Call Recording Compliance
Recording phone calls is regulated at the federal, state, and international level. The rules differ by jurisdiction and by who initiates the call. Get this wrong and you face wiretap-statute civil damages (often $5,000-10,000 per call), criminal exposure, and GDPR fines up to 4% of global revenue.
US federal law — Wiretap Act (18 USC 2511)
The federal Wiretap Act requires that at least one party consent to the recording. If you are a party to the call, you are the consenting party — federal law allows you to record without telling the other side. This is the "one-party consent" baseline.
State law can be stricter. State law applies.
US state law — one-party vs two-party consent
Two-party consent states (require ALL parties consent)
| State | Statute | |---|---| | California | Cal. Penal Code §632 | | Connecticut | Conn. Gen. Stat. §52-570d | | Delaware | 11 Del. C. §1335 | | Florida | Fla. Stat. §934.03 | | Illinois | 720 ILCS 5/14 | | Maryland | Md. Code Cts. & Jud. Proc. §10-402 | | Massachusetts | M.G.L. c. 272 §99 | | Montana | Mont. Code §45-8-213 | | Nevada | NRS §200.620 | | New Hampshire | RSA §570-A:2 | | Pennsylvania | 18 Pa.C.S. §5703 | | Washington | RCW §9.73.030 |
In two-party-consent states, every party on the call must affirmatively consent before recording begins. Implied consent (continuing the call after a beep) is accepted in some states (CA, WA) but not all (MA, IL require explicit verbal acknowledgement).
One-party consent (federal floor, 38 states)
All states not listed above. Recording is legal if at least one party (which can be you, the recorder) consents.
Interstate calls — apply the stricter law
When the caller is in a one-party state and the callee is in a two-party state, the stricter law applies. A California caller calling a Texas business: California two-party rule applies; Texas business must obtain explicit consent before recording.
Default operating assumption for any production call platform: announce recording at the start of every call. Get explicit verbal "yes" if recording sensitive content. This satisfies the strictest state.
The standard disclosure script
"This call is being recorded for quality and training purposes. By continuing this call, you consent to the recording."
For two-party-consent states with explicit-consent requirements (MA, IL), add:
"Do you consent to the recording? Please say yes or no."
If the caller says no, the SWML script should not record. Use:
- prompt:
play: say:This call may be recorded. Do you consent? Say yes or no.
speech_timeout: 5
speech_hints: "yes,no"
- cond:
when: "${prompt_value} == 'yes'"
then:
- record:
stereo: true
else:
- play: say:Understood, we will not record. How can I help?
GDPR — EU and UK
If any caller is in the EU/EEA, UK, or Switzerland, GDPR applies.
Article 6 — Lawful basis required
Most call-recording use cases rely on:
- Consent (Article 6(1)(a)) — explicit, opt-in. Best for marketing or non-essential recording.
- Legitimate interest (Article 6(1)(f)) — for quality assurance, fraud prevention, dispute resolution. Must pass the three-part test and document a Legitimate Interest Assessment (LIA).
- Contract necessity (Article 6(1)(b)) — for transaction confirmation calls.
Article 13/14 — transparency
Before or at the start of recording, the caller must be told:
- The identity and contact of the controller
- The purpose of the recording
- The legal basis
- Recipients of the recording (carriers, transcription vendors, etc.)
- Retention period
- Their rights (access, erasure, objection)
A short verbal notice plus a privacy notice URL satisfies this:
"This call is recorded for quality assurance and may be reviewed for compliance. For full details, see [domain]/privacy. Stay on the line to continue with recording, or press 9 to opt out."
Article 17 — right to erasure
EU callers can request recording deletion. Build a workflow to look up recordings by caller phone number and delete them within 30 days of request.
Special categories (Article 9)
Health, biometric, religious, or sexual orientation data spoken during a call is special-category data. Requires either explicit consent or one of the Article 9(2) derogations. Healthcare and financial services need extra scrutiny here.
CCPA / CPRA — California Consumer Privacy Act
California consumers have the right to know what personal information is collected and to opt out of its sale or sharing. Call recordings containing personal information trigger CCPA notice obligations.
- Notice at collection — before or at the start of recording.
- Right to know — consumers can request recordings stored about them.
- Right to delete — must comply within 45 days of verified request.
A CCPA-compliant disclosure: same as the standard disclosure plus a link to your CCPA privacy notice.
PCI-DSS — payment card data
If a caller speaks credit card numbers during a recorded call, PCI-DSS Requirement 3.4 prohibits storing sensitive authentication data (CVV, full PAN) after authorization.
Two compliant patterns:
- Pause and resume — automatically detect when payment is being collected and pause recording. Resume when complete.
- DTMF capture — collect card number via DTMF directly to a PCI-validated provider, never spoken into the recorded audio.
SignalWire SWML supports both via record_call with start/stop hooks, or via prompt with masked DTMF.
Healthcare — HIPAA
Recording a call with a covered entity that contains PHI requires:
- A Business Associate Agreement (BAA) with every vendor that touches the audio (carrier, transcription, storage).
- Encrypted storage at rest (AES-256 minimum).
- Encrypted transit (TLS 1.2+, SRTP).
- Access logging and audit trail.
- Six-year retention requirement (HIPAA §164.530(j)).
SignalWire offers HIPAA BAA on enterprise plans. AssemblyAI and Deepgram offer BAA on enterprise tiers.
Retention and storage
Recording retention by purpose:
| Purpose | Typical retention | |---|---| | Quality assurance | 30-90 days | | Sales evidence | 12 months minimum | | Dispute resolution | 24-36 months | | Regulated industries (financial) | 5-7 years (FINRA, SEC) | | Healthcare (HIPAA) | 6 years | | Marketing consent verification | Duration of consent + 4 years |
Document the retention policy. Auto-delete recordings past the retention window. Maintain audit logs of deletions.
SignalWire implementation pattern
version: 1.0.0
sections:
main:
- answer: {}
- play: say:This call may be recorded for quality and training purposes.
- record_call:
stereo: true
format: mp3
beep: false
direction: both
For two-party-consent + GDPR + CCPA compliance, expand to:
- play: say:For quality and compliance, this call may be recorded. Press 9 at any time to opt out, or stay on the line to continue.
- record_call:
stereo: true
format: mp3
The recording is saved to SignalWire storage. Webhook on call end delivers the URL — fetch and move to encrypted storage immediately.
References
- 18 USC 2511 — Federal Wiretap Act
- Cal. Penal Code §632 — California two-party consent
- 720 ILCS 5/14 — Illinois Eavesdropping statute
- GDPR — Regulation (EU) 2016/679
- CCPA — Cal. Civ. Code §1798.100 et seq.
- HIPAA — 45 CFR §164 (Privacy and Security Rules)
- PCI-DSS v4.0 — Requirement 3.4