.