The rules that apply to AI calls
No Indian law bans a business from using AI to talk to people on the phone. What the law regulates is the purpose and manner of the call. A promotional or sales call made by AI is treated the same way as one made by a person, and in some respects more strictly, because TRAI now has rules aimed at calls placed by software.
Four sets of rules matter most for a business planning AI calls:
- TRAI’s Telecom Commercial Communications Customer Preference Regulations, 2018 (TCCCPR), with amendments in February 2025 and September 2026.
- The DLT (Distributed Ledger Technology) system run by telecom operators, where senders, headers, consent and now A2P calling are registered.
- The Digital Personal Data Protection Act, 2023 and the DPDP Rules notified in November 2025.
- General law on privacy and recordings, plus sector rules if you are a bank, insurer or other regulated entity.
TCCCPR 2018, DND and DLT
TCCCPR 2018 sorts commercial communication into transactional, service and promotional types. People record their preferences in the National Customer Preference Register, commonly called DND, by calling or texting 1909 or using an approved app. They can block all promotional communication or only certain categories, such as real estate or education, and certain time bands and days.
Promotional calls must not go to a number that has blocked that category unless the person has given explicit consent that is recorded through the operators’ consent system. Senders and telemarketers register on the DLT platform, and operators use it to check each communication against preferences and consent.
Promotional voice calls are generally permitted only between 9 am and 9 pm, and people can choose narrower time bands in their preferences. Transactional and service communication to existing customers is treated differently. Check the current regulation text for your category, because the boundary between service and promotional is where most mistakes happen.
The 2025 Second Amendment
TRAI notified the TCCCPR (Second Amendment) Regulations on 12 February 2025. According to TRAI’s press release and law-firm summaries, the main changes were:
- Customers can report spam within 7 days instead of 3, and can complain even without first registering a DND preference.
- Telecom operators must act faster against senders after complaints, including usage caps and disconnection of unregistered telemarketers for repeated violations.
- Separate number series let people tell call types apart: the 140 series is for promotional calls and the 1600 series for service and transactional calls. Confirm with your telecom provider which series and registrations apply to your calls.
- Explicit consent taken for completing a specific transaction is valid only for a limited period (law-firm summaries state 7 days), and inferred consent lasts only as long as the customer relationship.
- Financial disincentives on operators that fail to curb spam, capped at ₹50 lakh per month per service area.
The 2026 Third Amendment: A2P and AI-generated calls
On 18 September 2026 TRAI notified the TCCCPR (Third Amendment) Regulations, 2026, after a consultation that opened in March 2026. This is the change most relevant to AI calling.
TRAI defines Application-to-Person (A2P) calls as calls initiated by applications, software or automated platforms without a person dialling, and news reports of the regulation text say this includes robocalls and pre-recorded or artificial voice calls. Every entity making A2P calls must declare this to its telecom provider in advance, along with the numbers (CLIs) it will use, and the declaration is recorded on DLT. A2P calls made without a declaration are treated as unsolicited commercial communication.
The amendment also lets operators levy a termination charge of up to 5 paise per minute on such calls, requires operators to use AI and machine-learning tools to flag suspected spam senders, and gives consumers a right to appeal how a complaint was resolved within 15 days. News reports say the provisions start in stages, at 30, 60 and 90 days from publication. Because this is new, operator processes for A2P declaration were still being set up when we wrote this guide; confirm the current position with your telecom provider.
Consent, calling hours and call recording
Consent is the safest base for any outbound AI call. A person who registered for your webinar and ticked a box agreeing to calls about it is a very different contact from a purchased list. Keep a record of when and how each person agreed, and what they agreed to.
Indian law does not have one statute that says whether all parties must agree before a call is recorded. Courts and commentators generally treat recording by a participant as permissible, but the right to privacy recognised by the Supreme Court, the DPDP Act and sector rules all point the same way for businesses: tell people the call is recorded, say why, and protect the recording. This is an area where the position is not fully settled, so take advice if recordings will be used as evidence or shared.
- Call only people who gave you their number for a reason related to the call.
- Stay inside 9 am to 9 pm for promotional calls, in the contact’s local time.
- Cap attempts per person per day and stop at once when someone says no.
- Announce recording at the start of the call.
- Keep consent records and do-not-contact lists in one place used by every channel.
DPDP Act 2023 basics for calling
The Digital Personal Data Protection Act, 2023 governs the personal data your calls use: names, numbers, recordings and transcripts. Its core rule is that you process personal data for a lawful purpose, with consent that is free, specific, informed and given by clear action, or under a listed legitimate use. Consent must follow a notice that says what data you collect and why, and people can withdraw consent as easily as they gave it.
MeitY notified the DPDP Rules on 14 November 2025. Some rules, including those setting up the Data Protection Board, took effect at once; consent managers follow after 12 months, and most obligations on businesses apply 18 months after notification, in May 2027. Penalties under the Act go up to ₹250 crore for failing to take reasonable security safeguards. If you use a platform to make calls, you remain the data fiduciary for your contacts, and the platform acts on your instructions.
AI disclosure and good practice
At the time of writing, no Indian law we found requires an AI voice agent to announce that it is an AI on every call. TRAI has, however, discussed AI-based telemarketing and AI disclosure in its recent consultations, so this may change. We recommend that the agent says it is an AI assistant at the start of the call. It costs little, avoids complaints, and protects your brand if a recording is ever shared.
- Introduce the AI by name and say which business it calls for.
- Give a clear way to reach a person, and transfer when asked.
- Never let the AI invent prices, offers or guarantees; give it your approved content.
- Review transcripts weekly for complaints or wrong answers.
What WebinarRun gives you, and what stays with you
WebinarRun gives you controls that make compliant calling easier: campaign calling hours set in each contact’s local time, a daily call cap per person, do-not-contact handling shared across WhatsApp and calls, "what this campaign sells" so existing buyers are skipped, and call recording with transcripts. When recording is on for WhatsApp calls, the caller hears a recording notice before the conversation starts.
These are tools, not compliance on your behalf. You decide who to call, you are responsible for having consent and checking DND and DLT requirements, and you are the data fiduciary for your contacts under the DPDP Act. If you are unsure whether a campaign is allowed, ask a lawyer before you start it.