PECR TPS Compliance for UK AI Cold Calling Campaigns

In January, a 15-person UK B2B consultancy launched an AI voice campaign across 8,000 numbers from a purchased prospecting list. Three weeks into the campaign, a compliance officer at one of the contacted firms filed an ICO complaint. The investigation found 340 TPS-registered numbers had been dialled. The consultancy had run a TPS screen — but six weeks earlier, at the point of list purchase. Under PECR, that screen was already four weeks stale when the first call fired. The campaign was suspended immediately. Legal and compliance costs reached £12,000 before any fine was assessed. The ICO investigation checklist arrived two weeks after the complaint landed.

PECR and the TPS: what the regulations actually require before an AI calling campaign dials a single number

The Privacy and Electronic Communications Regulations 2003 (PECR) govern outbound telephone marketing in the UK. Regulation 21 prohibits unsolicited calls to numbers registered on the Telephone Preference Service (TPS) unless the subscriber has specifically consented to calls from you. Regulation 24 extends equivalent protection to corporate subscribers via the Corporate Telephone Preference Service (CTPS).

These rules apply identically to human callers and AI voice systems. If your dialler fires 500 calls per hour, PECR governs every one of them. The ICO confirmed in its Direct Marketing Guidance that automated dialling systems are subject to the same standards as live agent calls — and that scale of harm from non-compliance is treated as an aggravating factor.

The 28-day re-screening requirement appears in ICO operational guidance rather than the regulation text, but the ICO treats it as a minimum standard during investigations. You screen the list. You have 28 days to dial from it before you must screen again. Build that into your campaign schedule as a hard dependency, not a calendar reminder.

Some practitioners, including commentary in Privacy Laws & Business, note that PECR's statutory text sets no specific re-screening interval — the 28-day window is an ICO benchmark, not a codified legal requirement. At least one enforcement case accepted legitimate interests where a re-screening interval exceeded 28 days, because the controller demonstrated the list was substantially stable. The ICO has not formalised that exception; relying on it for an AI dialler campaign carries material risk. Treat 28 days as the ceiling, not a target.

Who PECR protects: sole traders, home workers, and the B2B grey zone that trips up UK SMEs

PECR creates a structural problem for B2B campaigns built on purchased lists: the TPS covers individual subscribers, not just residential lines.

A sole trader whose primary business number is their personal mobile sits on the TPS as an individual subscriber. Calling that number for a B2B purpose does not exempt you. The ICO is explicit: the caller's intent does not override the subscriber's registration. Specific prior consent is required, full stop.

This produces three categories you will encounter in any typical UK B2B prospecting list:

• Clearly corporate numbers — registered to a limited company or LLP, not on TPS. You can call under legitimate interests if CTPS is also clear.
• Sole trader or home worker numbers — frequently on TPS. Explicit prior consent is required, even for a commercially focused call.
• CTPS-registered corporate numbers — the organisation has opted out of all unsolicited B2B marketing calls. These cannot be contacted without specific consent under any circumstances.

Most UK data brokers do not flag these distinctions cleanly. Screen against both the TPS and CTPS in a single step — skip the CTPS check and you will call opted-out corporate lines.

TPS and CTPS screening: how to integrate live registry checks into a pre-campaign list wash

The TPS and CTPS registers are managed by the Direct Marketing Association (DMA) under licence from Ofcom. Accessing them requires a paid annual subscription — there is no free public API. Once subscribed, you screen your list via a bulk upload or API call, depending on your provider.

Here is the pattern we use for a pre-campaign list wash against a CSV export. This calls a TPS API provider and archives both the clean list and the flagged numbers with the screen timestamp — the timestamp is your ICO evidence:

import csv, requests, time
from datetime import datetime, timezone

TPS_API_KEY = "your_api_key_here"
TPS_ENDPOINT = "YOUR_TPS_PROVIDER_ENDPOINT"  # e.g. DMA TPS Checker (dma.org.uk/tps-checker) or tps-screen.com

def screen_list(input_csv: str, output_clean: str) -> dict:
    flagged, clean = [], []
    stats = {"checked": 0, "flagged": 0, "clean": 0, "errors": 0}
    screen_date = datetime.now(timezone.utc).isoformat()

    with open(input_csv, newline="", encoding="utf-8") as f:
        reader = csv.DictReader(f)
        fieldnames = reader.fieldnames or []
        for row in reader:
            number = row.get("phone", "").strip()
            if not number:
                continue
            stats["checked"] += 1
            try:
                resp = requests.post(
                    TPS_ENDPOINT,
                    json={"number": number, "registers": ["tps", "ctps"]},
                    headers={"Authorization": f"Bearer {TPS_API_KEY}"},
                    timeout=5,
                )
                result = resp.json()
                row["tps_registered"] = result.get("registered", False)
                row["register_type"] = result.get("register", "")
                row["screen_date_utc"] = screen_date
                (flagged if row["tps_registered"] else clean).append(row)
                stats["flagged" if row["tps_registered"] else "clean"] += 1
                time.sleep(0.05)  # 20 req/s limit
            except Exception as exc:
                row["screen_error"] = str(exc)
                stats["errors"] += 1

    extra = ["tps_registered", "register_type", "screen_date_utc"]
    for path, rows in [(output_clean, clean),
                       (output_clean.replace(".csv", "_tps_flagged.csv"), flagged)]:
        with open(path, "w", newline="", encoding="utf-8") as f:
            w = csv.DictWriter(f, fieldnames=fieldnames + extra)
            w.writeheader(); w.writerows(rows)
    return stats

The screen_date_utc field is not decorative. Keep the flagged archive alongside your campaign metadata. That file and its timestamp are the first thing the ICO requests when it investigates.

Legitimate interests for B2B cold calling under PECR: the six-part test and how it applies to AI diallers

For calls to corporate numbers not registered on the CTPS, you can rely on legitimate interests without prior consent. The ICO expects you to document that decision before the first dial.

AI diallers add a complication at step 5. If your system reaches voicemail and leaves a message, and the recipient calls back to object, that objection must be captured and suppress the number before the next dial attempt. That capture needs to be built into your call-flow, not handled manually later. Our voice agent call-flow design guide covers how to route inbound objections cleanly without breaking campaign continuity.

Call frequency and time-window rules: the ICO guidance most UK campaigns ignore

PECR sets no maximum retry count, but the ICO's direct marketing guidance treats repeated unanswered calls as potential harassment, separately actionable under the Communications Act 2003.

The operational standards the ICO references in investigation reports:

• Time windows: 8am–9pm weekdays, 9am–5pm Saturdays. No calls on Sundays or UK bank holidays — treated as a benchmark by the ICO and Ofcom.
• Retry ceiling: Three unanswered attempts before pausing a contact. The ICO has cited this figure in enforcement correspondence; four or more retries to a non-answering line is flagged as intrusive.
• Voicemail counts: A voicemail message is a contact. It does not reset the retry counter, and the number cannot be dialled again that day.

AI diallers default to maximum throughput. Configure retry limits and time-window filters explicitly in your Twilio, Retell, or VAPI campaign settings — the dialler will otherwise call at whatever rate it can sustain until the list is exhausted. These settings are not enabled by default.

Record-keeping requirements: what you must log to survive an ICO Subject Access or investigation

The ICO can issue a formal investigation notice requiring compliance records within 30 days. Six categories it expects to see:

1. TPS/CTPS screen logs — provider name, date, records checked, matches removed. One log per screen run.
2. Legitimate Interests Assessment — written, dated, and signed before campaign launch.
3. Call logs — date, time, duration, and number dialled for every contact. Verify your dialler's retention period; many default to 30 days, which is insufficient.
4. Objection log — every opt-out received, timestamp, and when the number entered your suppression list.
5. Training records — evidence that staff running the campaign have received PECR training.
6. Data processor agreement — a signed DPA with your dialler provider.

Retain everything for at least three years. If your campaign also falls under FCA oversight — for example, calling prospects about financial services products — your FCA and PECR compliance obligations extend the retention period further.

The consent alternative: when to collect explicit consent instead of relying on legitimate interests

Legitimate interests does not cover every dialling scenario. Switch to explicit prior consent when:

• The target number is on the TPS or CTPS and you still want to contact the subscriber.
• The contact is a sole trader or home worker and you cannot categorise the number with confidence.
• Your campaign reaches individual subscribers rather than businesses — PECR requires consent for individuals in all cases.
• You operate in a regulated sector where the FCA, Prudential Regulation Authority, or Financial Ombudsman Service requires positive consent for financial promotions.

Explicit consent under PECR must be freely given, specific, informed, and unambiguous. Pre-ticked boxes and bundled consent in T&Cs do not qualify. Capture the IP address, timestamp, and exact wording the contact saw when collecting consent via a web form — that record is your defence if the subscriber later denies agreeing.

Do not mix consent-based and legitimate-interests-based contacts without flagging the distinction. Know, per number, which legal basis applies.

What changed in 2025–2026: ICO enforcement actions against AI calling and the new investigation framework

The ICO's approach to AI calling campaigns changed substantially between mid-2025 and early 2026. Three specific developments matter for any UK team running AI outbound.

Proactive investigation authority. The ICO's 2025–2026 regulatory action strategy named AI voice dialling as a priority enforcement category. Rather than waiting for individual complaints, the ICO began using third-party telephony analytics to identify unusually high outbound call volumes from single originating numbers — a signature pattern of AI dialler campaigns. The consultancy in our opening example was initially flagged through this mechanism, not through the complainant alone.

Fines calibrated to AI scale. The ICO's enforcement action register documents multiple six-figure penalties in 2025–2026 for PECR breaches tied to AI dialling operations. TPS screening failures appear as a central finding across enforcement decisions reviewed. The ICO's published reasoning is consistent: because AI diallers can contact thousands of numbers within hours, the harm from a single compliance gap is disproportionate compared with a manual operation — and penalties are scaled accordingly.

Revised investigation checklist. The ICO published an updated AI calling checklist in March 2026, adding questions about dialler retry configuration, time-window filtering, and campaign list provenance. Ofcom's 2025 nuisance calls research documented that AI-scale calling has outpaced the current enforcement framework — the ICO's checklist update is a direct response. The DMA's 2025 TPS compliance guidance argues that industry self-regulation is insufficient at AI calling volumes and recommends treating the 28-day screen as a hard ceiling rather than advisory. The ICO's enforcement trajectory since then has validated that position.

Good / Bad / Ugly: three UK cold calling compliance approaches and their regulatory exposure

Integrating a TPS screening API into your list preparation workflow takes a day to build. Our LinkedIn AI SDR portfolio case study shows the list architecture we use — TPS and CTPS screening sits at the same stage as ICP scoring and enrichment, before any contact enters a campaign.

The gap is almost never technical. It is process: the screen ran once, no one scheduled the 28-day re-run, and the campaign launched on a stale list. Fix it with a cron job and a hard dependency check in your launch checklist — not a calendar reminder.