- PECR restricts qualifying unsolicited marketing calls to registered numbers. Screening TPS, CTPS, and your own suppression list is the operational control used to avoid prohibited calls - and AI-driven outbound makes that control easier to skip at scale.
- Compliance failures here are rarely deliberate. They tend to happen because phone data enters the pipeline unchecked, agents dial from unscreened lists, or screening happens once at import and is never refreshed before the call.
- The fix is structural: screen numbers against TPS/CTPS at the point closest to the call, not just at the point of import. Build the check into the workflow, not around it.
This article is general information about how UK marketing rules apply to automated outbound calling. It is not legal advice and it is not a compliance certification for any particular workflow. Positions here are drawn from published ICO guidance, which the ICO notes is under review following the Data (Use and Access) Act. Take advice on your own processing.
AI agents are getting very good at outbound calling. They can research a prospect, generate a talk track, dial the number, handle objections, and log the outcome - all without a human picking up the phone.
That speed is the point. It is also the risk.
Because every number an AI agent dials is subject to the same rules that apply to a human SDR. And one of the most important rules in UK outbound - one that teams consistently underestimate - is the Telephone Preference Service.
What TPS and CTPS actually require
The Telephone Preference Service (TPS) is a register of individuals who have opted out of unsolicited sales calls. The Corporate Telephone Preference Service (CTPS) is the equivalent for businesses.
The registers themselves are not the law. What PECR does is restrict qualifying unsolicited marketing calls to registered numbers unless the required consent or an exception applies. The registers are how you find out which numbers those are.
So the practical rule is: if a number is registered on the TPS or CTPS, you should not make unsolicited direct marketing calls to it unless the person has given you specific, prior consent to call them. “Specific” means they consented to calls from your organisation, not just that they filled in a form somewhere. “Prior” means the consent was given before you called, not that you plan to ask for it during the call. PECR also says you must not call anyone who has previously told you they do not want your calls, whether or not they are registered.
Screening against the TPS, the CTPS, and your own suppression list is therefore the operational control you use to avoid making a prohibited call. It is not itself the legal obligation - it is how you meet one.
Why AI outbound makes this harder, not easier
Automation can increase call volume substantially, and volume is what turns a process gap into a pattern. The controls below matter more as throughput rises, whatever your actual numbers are.
Volume amplifies mistakes
If a bad number makes it into an AI agent’s call queue, it does not get a gut check. Nobody pauses and thinks “this number looks wrong” or “I think this person asked us not to call.” The agent dials it because it is on the list. At scale, one unchecked batch can repeat the same mistake across every row in it before anyone notices.
Agents do not question their inputs
A well-trained SDR might recognise a personal mobile and hesitate, or notice that a number has been flagged before. AI agents work from the data they are given. If the list says dial, the agent dials. The quality control has to happen before the number reaches the agent - not during the call.
Speed compresses the feedback loop
When an AI agent hits a registered number, a complaint can arrive before the team reviews its call logs. With human-led outbound there is usually more opportunity to notice and correct a problem between calls. When dialling is automated, the same mistake can repeat across a list before anyone looks at it.
Multi-agent setups multiply the risk
Some teams run multiple AI agents in parallel, each working a different segment or territory. If TPS screening is not built into the shared data pipeline, each agent inherits the same unchecked numbers - and the same compliance risk, multiplied.
Where teams actually get caught out
Breaches of this kind are rarely the result of teams deliberately ignoring the rules. They tend to come from gaps in the data workflow.
Phone numbers enter the pipeline unchecked
A rep downloads a list from LinkedIn, a webinar platform, or a purchased database. The list includes phone numbers. Nobody screens them against TPS before they are loaded into the dialler or handed to an AI agent. The numbers were never checked because the import process does not include a check.
TPS screening happens at import but is never refreshed
Some teams do screen numbers when they first enter the CRM. But the registers are updated continuously, and a number screened earlier may since have been registered. If you screened it once at import and never again, you are calling on the basis of a check that may no longer hold.
Consent is assumed, not recorded
A prospect filled in a form on your website. Someone on the team assumes that counts as consent to call. But the form did not include a specific opt-in for phone calls from your organisation. General consent, implied consent, and “they gave us their number” are not the same as specific prior consent under PECR.
Personal mobiles get mixed in with business lines
Some data sources include personal mobile numbers alongside business direct dials. The TPS applies to individual subscribers - which includes personal mobiles even if the person is a business contact. If your list does not distinguish between personal and business lines, you are exposed.
The screening gate template
The principle is simple: screen every number before it reaches the dialler, as close to the point of calling as practically possible. What follows is the gate as a sequence of checkpoints - each one names the trigger, what gets written to the record, and what the agent is allowed to do with the outcome.
| # | Gate | Trigger | Check performed | Written to the record | Agent may dial? |
|---|---|---|---|---|---|
| 1 | Intake | Number enters the system from any source | Format normalised to E.164; source and acquisition date captured | phone_source, phone_acquired_at | No - not yet screened |
| 2 | Register screen | Immediately after intake | TPS and CTPS lookup | tps_status, ctps_status, screened_at | Only if both clear |
| 3 | Consent check | After register screen | Does a recorded, attributable consent exist for this number? | consent_status, consent_source, consent_at | Yes, if consent covers a registered number |
| 4 | Internal suppression | After consent check | Match against your own do-not-call list | suppressed, suppressed_reason | No if suppressed, regardless of register status |
| 5 | Re-screen | Before the number joins a dial queue | Repeat gate 2 if screened_at is older than your refresh window | screened_at updated | Only on a fresh pass |
| 6 | Dial | Agent picks up the record | None - the gate has already decided | dialled_at, campaign_id | Per gates 2-5 |
| 7 | Outcome | Call ends or an objection is received | Objection written straight to suppression | suppressed, suppressed_reason, objection_at | Never again for this number |
Gates 2 and 5 are the pair people skip. One without the other gives you either a screening record that goes stale or a last-minute check with no history behind it.
Screen at import and again before dialling
Check numbers against the TPS and CTPS when they first enter your system. Then check again before the number is queued for an AI agent to call. The second check catches numbers that were added to the register between import and the call.
Flag rather than silently delete
When a number fails a TPS check, flag it rather than deleting the row. The contact might still be reachable by email. Or the team might have specific consent that overrides the TPS registration. Flagging preserves the record and the decision trail. Silently deleting removes both.
Record the screening result and timestamp
For every number you check, log the result and the date. Retain evidence showing what was screened and when, so you can demonstrate the control was actually applied to a specific number at a specific time. “We use a tool that does it automatically” is a description of a process, not evidence that it ran.
Separate consent tracking from TPS status
A contact can be on the TPS and still be callable - if they gave you specific prior consent. But that consent needs to be recorded, attributable, and auditable. Keep consent status as a separate field from TPS status so your workflow can handle both signals correctly.
Do not let AI agents bypass the check
If your AI agent pulls numbers from a CRM, a list, or a B2B data enrichment tool, the TPS check must sit between the data source and the agent’s dial queue. The agent should never have access to an unscreened number. This is an architecture decision, not a training decision - you cannot solve it by telling the agent to “check TPS first.”
What about B2B calls - does TPS still apply?
Yes, and the practical answer is simpler than the folklore around it: for B2B calling you screen against both registers.
The TPS is the register for individual subscribers. The CTPS is the same thing for corporate bodies - companies, limited liability partnerships, Scottish partnerships, government bodies. Which register a number sits on follows the subscriber, meaning the entity named on the bill for the line, not whether the number happens to be a direct dial or a switchboard.
That is where the common mistake lives. Some businesses register with the TPS because they are sole traders or ordinary partnerships and count as individual subscribers; others register with the CTPS. You cannot tell which from the number, so the ICO’s guidance for B2B calls is to screen against both registers as well as your own do-not-call list.
There is no “B2B exemption” to fall back on either. A registered number needs specific consent before you call it, and a legitimate interests assessment does not override the registration.
The cost of getting this wrong
The ICO has enforcement powers for PECR breaches, including monetary penalties, and publishes the action it takes. The operational cost usually arrives first, though: complaints to handle, an evidence trail to reconstruct, a process to remediate, and ops time spent on all three instead of on pipeline.
There is also a plain commercial cost that needs no statistics to justify. Someone who registered with the TPS and got called anyway is not a prospect any more.
Wrapping up
AI-driven outbound is powerful. Automation can substantially increase calling capacity without a matching increase in headcount. But that capacity only works if the compliance layer scales with it.
TPS and CTPS screening is not a nice-to-have. It is the control that keeps you on the right side of a restriction that applies to every number you dial, whether a human or an agent dials it. The teams that build this check into their data pipeline, rather than bolting it on as an afterthought, are the ones that scale outbound without scaling risk.
Screen at import. Screen before dialling. Log the result. Track consent separately. And never let an AI agent dial a number that has not been checked. TPS screening is one control inside the wider job of governing prospect data before AI agents touch it.
Sources and further reading
Official ICO guidance only. Check these before making a decision about your own calling, rather than relying on this page. The ICO notes that its direct marketing guidance is under review following the Data (Use and Access) Act, so the current position may have moved.
- ICO: Telephone marketing — live and automated calls, and what the TPS and CTPS are.
- ICO: Business-to-business marketing — corporate and individual subscribers, and why B2B calling needs both registers screened.
- ICO: Guide to PECR — how the regulations are structured.
- ICO: Direct marketing guidance hub — the detailed guidance behind the summaries above.
- ICO: Lawful basis for processing — consent — what makes consent valid, which matters when you rely on it to call a registered number.
DataFixr includes TPS screening and phone validation as part of its cleaning workflow - so numbers are checked before they reach your CRM, your dialler, or your AI agent. Start using DataFixr free ->