Under federal law, only one party to a call needs to consent to its recording. That single rule, set by 18 U.S.C. § 2511, is the national floor. The practical problem is that several states set a stricter standard, requiring every participant to consent before a recording begins. For any business operating across state lines, the federal baseline alone is not enough.

The short verdict:

  • Federal baseline: One-party consent under 18 U.S.C. § 2511. Any participant in a conversation may record it without notifying the others.
  • All-party states: California, Connecticut, Delaware, Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Oregon, Pennsylvania, and Washington require every participant’s consent.
  • Interstate default: When a call crosses state lines and any party may be in an all-party state, courts have applied the stricter jurisdiction’s rules. The defensible business practice is to default to all-party disclosure on every recorded call.
  • Bottom line for businesses: Implement a universal upfront disclosure before any substantive conversation begins. Check the state-by-state list in the next section, and consult legal counsel for edge cases specific to your industry or call type.

Note: This article is general legal information, not legal advice. Confirm current rules with a qualified attorney or your state’s primary statutes before implementing a recording policy.

Table of Contents

The federal floor

18 U.S.C. § 2511, part of the federal Wiretap Act, makes it unlawful to intentionally intercept any wire, oral, or electronic communication without consent. The statute’s one-party exception means a participant in the call may record it without telling anyone else. That covers the majority of U.S. states. Federal criminal penalties for violations can reach up to five years imprisonment and $250,000 in fines, with civil damages set at the greater of actual damages or $10,000 per violation, per the U.S. Department of Justice.

States are free to be stricter, and many are. When state law conflicts with federal law on this point, the stricter standard controls for conduct within that state.

All-party states at a glance

The Reporters Committee for Freedom of the Press (RCFP) identifies the following states as requiring all-party consent for recorded phone calls. Consent may be express or implied after a clear, audible notice.

Jurisdiction Consent Standard Key Statute (Example)
Federal (18 U.S.C. § 2511) One-party 18 U.S.C. § 2511
California All-party Penal Code § 632
Connecticut All-party (hybrid) —
Delaware All-party (hybrid) —
Florida All-party Fla. Stat. § 934.03
Illinois All-party 720 ILCS 5/14-2
Maryland All-party —
Massachusetts All-party —
Montana All-party —
New Hampshire All-party —
Oregon All-party (hybrid) —
Pennsylvania All-party —
Washington All-party —
All other states One-party Varies

U.S. map highlighting consent requirement states

“Hybrid” states like Connecticut, Delaware, and Oregon apply different standards depending on whether the recording is of a phone call versus an in-person conversation. Recording Law’s state-by-state analysis documents these nuances in detail. Hawaii and Maine also appear in some hybrid analyses, so treat them with the same caution.

The phrase “two-party consent” is technically a misnomer. As Justia notes, the correct term is all-party consent: every participant in the call must be notified and agree, regardless of how many people are on the line. A three-person conference call in California requires three consents, not two.

Scenarios that change the rule

  • In-person vs. electronic: Hybrid states like Oregon treat phone calls and face-to-face conversations under different rules. The Texas State Law Library’s audio recording guide is a good model for how state law libraries document these distinctions at the state level.

Which jurisdiction’s law controls on interstate calls?

This is where call recording laws get genuinely complicated. When a caller in a one-party state calls someone in California, which rule applies?

Courts have not settled on a single uniform answer, but the leading practical guidance from Justia points to a consistent pattern: courts often apply the stricter jurisdiction’s requirements when a call is connected to that state. The California Supreme Court’s reasoning in Kearney v. Salomon Smith Barney (2006) is the most-cited example. The court held that a Georgia firm recording calls with California clients without notice violated California law, even though Georgia is a one-party state.

The conservative operational rule

For businesses, the takeaway is simple: if any participant on a recorded call may be located in an all-party state, treat the call as subject to that state’s rules. Attempting to detect caller location in real time introduces its own operational risk. Geolocation data can be wrong, VoIP numbers don’t map reliably to physical locations, and mobile callers move. A single missed detection in California or Illinois can expose your business to statutory damages.

The defensible posture, recommended by multiple compliance guides including Viirtue’s 50-state breakdown, is a universal upfront disclosure on every recorded call, regardless of where the parties appear to be located.

Pro Tip: Never build per-call location-detection logic as your primary compliance mechanism for automated systems. Even if you get it right 99% of the time, the 1% failure in a strict state is the one that generates litigation. A single universal disclosure script costs almost nothing and eliminates the risk entirely.

Valid consent has two components: the notice must be clear, and it must happen before any substantive conversation begins. Dial Raven’s state-by-state guide confirms that continued participation after a clear disclosure is widely treated as implied consent, making the IVR pre-connect announcement the most practical tool for high-volume call environments.

Sample disclosure language

Inbound (IVR):
“This call may be recorded or monitored for quality assurance and training purposes. By continuing, you consent to this recording.”

Outbound (agent or automated):
“Hello, this call is being recorded. By continuing this conversation, you agree to the recording. If you do not wish to be recorded, please let me know now.”

Conference/multi-party:
“This call is being recorded. All participants are advised that by remaining on the line, you consent to the recording of this call.”

Documentation best practices

Logging consent is as important as obtaining it. At minimum, your system should capture:

  • Timestamp of when the disclosure played or was delivered
  • The specific disclosure language used (version-controlled)
  • Whether the caller continued after the disclosure (implied consent) or gave express verbal confirmation
  • Agent ID or system ID that delivered the disclosure
  • Retention period and storage location of the consent record

Pro Tip: Store a short consent snippet, separate from the full call recording, that captures just the disclosure and the caller’s response. If the full recording is ever deleted per your retention schedule, the consent record survives independently for audit and litigation purposes.

Workplace recording is a distinct legal category, and the rules are not simply “employers can record anything on company equipment.” State all-party consent laws apply to employer-employee calls just as they apply to customer calls. A company policy or employee handbook notice does not override California Penal Code § 632.

  • Update your employee handbook to include an explicit recording and monitoring disclosure.
  • Provide written acknowledgment at onboarding that employees have received and understood the policy.
  • Display visible indicators (e.g., a notification banner in your softphone or CRM) when a session is being recorded.
  • Maintain documented opt-out procedures for any context where opt-out is legally required.
  • Review policies annually with legal counsel, particularly if your workforce spans multiple states.

Additional privacy regimes

HIPAA-covered entities recording calls with patients face additional obligations around protected health information. PCI DSS compliance requires pausing or masking recordings during payment card data entry. Union rules may restrict monitoring frequency or require notice beyond what state law mandates. These constraints layer on top of, not instead of, state consent requirements.

Penalties for unlawful recording and admissibility of recordings as evidence

Getting call recording consent wrong carries real financial and criminal exposure. Federal and state penalties are not theoretical.

Federal penalties under 18 U.S.C. § 2511 and § 2520

Per the U.S. Department of Justice, federal criminal penalties for unlawful interception include up to five years imprisonment and fines up to $250,000. Civil remedies under 18 U.S.C. § 2520 allow the injured party to recover the greater of actual damages or $10,000 per violation, plus attorney’s fees.

State-level penalties

State Criminal Exposure Civil Damages
California (Penal Code § 632) Misdemeanor or felony; up to federal fines and penalties Actual damages or statutory damages per violation
Illinois (720 ILCS 5/14-2) Class 4 felony Actual damages plus attorney’s fees
Maryland (all-party consent state) Felony; up to 5 years Actual damages or statutory damages per violation
Pennsylvania (—) Felony of the third degree Actual damages plus statutory damages
Federal (18 U.S.C. § 2511/§ 2520) Up to 5 years imprisonment Greater of actual damages or $10,000 per violation

State penalties are sourced from the RCFP’s recording law guidance and primary state statutes. Always verify current penalty amounts directly from the statute, as legislatures update them.

Admissibility of unlawfully obtained recordings

Courts in all-party states routinely exclude recordings obtained without required consent. Beyond exclusion, the party who made the unlawful recording may face a counterclaim for statutory damages. Even in federal court, a recording that violates state law may be inadmissible or may expose the offering party to sanctions. The practical consequence: an unlawful recording intended as evidence can become the liability itself.

A compliance checklist for businesses implementing call recording

This is the operational playbook. Work through it with your legal counsel and engineering team before going live with any recording system.

1. Set your default posture

Adopt all-party disclosure as your universal standard. Apply it to every recorded call, inbound and outbound, regardless of apparent caller location. This single decision eliminates the need for per-call jurisdiction logic.

2. Implement IVR or pre-connect disclosures

Configure your phone system or AI voice agent to play a disclosure before the call connects to a live agent or before any substantive exchange begins. The disclosure must be audible, in the caller’s language, and unambiguous about the fact of recording.

Every recorded call should generate a consent metadata record. Log the timestamp, disclosure version, delivery method (IVR, agent, written), and whether the caller continued (implied) or verbally confirmed (express). 42voice’s CRM phone integration can store this metadata alongside call records for audit-ready retrieval.

4. Apply technical controls

  • Encrypt recordings at rest and in transit.
  • Restrict access by role: QA teams, legal, and compliance should have separate access tiers.
  • Tag recordings for legal hold when litigation is anticipated or active.
  • Pause or mask recordings during PCI-sensitive data entry.

5. Set a retention policy

Pro Tip: Retention periods should be tied to the purpose of the recording, not a single blanket rule. A QA call has different risk exposure than a call that documents a disputed transaction.

Use Case Recommended Retention Notes
Quality assurance / training — Delete after review cycle unless flagged
Customer dispute evidence 1–3 years Retain until statute of limitations expires
Regulatory compliance (financial) 3–7 years Match applicable regulatory requirement
Legal hold Indefinite until released Do not delete; document hold reason
Consent records Match the associated recording + 1 year Retain independently if recording is deleted

6. Train your team

Every agent and manager who handles recorded calls needs to understand the disclosure script, when to pause recording, and how to handle a caller who refuses consent. Document training completion and refresh annually.

Schedule a review of your recording policies at least once per year, or any time you expand into a new state, add a new call type, or deploy a new AI voice system. State legislatures update recording statutes, and a policy that was compliant last year may not be today.

If you discover a call was recorded without the required consent, act quickly and methodically.

  1. Identify the jurisdictions — Determine which states’ laws apply. If either party was in an all-party state, that state’s statute likely governs. This step determines whether you have a civil claim, a criminal complaint, or both.

For criminal complaints, contact your local FBI field office (for federal Wiretap Act violations) or your state attorney general’s office for state-level violations.

Primary sources and authoritative resources

These are the sources to consult when you need to verify a specific rule, check a statute’s current text, or brief legal counsel.

A note on secondary guides: Every secondary source, including the ones listed above, is a summary. State legislatures amend recording statutes, and summaries lag behind. Always verify the current statutory text directly before finalizing a compliance policy.

Compliance and customer experience are not opposites

Most businesses treat call recording consent as a legal checkbox. That framing misses the bigger opportunity. A clear, confident disclosure at the start of a call does more than satisfy a statute. It signals to the caller that your business operates transparently, that you respect their privacy, and that the conversation is being documented for their protection as much as yours.

The tension between compliance and conversion is real but often overstated. A disclosure that runs five seconds and uses plain language (“This call is being recorded for quality and training purposes”) has a negligible effect on call completion rates. What does hurt conversion is a disclosure that sounds like a legal disclaimer read at speed, or one that interrupts the caller before they’ve even heard a greeting. The sequence matters: greet first, disclose second, then proceed.

There’s a subtler point worth raising for businesses deploying AI voice agents. AI transcription and analytics add privacy obligations that go beyond basic consent. When an AI agent records, transcribes, and analyzes a call, the caller’s data is being processed in ways that a simple “this call may be recorded” disclosure may not fully cover. Depending on your industry and the states involved, you may need to disclose the use of AI processing explicitly. The RCFP’s guidance notes that relying on static state maps is risky precisely because the law is evolving faster than most compliance guides can track.

The businesses that get this right are not the ones with the most complex compliance systems. They’re the ones that made a single, defensible decision early: disclose to everyone, every time, before the conversation starts. That posture costs almost nothing to implement and removes the largest category of recording-related legal risk in one step.

Compliance and customer experience are not opposites — overview diagram

How 42voice makes compliant call recording straightforward

Call recording compliance is a configuration problem as much as a legal one. Your phone system needs to play the right disclosure at the right moment, log the consent, and store the recording securely. That’s exactly where 42voice’s AI customer support solutions are built to help.

42voice

42voice deploys configurable IVR announcements that play before any agent or AI voice agent connects, capturing implied consent automatically on every inbound call. For outbound campaigns, the AI cold calling system delivers a compliant disclosure at the start of each call, with consent metadata logged directly to your CRM via native integration. Role-based access controls, retention tagging, and audit logs are built into the platform, so your compliance team has the documentation it needs without manual tracking.

Deployment typically takes 3–5 days. During onboarding, 42voice recommends a legal review of your disclosure scripts to confirm they meet the requirements of every state your calls touch. Ready to see it in action? Book a demo and bring your compliance checklist.

Useful sources for further research

Reminder: State statutes are amended regularly. Verify the current text of any statute directly from the official state legislature website before relying on it in a compliance policy. Secondary guides, including those listed here, are summaries and are not a substitute for state-specific legal review.

FAQ

Yes, but the standard varies. Federal law requires only one party’s consent under 18 U.S.C. § 2511, but states like California, Florida, and Illinois require every participant to consent before recording begins.

Can someone record a call without your permission?

In one-party consent states, yes. A participant in the call may record it without telling you. In all-party states, recording without notifying every participant is illegal and can result in criminal charges and civil damages.

Preserve the recording, document the circumstances, identify which states’ laws apply, and consult legal counsel. You may have a civil claim for statutory damages under 18 U.S.C. § 2520 or applicable state law, and a criminal complaint may be appropriate in all-party states.

Do you legally have to tell someone a call is being recorded?

In all-party consent states, yes, before the recording begins. In one-party states, the party doing the recording is not required to notify others, but businesses commonly disclose anyway as a best practice and to cover interstate call risk.

California, Connecticut, Delaware, Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Oregon, Pennsylvania, and Washington are the states most commonly classified as all-party, per RCFP guidance. Connecticut, Delaware, and Oregon have hybrid rules that depend on the type of communication.