What's it about?

Voice-controlled AI systems and multi-agent systems are transforming not only customer service but increasingly also marketing, recruiting, logistics , coaching, and internal process management.
However, organizations that use voice and call automation find themselves navigating the complex interplay of data protection, telecommunications law, media law, copyright law, and AI regulation —both in Europe and in the UAE. Mistakes can be costly: In 2024 alone, the TDRA imposed over 2,000 fines for unauthorized AI calls—with individual fines of up to AED 150,000.

How do multi-agent voicebots work—and what are they capable of today?

Modern AI voicebots are much more than just intelligent answering machines. They serve as human interfaces to corporate systems—from inventory management and logistics to marketing, HR, and compliance. They interact using natural-sounding voices, understand user requests in context, and act on them in real time. Through API interfaces, they schedule appointments, process orders, or forward information to internal systems.

In addition, they can record, transcribe, and analyze conversations—for example, to summarize customer conversations, evaluate job candidate interviews, or optimize sales and coaching processes.

This means that an AI agent can now conduct market research, identify sales opportunities, develop communication strategies, integrate them into CRM systems—and, if necessary, even automatically call a customer or candidate.

As a result, voicebots today already touch on several areas of law at once—and significantly increase the demands on governance, data protection, and oversight.

1. Voice and Right of Privacy – Bruce Willis at the Dentist

A voicebot’s voice sounds human because it is trained using real voice profiles.
From a legal standpoint, it is irrelevant whether the bot sounds like Bruce Willis or like “Inge from next door”—the voice is part of the general right of personality (Sections 823, 1004 of the German Civil Code (BGB) in conjunction with Article 2(1) and Article 1(1) of the German Basic Law (GG)). It may not be used or imitated without the consent of the person concerned. The voice rights of deceased public figures would have to be licensed from their heirs.

The unauthorized recording or use of a voice for training purposes constitutes a violation of personal rights, may give rise to copyright claims (Sections 22 and 23 of the Austrian Art Copyright Act (KunstUrhG)), and generally also constitutes a violation of data protection laws.

In extreme cases, the act may constitute a criminal offense under Section 201a of the German Criminal Code (StGB) (invasion of the highly personal sphere of life through audio recordings)—particularly in the case of voice impersonations or deepfakes.

2. Conversation Analysis and Data Protection

As soon as a voicebot records or transcribes conversations, several layers of data protection come into play:
Voice data contains personal information and often biometric data—therefore, Article 9 of the GDPR (special categories of personal data) and the principle of data minimization (Article 5(1)(c) of the GDPR) apply.

The following is required:

• explicit consent (Art. 6(1)(a) of the GDPR),
• in the case of a systematic analysis, a data protection impact assessment (Art. 35 of the GDPR),
• as well as a record of processing activities (Art. 30 of the GDPR).

Automated applicant evaluations or scoring processes may also violate Article 22 of the GDPR (“Prohibition of automated individual decision-making”).
According to the ECJ’s SCHUFA ruling (2024), stricter limits apply here: Even de facto effective preliminary decisions are considered automated.

A voice application must make its privacy policy easily accessible—for example, on its website or via a QR link in an app.

This must include, among other things: the controller, the purpose, the legal basis, the retention period, the rights of data subjects, and, if applicable, a reference to automated decision-making.

3. Data Processing and Hosting—Cloud, Location, and GDPR Transfer Rules

The legally compliant handling of voice and metadata is at the heart of every voicebot implementation. As soon as voice recordings or transcripts are processed, it must be clearly defined where the data is stored, who has access to it, and on what legal basis it is processed.

The General Data Protection Regulation (GDPR) applies in the EU, in particular Article 5 (Principles of Processing) and Article 32 et seq. (Security). Companies must ensure that all voice data is processed within the European Economic Area (EEA) or—in the event of outsourcing—is transferred only to recipients that ensure an adequate level of data protection (Art. 44 et seq. of the GDPR).

For cloud providers such as AWS, Azure, Google Cloud, or Twilio, this means that a Data Processing Agreement (DPA) is required under Article 28 of the GDPR. In some cases, a Transfer Impact Assessment (TIA) that evaluates the legal framework of the recipient country—such as the UAE or the U.S.—may be necessary. In some cases, Standard Contractual Clauses (SCCs) or Binding Corporate Rules (BCRs) may also need to be incorporated.

Data transfers to third countries (outside the EEA) are permitted only if they are safeguarded by contractual arrangements or adequacy decisions. There is currently no EU adequacy decision for the UAE—therefore, Standard Contractual Clauses (SCCs) or local hosting are required.

4. Media Law and Transparency Requirements

Voicebots that generate or communicate content are also subject to the State Media Treaty (MStV). According to Section 18 of the MStV, there is an obligation to identify the provider, and according to Section 19 of the MStV, there is an obligation to ensure that automated communication is recognizable.
Thus, if an AI speaks in a way that makes it sound like a human, it must be disclosed that the voice is artificial.

In addition, transparency requirements also arise from data protection law (Articles 5, 12–14, and 22 of the GDPR) and competition law (Section 5a of the UWG):
Anyone who uses AI systems for communication, analysis, or decision-making must inform users clearly and comprehensibly that automated processing is taking place and what consequences this may have.

The upcoming Article 52 of the EU AI Act harmonizes these requirements at the European level:
Every person must be able to recognize that they are interacting with an AI—and have the option to refuse or terminate the interaction. This applies in particular when the AI makes recommendations, analyzes emotions, or prepares decisions.

5. Competition Law Limits – Inbound vs. Outbound

Telemarketing calls can be problematic under Section 7 of the Unfair Competition Act (UWG).

Inbound calls (where the user initiates the call) are permitted if the voicebot identifies itself as an AI at the beginning (“I am an AI assistant from …”) and the user continues the conversation.
Consent is deemed to have been given implicitly by continuing the conversation.

Outbound calls (calls initiated by a company) are permitted only with prior express consent (Section 7(2)(2) of the German Unfair Competition Act (UWG)).

In the B2B sector, the “presumed consent” exception applies if the call is objectively in the best interest of the recipient and is relevant to the subject matter. This consent must be documented. Violations may be penalized by the Federal Network Agency with fines of up to €300,000. Under competition law, voicebots are generally treated the same as humans.

6. Telecommunications Law (TDDDG/TTDSG, TKG)

The TDDDG (the successor to the TTDSG) governs data protection for end devices and communication systems.

• 25 TDDDG – End-User Access

Any access to the microphone, storage, or sensors requires prior, informed consent. This also applies to wake-word detection and buffering.
A simple browser or app prompt is not sufficient. Only “strictly necessary” processes are exempt.

• 3 TDDDG – Telecommunications Privacy

The content and metadata of voice sessions may not be collected, analyzed, or disclosed to third parties without authorization. Violations may result not only in fines but also in criminal liability under Section 206 of the German Criminal Code (StGB). Companies must implement technical and organizational measures (TOMs): encryption, access restrictions, and minimal logging.

Telecommunications Act (TKG)

The TKG applies only when the voicebot facilitates communication between people (e.g., call routing or conference services). In this case, it constitutes a number-independent interpersonal communication service (NI-ICS) subject to additional obligations under §§ 168 et seq. of the TKG.

7. Protection of Copyright and Trade Secrets

AI systems may only be trained using data that is lawfully accessible (Section 44b of the German Copyright Act (UrhG) – Text & Data Mining). Rights holders may opt out. This also applies to the use of internal call recordings.

Voice transcripts often contain confidential information. Such information is protected under Section 2 of the German Data Protection Act (GeschGehG) only if appropriate security measures are in place—such as NDAs, access restrictions, and encryption. AI service providers should therefore always have confidentiality agreements in place.

8. The EU AI Act—What Will Change Starting in 2025

The AI Act (Regulation (EU) 2024/1689) will take effect in phases starting in 2025 and will revolutionize the way AI systems are handled in Europe.

Since February 2025, a ban has been in effect on certain applications (emotion recognition in the workplace, social scoring). In August 2025, additional requirements were introduced for general-purpose AI regarding transparency, training documentation, and copyright policy.

Starting in August 2026, stricter requirements for high-risk AI—such as registration, risk management, and CE marking—will be introduced. Full enforcement will then take effect in August 2027, including market surveillance and fines of up to €35 million or 7% of revenue.

The implications for voicebots include, among other things, a ban on emotion recognition or behavioral analysis in HR or workplace contexts. With regard to applicant scoring or automated selection, this constitutes high-risk AI, and the “human oversight” requirement applies in particular here.)

What Is the Legal Situation in the UAE—New Requirements for Voice and Telemarketing AI?

The UAE Personal Data Protection Law (PDPL) (Federal Decree Law 45/2021) is implemented through Cabinet Resolutions 56 & 57 (2024). The TDRA (Telecommunications and Digital Government Regulatory Authority) oversees the use of AI in customer interactions and telemarketing.

For inbound calls, consent is also presumed to be implied by the call itself. An AI disclaimer stating “I am an AI…” is required; a separate license is not necessary.

In the case of outbound calls, however, prior consent is required, and compliance with the “Do Not Call Registry” is mandatory.  As with inbound calls, the AI disclosure “I am an AI…” is required, and there must also be an opt-out option at the beginning of the call. Use is time-limited; permitted calls may only be made between 9 a.m. and 6 p.m. A TDRA license is required, and violations may result in fines of up to 20 million AED.

What about the technical setup?

The United Arab Emirates has one of the most restrictive telecommunications regimes in the world. The TDRA is responsible for licensing and overseeing all telecommunications services. Only two official operators, Etisalat and du, hold a monopoly on telecommunications and VoIP services, including SIP trunks, SMS gateways, and landline numbers.

A common practice with voicebots and similar systems is, for example, the use of Twilio, SIP trunks, or U.S. phone numbers. Twilio is not licensed in the UAE and is not authorized to provide telecommunications services.

As a general rule, this applies to all SIP trunks from abroad (e.g., the U.S., Germany, the U.K.): Only TDRA-licensed providers are permitted to terminate SIP trunks into local telephone networks. External SIP trunks (e.g., from Asterisk, 3CX, Twilio, Zoom, Vonage, RingCentral, etc.) may not be connected directly to UAE phone numbers or integrated into local voicebots or call centers. Such connections are considered illegal international gateway services. Substantial fines of up to AED 500,000 and system suspension may result.

A local storage requirement also applies to data processing and data residency: According to Cabinet Resolution No. 56/2024 (Implementation of the PDPL), telecommunications and communications data (call logs, voice records, metadata) may only be stored in the UAE or in recognized free zones (DIFC, ADGM). Transfers abroad are permitted only with authorization from the Data Office or if an “adequate level of protection” is ensured.

Generally permissible storage locations include the UAE mainland (Etisalat, du) or certain free zones with so-called “data sovereignty,” such as the Dubai International Financial Center (DIFC) or the Abu Dhabi Global Market (ADGM). Both zones have their own data protection laws (based on the GDPR) and are considered “safe havens” within the UAE.

Violations may result in fines of up to 20 million AED and personal liability for management.

What Should Be Done? – Recommendations for Action

Companies should take action now and:

• Designing Consent Flows That Comply with the GDPR and PDPL
• Implementing AI Disclosure & Human Fallback
• Integrate DNCR and license checks
• Check VoIP Compliance (Twilio/Vonage)
• Clearly define data location (EU/UAE)
• Create Audit Trails & Incident Playbooks
• Enter into company agreements for internal use
• Implement the AI Act Roadmap (Documentation, Copyright, Risk Management)
• Implement an AI Registry and Impact Assessment
• Establish Employee Training and Governance for AI Compliance

In Conclusion

Multi-channel voicebots will revolutionize business communication in the coming years—but they will also make it more legally complex. Companies that implement transparency, documentation, and human oversight today will build trust and ensure legal certainty at the same time.

The future belongs to those who think about technology and the law together.

Please contact us.