PECR Compliance for AI Phone Systems: What UK Businesses Must Know

PECR governs unsolicited electronic communications in the UK. Here's how AI voice agents and their follow-up messaging must comply — and how to do it correctly.

The Privacy and Electronic Communications Regulations 2003 (PECR) implement the EU ePrivacy Directive in UK law and govern how businesses use electronic communications for marketing and outreach. For businesses using AI voice agents, PECR is relevant in two key areas: inbound call handling and outbound follow-up communications.

Does PECR Apply to Inbound AI Calls?

When a caller rings your business number and an AI answers, PECR does not generally apply to that inbound leg — the caller initiated contact. However, if your AI agent calls out to customers (for appointment reminders, callbacks, or outreach), PECR's rules on automated calling and electronic marketing apply immediately.

Automated Calls and Direct Marketing

Under PECR Regulation 19, automated direct marketing calls require explicit prior consent from the called party. This means your AI agent cannot call customers for promotional purposes without documented consent — and 'soft opt-in' is only available for existing customers in respect of similar products or services.

SMS and Email Follow-Ups

If your AI agent sends an SMS confirmation or follow-up email after a call, PECR requires that: (1) the recipient has consented to marketing communications, or (2) the message is a transactional confirmation rather than marketing content. Appointment confirmations are generally transactional and do not require consent beyond the call itself.

Best Practices for PECR-Compliant AI Voice Deployment

• ✓Clearly identify AI calls and inbound handling in your privacy notice
• ✓Obtain explicit consent before any outbound AI marketing calls
• ✓Use double opt-in for SMS marketing lists
• ✓Ensure appointment confirmation messages are purely transactional
• ✓Maintain accurate suppression lists (TPS, CTPS for business numbers)
• ✓Work with a provider that offers PECR-compliant outbound defaults