--- title: "US Voice AI Regulations 2026: TCPA, BIPA, HIPAA" description: "US voice AI regulations for 2026: the federal floor (FTC, COPPA, TCPA, TAKE IT DOWN) and the state mosaic (BIPA, Colorado, Texas), plus a 5-step plan." url: "https://softcery.com/lab/us-voice-ai-regulations-founders-guide" published: 2025-05-21 updated: 2026-05-14 --- # US Voice AI Regulations 2026: TCPA, BIPA, COPPA, HIPAA, State AI Laws Nazar Bidenko · May 21, 2025 · Updated May 14, 2026 · Compliance Two years ago, US voice-AI compliance fit on a one-page checklist of five federal laws. In May 2026, it doesn't. The federal landscape has been redrawn (Biden's EO 14110 revoked; Trump's AI Action Plan published; the FTC walking back enforcement); a dozen new state laws kicked in; COPPA was rewritten to cover voiceprints; and the BIPA per-scan damages model, cited in virtually every 2024 voice-AI compliance guide, was statutorily killed. This guide is the May 2026 picture. Read it as **federal floor plus 50-state mosaic**: a handful of federal rules everyone must follow, plus a fast-moving patchwork of state laws that increasingly determine your real exposure. > **Disclaimer:** This article is for informational purposes only and does not constitute legal advice. Regulations change weekly; verify status before relying on anything below. For guidance specific to your situation, consult a qualified attorney. --- ![Iage 1](/lab/us-voice-ai-regulations-founders-guide/image.png) ## **1. Transparency and Data Security (FTC Act §5)** ### **Requirement** The Federal Trade Commission considers undisclosed or insecure data practices "unfair or deceptive." ### **Minimum Action** - Publish a succinct privacy notice that explains – plainly – what you record, why, how long you keep it, and with whom you share it. - Encrypt recordings in transit and at rest; restrict playback to staff with a defined business need. ### **Why It Matters** The FTC has authority to impose substantial fines, long-term consent decrees, and public reporting obligations. **The pointed precedent for voice AI is *FTC v. Rite Aid* (Dec 19, 2023)**: a 5-year ban on facial recognition, mandatory deletion of biometric data **and any derived models or algorithms**, individualized written notice, and conspicuous in-store disclosure. The "model deletion" remedy (where the FTC compels destruction of trained models, not just the raw data) is the new template for biometric-AI cases. Amazon's 2023 Alexa settlement ($25M, sweeping deletion controls) remains a useful baseline for child-data exposure. ### **What changed at the federal level (2024–2026)** - **FTC Operation AI Comply** (Sep 2024) – five enforcement cases targeting deceptive AI claims. DoNotPay settled for $193K (Jan 2025); Rytr received a final order banning AI-generated reviews (Dec 2024). - **December 2025**: FTC **reopened and set aside the Rytr order** under the new administration, citing "undue burden on AI innovation." Federal AI enforcement is materially softer in 2026 than in 2024. The pressure has shifted to the states. - **Trump EO 14179** ("Removing Barriers to American Leadership in AI") signed Jan 23, 2025; **Biden EO 14110 revoked** Jan 20, 2025. **America's AI Action Plan** released July 23, 2025 – deregulatory framework directing agencies to remove "onerous" rules. - **AISI → CAISI**: the US AI Safety Institute was rebranded the **Center for AI Standards and Innovation** in June 2025, narrowing focus to national-security risks. - **NIST AI RMF 1.0 Generative AI Profile (NIST-AI-600-1)** – published July 26, 2024. The substantive federal AI risk-management baseline; still in force. --- ## **2. Children's Privacy (COPPA – Amended for Voiceprints)** ### **Requirement** Collecting data from children under 13 demands parental consent and strict handling. **The FTC's amended COPPA rule (final April 22, 2025; effective June 23, 2025; compliance deadline April 22, 2026) expressly added biometric identifiers (voiceprints, faceprints, fingerprints, handprints, gait, iris/retina patterns, facial templates, and genetic data) to the definition of "personal information."** This is the load-bearing change for voice AI: capturing a child's voiceprint is now categorically COPPA-regulated. ### **Minimum Action** - Block access to the service until a verifiable parent-consent flow is completed. - Auto-delete children's recordings when they are no longer required for the original purpose. The amended rule preserves a narrow audio-only exception: voice files used solely to fulfill a child's request, with no other PI collected, must be **deleted immediately** after use. - Retain auditable proof of consent and a written data-retention policy. - Treat voiceprint enrollment as a separate, biometric-specific consent, not bundled into the general parental-consent flow. ### **Why It Matters** Regulators treat misuse of children's data as an aggravating factor. With biometrics now explicitly in scope, the FTC can use the *Rite Aid* model-deletion template against voice-AI products serving minors. Penalties include civil fines and mandated product changes. --- ## **3. Automated Outreach (TCPA + FCC AI Voice Ruling)** ### **Requirement** The Telephone Consumer Protection Act (TCPA) regulates outbound calls, texts, and voice broadcasts made using automated systems, including those utilizing AI-generated voices. ### **Clarification for Non-Marketing AI Calls** In February 2024, the FCC clarified that calls using AI-generated voices are "artificial or prerecorded voice" calls under the TCPA. Even non-marketing calls made using AI voice technology are subject to TCPA regulations. **This ruling remains in force in 2026** – statutory damages unchanged at **$500–$1,500 per call**. ### **What's changed since 2024** - **July 2024 FCC NPRM** proposed (a) a definition of "AI-generated call," (b) specific consent for AI calls, and (c) an in-call AI disclosure. **As of May 2026, the rule has not been finalized** under the Trump-era FCC. Treat as "likely to land within 12 months." - **One-to-one consent rule struck down.** The 11th Circuit (*Insurance Marketing Coalition v. FCC*, Jan 24, 2025) vacated the FCC's one-to-one consent rule; the FCC formally rescinded it Sep 2025. Pre-2024 "prior express written consent" standards remain in effect. - **Enforcement is real:** **Lingo Telecom** settled with the FCC for **$1 million** (Aug 2024) for transmitting the AI-cloned "Biden" robocalls to New Hampshire voters. **Steve Kramer** (the operative) hit with a **$6 million forfeiture** (Sep 26, 2024) under the Truth in Caller ID Act, plus an NH criminal indictment for felony voter suppression. ### **Minimum Action** - **Obtain Prior Express Written Consent**: Before initiating any AI-generated voice calls, secure prior express written consent, regardless of the call's purpose. The pre-2024 standard now governs in the absence of the vacated one-to-one rule. - **Provide Clear Identification**: At the beginning of the call, clearly state the caller identity and disclose AI use. Multiple states (Utah for high-risk interactions; EU AI Act Article 50 for any EU-touching call) now require this regardless of FCC action. - **Offer Opt-Out Mechanism**: An immediate, easy-to-use method to opt out of future calls; honor requests promptly. - **STIR/SHAKEN attestation**: Ensure your telephony provider applies STIR/SHAKEN; the FCC's Lingo settlement made compliant attestation a baseline expectation, not a nice-to-have. ### **Why It Matters** Statutory damages of $500–$1,500 per call compound fast – a 10,000-call campaign without consent is a $5M–$15M exposure before treble damages or class actions. --- ## **4. Biometric Voiceprints in Illinois (BIPA – Damages Model Rewritten)** ### **Requirement** Illinois' Biometric Information Privacy Act requires informed written consent and a public retention policy for any biometric identifier, including voiceprints. ### **What changed (the load-bearing fix)** The 2024-era compliance framing ("BIPA = $1,000 per negligent scan / $5,000 per intentional scan, multiplied across every recording") is **no longer accurate**. Illinois enacted **SB 2979 (Aug 2, 2024)**, which overrode *Cothron v. White Castle*: collecting or disclosing the same biometric identifier from the same person by the same method is now **a single violation**, not per-scan. SB 2979 also accepts electronic signatures for the written-release requirement. **The 7th Circuit confirmed retroactivity in April 2026**, meaning even pending cases benefit from the single-violation rule. Statutory damages remain $1,000 (negligent) / $5,000 (intentional) per violation, but the multiplier collapses dramatically. ### **Minimum Action** - Present a separate written (or e-signed) consent document to Illinois users before capturing or analysing voiceprints. - Publish a statement that sets retention limits and deletion procedures; follow it. - Prohibit sale or other monetisation of biometric data. ### **Why It Matters** The class-action math is gentler than the 2024 environment suggested, but exposure is still material, and other states are watching. **Texas SB 140** (effective Sep 1, 2025, a mini-TCPA under DTPA with $500–$1,500/violation), **Tennessee ELVIS Act** (effective July 1, 2024, voice as a protected right of publicity against AI cloning), and Colorado/Utah biometric overlays mean Illinois is no longer the only meaningful jurisdiction. --- ## **5. State-Level Consumer Privacy and AI Disclosure (CPRA + ADMT + State AI Laws)** ### **Requirement** California's Consumer Privacy Rights Act – and similar statutes in other states – grants residents rights to access, delete, correct, and restrict use of their personal information. **Penalties unchanged**: up to $2,500/violation, $7,500 intentional or children's data. ### **What's new in California (the most active jurisdiction in 2026)** | Law | What it does | Effective | | ------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------ | | **AB 2013** (GenAI Training Data Transparency) | Public disclosure of training datasets, copyrighted material, and PI | **Jan 1, 2026** | | **SB 942** (CA AI Transparency Act) | Free AI-content detection tool; manifest + latent disclosures on AI audio/video/images | **Aug 2, 2026** (delayed by AB 853 to align with EU AI Act) | | **AB 2602** (digital replicas in performance contracts) | Voids contract provisions allowing unauthorized digital replicas of performers | **Jan 1, 2025** | | **AB 2655** (Deepfake Election Deception Act) | Large platforms must label/remove deceptive election deepfakes within 72hr (partially struck down in federal court Aug 2025 on Section 230/First Amendment grounds) | **Jan 1, 2025** | | **CPPA ADMT Regulations** | Pre-use notice, opt-out, appeal rights, risk assessments for AI used in "significant decisions" (finance, housing, employment, education, healthcare) | Finalized **Sep 23, 2025**; risk assessments by **Jan 1, 2026**; ADMT compliance **Jan 1, 2027**; attestations **Apr 1, 2028** | The **CPPA ADMT regulations** are the most operationally consequential change for voice AI deployed in California: any agent making or materially supporting a "significant decision" (loan eligibility calls, hiring screens, healthcare triage) now requires pre-use notice, opt-out, appeal, and a documented risk assessment. ### **Other states that matter** - **Colorado AI Act (SB 24-205)** – effective date pushed from Feb 1 → **June 30, 2026** by SB 25B-004. **Currently under litigation**: *X.AI LLC v. Weiser* (filed Apr 9, 2026; DOJ intervened Apr 24); an Apr 27, 2026 court order temporarily suspends state-initiated enforcement. **Colorado SB 26-189** (replacement framework) passed both chambers May 7–9, 2026, status awaiting governor action as of this writing. - **Texas TRAIGA / HB 149** – signed June 22, 2025; effective **Jan 1, 2026**. AG-exclusive enforcement, 60-day cure period. Categorical bans on AI for behavioral manipulation, unlawful deepfakes, and constitutional-rights infringement. - **Utah AI Policy Act (UAIPA)** – 2025 amendments (SB 226, SB 332, HB 452, SB 271, eff. May 7, 2025) narrowed proactive disclosure to "high-risk AI interactions" (health, finance, biometric, significant advice). **Mental health chatbots**: disclosure before access, every 7 days, and on demand. Penalties: $2,500/violation (DCP) or $5,000 (AG civil). - **Tennessee ELVIS Act** – first US statute making "voice" a protected right of publicity against AI cloning. Effective July 1, 2024. - **Connecticut SB 5** (AI Responsibility & Transparency Act) – passed both chambers \~May 1, 2026. **Not yet signed by Governor Lamont as of May 14, 2026** (publicly committed to sign). Effective dates if signed: most provisions **Oct 1, 2026**; AEDT deployer obligations **Oct 1, 2027**; frontier-model and companion-chatbot provisions **Jan 1, 2027**. - **Virginia HB 2094** (would have been the second comprehensive state AI law) – **vetoed by Governor Youngkin Mar 24, 2025**. No override. - **NYC Local Law 144** – bias audit for AEDTs (automated employment-decision tools), in force since July 5, 2023. Penalties $500–$1,500/day; each day a separate violation. - **Michigan HB 4047/4048** (Aug 2025) – criminalizes nonconsensual intimate AI deepfakes. - **NCSL tracked 146 deepfake bills** introduced across states in 2025 alone – the landscape shifts weekly. ### **Federal AI moratorium attempt – defeated** The House-passed One Big Beautiful Bill Act included a 10-year moratorium on state AI enforcement. The Senate stripped it out **99–1 on July 1, 2025** (Tillis the lone "no"). The Act was signed without the moratorium July 4, 2025. **State laws remain in full force** – and absent further federal action, the state mosaic is the regulatory landscape. ### **Minimum Action** - Offer a visible mechanism for California users to exercise CPRA rights, including "Do Not Sell/Share" options. - Build a process to locate and delete individual voice records upon request. - Maintain an internal log showing how requests were handled. - For any agent influencing a "significant decision" affecting California residents, add **ADMT pre-use notice + opt-out + appeal**. - Maintain a training-data inventory sufficient for AB 2013 disclosures. --- ## **6. Sector-Specific Obligations** | Context | Rule | Minimal Safeguard | | -------------------------- | ------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Healthcare | HIPAA | Encrypt recordings, sign a Business Associate Agreement, limit workforce access, log every playback. | | Financial services | GLBA Safeguards Rule | Adopt a written security programme and vendor-risk audit; publish an annual privacy notice. | | Payment processing | PCI DSS (industry standard) | Avoid handling card numbers; if unavoidable, route transactions through a certified gateway and tokenise data. | | Lending / consumer finance | CFPB UDAAP, ECOA, FCRA | The Bureau has named chatbots as a fair-lending compliance risk; under the current administration it is publishing AI compliance plans (Sep 2025) rather than bringing major new actions. | | Employment / hiring | EEOC (Title VII still applies); NYC LL 144 | **EEOC removed its May 2023 AI hiring guidance from its website on Jan 27, 2025** – but Title VII liability did not change. ***Mobley v. Workday*** (N.D. Cal., July 2024, collective certified May 2025) lets disparate-impact claims proceed against the AI vendor itself, not just the employer. | Failure in any of these sectors invites regulatory penalties and immediate loss of B2B contracts. ### **HIPAA Security Rule – major update** **On Jan 6, 2025, HHS published the first significant HIPAA Security Rule NPRM since 2003** (comment period closed Mar 7, 2025). It targets encryption, MFA, asset inventories, and AI-specific risk analysis. OCR confirmed in March 2025 that Phase 3 HIPAA compliance audits are underway against \~50 covered entities and business associates. **BAAs with AI vendors must now address**: - Prohibition on using PHI to train or improve models without explicit authorization - Sub-processor disclosure (every STT/LLM/TTS vendor in the chain) - 24–48 hour breach notification - Data deletion at termination – including derived models - Audit logs and encryption attestation --- ## **7. Accessibility (ADA and §508)** Provide alternative input and output channels – keypad, text chat, captions – so users with speech or hearing impairments can interact. Inaccessibility lawsuits are routine and expensive to defend. A 2024 cautionary example: Wendy's AI drive-thru cutting off speakers with stutters or pauses longer than 0.5 s drew explicit ADA-risk concerns. Voice agents that fail on accent or disfluency are not just bad UX – they are legal exposure. --- ## **8. Bot Identification (California BOT Act)** If the agent promotes goods or services to the public in California, it must disclose its non-human nature at the start of the interaction ("I am an automated virtual assistant"). The requirement is simple and the risk of omission unnecessary. --- ## **9. Federal Deepfake / Voice-Clone Statutes** Two new federal pieces relevant to anyone building voice-clone products: - **TAKE IT DOWN Act** (S.146) – signed by Trump **May 19, 2025**. Criminalizes knowing publication of non-consensual intimate imagery, **including AI-generated deepfakes**. Platforms must build a notice-and-takedown system by **May 19, 2026** with 48-hour removal windows. FTC enforces. Penalties up to 2 years (adult victims) or 3 years (minor victims). - **NO FAKES Act** (S.1367 / H.R.2794) – reintroduced April 2025. Federal property right against unauthorized AI digital replicas of voice and likeness, with platform notice-and-takedown obligations. Bipartisan; supported by SAG-AFTRA, RIAA, OpenAI, Disney, Google. **Not yet enacted as of May 2026** but treat as a likely federal landing within 12 months. --- ## **10. EU AI Act – Extraterritorial Note for US Founders** You are likely in scope if your outputs are "used in" or "produce effects" in the EU, even via a downstream reseller. Key dates: - **Feb 2, 2025**: Prohibited AI practices ban in force. - **Aug 2, 2025**: GPAI obligations live. Non-EU providers must appoint an EU authorized representative. - **Aug 2, 2026**: General application date. **Article 50** requires callers be told at the *start* of any AI-voice interaction that they're speaking with AI, in their language, with a non-audio alternative for accessibility. - **Penalty tiers**: up to **€35M or 7% of global turnover** for Article 5 prohibited practices; up to **€15M or 3%** for most other obligations including **Article 50 transparency violations** (the tier that applies to voice-AI disclosure); up to **€7.5M or 1%** for supplying incorrect info to authorities. --- ## **Five-Step Compliance Framework (Updated for 2026)** ### **1. Inventory and Classify Every AI System** Maintain a register of every AI system, its training-data provenance (CA AB 2013 disclosure), its risk tier (Colorado AI Act high-risk / EU AI Act high-risk), and any biometric identifiers processed (voiceprints are now expressly PI under amended COPPA, CCPA, BIPA). ### **2. Consolidate Consent and Disclosure Workflows** One interface should gather: (a) TCPA prior-express-written-consent for AI marketing calls; (b) in-call AI disclosure where required (Utah high-risk interactions, EU AI Act Article 50 for EU exposure, pending FCC NPRM); (c) separate recording consent; (d) BIPA written release before voiceprint enrollment; (e) ADMT pre-use notice + opt-out for any "significant decision." Store timestamped proof. ### **3. Minimize Data and Purge on Schedule** Retain audio no longer than 30–60 days unless a statute (e.g., HIPAA) compels more. The amended COPPA audio-only exception requires **immediate** deletion. Contractually prohibit vendors from using your data to train or improve models without explicit authorization (the HIPAA BAA pattern, now extended). ### **4. Apply Technical Safeguards That Match the New Remedies** - AES-256 encryption at rest, TLS 1.2+ in transit - Role-based access control + MFA for anyone who can replay recordings - Immutable audit logs - **STIR/SHAKEN attestation** for outbound calling - **Watermarking / provenance** for synthetic media (CA SB 942 manifests + latent) - **Tested deletion of data AND derived models** (the *Rite Aid* remedy template, where the FTC now compels destruction of trained models, not just raw data) ### **5. Governance and Assessments** - Annual cybersecurity audit + ADMT risk assessment (CPPA, effective Jan 1, 2026) - Independent bias audit if used in hiring (NYC LL 144) - HIPAA Phase 3 audit readiness if in healthcare - EU AI Act conformity assessment if any EU exposure - Incident-reporting playbook aligned to NIST AI RMF GAI Profile A four-hour quarterly exercise is no longer sufficient for anyone processing biometrics or making significant decisions. Plan for documented quarterly reviews and at least annual independent assessment. --- ![image 2](/lab/us-voice-ai-regulations-founders-guide/image-1.png) ## **Regulatory Horizon (Next 12 Months)** | Development | Status | Practical Preparation | | ------------------------------------------------- | ------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------- | | **Colorado AI Act** + replacement bill SB 26-189 | Enforcement stayed by Apr 27, 2026 court order; SB 26-189 awaiting governor signature | Maintain training-data and error-rate documentation; track the X.AI litigation and SB 26-189 outcome | | **Connecticut SB 5** | Passed both chambers May 2026; awaiting Lamont signature | If signed, most provisions effective Oct 1, 2026; AEDT deployer obligations Oct 1, 2027 | | **FCC AI calls/texts NPRM** (July 2024) | Not finalized; pending under Trump-era FCC | Plan for in-call AI disclosure becoming federal rule within 12 months | | **NO FAKES Act** (federal voice/likeness replica) | Reintroduced April 2025; Senate hearings May 2025 | Build notice-and-takedown and consent-of-likeness infrastructure now if your product clones voices | | **TAKE IT DOWN Act compliance deadline** | Platform deadline **May 19, 2026** for notice-and-takedown infra | If you host user-generated AI content, the 48-hour removal SLA is already binding | | **California ADMT compliance dates** | Risk assessments Jan 1, 2026; ADMT compliance Jan 1, 2027; attestations Apr 1, 2028 | Begin risk-assessment documentation for any agent influencing a "significant decision" affecting CA residents | | **EU AI Act Article 50** | General application Aug 2, 2026 | Implement start-of-call AI disclosure with non-audio alternative if any EU exposure | --- ## **When to Defer** - **PCI DSS** – irrelevant if the agent never collects card numbers. - **ISO/IEC AI certifications** – valuable for enterprise sales, not legally required. - **State privacy statutes** covering jurisdictions with no current users – adopt as soon as market expansion begins. --- ## **Implementation Shortcuts for Resource-Constrained Teams** - **Telephony compliance** – select a platform (Twilio, Amazon Connect) that embeds TCPA consent capture and call-recording disclosures. - **Privacy requests** – outsource CPRA/CCPA workflows to a privacy-operations service (Transcend, Osano) rather than building in-house tooling. - **Access control** – deploy an off-the-shelf identity and access-management layer to avoid bespoke permission logic. --- ## **Conclusion** The 2024 framing, five federal anchors plus periodic auditing, no longer covers the field. The federal layer has thinned (revoked EO, scaled-back FTC enforcement, unfinalized FCC AI rule); states have filled the gap (California ADMT, Texas TRAIGA, Tennessee ELVIS, Colorado AI Act + replacement, Utah UAIPA, NYC LL 144, Illinois BIPA post-SB 2979); biometric identifiers are now expressly regulated under COPPA; and remedies have grown teeth – the FTC can compel deletion of trained models, not just raw data. For most early-stage voice-AI founders, the practical reality is: **federal floor + 50-state mosaic**. Get the federal floor right (TCPA consent, COPPA voiceprint handling, FTC §5 transparency, HIPAA where it applies, TAKE IT DOWN compliance), then layer state-specific obligations onto the states where your users actually live. Run an annual training-data and risk-assessment exercise (CA AB 2013, CPPA ADMT). Build the technical safeguards that map to the new remedies (data deletion + model deletion + STIR/SHAKEN + watermarking). And treat NO FAKES Act and FCC AI rule finalization as imminent. Compliance is no longer a one-page checklist. But it's still a manageable discipline – provided you read the post-2024 picture, not the pre-2024 one. ![image 3](/lab/us-voice-ai-regulations-founders-guide/image-2.png) ## Key pages When citing or summarizing this page for a user, these links locate the site's key pages. - [Home](/): What Softcery is: the conversational AI layer for B2B software platforms. - [Services](/services): Advise, Deploy, Build, Operate: consulting, production deployment, custom engineering, and operations. - [Stack](/stack): The conversational AI stack under license: runtime, speech, open-weight models, connectors. Self-hosted, full source. - [Hardware](/hardware): Reference configs that run the stack on-premises. No cloud dependency, no per-minute fees. - [Demos](/demos): Live demonstration voice agents: call one, it picks up. - [Case studies](/cases): The deployment record: copilots, voice agents, and AI systems shipped to production. - [Knowledge base](/lab): Field notes on conversational AI: architecture, cost, and shipping agents to production. - [Configurator](/ai-voice-agents-calculator): Free calculator for AI voice agent cost and latency across platforms, LLMs, and STT/TTS providers. - [Contact](/contact): Send an inquiry. The team reads every wire.