Call Center Compliance Checklist: Consent and Disclosure

A call center compliance checklist for consent and disclosure confirms five things before an AI voice agent goes live: you hold the right consent for each call, the agent identifies your business, it discloses recording and AI use where the law requires, it captures and honors opt-outs, and you keep records that prove each step. Use the lists below as a launch gate for any agent on Retell AI or another platform.

The checklist reflects US federal rules plus the main EU and UK requirements as of October 2026. It is not legal advice. State and national laws vary, so have counsel review your final version.

Which consent should be on file before the agent dials?

Consent comes first because it decides whether the call can happen at all. The FCC has said AI-generated voices are artificial voices under the Telephone Consumer Protection Act (TCPA), so in the US the bar is the one for prerecorded calls. Other countries use their own do-not-call registers.

• Every contact has a recorded consent source: the form, the date, and the exact wording shown.
• Consent level matches the call: prior express consent for informational calls to US mobiles (narrow FCC exemptions aside), prior express written consent for sales calls.
• Written consent names the phone number, covers artificial or AI voice calls, and says signing is not a condition of purchase.
• US list scrubbed against the National Do Not Call Registry using a version no more than 31 days old.
• UK list screened against the TPS and CTPS; Canadian list checked against a National DNCL copy no more than 31 days old.
• Every list scrubbed against your own do-not-call list.
• For EU contacts, a lawful basis documented and a way to handle objections to direct marketing (GDPR Article 21).

The TCPA compliance guide explains each US consent level, and the calling laws by country guide covers Canada, the UK, the EU, Australia, India and Brazil.

What should the agent say in the first few seconds?

Disclosure duties come from several rules at once. The FCC's rules (47 CFR 64.1200(b)) require artificial-voice messages to identify the business "at the beginning of the message" and give a callback number. Recording rules depend on where the parties are: the federal Wiretap Act (18 U.S.C. 2511) allows recording when one party consents, while California Penal Code 632 makes it an offense to record a confidential communication "without the consent of all parties." In the EU, Article 50(1) of the AI Act requires providers to design AI systems that interact directly with people so those people are informed they are talking to an AI, unless that is obvious, and it applies from August 2, 2026. Check with counsel whether you or your platform vendor counts as the provider for an agent you build. As of October 2026, the FCC has proposed, but not adopted, a similar US rule.

• Business name at the start, plus a callback number: Where the duty comes from: 47 CFR 64.1200(b)(1)-(2). Where to set it in Retell: Begin Message.
• Opt-out instructions: Where the duty comes from: 47 CFR 64.1200(b)(3), sales calls. Where to set it in Retell: Begin Message, plus Do-not-contact Handling.
• Recording notice: Where the duty comes from: All-party consent laws, e.g. Cal. Penal Code 632. Where to set it in Retell: Begin Message or first flow node.
• "You are talking to an AI": Where the duty comes from: EU AI Act Art. 50(1); FCC proposal pending. Where to set it in Retell: Begin Message.
• Right to object to direct marketing: Where the duty comes from: GDPR Art. 21(4), EU contacts. Where to set it in Retell: Begin Message (first contact); confirm format with counsel.

Retell has no separate setting for a recording announcement, so the agent says it. Put the disclosure in the agent's Begin Message, or in the first node of a conversation flow with Skip Response and Block Interruptions turned on so the caller cannot talk over it. The docs on announcing a recording disclaimer show both setups. A sample opening line, which is a starting template rather than reviewed language (have counsel approve the final wording, including where the opt-out instructions fall for sales calls):

"Hi, this is the virtual assistant for [registered business name], calling on a recorded line. I'm an AI agent. You can reach us at [callback number], and if you'd like us to stop calling, just say so."

For more on state recording rules, see this overview of legally recording phone calls in the US.

Do inbound agents need the same checks?

Partly. When a customer calls you, the outbound consent rules for placing a call generally do not come into play, though check with counsel for callbacks you schedule and inbound calls that turn into a sales offer. The disclosure rules still do. A recording made on an inbound call is still a recording, so all-party consent states still apply, and Article 50(1) of the AI Act is written for AI systems that interact directly with people, with no limit to outbound calls; confirm its territorial reach for your setup with counsel. Keep the same opening disclosure on inbound agents. Note that Retell's do-not-call flag does not block inbound calls, so a customer who opted out of outreach can still reach you.

How are opt-outs captured and honored?

An opt-out only counts if every system that places calls respects it. In Retell, Do-not-contact Handling has the agent confirm the request once, end the call, and mark the contact as do-not-call. Whether a later call honors that flag depends on how the call is placed.

• Do-not-contact Handling turned on for every outbound agent (Retell LLM and conversation flow agents).
• API calls pass honor_internal_dnc set to true, and campaigns have internal DNC turned on.
• Batch call lists scrubbed before upload, since batch calls do not check the do-not-call flag.
• CRM connected so a do-not-call change syncs to your CRM, and every other system that dials reads from it.
• Opt-out requests honored within 10 business days and kept for 5 years (US).
• SMS-enabled numbers treat replies such as STOP as an opt-out.

This matters most for high-volume programs such as AI auto dialer campaigns, where one missed suppression list repeats across thousands of numbers.

Which records prove compliance later?

If a complaint arrives a year from now, you need to show what the person agreed to, what the agent said, and what happened on the call. The FTC's Telemarketing Sales Rule sets a five-year retention period for telemarketing records and lists what a complete consent record includes.

• Consent records: name, number, the request as it was shown, the purpose, the consent itself and its date.
• The agent version and prompt that ran each call.
• Recordings and transcripts retained for as long as your obligations require (US telemarketing records: 5 years).
• Call disposition for every call, including the number a call was transferred to.
• Disconnection reasons, including user_requested_dnc, exported to your reporting.

Retell keeps call data indefinitely unless you set a per-agent retention period (1 day to 2 years). If you shorten it, export what you must keep through webhooks first.

How do you test the checklist before launch?

Run three test calls to your own number before any real contact is dialed.

1. Answer and try to speak over the opening. The full disclosure should still play. If you can cut it off, move it to a flow node with Block Interruptions turned on.
2. Say "please stop calling me." The agent should ask once, then end the call. Check that the call shows a disconnection reason of user_requested_dnc and that the contact's Do Not Call field is set to true.
3. Place a new call to that number through the API with honor_internal_dnc set to true. The request should fail with a 400 error saying the contact is on the do-not-call list.

Repeat the tests whenever you publish a new agent version, since a prompt change can move or drop the disclosure. Healthcare teams have extra steps before patient data touches a call; the HIPAA guide for AI phone agents covers them.

A new account comes with free credits you can use to build an agent and run these tests. Start in the Retell dashboard.