Back to Blog
call recording consent TCPA compliance law firms is call recording legal call recording laws by state legal call recording

Call Recording Consent Laws for U.S. Businesses

Call Recording Consent Laws for U.S. Businesses

Recording a phone call in the United States is lawful when at least one party to the conversation consents, under the federal baseline set by 18 U.S.C. § 2511. That minimum applies in every state. The practical problem is that several states require all parties to consent, and if your business calls customers, employees, or prospects across state lines, you may be operating under the stricter rule without knowing it.

The safest default for any business recording calls: announce the recording before it starts, log that announcement, and document consent. Three steps. Every call.

What this guide covers:

  • The federal one-party consent baseline and its penalties
  • A 50-state classification table (one-party, all-party, hybrid)
  • Which state’s law controls on interstate calls
  • Penalties and litigation exposure
  • An operational compliance checklist with sample scripts
  • What to do if you were recorded without consent

Key Takeaways

Federal law sets a one-party consent baseline for recording phone calls, but roughly 11 states require all-party consent, and courts often apply the stricter state’s rule to interstate calls.

Point Details
Federal baseline 18 U.S.C. § 2511 permits recording when one party consents; violations carry civil damages of at least $10,000 per violation.
All-party states Several states, including California, Florida, Pennsylvania, Illinois, and Washington, require every party to consent before recording begins.
Interstate calls If any party is in an all-party state, treat the call as all-party; courts may apply the stricter state’s law per Kearney v. Salomon Smith Barney.
Operational default Announce recording before it starts, log the disclosure in your CRM, and document employee acknowledgment in writing.
Attorney Assistant Attorney Assistant implements compliant intake disclosure workflows, consent logging, and 24/7 coverage for law firms.

Table of Contents

The FCC confirms that federal law sets a floor, not a ceiling. States can and do impose stricter rules. According to state-by-state surveys, most jurisdictions follow the federal one-party standard, a smaller group require all-party consent, and some apply hybrid rules depending on the medium or context.

Diagram comparing state call recording consent requirements

The table below reflects the classification as of the date this article was last reviewed. Statutes and case law change. Consult your state attorney general’s website or qualified counsel before making compliance decisions for high-risk calls.

Last reviewed: June 2026

Business traps to watch: California’s CIPA generates more class-action filings than any other state wiretap statute. Pennsylvania and Florida enforcement is active and plaintiff-friendly. If your call center, sales team, or intake staff contacts residents of any all-party state, that state’s rule likely applies to those calls.

The federal baseline: what 18 U.S.C. § 2511 actually says

The Wiretap Act, codified at 18 U.S.C. § 2511, makes it a federal crime to intentionally intercept a wire, oral, or electronic communication without authorization. The participant exception is the key carve-out: a person who is a party to the communication may record it without the consent of the other parties. That is the one-party consent rule.

Congress built this framework through the Omnibus Crime Control and Safe Streets Act with the explicit intent to create a uniform baseline for interception rules while leaving states free to provide stronger protections. The federal floor matters because it defines the minimum exposure everywhere. State law can only add to it.

Federal civil remedy under 18 U.S.C. § 2520: A person whose communications are unlawfully intercepted may sue for the greater of actual damages or $10,000 per violation, plus punitive damages, attorney’s fees, and costs. Criminal penalties under § 2511 include fines and imprisonment of up to five years.

That $10,000 floor per violation is what makes class actions expensive fast. A single outbound calling campaign that records thousands of calls without proper disclosure can generate aggregate exposure that dwarfs any operational savings from skipping the compliance step.

The Reporter’s Committee for Freedom of the Press recording guide is one of the most thorough public resources for understanding how federal and state rules interact, including hybrid-state nuances that statutory text alone does not resolve.

Which state’s law controls on interstate calls

No federal statute directly answers this question for private civil disputes, so courts decide case by case. The leading example is Kearney v. Salomon Smith Barney, Inc., where the California Supreme Court applied California’s all-party rule to calls placed from Georgia to California. The court reasoned that California had a strong protective interest in its residents’ privacy, even when the recorder was located in a one-party state.

The practical lesson from Kearney and similar decisions: courts often apply the law of the state where the recipient is located, particularly when that state has the stricter rule.

Rules of thumb for multi-state operations:

  • If any party to a call is in an all-party state, treat the entire call as subject to all-party consent requirements.
  • Mobile numbers are unreliable location proxies. A California area code may belong to someone now living in Texas, and vice versa. Do not rely on area code alone.
  • Ported numbers create the same problem. The number’s history tells you nothing about where the person is today.
  • Remote employees in all-party states are a separate exposure point. An employee working from home in Washington state is subject to Washington’s all-party rule even if your office is in Texas.
  • Multi-state teams need a single policy, not state-by-state patchwork. One all-party default covers everyone.

Pro Tip: Log the state disclosure was given, not just that it was given. If a dispute arises over which state’s law applies, a timestamped CRM entry showing the disclosure played before recording started is far more defensible than a general policy document.

Penalties and litigation risks from unlawful recording

The financial exposure from noncompliance is not theoretical. It is the reason plaintiff-side attorneys actively monitor call recording practices, particularly in California, Florida, Pennsylvania, Illinois, and Washington.

Federal exposure under 18 U.S.C. § 2520:

  • Civil damages: the greater of actual damages or $10,000 per violation
  • Punitive damages at the court’s discretion
  • Attorney’s fees and litigation costs
  • Criminal penalties: up to five years’ imprisonment and fines up to $250,000 per count under § 2511

State-level exposure:

  • California CIPA allows $5,000 per violation or three times actual damages, whichever is greater, plus injunctive relief. Class actions under CIPA are common and expensive.
  • Illinois Eavesdropping Act violations are a Class 4 felony for a first offense, escalating to a Class 3 felony for subsequent violations.
  • Florida’s Security of Communications Act creates civil liability and criminal penalties for violations.
  • Pennsylvania’s Wiretapping and Electronic Surveillance Act carries criminal penalties and civil remedies.
  • Maryland, Massachusetts, and Washington each have their own civil and criminal exposure frameworks.

Why class actions are the primary business risk:

A single outbound dialing campaign, a customer service line that records without disclosure, or a chatbot that records without notice can generate thousands of individual violations. At $10,000 per violation federally, or $5,000 per violation under CIPA, aggregate exposure in a class action can reach seven or eight figures before litigation costs. California plaintiffs’ firms have filed hundreds of CIPA class actions in the past several years, many targeting businesses that assumed their recording practices were compliant.

The enforcement trend is toward more litigation, not less. Businesses that operate in all-party states without a documented disclosure process are the primary targets.

Penalties and litigation risks from unlawful recording — overview diagram

A practical compliance checklist for businesses that record calls

Compliance is an operations problem, not just a legal one. The failures that generate liability are almost always process failures: recording starts before the announcement plays, the IVR is configured incorrectly, outbound dialers have no disclosure, or consent is never logged anywhere.

Step 1: Set your default posture

Decide now, in writing, that your organization will treat every recorded call as subject to all-party consent requirements. Document that decision in your call recording policy. This single choice eliminates most multi-state exposure.

Step 2: Configure your technology correctly

  • Place the disclosure announcement at the very start of the call flow, before any recording begins.
  • Set the recording trigger to activate only after the disclosure completes. A disclosure that plays while recording is already running does not satisfy the requirement.
  • For inbound IVR: the announcement must play before the caller is connected to an agent or queue.
  • For outbound dialers: the disclosure must play before the conversation begins, not after the agent connects.
  • Use a beep tone or periodic tone reminder where required by state law (some states require it).

Step 3: Write and use consistent scripts

Sample IVR announcement (inbound): “This call may be recorded for quality assurance and training purposes. By continuing, you consent to this recording.”

Sample agent disclosure (outbound): “Hi, this is [Name] calling from [Firm]. I want to let you know this call may be recorded. Is that okay?”

Keep outbound scripts conversational. A robotic recitation followed by silence while the caller processes the question is better than skipping the step entirely.

Step 4: Log consent in your CRM

Every recorded call should generate a CRM entry that captures: the date and time of the call, the disclosure method used (IVR or agent), the caller’s stated or implied consent, and the recording file reference. This log is your evidence if a dispute arises. A call tracking system integrated with your CRM makes this auditable automatically.

Step 5: Handle employee recording separately

Employees have separate consent rights. Legal guidance on recording employee calls recommends written policies and signed acknowledgments at onboarding. Include the recording policy in your employee handbook. Have every employee sign a specific acknowledgment that calls may be monitored and recorded. Keep signed copies in personnel files.

Step 6: Audit regularly

  • Pull a sample of recorded calls monthly and verify the disclosure played before recording started.
  • Check that CRM consent logs are being created for every recorded call.
  • Review your IVR configuration after any phone system update. System updates frequently reset or alter call flow settings.
  • Map all recording points: inbound lines, outbound dialers, conference bridges, and any call-recording apps used by remote staff.

Pro Tip: Automate the disclosure on outbound dialers so no agent can begin a recorded call without the announcement playing first. Tie the disclosure event to a CRM timestamp. Human error in this step is the most common source of liability, and automation removes it entirely.

If you believe someone recorded your phone call without required consent, the steps below apply whether you are an individual or a business.

  1. Preserve everything you have. If you have a copy of the recording, save it immediately. Do not delete it, even if its existence is uncomfortable. It is evidence.
  2. Document the context. Write down the date, time, approximate duration, who called whom, and what the call was about. Note the caller’s area code and any information you have about their location.
  3. Preserve your phone records. Pull your call log from your carrier and save it. Carrier records can be subpoenaed, but having your own copy speeds the process.
  4. Identify which state’s law applies. If you are in an all-party state and the recorder was not a party to the call, you likely have a claim. If you are in a one-party state and the recorder was a party, federal law was probably not violated, though state law may still apply.
  5. Report to the appropriate authority. For criminal violations, contact your state attorney general’s office or local law enforcement. For federal violations, the Department of Justice handles criminal Wiretap Act prosecutions. The FCC does not handle private recording complaints between individuals.
  6. Consult an attorney. Civil claims under 18 U.S.C. § 2520 allow you to sue for the greater of actual damages or $10,000 per violation, plus punitive damages and attorney’s fees. State statutes may provide additional remedies. An attorney can assess whether the facts support a viable claim and which forum is most favorable.

One-party consent means that recording a conversation is lawful as long as at least one person participating in the call consents. That person can be the recorder. So if you are on a call and you decide to record it, you have consented, and federal law is satisfied. The other party does not need to know.

All-party consent (sometimes called two-party consent, though “all-party” is more accurate when more than two people are on the call) means every person on the call must consent before recording begins. Consent can be express (the person says “yes”) or implied (the person stays on the line after a clear disclosure that the call will be recorded). Implied consent through a clear IVR announcement is the standard business method.

The “two-party” label is technically imprecise for conference calls. If five people are on a call in California, all five must consent. “All-party” is the correct term.

Exceptions and special rules you need to know

Employee monitoring: Employers generally may monitor and record business calls on company phone systems with proper notice. The key requirements are a written policy, employee acknowledgment at onboarding, and limiting monitoring to business calls on business systems. Personal calls on personal devices are a different matter and carry much higher risk.

Public places and in-person conversations: Recording laws for in-person conversations differ from wire recording laws. Most states apply their wiretap statutes to wire and electronic communications. In-person recording in a public place where there is no reasonable expectation of privacy is generally treated differently, though some states (California, Illinois) apply their statutes broadly to in-person conversations as well.

Law enforcement: Federal and state law enforcement agencies operate under separate statutory frameworks with court authorization requirements. Those rules do not apply to private parties.

Business system exception: Some states recognize that employees have reduced privacy expectations on employer-provided phone systems when they have been notified of the monitoring policy. This does not eliminate the consent requirement for the other party to the call (a customer, for example), but it addresses the employee’s consent.

Consent obtained by fraud: Consent obtained through deception is not valid consent. A disclosure that misrepresents the purpose of the recording or conceals the identity of the recorder does not satisfy the legal requirement.

Oregon and Hawaii hybrid rules: Both states have nuances in how their statutes apply to wire versus in-person communications. Oregon’s statute has been interpreted differently in different contexts. If your business operates in either state, a state-specific legal review is worth the cost.

Customer service call centers: A company in Texas operates a call center that handles calls from customers nationwide. Its IVR plays a disclosure before every call connects to an agent. Calls from California, Florida, and Pennsylvania customers are covered because the disclosure creates implied consent. Calls where the IVR is bypassed (transferred calls, direct agent lines) are not covered and create exposure.

Outbound telemarketing and sales: A sales team in New York calls prospects across the country. The team records calls for training. Without an outbound disclosure, every call to a resident of an all-party state is a potential violation. Adding a brief agent disclosure at the start of each call (“this call may be recorded”) resolves the issue for implied consent purposes in most states.

Law firm intake calls: A personal injury firm in Florida takes calls from potential clients. Florida requires all-party consent. The firm’s intake line must announce recording before the conversation begins. Intake calls that are recorded without disclosure expose the firm to civil liability under Florida’s Security of Communications Act, and potentially to evidence admissibility issues if the recording is later used in litigation. Consistent legal intake processes that include a compliant disclosure protect both the firm and the client.

Internal team calls and remote employees: A firm with employees in Washington state records internal team calls for training. Washington requires all-party consent. Every participant on those calls, including remote employees calling in from Washington, must be notified before recording begins. A blanket policy in the employee handbook plus a verbal or IVR reminder at the start of recorded meetings satisfies this requirement.

Conference bridges and video calls with audio recording: Multi-party calls on platforms like Zoom or Teams that are recorded must include a disclosure to all participants. Most platforms provide a built-in recording notification. Verify it is enabled and that it plays before recording begins, not after.

Automated calling systems, IVR bots, and AI-powered intake tools that record conversations are subject to the same consent rules as human-to-human calls. The technology does not change the legal requirement.

Two separate regulatory frameworks apply to automated outbound calls. The Telephone Consumer Protection Act (TCPA) governs automated dialing, prerecorded messages, and ringless voicemail to cell phones, with its own consent requirements that are distinct from wiretap law. TCPA compliance for law firms is a separate analysis, but the two frameworks overlap: an outbound automated call that records the conversation must satisfy both TCPA consent requirements for the call itself and wiretap consent requirements for the recording.

For inbound bots and AI intake tools, the disclosure requirement is the same as for a human agent. If the bot records the conversation, it must announce that fact before recording begins. Placing the disclosure in the IVR flow before the bot engages is the standard approach.

One practical issue with AI intake tools: some systems begin transcribing or recording the moment the call connects, before any announcement plays. Verify your configuration. The recording start trigger must follow the disclosure, not precede it.

Recording calls involving minors or vulnerable individuals

No federal statute specifically prohibits recording calls involving minors, but several considerations apply.

A minor cannot provide legally binding consent in most states. If your business records calls and a caller is a minor, the consent of a parent or legal guardian is required in all-party states. In practice, this means your disclosure must be clear enough that an adult who is present or who authorized the call can provide consent on the minor’s behalf.

For calls involving individuals with cognitive impairments or diminished capacity, the same principle applies: consent must come from someone with legal authority to give it. A disclosure that plays to a person who cannot legally consent does not satisfy the requirement.

Law firms handling family law, guardianship, or juvenile matters face this issue directly. Recording intake calls with minors or their parents requires the same disclosure process as any other call, with the added step of confirming that the consenting adult has authority to consent on the minor’s behalf.

Healthcare providers and social service organizations that record calls involving vulnerable individuals should also review applicable HIPAA requirements, which layer additional restrictions on top of wiretap law.

Most businesses treat call recording consent as a legal task: get the policy written, hand it to IT, and move on. That is exactly the posture that generates liability.

The actual failures happen in operations. Recording starts before the IVR announcement finishes. An agent skips the disclosure on an outbound call because the script feels awkward. A phone system update resets the call flow and nobody notices for three months. A remote employee in California uses a personal recording app that nobody approved. None of these are legal failures. They are process failures.

For law firms, the stakes are higher than for most businesses. A recorded intake call that lacks proper consent can become a problem in litigation, not just a regulatory exposure. If the recording is later used for training, quality review, or as evidence of what a client said, its admissibility and the firm’s credibility depend on whether consent was properly obtained and documented.

There is also a revenue dimension. Firms that record intake calls consistently, with proper consent and logging, can review those calls to identify where leads are being lost, where agents are deviating from intake scripts, and where follow-up is breaking down. That data is only useful if the recordings exist and are legally defensible. A firm that skips the disclosure step to avoid friction is also destroying the training and quality data it needs to improve intake conversion.

The fix is not complicated. It is a policy decision, a technology configuration, a CRM logging step, and a staff training update. Firms that treat it as an operational process rather than a one-time legal task stay compliant and get better data.

Attorney Assistant helps law firms get intake compliance right

Law firms that record calls without a documented disclosure process are carrying two risks at once: litigation exposure and lost intake data. Attorney Assistant addresses both.

Attorney Assistant

Attorney Assistant handles the operational layer that most firms never get to: intake disclosure scripts built into call flows, consent logging tied directly to CRM records, staff training on outbound disclosure, and 24/7 intake coverage that applies the same compliant process to every call, not just the ones that happen during business hours. The result is a defensible consent record on every intake call and a complete set of recordings you can actually use for training and quality review.

If your firm records calls and you are not certain your disclosure process is configured correctly, that is worth a conversation. Book a call to walk through your current intake and recording workflow and identify where the gaps are.

Sources

The following primary sources and authoritative references support the analysis in this article. Check your state attorney general’s website for local guidance and recent statutory changes, as wiretap statutes and case law evolve.

This article provides general legal information, not legal advice. Consult a qualified attorney for guidance specific to your situation and jurisdiction.

This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.

FAQ

Under federal law, recording is lawful if at least one party consents, per 18 U.S.C. § 2511. In all-party states like California, Florida, and Pennsylvania, recording without all parties’ consent is illegal and can trigger civil and criminal penalties.

Do you have to tell someone a call is being recorded?

In one-party states, no disclosure to the other party is legally required. In all-party states, you must notify all parties and obtain their consent before recording begins. For businesses operating across state lines, disclosing on every call is the safest practice.

Can I sue someone for recording me without permission?

Yes. Federal law under 18 U.S.C. § 2520 allows you to sue for the greater of actual damages or $10,000 per violation, plus punitive damages and attorney’s fees. State statutes in all-party states often provide additional remedies, and some, like California’s CIPA, allow $5,000 per violation.

States commonly classified as all-party include California, Connecticut, Delaware, Florida, Hawaii, Illinois, Maine, Maryland, Massachusetts, Montana, Nevada, New Hampshire, Oregon, Pennsylvania, and Washington. Counts vary slightly across surveys because of hybrid rules and evolving case law, so confirm your specific state’s current statute.

Does federal law cover automated calls and AI bots that record conversations?

Yes. Automated systems and AI intake tools that record calls are subject to the same wiretap consent rules as human-to-human calls. Outbound automated calls also fall under the TCPA, which has its own separate consent requirements for dialing and prerecorded messages.

Back to Blog

Related Articles