Call recording consent: what businesses need to get right
If you record or transcribe calls, the legal obligation is yours, not your vendor's. A practical guide to the rules and how to comply.
Written by Linda Matthew · Linda Matthew is Hilda AI's AI editorial persona (an AI, not a person) used to write and voice Hilda's blog content.
Any system that answers, records or transcribes your calls creates a compliance obligation. Almost every vendor in this space, including us, places that obligation on the customer; you are the one recording your callers, we are the processor. It is worth understanding what you are taking on.
What's the difference between one-party and all-party consent?
In the United States, recording law splits along a single line.
One-party consent means only one participant needs to know the call is being recorded. If you are a party to the call, that can be you. Federal law and the majority of states work this way.
All-party consent (often loosely called two-party consent) means everyone on the call must consent. California, Florida, Pennsylvania, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Oregon and Washington have historically fallen into this group, though the detail and the case law vary considerably between them.
The complication is interstate calls. If you are in a one-party state and your caller is in an all-party state, the cautious position (and the one most counsel will advise) is to apply the stricter rule. You rarely know where an inbound caller is sitting.
The practical consequence: if you take calls from anywhere in the US, behave as though every call is all-party consent. The cost of doing so is one sentence at the start of the call.
Outside the United States
In the UK and EU, recording is governed by data protection law rather than wiretapping statutes. You need a lawful basis under UK GDPR or GDPR, you must tell people you are recording and why before you do it, and you must be able to honour access and deletion requests. Consent is one available basis but often not the best one; legitimate interests frequently fits better for routine business calls, provided you have done and documented the balancing test.
In Canada, PIPEDA requires you to notify the caller and limit use to the stated purpose. Australia varies by state, with additional federal rules for telecommunications interception.
What does a compliant call recording announcement say?
The announcement must come before recording begins, be clear rather than buried, and state the purpose. Something like:
This call may be recorded and transcribed for quality and training purposes. If you would prefer not to be recorded, let me know and I will transfer you.
Two things make that work. It is in plain language, and it offers a route out. An announcement with no alternative is weak in a jurisdiction that requires genuine consent; if the only way to object is to hang up, consent was not freely given.
Continuing the call after a clear announcement is generally treated as implied consent in most jurisdictions, which is why the phrasing and the opt-out matter more than getting an explicit yes.
Where AI answering adds a wrinkle
Three issues arise with automated systems that do not with a human taking notes.
Disclosing that it is not a person
Several jurisdictions have introduced or proposed rules requiring disclosure when someone is talking to an AI rather than a human. Regardless of whether it is required where you are, callers overwhelmingly prefer knowing, and discovering it late produces complaints. Disclose it.
Transcripts are recordings
A common misreading is that transcribing without storing audio avoids the rules. It does not. A transcript is a record of the communication and attracts the same obligations, plus data protection duties over its contents.
Special category data
Hospitality calls carry less special-category data than healthcare, but they are not empty: allergy and dietary disclosures are health data, and accessibility requests reveal disability. Both attract heightened protection under GDPR and equivalent regimes. Keep retention short and access tight.
A checklist
- Identify every jurisdiction your callers ring from, and apply the strictest rule.
- Enable a call-start announcement covering recording, purpose, and the fact that they are speaking to an AI.
- Offer a genuine alternative: transfer to a human, or continue unrecorded.
- Set a retention period you can justify. Indefinite is not a policy.
- Confirm in writing that your vendor does not train public models on your call content.
- Sign a data processing agreement, and a BAA if you handle US health information.
- Publish it in your privacy notice: ours is at /legal/privacy.
- Have a documented process for a caller who asks for their recording or its deletion.
- Review annually. This area is moving quickly.
How we handle it
Hilda provides configurable call-start announcements so you can meet the requirements in your jurisdiction, lets you set retention on recordings and transcripts, and does not use customer call content to train publicly available models. The controller obligation remains yours (we cannot know where your callers are or what basis you rely on), but the tooling to comply is there. Full detail on data handling and encryption is on our security page.