This page summarizes the law as of October 2026 to help you plan AI phone calls. It isn’t legal advice. Laws and how regulators apply them change, so check your use case with a lawyer before you start a campaign.
At a glance
Is AI cold calling legal in Finland?
Only with prior consent when you call a natural person. Section 200(1), Finland’s version of ePrivacy Directive Art. 13(1), says direct marketing through “automatisoitujen soittojärjestelmien” may only target natural persons “jotka ovat antaneet siihen ennalta suostumuksensa.” In English: marketing through automated calling systems may only reach people who gave their consent in advance. Who it protects. Section 200 covers natural persons. Under Section 202, you may market to companies “jollei tämä ole sitä nimenomaisesti kieltänyt” (unless they expressly prohibited it), automated calls included. A sole trader (toiminimi) is a natural person, so we read Section 200 as covering them. For an employee’s own work email, the Data Protection Ombudsman expects consent unless the offer substantially relates to their job (DLA Piper). Apply the same caution to direct numbers. Whether an AI agent counts. The Act doesn’t define an automated calling system, and we found no Finnish court or regulator decision on AI agents. The ASML telemarketing code (January 2025) requires the consumer’s explicit permission for sales calls made “ns. robotilla tai muutoin ilman ihmispanosta” (by a so-called robot or otherwise without human input). An AI agent that holds the conversation fits that description, so treat its calls as automated. Human in the loop. The same code allows automatic dialing without consent when a human holds the conversation. A colleague who listens or takes over after a forward doesn’t change the answer, because the AI agent still talks first.Cold calls by a human
Section 200(2) allows live marketing calls unless the person “nimenomaisesti kieltänyt” (expressly prohibited) them. Screen consumer numbers against Puhelin-Robinson first and stop when someone says no. In MAO:52/2024, the Market Court banned AAA-Palvelut Oy from continuing sales calls after consumers wanted to end them. Written confirmation. Since January 1, 2023, the Consumer Protection Act (Kuluttajansuojalaki, KSL 6:12 a) requires you to send your offer in writing or another durable form after the call. The consumer is only bound once they accept it the same way. This covers all consumer goods and services, energy included, unless the consumer called you or asked you to call.No switch to opt-in is pending. In a 2024 survey by the competition and consumer authority KKV, 82% of consumers favored opt-in (report 1/2025). The Ministry of Justice’s evaluation of December 30, 2025 found no current need for new legislation, only better enforcement (EDK-2026-AK-1442).
Existing customers and callback requests
Existing customers. The customer exception in Section 200(3) covers email, text, speech, sound, and image messages, but doesn’t name automated calling systems. Don’t rely on it for AI calls. A human may call existing customers, and Puhelin-Robinson doesn’t block offers within an existing customer relationship. Callback requests. When someone asks you to call them back about a topic, that request is consent for the call, as long as it covers a call by an AI agent. Keep a record of it. Such a call also skips the written confirmation, but the Consumer Ombudsman says that agreeing to marketing calls online, for example in a competition, isn’t an explicit request. A practical route is your own ads leading to a form where people ask for a callback by your AI agent.Do-not-call register: Puhelin-Robinson
Companies have no register and object to you directly. For AI calls to consumers you need consent anyway, and ASML lets you rely on it despite a registration.
Consent for AI calls
Through the ePrivacy Directive (Art. 2(f)), consent follows the GDPR standard: voluntary, specific, informed, and unambiguous (GDPR Art. 4(11)).
Purchased lists and partners. The Data Protection Ombudsman’s autumn 2025 guidance covers numbers from third parties. In the first call, say where the number came from, who you are, and where your privacy notice is. Honor an objection on the spot (DLA Piper). Ask any vendor for the exact consent text and collection method. botBrains asks for this evidence before outbound campaigns, see Before you start outbound campaigns.
Tell callers they’re talking to an AI
Since August 2, 2026, Article 50 of the EU AI Act requires that people know they’re talking to an AI system, at the latest when the conversation starts. This applies to inbound and outbound calls, to consumers and to business contacts, and you can’t count on the exception for obvious cases when your AI agent sounds human. The default introduction already says that your AI agent is an AI, so keep that statement first when you edit it. When you call a consumer to sell something, the Consumer Rights Directive also requires you to name your company, anyone you call for, and the commercial purpose at the start. In Finland, Traficom mainly supervises these transparency duties, which have applied since August 2, 2026. Its guidance names AI voice assistants and AI agents and accepts a spoken notice at the first interaction. At the start of a sales call, KSL 6:10 requires your company name, the company you act for, and the commercial purpose. In 2024, the Consumer Ombudsman told a seller to stop opening with health questions and state the purpose first (KKV). For financial services and insurance, KSL 6 a:10 also requires the name of the person speaking and a recording notice. An AI agent has no personal name, so give the agent’s name and say it’s an AI. Recommended introduction for outbound marketing calls in Finnish:Call recording
Criminal law. Eavesdropping under Rikoslaki 24:5 covers speech “jota ei ole tarkoitettu hänen eikä muunkaan ulkopuolisen tietoon” (not meant for the listener or any outsider). Recording a call you take part in isn’t eavesdropping, and ASML’s recording guidance calls it a traditional right of each party. Data protection. You don’t need consent. You need a lawful basis, such as legitimate interest (GDPR Art. 6(1)(f)), and must tell the caller before or at the start of the call (Art. 13). A recording only becomes biometric data when you use it to identify someone (Art. 4(14), Art. 9), which quality recording doesn’t do. Access requests. On March 2, 2026, the Data Protection Ombudsman’s sanctions board fined Suomen Numerokeskus Oy EUR 5,000. The company only let callers listen to sales call recordings, deleted them, and never sent copies (decision). Give a copy when someone asks. The star key in the botBrains introduction stops the recording and discards it, while the transcript stays. botBrains stores recordings and transcripts in the EU.Caller ID and calling hours
Finnish law sets no calling hours. The ASML telemarketing code sets the industry standard for consumer calls:
Under Traficom Regulation 28, Finnish operators block spoofed calls from abroad that show a Finnish number (Traficom). The caller sees your botBrains number, and botBrains provisions Finnish numbers on request. botBrains doesn’t enforce calling hours, so plan your calls yourself.
Sector rules
Fines and enforcement
In MAO:52/2024, each of three bans against AAA-Palvelut carried a EUR 50,000 conditional fine. We found no Finnish case on AI calls.
Sources
- Laki sähköisen viestinnän palveluista (917/2014), Sections 200-203, 305, 335 a, 349
- Kuluttajansuojalaki (38/1978), chapter 6, Sections 10 and 12 a, chapter 6 a, Sections 10 and 11 b
- Laki kuluttajansuojaviranomaisten eräistä toimivaltuuksista (566/2020), Sections 13-18 and 21
- Rikoslaki (39/1889), chapter 24, Section 5
- Laki saatavien perinnästä (513/1999), Section 4
- Directive 2002/58/EC (ePrivacy), Art. 2(f) and 13
- GDPR, Art. 4, 6, 7, 9, 13, 83
- EU AI Act, Art. 50 and 99
- Tietosuojavaltuutettu decision, March 2, 2026
- Consumer Ombudsman: telephone sales guidance, guidance update, three written confirmation cases, Vattenfall, MAO:52/2024
- KKV, Kuluttajien näkemyksiä ja kokemuksia puhelinmyynnistä, report 1/2025
- Ministry of Justice, evaluation of the written confirmation procedure, December 30, 2025
- Traficom: AI disclosure guidance, transparency duties, August 20, 2026, Regulation 28
- ASML: Puhelin-Robinson, FAQ, telemarketing code, 2025, recording guidance, 2025
- DLA Piper, Data Protection Laws of the World: Finland, electronic marketing
Next steps
Phone integration
Set up your phone line, introductions, and outbound calls.
Calling laws by country
Compare consent rules for AI calls across the EU, the UK, and the US.