Call Recording Compliance: What to Know State by State

Your AI receptionist records calls. That is one of the main reasons to have it: transcripts you can search, recordings you can review, summaries your team can act on. But recording phone calls in the United States is governed by a patchwork of federal and state laws, and getting it wrong can be expensive.

This guide covers what business owners need to know about call recording compliance when an AI is the one doing the recording. It is not legal advice. Recording laws have nuances, and if you operate in a high-risk situation, talk to an attorney in your state. But the practical framework below keeps most small businesses on safe ground.

The federal baseline: one-party consent

Federal law, specifically the Wiretap Act (18 U.S.C. section 2511), sets the national floor: a call can be recorded as long as one party to the conversation consents. Your AI receptionist counts as your party, so at the federal level, the AI recording its own calls is permitted.

But states can set stricter rules, and many do. When state and federal law conflict, the stricter rule wins. So the federal baseline is the starting point, not the answer.

The two-party consent states

About a dozen states require all parties to a call to consent before it can be recorded. The commonly cited list: California, Connecticut, Delaware, Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Oregon, Pennsylvania, and Washington.

A few of these have quirks worth knowing. Connecticut’s all-party rule applies to phone calls specifically. Oregon’s applies to in-person conversations more strictly than phone calls. Michigan’s statute reads like an all-party law, but its courts have generally allowed a participant to record, so it is often treated as a hybrid. Nevada has a specific statute requiring all-party consent for phone calls. The exact count varies by source because the edge cases are genuinely ambiguous.

Here is the practical takeaway: if you do business across state lines, which most businesses with a website do, assume the stricter rule applies. A caller in Texas (one-party) calling your business in Florida (two-party) creates a conflict, and the accepted practice is to follow the two-party standard. Since you cannot always know where a caller is, the safe default is all-party consent for every call.

The announcement solves almost everything

In both one-party and two-party states, a clear announcement at the start of the call followed by the caller staying on the line counts as consent. This is why every customer service line in America opens with “this call may be recorded for quality assurance.”

Your AI receptionist should play a recording disclosure before the conversation starts. Make it part of the greeting: “Thanks for calling Brightline Plumbing. This call may be recorded for quality purposes. How can I help?” The disclosure needs to come before the recording starts, not buried in the middle of the call.

This single step satisfies one-party states trivially and two-party states through implied consent. It also happens to be good manners. Callers who know they are being recorded tend to be clearer and more direct, which makes the transcripts better.

Transcription is recording

A common misconception: “we don’t record, we only transcribe.” Legally, that distinction does not hold up. Transcription requires capturing the audio of the conversation, which is what the wiretapping statutes regulate. An AI agent that listens, transcribes, and summarizes is recording the call for legal purposes, even if no audio file is ever saved.

Configure your AI’s disclosure and consent handling around the fact that the conversation is being captured, regardless of whether you keep the audio. If your provider offers a “transcription only, no audio storage” mode, that helps with data minimization and privacy, but it does not change the consent requirement.

What to configure in your AI platform

• Recording announcement: enabled on every call, played before the conversation begins.
• Opt-out handling: decide what happens if a caller objects to being recorded. The clean options are to transfer to a human on an unrecorded line, or to continue the call without recording if your system supports it. Know which one your provider offers before a caller asks.
• Employee notification: if your team takes transferred calls that are recorded, they need to know. Put it in writing, in the handbook or a simple policy acknowledgment.
• Data retention: decide how long you keep recordings and transcripts, and delete on schedule. Keeping everything forever increases your exposure if there is ever a dispute.
• Access control: limit who can listen to recordings and read transcripts. The office manager probably needs access. The part-time weekend help probably does not.

For the training and review side of recordings, call recording and transcripts for training your team goes deeper. If you handle health information on calls, read the HIPAA checklist for AI phone agents as well, since that adds a second layer of requirements.

Payment card data: the separate trap

Recording laws are not the only compliance issue. If your AI takes payment information over the phone, storing recordings that contain full card numbers creates PCI compliance problems on top of everything else. The standard practice is to pause recording during the payment portion of the call, or to use a payment flow that keeps card data out of the recording entirely.

Ask your provider how they handle this. “We record everything” is the wrong answer if you take cards by phone. Either the AI should not be taking card numbers at all, directing callers to a payment link instead, or the recording should pause during that segment.

Interstate and international calls

For interstate calls, follow the stricter of the two states’ rules, which in practice means defaulting to all-party consent everywhere. For international calls, the rules vary widely by country, and some are much stricter than any US state. If you take calls from outside the US, the announcement approach still helps, but check the specific country’s requirements.

The bottom line

Call recording compliance for an AI receptionist comes down to three habits: announce the recording on every call, default to all-party consent since you cannot control where callers are, and keep your retention and access policies tight. Do those three things and you cover the vast majority of the risk.

Laws change and edge cases exist, so revisit this yearly or when you expand into new states. And when in doubt, the announcement is cheap insurance. It costs you four seconds at the start of the call and buys you compliance in every state.