What is the TCPA and why does it bite AI voice agents?

The Telephone Consumer Protection Act restricts calls made with artificial or prerecorded voices without the required consent. Statutory damages are $500 per violating call and up to $1,500 for willful violations, and they stack per call, which is exactly how autonomous outbound scales.

What makes Lowry v. OpenAI different from a normal TCPA case?

The target. Instead of only suing the telemarketer that ran the campaign, the complaint seeks to hold the platforms, OpenAI and Twilio, liable on the theory that they knew of violations and had the technical ability to prevent them. If that theory survives, every AI voice platform inherits its customers' compliance risk.

Can a content policy really reduce TCPA exposure?

It addresses the content half. Required-disclaimer checks enforce artificial-voice disclosure on every opening, and claims checks block false pretexts like fake callbacks. Consent and Do Not Call screening are data controls that must run alongside. Together they turn per-call compliance into something auditable.

AI robocall TCPA lawsuits: platform liability arrives

Q: What does Lamb v. Mortgage One Funding allege?

That in January 2026 an AI-generated voice cold-called the plaintiff's cell phone for Mortgage One Funding, mimicked a live person, claimed to be returning a call that never happened, pitched refinancing, and transferred to a live agent, all allegedly without prior express written consent and to a number on the Do Not Call Registry.

Published 2026-07-27 · EvalLayer

Two lawsuits, Lowry v. OpenAI filed in December 2025 and Lamb v. Mortgage One Funding filed in February 2026, are testing whether the companies behind AI voice outreach, including the platforms that power it, are liable under the Telephone Consumer Protection Act for what their agents say on outbound calls. The TCPA's statutory damages of $500 to $1,500 per call were written for human boiler rooms. Autonomous agents place calls at a volume no boiler room ever reached, and both suits treat that scale as the point.

What happened

Lowry v. OpenAI and Twilio

In December 2025, Virginia consumer William Lowry filed a TCPA complaint that goes after the platform layer. The campaigns at issue were allegedly run by a debt-relief telemarketer, Fresh Start Group, but the complaint seeks to hold OpenAI and Twilio liable for the automated texts and calls their technology and phone numbers enabled. The theory, analyzed by TCPA specialists at the National Law Review, is that the platforms had knowledge of violations and the technical capability to prevent them, and chose not to. The complaint notes Twilio had already received an FCC cease-and-desist letter in 2024 over illegal robocall traffic on its network.

Lamb v. Mortgage One Funding

On February 24, 2026, Chase Lamb filed a class action in the Eastern District of Michigan against mortgage lender Mortgage One Funding, covered by Inman. The complaint alleges that in January 2026 an artificial voice cold-called his cell phone, mimicked a live person, claimed to be returning a call that never happened, pitched cash-out refinancing and home improvement loans, then transferred him to a live sales agent. It alleges no prior express written consent, no disclosure that the voice was artificial, and a number on the National Do Not Call Registry. Claimed classwide damages exceed $5 million.

Both cases are pending. Everything above is allegation, not judgment. What matters commercially is that the theories are now live in federal court.

What it risks

The arithmetic is the risk. At $500 per call, a modest AI outbound campaign of 10,000 non-compliant calls is $5 million in statutory exposure before willfulness triples it, and class actions aggregate exactly this way. For voice AI platforms the Lowry theory is worse: if liability attaches to whoever had the technical capability to prevent the violation, then every platform that can screen calls and does not is choosing its own exposure. That question hangs over the entire voice agent industry regardless of how these two suits resolve.

The root cause in policy terms

Strip out the legal doctrine and both complaints describe the same missing control: nothing checked the call before it happened.

No required-disclosure enforcement. The Lamb complaint alleges the artificial voice never identified itself as artificial. A per-call disclosure requirement was either absent or unenforced.
No claims control. A voice agent claiming to return a call that never happened is a fabricated pretext. Nothing constrained the script to claims that were true.
No consent gate. Calls allegedly went to numbers with no documented consent, including Do Not Call registrations, meaning the dialing decision itself was ungated.
Platform-level blindness. The Lowry theory targets platforms that route millions of calls with the ability to check them and no policy layer doing so.

The policy that would have caught it

Consent and Do Not Call screening are list lookups that must gate dialing. The content of every call opening is a policy check:

{
  "required_disclaimers": [
    "This call uses an artificial voice"
  ],
  "approved_claims": [
    "Offers are subject to credit approval and licensing"
  ],
  "forbidden_commitments": ["rate_guarantees", "savings_promises"],
  "blocked_topics": ["claims_of_prior_contact_without_record"]
}

An opening script with no artificial-voice disclosure fails the deterministic required_disclaimers check and returns rewrite, with the disclosure inserted and the rewrite re-checked before use. A script that says it is returning the customer's call, when no record of prior contact exists, fails the claims check and returns block. A live agent handoff that improvises a guaranteed rate hits forbidden_commitments and comes back require_approval at minimum. Each check costs about a cent against a statutory floor of $500 per bad call, which is the easiest risk arithmetic in this entire incident database. The decision mechanics are in the authorization guide, and the demo shows violations being caught live.

Lessons

Outbound voice is the highest-stakes agent surface. Damages are statutory, per call, and indifferent to intent, unlike reputational harm that scales with virality.
Platform liability is the industry question. If Lowry's capability-to-prevent theory holds, screening becomes a platform obligation, not a customer courtesy.
Compliance must be per-call and provable. An audit trail showing every opening was checked for disclosure and false pretexts is the difference between a defense and a settlement, a point developed in the liability guide.
Voice vendors selling into regulated verticals should expect this exact question in every security review, the way chatbot vendors now field questions about the Air Canada ruling.