> ## Documentation Index
> Fetch the complete documentation index at: https://docs.famulor.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Consent & compliance

> Choose universal or per-channel opt-outs and manage cross-channel suppression records.

Consent & Compliance controls how **marketing opt-outs** are enforced across a
workspace. Suppression enforcement is always active. Workspace owners and
admins configure the mode under **Settings → Data → Suppression**; other
members have read-only access.

## Consent modes

### Universal opt-out

An opt-out received on any channel blocks marketing outreach to the linked contact on voice, SMS, email, and supported messaging channels.

Universal mode is the conservative default and remains available on every
plan.

### Per-channel opt-out

An opt-out applies only to the originating channel. For example, an SMS
opt-out blocks SMS marketing while independent voice or email consent can
remain usable.

Per-channel mode requires the **Consent & Compliance** plan feature. If that
feature is unavailable, the workspace remains in universal mode; suppression
enforcement is never disabled.

<Note>
  Changing the workspace mode does not rewrite earlier opt-outs. The rule that applied when the contact opted out remains visible in the audit history.
</Note>

## Suppression records

An active record can be linked to a contact, phone number, or email address. It shows the affected channels, where the request was received, its reason, and when it was created.

Listing with a `channel` filter returns both that channel's records and
universal (`all`) records, because both block outreach on the requested
channel.

## Restoring consent

Restoring consent does not erase compliance history. The active suppression is
revoked and an opt-in event is appended to the audit trail.

Use the suppression record ID whenever possible. The API also accepts a URL-encoded E.164 phone number or email address.

<Warning>
  Only restore consent when you have an appropriate, documented basis to do so.
  Product settings assist with enforcement but do not replace legal review for
  your jurisdiction, outreach purpose, and communication channel.
</Warning>

## Legal grounding for outreach

<Note>
  This section is general information, not legal advice. Marketing and telemarketing rules vary by country and channel — confirm your specific case with legal counsel before launching a campaign.
</Note>

Voice, SMS, and email outreach are regulated wherever you call or message into, not just where your workspace is based. A few frameworks come up most often:

| Region         | Key rules                                                                                                                                                 |
| -------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
| European Union | GDPR: a lawful basis for processing (Art. 6), valid consent conditions (Art. 7), and information duties toward the person you're contacting (Art. 13/14). |
| Germany        | UWG §7 — unsolicited phone/email advertising is tightly restricted for consumers, and for businesses requires "presumed interest."                        |
| Austria        | TKG 2021 §107 — unsolicited calls and messages generally need prior consent, including for business contacts.                                             |
| Switzerland    | nDSG, plus the star-registration ("Robinson list") opt-out for marketing calls.                                                                           |
| United States  | TCPA and CAN-SPAM — the reason **Universal Opt-Out** (above) is the recommended default: an opt-out on any channel suppresses all of them.                |

Practical baseline regardless of region: keep a documented basis for each contact (consent record, existing relationship, or legitimate interest), make opting out easy and immediate, and keep the audit trail suppression records already provide. Pair this with your workspace's [data retention](/settings/data-retention) settings so contact and consent records aren't kept longer than needed. For outbound calling specifically, see [Dialer, retries & compliance](/campaigns/dialer-and-compliance).

## AI disclosure requirement

Since August 2026, the **EU AI Act's transparency obligation (Art. 50)** requires that people be told when they're interacting with AI — for example an AI voice assistant on a call — unless it's obvious from context. A short, clear line is enough, such as telling the caller up front that they're speaking with an AI assistant.

<Tip>
  The simplest way to comply is to have your assistant say so as part of its opening — see [Prompt writing](/assistants/prompt-writing) for structuring an assistant's greeting. If your assistant uses a **cloned voice**, a related but separate labelling duty also applies — see [Voice cloning consent](/assistants/voice-cloning-consent).
</Tip>

## REST API

Read or update the workspace mode:

```bash theme={null}
curl https://YOUR_DOMAIN/api/v1/settings/consent-compliance \
  -H "Authorization: Bearer fam_..."
```

```bash theme={null}
curl -X PATCH https://YOUR_DOMAIN/api/v1/settings/consent-compliance \
  -H "Authorization: Bearer fam_..." \
  -H "Content-Type: application/json" \
  -d '{"mode":"per_channel"}'
```

Record an opt-out:

```bash theme={null}
curl -X POST https://YOUR_DOMAIN/api/v1/suppression-list \
  -H "Authorization: Bearer fam_..." \
  -H "Content-Type: application/json" \
  -d '{
    "email": "contact@example.com",
    "channel": "email",
    "reason": "Unsubscribe request"
  }'
```

The suppression API accepts at least one of `contact_id`, `phone`, or `email`.
When `channel` is omitted, phone defaults to `voice` and email defaults to
`email`. Use `GET /api/v1/suppression-list?channel=sms` to list records that
block SMS. Restore one record with
`DELETE /api/v1/suppression-list/{id-or-identity}`.

REST scopes are `settings:read` / `settings:write` for the mode and
`suppression:read` / `suppression:write` for records.

## MCP

* `get_consent_mode` and `set_consent_mode`;
* `list_suppression_entries`;
* `add_suppression_entry`;
* `remove_suppression_entry` (restores consent and retains the audit trail).

MCP follows the same permissions and returns the same customer-facing data as the REST API.