Before you test anyone: authorisation and consent

Who must authorise a campaign, what consent a cloned voice and a member of staff need, and what the platform refuses to do.

A simulated scam call is still a call to a real person. DeepBlocker only places it when someone with authority has said so in writing, the people called are your own staff, and any cloned voice belongs to someone who agreed. This page explains each gate in plain words.

Calls go to your own staff only. Your licence does not allow calls to anyone outside your organisation.

​

Who must authorise a campaign

Every campaign ends with an authorisation block on the Authorise and launch step. The server refuses to launch without it, so it cannot be skipped.

Field	What to enter	Required
Authorized by	The full name of the person who approved this test	Yes
Authorizer email	Their work email	Yes
Engagement / SOW reference	Your own reference, for example a ticket or a statement of work number	No

Below the fields are two tick boxes. Both must be ticked:

• I understand that this campaign will initiate automated phone calls to the selected contacts and that all applicable TCPA regulations have been followed.
• I have reviewed all campaign settings and confirm they are correct. I understand that campaigns cannot be modified once launched.

Some campaign kinds add one more tick:

Campaign kind	Extra tick
Help desk test	The help desk is in scope for this test, plus a note naming the help desk and who agreed
Any campaign that sends a warm-up text or email	Messages to staff phones and inboxes are in scope for this engagement.

The record is stored with the campaign and appears in the auditor pack. See Authorise and launch.

​

Consent for a cloned voice

A voice is cloned only with the consent of its owner. The console records that consent in one of two ways.

An executive records their own consent

On the Voices page, Invite an executive sends the person a one-use link by email. The link lasts 7 days. They read the consent text, record the consent sentence in their own voice, then record or upload about two minutes of speech. The clone is made only after that. From the same link they can withdraw later: the clone is deleted and every campaign using it is blocked. See Clone an executive’s voice with consent.

You attest consent for another voice

For a voice you cloned yourself, the Attest consent button records that you confirm the person agreed. The console shows the words: Confirm this person consented, so campaigns can call with this voice. A voice with no consent cannot be used in a campaign.

Your licence adds two rules: a voice is cloned for the named campaign only, and voice samples are treated as biometric data.

​

Consent for the people you call

Each person in People carries consent fields. The CSV import has a tcpaConsent column, and the wizard only counts people whose consent is recorded. The fields are:

Field	Values
Consent	Yes or no
Consent scope	Testing, training or awareness
Consent method	Written, verbal, imported or electronic
Opt-out	Yes or no, with a date
Do not call until	A date

See Add the people you will call. The Fair testing rules page adds cooling-off days, quiet hours and a limit on calls per quarter.

​

What the platform refuses

• A launch with no named authoriser, no authoriser email, or an unticked box.
• A campaign whose voice has no recorded or attested consent.
• A call to a person with no consent, an opt-out, or a do-not-call date in the future.
• A launch when the workspace kill switch is on. See Pause, resume, stop everything.
• A launch when the workspace has no simulated-call minutes left. See When you run out.

A simulation measures how people respond on the day. It does not promise to find every weakness. This is written into your licence, and it is true.