The TCPA's April 11 Deadline Is the First Real Regulatory Test for Restaurant Voice AI

I read the FCC’s refreshed robocall guidance this morning before my coffee was even warm, and the thing I kept coming back to is the date at the top of every restaurant voice-AI investor deck I have seen in the last six months: April 11, 2025. That is next Friday. Seven days from now. By the end of that day, every outbound voice agent ringing a guest’s mobile phone on behalf of a restaurant chain will be operating inside a federal statute that carries $500-per-call damages on the low end and $1,500 per call when a court finds the conduct willful.

I have been writing The Bottom Line long enough to know what regulatory cliffs do to deal multiples. They compress the premium for the messy operators and they widen the premium for the boring, clean ones. That repricing has not shown up in the term sheets I am tracking yet. It will.

Here is my contrarian read for the week, ahead of the deadline: TCPA exposure is about to become the single most quoted line item in restaurant voice-AI vendor due diligence, and it will quietly do more damage to the 2024-vintage long tail of “AI phone agent” startups than any of the product bake-offs running inside Inspire Brands, Yum, or Restaurant Brands right now. The compliance gap between the publicly disclosing incumbents — SoundHound, Presto, Hi Auto — and the seed-stage cohort that shipped voice product in Q4 2024 is no longer a product gap. As of next Friday, it is a legal liability gap. And legal liability gaps get priced into M&A.

What actually changes on Friday next week

Let me lay out what flips on April 11, because I keep seeing it described loosely in pitch decks and that looseness is part of the problem.

The FCC issued a declaratory ruling in February 2024 confirming that AI-generated voices — the synthetic, model-driven voices used by every serious restaurant voice agent today — qualify as an “artificial or prerecorded voice” under the Telephone Consumer Protection Act. That ruling did not change the statute. It clarified that the statute already covered the technology. Every outbound AI voice call to a residential or wireless number now sits inside the same TCPA regime that has produced the multi-hundred-million-dollar class actions you have read about for the last decade.

What takes effect on April 11 is the second move: the FCC’s expanded opt-out keyword rules. As of next Friday, any caller using an artificial or prerecorded voice — which now explicitly includes restaurant AI voice agents — must recognize and honor a defined set of opt-out keywords. The operative list, drawn from the FCC’s updated guidance and summarized cleanly in Hostie’s 2025 TCPA-FCC compliance checklist for AI voice calls in restaurants, is: STOP, QUIT, CANCEL, END, REVOKE, OPT OUT, and UNSUBSCRIBE. The caller has a hard window — ten business days — to process the revocation and stop further contact. The consumer can revoke consent through “any reasonable means,” which is the phrase that will keep voice-AI product managers awake for the rest of Q2.

That last clause matters. “Any reasonable means” means a guest can say “take me off this list” in a free-form sentence to your voice agent, and your voice agent has to catch it, classify it as a revocation, log it, and propagate the suppression across every channel — outbound voice, SMS, email tied to that profile — within ten business days. That is not a prompt engineering problem. That is a system-of-record problem.

Why the $500-$1,500 number matters at chain scale

Numbers first.

The TCPA’s statutory damages are $500 per call for negligent violations. Up to $1,500 per call when a court finds the violation knowing or willful. There is no cap. The damages stack per call, per plaintiff, and the plaintiffs in TCPA cases organize quickly because the math is so favorable to class certification.

Now run that math against a restaurant operator profile.

A regional chain with 200 locations, an average guest database of 12,000 phone numbers per store, and a monthly outbound voice campaign cadence — reservation reminders, loyalty re-engagement, lapsed-guest win-back — is dialing 2.4 million numbers a month if every guest gets one call. Industry pull-through on these databases is closer to 30 percent reachable in a given month, so call your real outbound volume 720,000 connected calls a month. If your voice-AI vendor’s opt-out keyword detection misfires on even one percent of those calls — meaning the agent kept the conversation open after the guest said “unsubscribe” or “take me off this list” — you have 7,200 potentially noncompliant calls in a single month.

At the negligent floor of $500 per call, that is $3.6 million of exposure for a single month of one chain. At the willful ceiling of $1,500, it is $10.8 million.

I am not picking apocalyptic numbers. The denominators are loose, sure, but the order of magnitude is the point. A single misconfigured voice agent deployed across a 200-store chain is, by April 12, a multi-million-dollar legal exposure that will sit on the restaurant operator’s balance sheet, not the vendor’s, unless the vendor contract has been carefully repapered. Most of them have not been.

My base case: the first headline-grade TCPA action against a restaurant voice AI deployment lands inside the next nine months, and it will not be against one of the public names. It will be against a chain that bought a 2024-vintage voice-AI product and never asked the vendor to demonstrate, on the record, how revocation propagates.

The vendor map after April 11

Here is how I am sorting the field as of this week. This is not a ranking of product quality. This is a ranking of regulatory readiness, which is a different axis.

SoundHound. Public company, public disclosures, in-house counsel that has been speaking publicly about TCPA exposure since the February 2024 declaratory ruling. Their voice platform was built with telecom-grade compliance assumptions baked in, because their pre-restaurant business was already operating inside the regulated voice ecosystem. They will be fine on April 11. They will also, I suspect, start charging a premium for that fineness.

Presto. Also public. Has spent the last eighteen months on operational discipline and has had to make its compliance posture legible to public-market investors. Drive-thru voice is a slightly different TCPA fact pattern than outbound campaign voice, because the inbound-call fact pattern carries different consent assumptions, but they are inside the regulated tent.

Hi Auto. Privately held, well-funded, enterprise-focused. The enterprise sales motion forces them to answer compliance questionnaires from sophisticated buyers. That is its own forcing function. They will be ready.

The long tail of late-2024 startups. This is where my read gets uncomfortable for the founders involved. A meaningful number of restaurant voice-AI products that shipped in Q3 and Q4 2024 were built by teams who came out of consumer voice-assistant or AI-tooling backgrounds. They did not come out of telecom. They do not have a TCPA-shaped reflex. Several of the demos I have seen in the last sixty days do not have a clear answer to “what happens if the guest says ‘stop’ in the middle of the call,” let alone a propagation guarantee for revocation across the operator’s other channels. That cohort has roughly seven days to either build it or quietly stop selling outbound campaigns.

The companies that survive April 11 with their growth motion intact will be the ones that can put a written compliance attestation in front of a chain’s general counsel. Everyone else is going to spend Q2 negotiating indemnification language they should have written into the master services agreement six months ago.

How TCPA exposure rewrites the deal premium

I cover M&A in this column, so let me say plainly what I think the deal implications are. They will not show up cleanly in the next sixty days. They will show up in the back half of 2025 and into 2026, and they will look like this.

First, the diligence checklist changes this week. Every serious acquirer evaluating a restaurant voice-AI target — strategic or financial — adds a TCPA compliance section to their data room request. That section asks for: documented consent capture flows, the opt-out keyword detection model and its measured accuracy, the propagation architecture for revocation, the audit log retention policy, the contractual indemnification language with restaurant operator customers, and the insurance coverage in place against TCPA class action exposure. None of those questions were standard six months ago. All of them will be standard by the end of Q2.

Second, the multiple compresses for vendors who cannot answer those questions cleanly. I have been hearing late-2024 voice-AI rounds priced on 25 to 40x forward revenue. That math assumes the revenue is durable. Revenue that is one TCPA class action away from being unwound is not 25x revenue. It is closer to 8 to 12x revenue, because the acquirer has to discount for the contingent liability and the operational cost of remediation post-close.

Third, the premium widens for “TCPA-clean” vendors. I have used the phrase “TCPA-clean” in three conversations this month and I expect to use it in thirty more by the end of Q2. The strategic acquirers — the POS platforms, the reservation platforms, the loyalty platforms that all want voice in their stack — are going to pay up for the targets that come pre-cleared. SoundHound, Presto, Hi Auto, and one or two of the better-built private names are going to see their inbound interest concentrate. The middle of the market is going to thin out.

This is the same pattern we saw in payments compliance ten years ago, in HIPAA compliance for health-tech in the late 2010s, and in SOC 2 for B2B SaaS more recently. A regulatory cliff prices the cohort, and the cohort sorts into two stacks: the documented and the rest.

How to repaper your voice-AI contract this week

If you are a restaurant operator reading this — which a number of you are, based on the inbound to [email protected] after the recent piece on the consolidation wave that I will get back to — here is the practical action list before next Friday.

One. Ask your voice-AI vendor, in writing, for their TCPA compliance attestation. Specifically: how do they detect the seven mandated opt-out keywords, what is the measured false-negative rate of that detection, how is revocation logged, how is it propagated to other channels, and what is the time-to-suppression guarantee. If they cannot answer these in writing by next Wednesday, you have a problem.

Two. Read your master services agreement’s indemnification clause carefully. The 2024-vintage voice-AI contracts I have reviewed lean heavily on operator-side responsibility for “compliance with applicable law.” That language is unfriendly to you. The post-April-11 contracts need to flip — the vendor providing the voice agent that touches the consumer is the right party to indemnify, and the carve-outs need to be narrow.

Three. Audit the consent capture flow for the phone numbers you are about to dial. If consent was captured pre-2024 without language that contemplated AI voice contact, you have a defensible-but-not-clean position. The cleanest move is to re-paper consent with a fresh opt-in that explicitly covers AI voice outreach. This is a one-quarter project, not a one-week project, but starting it now is the difference between being the named defendant and being a footnote.

Four. Look at your other channels. The reservation platforms, the loyalty stacks, the payments overlays — all of these may be carrying contact databases that are about to be exposed to outbound AI voice. The integrations matter. There is a deal we cover in a later Bottom Line piece, around the DoorDash and SevenRooms transaction, that has implications for which guest databases are about to get dialed by whose voice agent. There is another later piece on the Resy and Amex loyalty / payments stack that touches the same question from a different angle. Both pieces assume the TCPA layer underneath. Get the TCPA layer right first.

My base case for the rest of Q2

I do not think April 11 produces a single dramatic enforcement moment. The FCC does not work that way, and the plaintiff’s bar does not file on day one. What happens instead is quieter and more consequential.

In the first thirty days post-deadline, the chain operators get diligence-style emails from their vendors trying to demonstrate readiness. The good vendors send useful answers. The thin ones send marketing copy. The chains start triaging.

In the second thirty days, the first plaintiff-side discovery letters arrive. These are not lawsuits. They are fishing expeditions, and they are aimed at the chains, not the vendors, because the chains have the deeper pockets. The chains then turn to the vendors and ask for their indemnification.

By the end of Q2, the term sheets I am tracking for the voice-AI category start to show the bifurcation I described above. The clean names trade higher. The unclean names trade lower or stall. The seed-stage cohort that raised on growth promises in Q4 2024 does its next round at a flat or down mark, and a non-trivial fraction of that cohort gets absorbed into the larger names at acquihire pricing.

That is the M&A picture. The product picture is more interesting and I will come back to it in a future column, because the operators who get the compliance plumbing right are going to be able to do things with their guest databases — personalized outbound, multi-channel coordination, real lifecycle marketing — that the operators who got blocked at the TCPA layer cannot do at all. The compliance moat becomes the product moat.

Next Friday is not a cliff. It is a sorting mechanism. Make sure you are in the right pile.

— Marcus writes The Bottom Line. Tips: [email protected].