Call Recording Laws by State: What Your Business Needs to Know in 2025

Call recording is one of the most valuable features of a modern VoIP system. Sales teams use it for coaching, support teams use it for quality assurance, and legal teams use it for dispute resolution. But recording calls without understanding the legal requirements can expose your business to significant liability. This guide explains federal and state call recording laws, identifies which states require one-party vs. two-party consent, and provides practical guidance for recording business calls legally in 2025.

The federal wiretapping law (18 U.S.C. § 2511) sets the baseline: one-party consent. This means a participant in the conversation can record it without informing the other parties. If you are on the call (or an employee of your business is on the call), you can legally record it under federal law. However, federal law sets a floor — not a ceiling. States are free to impose stricter requirements, and many do. When state law is stricter than federal law, state law controls. Important: If the callers are in different states, the strictest applicable law typically governs. This is why many businesses adopt a blanket policy of notifying all callers that recordings may occur.

In these 37 states (plus Washington D.C.), only one party to the call needs to consent to the recording: Alabama, Alaska, Arizona, Arkansas, Colorado, Connecticut, Georgia, Hawaii, Idaho, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maine, Michigan, Minnesota, Mississippi, Missouri, Nebraska, New Jersey, New Mexico, New York, North Carolina, North Dakota, Ohio, Oklahoma, Oregon, Rhode Island, South Carolina, South Dakota, Tennessee, Texas, Utah, Virginia, West Virginia, Wisconsin, Wyoming, and Washington D.C. In practice, this means that if your employee is on the call and consents (or your company policy authorizes recording), the recording is legal without notifying the other party. However, best practice is still to notify callers — it builds trust and provides an extra layer of legal protection.

These 13 states require all parties to consent before a call can be recorded: California, Delaware, Florida, Illinois, Maryland, Massachusetts, Michigan (case law is mixed — treated as two-party by many attorneys), Montana, Nevada, New Hampshire, Oregon (for in-person conversations; one-party for phone calls in some interpretations), Pennsylvania, Vermont, and Washington. Note: Some of these states have nuances. For example, Nevada law requires one-party consent for phone calls but all-party consent for in-person conversations. Oregon has similar distinctions. Always consult state-specific legal guidance for precise compliance. If your business handles calls from any of these states — even if your office is in a one-party state — the safest approach is to notify all callers with a recorded disclosure.

This is where compliance gets complicated. If a caller in a one-party consent state (like New York) calls a business in a two-party consent state (like California), which law applies? Courts have not established a single uniform rule. Some courts apply the law of the state where the recording is made. Others apply the law of the state where the stricter party is located. And some apply the law of the state where the cause of action is filed. The practical solution: adopt a universal two-party consent policy. Notify every caller that the call may be recorded, regardless of where they are located. This eliminates the ambiguity entirely and costs nothing to implement — just add a recording notice to your auto-attendant greeting.

Follow these steps to record calls legally: 1. Adopt a written policy: Document your call recording practices — what is recorded, who has access, how long recordings are stored, and when they are deleted. 2. Add a recording disclosure: Configure your VoIP auto-attendant or queue greeting to include: "This call may be recorded for quality assurance and training purposes." By continuing the call, the caller provides implied consent. 3. Provide opt-out when required: Some states require you to offer an opt-out mechanism. If a caller objects, your agents should know the procedure — typically, they stop the recording for that call. 4. Train your team: Make sure every employee who handles calls understands the recording policy, knows which calls are recorded, and can respond appropriately if a caller asks about it. 5. Secure recordings: Store call recordings with encryption at rest and restrict access to authorized personnel. This protects sensitive information and supports compliance with data protection regulations. 6. Set retention policies: Do not keep recordings indefinitely. Establish retention periods based on your industry requirements — typically 30–90 days for quality assurance, longer if regulations require it.

Some industries have additional recording requirements beyond state consent laws: Healthcare (HIPAA): Call recordings containing protected health information (PHI) must be stored, accessed, and disposed of in compliance with HIPAA rules. Encryption, access controls, and audit trails are mandatory. Financial services (Dodd-Frank, MiFID II): Broker-dealers and financial advisors may be required to record all client calls and retain them for specific periods (typically 3–7 years). Payment processing (PCI DSS): If credit card numbers are spoken during a call, recordings must be handled as cardholder data under PCI DSS. Use pause-and-resume recording features to avoid capturing payment card details. Call centers: The Telephone Consumer Protection Act (TCPA) governs outbound calling practices and has specific rules about automated dialing and recording. Compliance is especially critical for sales and collections teams.

Recording employee calls for training and quality purposes is generally permissible if employees are informed. Best practices include: • Include a call recording disclosure in the employee handbook and employment agreement. • Notify employees that business calls may be monitored and recorded. • Clearly distinguish between business and personal calls — recording personal calls without consent is problematic even in one-party consent states. • Use recordings constructively — for coaching, dispute resolution, and process improvement — not as a punitive surveillance tool. Most employees expect business calls to be recorded, especially in sales and support roles. Transparency about the practice prevents misunderstandings.

Modern VoIP platforms include built-in tools to make compliant recording easier: Automatic recording announcements: Play a disclosure message before the call connects, configurable per call queue, ring group, or extension. On-demand recording: Allow agents to start and stop recording manually, useful for calls where only certain segments should be captured. Pause-and-resume: Temporarily pause recording when sensitive information (like credit card numbers) is being shared, then resume automatically. Role-based access: Restrict who can listen to, download, or delete recordings based on their role. Automatic retention and purging: Set policies to automatically delete recordings after the retention period expires. Encryption at rest: Ensure stored recordings are encrypted so that a data breach does not expose call content. ON VoIP includes all of these features, making it straightforward to record calls in full compliance with applicable laws.

Call recording is a powerful tool for improving sales performance, resolving disputes, and maintaining service quality — but it comes with legal obligations. The safest approach for any business is simple: notify all callers with an automated recording disclosure, train your team on the policy, secure your recordings, and establish retention schedules. ON VoIP makes compliance easy with built-in recording announcements, pause-and-resume, encryption, and automated retention policies. Talk to our team to set up a recording workflow that fits your business and your legal requirements.