Voice AI and withdrawing consent: the mid-call opt-out

Three minutes into a booking call, the caller changes their mind. "Actually, I would rather you did not record this." A human agent stops, notes it, and carries on. A voice agent that only offered an opt-out in its opening line, and then stopped listening for one, keeps recording anyway. That gap between what the law grants a caller and what the software actually does is where consent goes wrong.

In 2026, roughly 88% of enterprises use AI in some form, yet only around 6% capture material earnings impact from it, according to McKinsey's State of AI. The firms that pull ahead are not the ones with the flashiest demo. They are the ones whose systems behave correctly when a real person exercises a real right, halfway through a real call. Honouring a mid-call opt-out is one of those tests, and it is narrower and more technical than most teams assume.

This guide covers what a caller can actually withdraw, when a withdrawal even applies (it does not for most service calls), what it stops and what it does not, and how a voice agent detects and acts on an opt-out in real time. It is written for the people who own the deployment, not the marketing page.

This guide is shipped by the team behind Dilr Voice, enterprise voice AI built for regulated deployments. Or see DATS, our five-stage AI consulting system.

What does withdrawing consent mid-call actually mean?

Withdrawing consent mid-call is a caller revoking a permission they gave earlier in the same conversation, so whatever that permission authorised must stop from that point on. Under UK GDPR Article 7(3), a data subject can withdraw consent at any time, and Dilr Voice treats the revoke as a live event, not a form to fill in later. It applies only to processing that ran on consent, a smaller set than most teams assume.

That last point is the one that trips deployments up. Article 7(3) governs consent, and only consent. If the call was recorded on the basis of consent, a caller can switch that off. But obtaining consent at the top of the call is a different job, covered in our guide to consent capture in AI voice calls, and the rules shift again across borders, mapped in the multi-jurisdiction consent guide. This post starts the moment a caller who did consent decides to take it back.

Does a caller always have the right to withdraw consent?

No. A caller can only withdraw consent where consent was the lawful basis in the first place, and most enterprise voice calls do not run on consent. Service calls typically run on contract or legitimate interests, so the relevant lever is not Article 7(3) withdrawal but the Article 21 right to object. Getting this scoping right is the single most common mistake we see: a team builds a "withdraw consent" flow, then applies it to calls that were never consent-based.

The practical map is short. Match each lawful basis to the right the caller can actually exercise on the call, and build the agent to recognise both.

Two of those rows matter more than teams expect. The Data (Use and Access) Act 2025 added a new recognised legitimate interests basis, Article 6(1)(ea), in force 5 February 2026, and the same commencement inserted a reference to it into Article 21(1), so an objection now reaches that basis too. We cover the new basis in the recognised legitimate interests guide and the older balancing test in the legitimate interest guide. If your agent handles marketing, the objection is absolute: Article 21(3) says the data "shall no longer be processed for such purposes", with no grounds to weigh.

What does a withdrawal actually stop, and what does it not?

A withdrawal is prospective, not retrospective. It switches off future processing on the consented basis; it does not unwind what was already lawfully done. Article 7(3) is explicit that withdrawal "shall not affect the lawfulness of processing based on consent before its withdrawal". So when a caller opts out of recording mid-call, Dilr Voice stops capturing from that instant, but the audio already recorded stays lawful under your retention rules, not deleted on the spot.

That distinction keeps three separate rights from being collapsed into one. Deleting the earlier audio is the right to erasure, a different request with its own tests, set out in our right to erasure guide. How long the pre-withdrawal segment is kept is a retention question, covered in the call recording retention guide. Conflating "stop now" with "delete everything" is both a design bug and a legal misstatement, because it promises callers something Article 7(3) does not grant.

How does a voice agent detect and honour an opt-out in real time?

A voice agent honours an opt-out by listening for it on every turn, not just the greeting, then acting within the same call. The ICO is clear the right to withdraw applies "at any time", so an opt-out offered only as an opening reply is not enough: the caller can opt out whenever they choose. Dilr Voice treats the opt-out as an interrupt, barging in on whatever it is doing and routing it to the right action.

The sequence below is the pattern we deploy. Each step is a discrete control, so it can be logged, tested and audited rather than buried inside a single model prompt.

Two engineering details decide whether this holds up. First, stopping the recording write is not the same as stopping the audio stream: many stacks keep a short rolling buffer for barge-in and latency, so "stop recording" must halt the write and purge the buffer, not merely flip a flag downstream. Second, the opt-out has to reach the systems of record. A revoke that the agent acknowledges but never writes to your suppression list or to Salesforce or HubSpot is a revoke the next campaign will ignore. Twilio-level call controls handle the media path; the governance lives in how you wire the write-through, which is the layer Dilr Voice is built around.

How does mid-call withdrawal interact with PECR and marketing calls?

For marketing calls, the Privacy and Electronic Communications Regulations sit on top of UK GDPR, and they bind the organisation running the campaign, not the voice vendor. Regulation 21 restricts live marketing calls to numbers on the Telephone Preference Service, and Regulation 24 requires the caller to identify themselves and give contact details. A voice agent does not absorb those duties for you; if you run the outbound campaign, they remain yours to discharge.

The enforcement is real and current. In May 2026 the ICO fined Energy Prices Direct Limited £160,000 for making over 700,000 unsolicited marketing calls to numbers on the Telephone Preference Service and its corporate equivalent, with some staff failing to identify themselves. A separate claims company was fined £90,000 in April 2025 for similar breaches. Neither penalty landed on a technology supplier; both landed on the caller, the party our AI outbound calling guide addresses directly.

The stakes then rose sharply. Since 5 February 2026 the DUAA has aligned PECR penalties with UK GDPR, so the ICO can now issue fines of up to £17.5 million or 4% of global turnover for a serious PECR breach, up from the old £500,000 cap. A mishandled marketing opt-out is no longer a nuisance-fine risk; it sits in the same penalty band as a headline data breach. Ofcom's persistent-misuse rules bind the caller in the same way, and there is no comfortable abandoned-call safe harbour to hide behind.

What happens to the recording and data already captured?

The recording and data captured before the opt-out remain subject to your normal retention and access rules, because withdrawal only reaches forward. That earlier audio was lawful when it was made, so it is not deleted automatically; it is kept for its defined period, then disposed of, and stays discoverable through a subject access request. Dilr Voice holds the pre-opt-out segment under the same governance as any other recording, flagged with the point at which capture stopped.

What must change is the caller's future state. The revoke belongs on a suppression list so the next outbound run skips them, and the CRM record should carry the flag so a human agent sees it too. That write-through is also your evidence: when the ICO asks how you honoured an opt-out, the audit trail of detection time, action taken and downstream suppression is the answer, which is why it belongs in your privacy notice and transparency record and your data protection impact assessment. The voice AI compliance library collects the adjacent duties in one place.

The same real-time governance thinking underpins our AI operating model consulting, where consent, objection and suppression are designed as controls before a single production call is placed.

What is the best way to manage mid-call consent withdrawal in 2026?

The best approach in 2026 is to design for the lawful basis first and the interface second: decide, per call type, whether the caller's lever is Article 7(3) withdrawal, an Article 21 objection or an absolute marketing objection, then build one real-time handler that recognises the opt-out on any turn and writes it through. Dilr Voice does this as a governed control with an audit trail, the evidence regulated buyers ask for. No single tool is best for every case.

If your only outbound activity is a light, consent-led campaign with a simple suppression file, a leaner builder such as Vapi, Retell AI, Synthflow or PolyAI can wire an opt-out intent quickly, and paying for full governance tooling would be over-engineering. The moment you are in scope for FCA rules, high call volumes, or an ICO audit, the calculus flips: you need the basis mapped per purpose, the write-through evidenced, and the retention split defended. That is where a managed execution office, our DATS methodology, and a properly scoped platform earn their keep. Be honest about which situation you are in before you buy.

Does honouring an opt-out mean deleting the call recording?

No. Honouring an opt-out stops future processing on the consented basis; it does not delete the recording already made. Under Article 7(3), earlier processing stays lawful, so the prior audio is kept under your retention policy and erased only on its schedule or on a valid erasure request. Treating "stop recording" as "delete everything" over-promises what the law requires and can itself create a records problem.

Can a caller withdraw consent for recording but keep talking?

Yes. Withdrawal is granular: a caller can revoke consent for recording while the call continues on another basis, such as contract, to complete the task they rang about. Dilr Voice stops the recording write, confirms it, and carries on with the service conversation. The caller does not have to abandon the call to exercise the right, and forcing that choice would fail the "as easy to withdraw" test the ICO applies.

Want to see this in production? Try Dilr Voice live, book an AI placement diagnostic, read about Dilr.ai, or see how we approach placing AI inside enterprise systems.

The featured principle worth memorising is the one the whole design serves. UK GDPR Article 7(3) states: "It shall be as easy to withdraw as to give consent." If giving consent took one spoken word at the start of the call, taking it back should take one spoken word at any point in it. A voice agent that makes withdrawal harder than consent was to give has already failed the test, whatever else it does well.

Written by the Dilr.ai engineering team, practitioners who ship enterprise AI in production. Follow us on LinkedIn for shipping notes, or subscribe via the RSS feed.