Voicebots and the Law – What’s Allowed?

Voicebots and AI-powered agents are increasingly supporting companies in sales and customer service. But before you launch such an agent, you need to know one thing: European law strongly regulates cold calling and marketing communications.

This article is a complete guide to the regulations, along with a practical look at how to launch a voice agent without breaking the law.

Legal foundations

European Union – ePrivacy, GDPR, and the new AI Act

Across the EU, regulations differ from country to country, but three pillars are consistent:

• ePrivacy – defines the rules for marketing communications (cold calling, SMS, e-mail).
• GDPR – governs the processing and protection of personal data.
• AI Act (2024–2027) – the first EU law on artificial intelligence, introducing transparency obligations when using bots.

Cold calling and voicebots

One of the most common questions is whether voicebots can be used for automated cold calling. Technically, it’s easy. Legally, it’s complicated.

• Consent is key – every marketing contact (phone, SMS, e-mail) requires prior, explicit consent from the recipient. This applies to human agents as well as automated systems. Lack of consent can mean severe financial penalties (up to several percent of annual revenue).
• Separate consents for channels – consent for e-mail does not equal consent for phone calls.
• What about B2B?
  • In some cases, companies can rely on legitimate interest, provided the contact is relevant to the recipient’s business and passes a balancing test.
  • In others, it may only be legal to make an initial call to ask for consent – and end the conversation there. Only after consent is granted can marketing communications take place.

Ethics and PR

Mass, unwanted calls made by bots are not only a legal risk but also a reputational disaster. Imagine thousands of automated calls flooding people every day – the backlash would be immediate. That’s why at CallPage we understand the interest in automated cold calling, but we don’t plan to develop mass outbound dialing features. It’s simply a bad customer experience and bad PR.

Practical differences across EU countries

Because the legal environment varies, it’s essential to check the national rules in every market you operate in. For example:

• Germany – no clear rules for B2B voicebots. Courts and regulators still debate whether to treat them as automated systems (requiring prior consent) or as individual conversations.
• Opt-in countries (e.g. Poland) – several EU states require explicit consent before cold calling.
• Opt-out countries (e.g., Italy, Croatia) – voicebots may place calls unless the number is on a “do not call” list.

Voicebots handling inbound calls

Inbound calls are a different story. Since the user initiates the call, consent to be contacted is implied. Still, only the additional rules apply:

AI Act classifies voicebots as “limited risk” systems. This means companies must:

• clearly inform the caller that they are speaking with an AI,
• maintain logs and documentation of the interactions,
• provide an option to transfer the caller to a human agent.

GDPR imposes data protection obligations:

• callers must be informed if conversations are being recorded,
• recordings and personal data must be stored securely,
• users must be able to access information about data processing and exercise their rights (e.g., request deletion).

How CallPage AI Voice Agent stays compliant

Strong legal foundations

CallPage has ensured full compliance:

• Data collected by the agent is not used to train AI models.
• All personal data is stored securely in CallPage’s infrastructure.

Contact initiation – always by the customer

CallPage voice agents never initiate outbound calls without consent. Two typical scenarios includes:

1. A customer calls a virtual number.
2. A customer requests a call via the website widget.

In both cases, the customer is the one taking the first step. Providing a phone number in the widget counts as consent, plus you can also add an extra checkbox to collect explicit marketing consent.

Marketing and commercial information

Data used purely for handling the initial call doesn’t require additional consent. If you plan to send follow-up communications (e.g., emails, newsletters), you must collect a separate marketing consent – easily done via the widget or during the call.

Recording conversations

Recording calls with CallPage is possible (and recommended) for quality control and lead analysis. But transparency is key:

• Inform customers beforehand, either via a checkbox or directly at the start of the call. (agent can inform the customer about it)
• Clearly state the purpose of recording (e.g., quality assurance).

Transparent communication

To comply with the AI Act and build trust, the voice agent should introduce itself clearly, for example:

“Hi, this is Tom – a virtual voice agent from Company X.”

Connecting to a human

With CallPage, it's easy to configure call transfers to a human agent when the voicebot can't answer a question. The only exception is the “after hours” mode, but in this case you can set up a fallback message that informs the caller politely - such as:

“Our consultants aren’t available at the moment.”

This approach maintains a positive user experience while respecting your team’s availability.

Checklist: fully legal use of AI Voice Agents

✅ No cold calling – the customer initiates the call.
✅ Additional consent if you plan to send follow-ups or newsletters.
✅ Inform the caller if conversations are recorded.
✅ Transparency – the user knows they are speaking with AI.
✅ Personal data is stored securely in infrastructure such as CallPage.

Conclusion

Voicebots and AI agents are not banned in the EU – but they are tightly regulated. The most important rule: consent from the user.

CallPage’s AI Voice Agent was designed with compliance in mind:

• the customer always initiates contact,
• data is stored securely,
• the system provides easy mechanisms for gathering consent and informing users.

That means you can use the automation without worrying about breaking the law.

This guide is for general information only. Every business situation is different, so it’s always best to consult with legal professionals – especially if you operate across multiple European markets.