GRC

ICO probes surge in robo calls as complaints hit five-year high

ICO robo call complaints nearly tripled to 3,684 in September. With PECR fines now at UK GDPR levels, outbound calling is a live compliance risk.

Illustration of scales of justice representing UK regulation of automated robo calls

Complaints to the Information Commission’s Office (ICO) about automated “robo” calls nearly tripled between July and September 2026, reaching their highest level since 2021. The regulator has opened an investigation into the surge, and any organisation that makes, buys or outsources outbound calls should check that its PECR position will hold up.

What happened

On 9 October 2026 the ICO published its complaint figures for automated nuisance calls. Members of the public lodged 1,374 complaints in July and 2,178 in August, a 58 per cent rise. September brought a further 69 per cent jump to 3,684, the most the regulator has recorded in five years.

The ICO confirmed it is investigating the increase and asked people to report suspicious automated calls through its online form. Andy Curry, the ICO’s Head of Investigations, called the figures “the tip of the iceberg”. He said most people simply hang up without reporting the call, so the true volume is likely to be much higher than the complaint data shows.

The regulator said the rise comes amid growing concern about robo calls, including AI-enabled marketing calls, and about calls designed to draw people into WhatsApp groups, extract personal details or steer them into fraudulent schemes. The Press Association’s coverage, carried by the Irish News, described the calls as using an automated voice to do this. London Crime News, citing Curry’s interview on BBC Radio 4’s You and Yours, reported that some calls pose as recruiters offering flexible or part-time work. It also said Curry believes many of the calls come from overseas, and that the ICO is looking for UK links that would give it something to enforce against.

The detail

Automated calls fall under the Privacy and Electronic Communications Regulations (PECR), which the ICO enforces alongside UK GDPR. PECR covers marketing calls, texts and emails, and treats automated calling systems more strictly than live calls. A recorded or synthetic-voice marketing message generally needs the recipient’s specific prior consent. Screening against the Telephone Preference Service (TPS) does not make it lawful.

The ICO’s announcement set out its recent enforcement record. Since April 2025 it has issued 15 monetary penalty notices for nuisance calls and spam texts, totalling £2.37 million. Last year two companies, Home Improvement Marketing Ltd and Green Spark Energy, were fined £550,000 between them for making unlawful automated marketing calls. The regulator says several further investigations into nuisance and scam calling are under way.

What has changed since those penalties is the size of the stick. The Data (Use and Access) Act 2025 (DUAA) raised the maximum PECR fine from £500,000 to the higher of £17.5 million or 4 per cent of global annual turnover, matching UK GDPR. According to a Weightmans briefing, those provisions came into force on 5 February 2026. Law firm MFMac’s analysis of the Act highlights two more changes. The ICO gains stronger investigative powers, including compelling witnesses to attend interviews and requiring technical reports. The meaning of a “call” is also widened, so a breach can occur whether or not the call actually reaches the person it was aimed at.

Chart of ICO complaint figures for automated nuisance calls rising from 1,374 in July to 3,684 in September 2026, with PECR fine levels

Why it matters for UK organisations

First, there is direct regulatory exposure. Any organisation that runs outbound campaigns, uses a predictive or automated dialler, or experiments with AI voice agents for sales, collections or customer retention is inside PECR’s scope. An investigation launched in response to a complaint surge is the kind of exercise that sweeps up legitimate businesses with weak consent records alongside outright scammers. With PECR fines now matching UK GDPR, a consent failure that once cost hundreds of thousands of pounds could now cost millions.

Second, there is supply chain exposure. Many firms buy leads or outsource calling to third parties, and responsibility does not disappear because a supplier dialled the number. If your brand is being promoted by a call your organisation never approved, your regulatory and reputational problem is the same.

Third, there is security exposure. The same automated, synthetic-voice infrastructure that drives nuisance marketing is used for fraud and social engineering. Calls that move people into messaging apps, harvest personal data or dangle fake jobs are reconnaissance and initial-access techniques as much as marketing.

Expert view

When we run social engineering assessments, the phone remains one of the most reliable ways into an organisation. Helpdesks, finance teams and reception staff are trained to be helpful, and a confident caller with a plausible story still gets further than it should. What the ICO data suggests is that automated and AI-assisted calling is now cheap and widespread enough to move the baseline. A machine can now make thousands of first-contact calls and hand the few who engage to a human, or to a messaging app where the real manipulation starts.

In my experience, organisations treat voice as a lesser channel than email. Email gets filtering, banners and reporting buttons. The phone gets a call-back procedure that nobody has tested. That imbalance is worth fixing.

On the compliance side, my concern is the gap between marketing and security governance. AI voice tools are often adopted by sales or customer service teams as a productivity win, without going through the data protection or security review that a new SaaS platform would get. Consent records, call scripts, supplier contracts and recordings all need to stand up if the ICO comes asking, and with the DUAA uplift the cost of getting this wrong is now material at board level.

The ICO’s reach has limits too. If much of this traffic originates overseas, enforcement will be slow and partial, so organisations should not wait for the regulator to solve it.

What to do now

  1. Inventory your outbound calling. List every team, platform and supplier that places calls on your behalf, including any pilot of AI voice agents.
  2. Evidence consent for automated calls. Make sure you hold specific, recorded prior consent for any automated marketing call, and screen live marketing calls against the TPS and your own suppression lists.
  3. Tighten supplier contracts. Require lead generators and call centres to show their consent sources, keep audit rights, and ban automated or synthetic-voice calling unless you have explicitly approved it.
  4. Bring AI voice tools into governance. Run a data protection impact assessment and a security review before any deployment.
  5. Harden your phone-based processes. Under the Cyber Essentials user access control theme, never reset passwords or MFA, or change payment details, on the strength of a phone call alone. Use call-backs to known numbers and out-of-band verification.
  6. Secure the telephony estate. In line with Cyber Essentials secure configuration, remove default credentials from dialler and telephony platforms, enforce MFA on their admin consoles, and keep them patched.
  7. Brief staff and customers. Warn them about automated calls that push people into WhatsApp groups or offer unsolicited work, and give them one clear route for reporting suspicious calls.

Bottom line

A near tripling of robo-call complaints in one quarter, an ICO investigation and PECR fines that now match UK GDPR make outbound calling a live compliance risk. Treat automated and AI-driven voice as both a regulated marketing channel and an attack surface, and make sure your consent evidence, supplier controls and call-handling procedures would survive scrutiny.

Sources

Related Posts