Legal AI Cold Calling in Germany: Consent Rules 2026

Legal AI Cold Calling in Germany: How Section 7 UWG, Section 7a UWG and the GDPR Interact

An AI voice agent may place outbound sales calls in Germany, but only under the same conditions a human caller would need to meet, plus two obligations most teams overlook: the consent documentation duty in Section 7a of the German Unfair Competition Act (UWG) and the AI transparency duty under Article 50 of the EU AI Act, which applies from 2 August 2026. The technology is not the bottleneck. The consent record is.

The short answer for revenue leaders: calling a consumer requires prior express consent. Calling a business requires at least presumed consent. And if the call counts as advertising using an automated calling machine, Section 7 (2) no. 2 UWG requires prior express consent in every case, including B2B. Calling without consent can trigger a fine of up to EUR 300,000. Failing to document the consent properly can trigger a separate fine of up to EUR 50,000.

This guide explains which layers of law apply simultaneously to a single AI call, what a defensible consent record actually looks like, and how to configure a no-code AI voice agent so the proof lands in your CRM automatically instead of in a spreadsheet nobody maintains.

Note: this article is a structured overview of the legal framework, not legal advice. For a binding assessment of your specific campaign setup, involve a law firm specialising in German competition and data protection law.

The three legal layers that apply to every AI call at once

The most common mistake in outbound projects is treating compliance as a single question: are we allowed to call? In practice at least three independent bodies of law apply, each with its own supervisory authority and its own test.

First, competition law. Section 7 UWG governs whether you may call at all. For telephone advertising the Federal Network Agency (Bundesnetzagentur) issues the fines, and competitors and consumer associations can additionally send cease-and-desist warnings, a route that in practice moves faster and costs more.

Second, data protection law. The GDPR governs whether you may process the phone number at all, what information duties you owe, and what happens to transcripts and recordings. The state data protection authorities supervise this.

Third, AI law. Article 50 of the EU AI Act requires that natural persons are informed when they are interacting with an AI system, unless that is obvious to a reasonably well-informed, observant and circumspect person. With a realistic-sounding voice agent, it is not. These obligations apply from 2 August 2026.

A setup that satisfies only one layer is not compliant. This is why so many outbound pilots stall after the first legal review: the campaign was clean under competition law but had no lawful basis for the data processing, or the other way round.

Section 7 UWG: when you may call and when you may not

Section 7 (2) UWG lists three situations in which an unreasonable nuisance is always assumed. Two of them matter for telephony.

No. 1 covers the classic sales call. Towards a consumer it is unlawful without prior express consent. Towards another market participant, meaning B2B, at least presumed consent is sufficient. Presumed means there must be concrete indications that the person called has an objective interest in this specific offer. A joinery that installs roof windows can plausibly call a roofing wholesaler. The same company cannot plausibly call a tax firm to sell office chairs.

No. 2 covers the automated calling machine. Here the law grants no B2B relief. Advertising using an automated calling machine is always an unreasonable nuisance without the addressee's prior express consent. This is exactly where AI voice agents become interesting.

The distinction between advertising and service is not a formality. It is the single biggest lever in the whole compliance design. A call that confirms an existing appointment, announces a delivery, clarifies a question about an open order or addresses an unpaid invoice is not advertising within the meaning of Section 7 UWG. The moment the same call offers an additional product, it becomes advertising.

Does an AI voice agent count as an automated calling machine?

This is the central open question, and it has not been settled by Germany's highest courts. The term automated calling machine originates from a time when it meant a tape machine: a device that plays a pre-recorded message with no human involvement and no dialogue.

A modern voice agent behaves differently. It listens, understands intent, responds to objections and hands over to a human when needed. Anyone arguing that this is not a tape machine has a serious case. So does anyone arguing that no human is involved in the individual call.

The practical consequence is straightforward: you do not build a campaign on an unresolved legal question. Treat AI outbound advertising as if Section 7 (2) no. 2 UWG applies, meaning prior express consent, including in B2B. That costs reach but makes the campaign hard to attack, and it has an underrated second effect: consented lists convert markedly better than cold lists, because the person picking up already knows the context.

Section 7a UWG: the documentation duty that derails most projects

Section 7a UWG is the provision most often missing from project plans. It demands two things. First, a consumer's prior express consent to telephone advertising must be documented in an appropriate form at the time it is given. Second, that record must be retained for five years from the point the consent is given and again after every use of it, and produced to the Federal Network Agency without undue delay on request.

Three details decide whether an audit succeeds or fails.

At the time it is given. A screenshot of the form produced after the fact is not enough. You need a record created at the moment of opt-in: timestamp, source, exact wording of the consent statement, and an identifier for the person.

After every use. The five-year clock restarts after every use of the consent, so every single call must be traceable back to the specific consent record. A campaign list with no back-reference to a consent ID does not meet the standard.

Without undue delay. When the Federal Network Agency asks, you do not have weeks to search three systems. The evidence has to be retrievable, ideally by phone number lookup.

Failing to document properly, completely or on time is a separate administrative offence, independent of whether the consent existed. You can have called lawfully and still be fined, because the proof is missing.

GDPR: lawful basis, information duties, recording

Permissibility under competition law and under data protection law are two separate tests. Even where Section 7 UWG is satisfied, processing the phone number needs a lawful basis under Article 6 GDPR, usually consent under Article 6 (1) (a) or legitimate interest under (f), the latter with a documented balancing test.

AI telephony adds three processing operations a human call does not have: transcription, processing by speech and language models, and automated evaluation of the outcome. All three need a clean entry in your record of processing activities and data processing agreements with every provider involved.

Recording is governed by a stricter rule. Capturing the non-publicly spoken word without consent is a criminal matter under German law. A transcript without audio is assessed differently and is often the more pragmatic choice. Either way the notice belongs at the start of the call, not in the small print.

Server location matters too. If you process European customer data, you should be able to explain where audio, transcripts and metadata are handled. An AI call center with EU hosting significantly reduces the burden of justification towards data protection officers and enterprise buyers.

EU AI Act from 2 August 2026: disclosure on the phone

Article 50 of the EU AI Act requires AI systems intended to interact directly with natural persons to be designed so that those persons are informed they are interacting with an AI system. The exception applies only where this is obvious to a reasonably well-informed, observant and circumspect person.

With a voice agent using natural prosody, that is precisely not the case. That is the entire point of the technology. So the disclosure belongs in the greeting, not in an answer to a question. It does not have to be clumsy. One sentence is enough.

Hello, this is Lena, the digital assistant at Nordlicht Energy Consulting. I am calling because you requested a callback about subsidy advice on our website on 14 July. Is now a good moment?

That single sentence satisfies three requirements at once: AI disclosure under Article 50 of the AI Act, identity and purpose disclosure under Section 312a (1) of the German Civil Code, and a reference to the specific consent. How to hard-wire a greeting so the language model cannot rephrase it is covered in the documentation on the initial message.

Section 312a German Civil Code: what must be said at the start

Where a business calls a consumer with a view to concluding a contract, the caller must disclose their identity, where applicable the identity of the person on whose behalf they are calling, and the commercial purpose of the call, at the beginning of the conversation. For distance contracts on financial services, the consumer must additionally be told if the call is or may be recorded.

The middle clause is the one agencies and white-label operators need to read twice. If your AI calls on behalf of a client, it must be clear who it is calling for. An agent that identifies only with the agency name does not meet the requirement.

Fine ranges and who enforces them

On top sits the warning-letter risk from competitors and consumer associations, which runs independently of the fine procedure and in practice arrives sooner. A cease-and-desist undertaking backed by a contractual penalty binds indefinitely and makes every repeat incident expensive.

What this means for your outbound economics

Compliance does not make outbound more expensive. It shifts where the cost sits. A cold list of 10,000 numbers is cheap to acquire and expensive in risk. An opt-in list of 1,200 numbers is expensive to acquire and close to risk-free. What matters is cost per qualified meeting.

This is where AI telephony changes the arithmetic. When a call costs per minute rather than per hour, it becomes economically sensible to work a smaller, properly consented list several times and in better time windows, instead of burning through a large list once. A follow-up three days later is predictable with a voice agent and often not with an outsourced call center. Per-minute rates are listed on the pricing page.

Implementation: seven steps to a defensible outbound setup

Step 1 — define the purpose. Before anything else, decide whether the campaign is advertising or service, and write the decision down. Everything downstream depends on it.

Step 2 — build a consent record in the CRM. You need at least four fields per contact: opt-in timestamp, source, exact wording of the consent statement, and a unique consent ID. A checkbox labelled may be called is not enough.

Step 3 — filter the campaign against that field. No contact without a valid consent ID enters the dialling list. Make this a technical block, not a process agreement. Process agreements break under quarter-end pressure.

Step 4 — hard-wire the greeting. AI disclosure, identity, principal, purpose and consent reference belong in the initial message, not in the free-form prompt. How to separate a fixed greeting from conversational logic is covered in the system prompt documentation.

Step 5 — process objections immediately. When someone says they do not want to be called again, that must be detected during the call, confirmed to the person and written to the CRM by webhook. A suppression list refreshed by an overnight batch is a live risk: the same contact can be called again before it runs.

Step 6 — write the outcome back. Result, timestamp and the consent ID used belong in the CRM after every call. That is how you meet the Section 7a (2) UWG requirement to maintain the record after every use. The integrations overview shows which systems connect directly.

Step 7 — test before you launch. Call yourself. Check the greeting, objection detection, human handover and the CRM entry. Only then scale.

Common mistakes in the field

The existing-customer misunderstanding. There is no existing-customer exemption for advertising calls to consumers comparable to the one for email. A gym chain with eleven locations that wants to reactivate lapsed memberships by AI needs express consent. The old contract is not enough.

Consent that came with the list. Buying addresses rarely means buying defensible consent. You have to produce the proof, not the list vendor. Without transferable documentation, the list is unusable for AI outbound to consumers.

Hidden disclosure. An agent that only admits to being AI when asked does not satisfy Article 50 of the AI Act. The information has to be volunteered.

Purpose creep. An appointment confirmation call that offers an add-on product at the end is an advertising call. The construction is common and regularly fails a competition-law review.

The blanket B2B assumption. Presumed consent in B2B requires concrete objective relevance to the offer, assessed per target segment rather than applied to all businesses at once.

Three industry examples

Energy consulting, B2C, leads from a comparison portal. Nordlicht Energy Consulting buys leads that include a callback request. The consent sits with the portal and transfers only if the portal contract says so explicitly and supplies the wording. Nordlicht stores timestamp, portal, wording and consent ID at import, calls only records with the complete set, and serves callback requests within two hours while the consent is still fresh.

Windows and doors manufacturer, B2B, prospecting property developers. Ostermeier Windows and Doors, 40 employees, calls regional developers. Objective relevance is clearly given. Because it is unresolved whether the voice agent counts as an automated calling machine, the AI agent only calls contacts who gave express consent at a trade fair or through a form. Pure cold prospecting stays with human reps.

Car dealership, service rather than advertising. A dealership uses the voice agent to confirm workshop appointments and remind customers of inspections due from the service interval. That is contract performance, not advertising, so Section 7 UWG does not apply. The moment the same call included a leasing offer, it would. The boundary is drawn hard in the prompt: no product offer without documented consent.

Conclusion

Legally sound AI cold calling in Germany is not a specialist legal topic. It is a data architecture question. Teams that keep consent, timestamp, source and wording clean in the CRM, filter every dialling list technically against that field, and write every outcome back with the consent ID satisfy Sections 7 and 7a UWG almost as a side effect. Teams that do not have a problem, with or without AI.

Three things must be settled before the first call: whether the campaign is advertising or service, a consent record that survives an audit, and a greeting that discloses AI use, identity, principal and purpose in one sentence. The EU AI Act makes the third point binding from 2 August 2026.

Famulor covers that chain in one system: lead fields for consent documentation, fixed greetings independent of the language model, real-time objection detection, post-call webhooks for the write-back, and EU hosting. The pragmatic next step is to take one existing campaign, run it against the seven steps above, and start with the segment whose consent is already documented today.

FAQ

Can an AI voice agent make cold calls in Germany?

To consumers, only with prior express consent. In B2B, Section 7 (2) no. 1 UWG generally allows presumed consent. However, it is unresolved whether an AI agent counts as an automated calling machine under no. 2, which would require express consent in B2B as well.

How high are the fines for unlawful telephone advertising?

Under Section 20 (2) UWG, up to EUR 300,000 for advertising calls to consumers without express consent and up to EUR 50,000 for missing or faulty consent documentation. The Federal Network Agency enforces both.

What exactly must I document under Section 7a UWG?

The consumer's express consent, in an appropriate form, at the time it is given. The record must be kept for five years from the point of granting and after every use, and produced to the Federal Network Agency without undue delay on request.

Do I have to disclose that the caller is an AI?

Yes. Article 50 of the EU AI Act requires people to be informed when they interact with an AI system unless it is obvious. With natural-sounding voice agents it is not obvious. The transparency obligations apply from 2 August 2026.

Is there an existing-customer exemption like the one for email?

No. The exemption in Section 7 (3) UWG applies expressly to electronic mail, not to telephone calls. Advertising calls to consumers require express consent even where a customer relationship exists.

Do appointment reminders and service calls fall under these rules?

Section 7 UWG applies only to advertising. Pure contract performance such as appointment confirmations, delivery notifications or questions about an open order falls outside it. GDPR duties and the AI disclosure obligation still apply.

May I record AI phone calls?

Only with the consent of everyone on the call. Capturing the non-publicly spoken word without consent is a criminal matter in Germany. A transcript without audio is assessed differently and is the more pragmatic option in many setups.

What happens if someone objects during the call?

The objection must take effect immediately: detected during the live conversation, confirmed to the person, and pushed to the suppression list by webhook rather than by an overnight batch job.

Is a purchased list with an opt-in flag sufficient?

Usually not. The burden of proof is on you, not the list vendor. Without transferable documentation of timestamp, source and wording, the list cannot be used for advertising calls to consumers.

Where can I read the original legal texts?

Full texts are freely available for Section 7 UWG, Section 7a UWG and Section 20 UWG. Regulator guidance is published by the Bundesnetzagentur. Terminology around AI telephony is explained in the Famulor glossary.