Federal law lets you record a call if one party consents, and that party can be you. Ten states require consent from everyone on the line. Five more are contested enough to treat the same way. On an interstate call the stricter state’s law governs, which is why most outbound programs announce recording on every dial.
In This Article
The gap between that federal floor and those fifteen stricter states is where outbound programs get sued. The failure is almost never the decision to record. It is the absence of proof that the disclosure was read on the calls in question, because the disclosure lives in a policy document instead of inside the audio file.
What follows is the map an outbound team needs: the federal floor, the states sitting above it, the ones no two published guides classify the same way, and the interstate rule that turns this from a lookup into a design decision. The call recording compliance programs we build and monitor start from exactly this material.
Do you need one party’s consent or everyone’s to record a call?
One party’s, under federal law, and that party can be you. Fifteen states go further and require consent from everyone on the line, so the answer depends on where both people are sitting.
78.7% of U.S. adults lived in wireless-only households in the second half of 2024, up 2.7 percentage points in twelve months.
The floor is federal. The federal Wiretap Act at 18 U.S.C. § 2511(2)(d), part of the Electronic Communications Privacy Act, permits a participant in a call to record it. States sit above that floor and cannot sit below it, so the operative question is never whether recording is legal. It is which state’s rules govern this particular dial.
The shorthand everyone uses (one-party states, two-party states) describes a statute’s default rule, not its actual trigger. That distinction costs money. California’s core provision attaches to a “confidential communication,” so the analysis turns on whether the other party reasonably expected the conversation was not being overheard. A separate California provision attaches to the device instead: any call over a cellular or cordless phone, confidentiality analysis or not. That second provision is the one an outbound program actually lives under, because the landline is close to gone: the National Center for Health Statistics put adults in wireless-only households at 78.7% in the second half of 2024, against 72.6% two years earlier.
Massachusetts is stricter in a different direction. Its statute turns on secrecy, which courts have read to require the other party’s actual knowledge rather than a disclosure played at them. Montana asks for the knowledge of all parties. Three all-party states, three different tests. A protocol built on the label rather than the text satisfies one of them and misses the other two.
Which states require all-party consent to record a phone call?
Ten states require consent from every party to a phone call: California, Delaware, Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Pennsylvania and Washington. Five more are contested and should be treated the same way.
The table lists the ten with the governing provision and the wrinkle that matters operationally, because in several of them the requirement is narrower or broader than the label suggests.
State | Provision | What actually triggers it |
|---|---|---|
California | Cal. Penal Code §§ 632, 632.7 | § 632 turns on a “confidential communication.” § 632.7 covers any cellular or cordless call regardless |
Delaware | 11 Del. C. § 1335(a)(4) | Wiretap and privacy provisions conflict. The privacy provision reads all-party, so treat it as all-party |
Florida | Fla. Stat. § 934.03 | Fla. Stat. § 934.03 All-party for oral and wire communications. Criminal exposure plus a private right of action |
Illinois | 720 ILCS 5/14-2 | Rewritten after People v. Clark. Turns on a reasonable expectation of privacy |
Maryland | Md. Cts. & Jud. Proc. § 10-402 | All-party, interpreted alongside a reasonable-expectation standard |
Massachusetts | Mass. Gen. Laws ch. 272, § 99 | Prohibits “secret” recording. Courts have read this as requiring actual knowledge, not passive notice |
Montana | Mont. Code Ann. § 45-8-213 | Requires the knowledge of all parties rather than affirmative consent |
New Hampshire | N.H. RSA 570-A:2 | All-party, and among the strictest enforcement postures in the group |
Pennsylvania | 18 Pa. C.S. §§ 5703, 5704 | All-party under WESCA. Business-call exceptions are narrow and fact-specific |
Washington | RCW 9.73.030 | All-party. The announcement must be recorded as part of the call itself
|
Read down the third column rather than the first. Four of these ten hang their requirement on a reasonable expectation of privacy or a confidentiality test, which means a business-to-business call to a published main line and a consumer call to a mobile at nine in the evening come out differently under the same statute. Massachusetts and Washington care less about consent as a concept than about the mechanics of how the other party was informed. That is the difference between a compliance matrix and a compliance program.
The remaining states and the District of Columbia follow the federal one-party standard. That is the sentence most guides stop at. It is also the sentence that gets programs sued, because a one-party state matters only if you know where both people on the call are sitting. Designing a single protocol against the strictest state you touch is the substance of multi-state call recording compliance programs, where the state list turns into a script and a dialer configuration.
Which states are unsettled, and why do published guides disagree?
Connecticut, Michigan, Nevada, Oregon and Vermont resist clean classification because their statutes and case law point in different directions, which is why published guides split on all five. Treat every one of them as all-party.
That disagreement is not sloppiness. It reflects real splits between statutory text and how courts have applied it, and each of the five splits for a different reason.
Connecticut’s civil statute is the most specific and the least discussed. It does not simply ask for consent. It names the acceptable methods: prior written consent, a verbal notification recorded at the start of the call as part of the recording itself, or an automatic tone warning repeating roughly every fifteen seconds. A program that announces recording but never captures the announcement inside the audio has satisfied no method on that list.
Michigan’s statute reads as all-party on its face. Michigan courts have long recognized a participant exception, and the state Supreme Court has never squarely resolved it. Nevada’s provision reads one way and its Supreme Court layered a reasonable-expectation gloss on top, which is why some guides put Nevada in the clear all-party column and others do not. Oregon splits by channel: phone calls follow a one-party rule while in-person conversations require all-party consent, so a recorded conference call with someone in an Oregon conference room is two legal questions at once. Vermont has no wiretap statute at all, and its protection comes from case law built around a reasonable expectation of privacy.
The operational answer is the same for all five. Treat them as all-party. That brings the count of states you design around to fifteen, and fifteen is the number worth remembering rather than ten.
If your agent and your customer are in different states, whose recording law applies?
The stricter state’s law. Courts run a choice-of-law analysis with no federal rule to resolve it, and the leading case applied California’s all-party requirement to a firm recording from a one-party state.
In Kearney v. Salomon Smith Barney, 39 Cal. 4th 95 (2006), the California Supreme Court applied California’s all-party rule to a firm operating out of Georgia, a one-party state, because the clients on the other end of those calls were in California.
So the governing law on any given dial turns on a fact your dialer does not know. Area code is not location. Number portability broke that assumption more than a decade ago, and a 415 number rings just as readily in Denver. A self-reported address in your CRM tells you where someone receives mail, not where they are standing when they answer. On consumer calling at volume, there is no version of this where you route by jurisdiction accurately enough to rely on it.
This is where multi-state campaigns stop being an abstraction. A single insurance program running across California, Connecticut, Maryland and Ohio touches two clear all-party states, one contested state and one one-party state on the same contact list, dialed by the same agents reading the same script in the same shift. Four protocols are neither cheaper nor safer than one protocol built to the strictest requirement in the set.
Does “this call may be recorded” count as consent?
In most states, yes: notice followed by the other person staying on the line is treated as implied consent. It is not sufficient in Massachusetts, Connecticut or Washington, each of which specifies how the other party must be informed.
That default is why the phrase sits on nearly every customer service line in the country, and it is a good default. It thins out in the states with specified methods or a secrecy standard.
It thins out in the states with specified methods or a secrecy standard. Massachusetts turns on whether the recording was secret, which pushes toward actual acknowledgment rather than a disclosure played over hold music. Connecticut names its three acceptable methods. Washington requires the announcement to be part of the recording. The common thread is evidentiary rather than semantic: a year later, answering a demand letter that covers fourteen months of calls, you are not asked what your policy said. You are asked to produce the audio where the disclosure was read.
That makes this a recording-architecture question rather than a scripting question. The disclosure belongs inside the file, timestamped ahead of anything substantive, on every call rather than every campaign. A script that opens with the disclaimer and a QA process that never verifies the disclaimer was read look identical in your documentation and completely different in discovery.
There is a second-order version worth planning for. Where the strictest rules apply, notice alone is not the safest posture, and the answer is to build an alternative rather than argue the point: an affirmative verbal acknowledgment captured before the substance begins, or a path that lets the call continue unrecorded when someone declines. Both are script decisions with routing consequences, which makes them far cheaper to design at launch than to retrofit.
What does getting call recording consent wrong actually cost?
In California, $5,000 per violation or three times actual damages, whichever is greater, with no proof of harm required. Damages run per call, which is how an ordinary class period becomes a seven-figure settlement.
$5,000 per violation, or three times actual damages, whichever is greater. No proof of harm required.
See where your campaign actually stands
The fastest way to know whether your dialer configuration, scripts, and records would hold up under the TSR is to map them against it, requirement by requirement. That is what a campaign compliance audit is for.
That structure is what makes recording claims attractive to the plaintiffs’ bar in a way most compliance exposure is not: damages are statutory, the class is defined by a date range in your own call logs, and nobody has to show they were harmed.
The arithmetic shows up in settlements. In Rahmat v. Aeroenlaces Nacionales (Ventura County Superior Court No. 2023CUBT012357), a carrier agreed to pay $3.95 million to resolve claims that customer service calls were recorded without all-party consent across a class period running from August 2022 to November 2023. Fifteen months of ordinary inbound and outbound service calls.
Exposure is also migrating toward technology most teams do not think of as a recorder. In a 2025 federal case, a court declined to dismiss claims against an AI voice platform that answered restaurant phone orders, where the allegation was that intercepting and recording the caller required the same consent a human-staffed line would. A related line of cases treats analytics and transcription vendors as third parties to the call rather than extensions of the business that received it. The obligation attaches to the function, not the headcount.
One current item, because many readers arrive with it backwards. California’s SB 690, passed by the legislature in August 2026, narrows private lawsuits only under the pen register and trap-and-trace provision aimed at website tracking. It leaves the wiretapping, eavesdropping and cellular recording provisions, the ones that govern your calls, fully intact for private plaintiffs.
Does the post-Chevron shakeup change how you should plan for this?
No, it raises the value of designing to the strictest standard. Courts are now free to reject federal agency interpretations they once had to follow, which makes the regulatory picture less predictable, not more.
Two decisions did the work. Loper Bright Enterprises v. Raimondo, 603 U.S. 369 (2024), ended Chevron deference. One year later, in McLaughlin Chiropractic Associates, Inc. v. McKesson Corp., 606 U.S. ___ (2025), decided 6-3 on June 20, 2025, the Supreme Court held that the Hobbs Act does not bind district courts to the FCC’s reading of the TCPA in private enforcement suits. District courts now interpret the statute themselves and give the agency’s view only appropriate respect.
Recording law is not FCC territory, so neither decision speaks to it directly. The knock-on matters anyway. Your consent layer and your recording layer are the same conversation and frequently the same sentence of script, and the federal half of that conversation is now open to relitigation in every district where you get sued. An FCC interpretation your program has relied on for a decade is persuasive authority rather than a shield.
State law is moving the same way from the other side. Florida, Maryland and Oklahoma have each enacted mini-TCPAs carrying their own consent and calling rules, and a plaintiff shut out of a federal theory has a state one to try. The recording statutes in this post are older and have proved durable, but the litigation around them is live: who counts as a party, whether an AI voice agent is a third party, whether a vendor receiving the audio is an extension of the business or a stranger to the call.
The planning conclusion matches the design conclusion. A protocol pegged to the strictest requirement you touch is insulated from most of this volatility, because it does not depend on any single interpretation surviving.
What a defensible call recording program looks like in practice
One protocol, built to the strictest standard in your calling footprint. The disclosure is read word-for-word at the top of every call and captured inside the audio file, and the whole thing is re-verified on a schedule.
Stop trying to be clever about jurisdiction. Five things carry the single-protocol approach in practice.
The disclosure lives in the audio
The disclosure lives in the audio. Read at the top of every call, ahead of any substantive exchange, captured in the same file as everything that follows. This is the item that most often fails at discovery, and it is a telephony configuration question as much as a script question.
The consent language is enforced word-for-word
The disclosure is scripted word-for-word and enforced as written. Consent language that agents paraphrase varies across thousands of calls, which means it varies across a class. Programs that hold up under scrutiny treat deviation from the consent disclaimer as an automatic QA failure rather than a coaching note: the difference between a guideline and an enforcement mechanism with consequences.
Retention and access are set before launch
Retention and access are decided before the first recording, not after the first subpoena. How long files are held, who can pull them, whether the retention window matches the limitations period for the claims you are exposed to: these are policy choices with legal consequences, and the recording items on the outbound compliance checklist cover the operational version.
Every vendor touching the audio is treated like an agent
Every vendor touching the audio gets the same treatment as an agent. Transcription, speech analytics, AI voice, quality scoring. If a third party receives the contents of the call, that relationship belongs in the consent analysis and in the contract.
Re-verification runs on a calendar
The whole thing gets re-verified on a calendar. State legislatures act, courts split, a contested state resolves in one direction or the other. A recording protocol written in 2024 and left alone is not a compliant protocol. It is a snapshot of one. Any multi-state outbound program inherits this review cycle whether or not anyone schedules it.
None of that is difficult in isolation. It is difficult to sustain across a campaign that is also being optimized weekly, staffed against turnover, and measured on contact rate. Across the campaigns we have audited, disclosure capture held on [X%] of monitored calls at launch and [Y%] by month four.
Frequently asked questions
Which states require all-party consent to record a phone call?
Ten states require consent from every party by statute or controlling case law: California, Delaware, Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Pennsylvania and Washington. Five more (Connecticut, Michigan, Nevada, Oregon and Vermont) are classified inconsistently because their statutes and case law point in different directions, and compliant programs treat all fifteen as all-party. The remaining states follow the federal one-party standard.
Is it legal to record a phone call without telling the other person?
Under federal law, yes, if you are a party to the call. 18 U.S.C. § 2511(2)(d) permits participant recording. State law can be stricter, and in about fifteen states it is, requiring everyone on the line to consent. Because an interstate call can pull in the stricter state’s law, recording without notice is a real risk for any business calling across state lines.
If my call center is in Texas and the customer is in California, whose call recording law applies?
Assume California’s. In Kearney v. Salomon Smith Barney (2006), the California Supreme Court applied California’s all-party consent rule to a firm recording from Georgia, a one-party state, because the clients were in California. No federal rule resolves these conflicts, so the standard approach is to treat the strictest applicable state law as governing.
Does saying "this call may be recorded" count as consent?
In most states, notice followed by the other person staying on the line is treated as implied consent. It is not sufficient everywhere. Massachusetts turns on whether the recording was secret, Connecticut names specific permitted methods including a recorded verbal notification or a repeating tone, and Washington requires the announcement to be part of the recording itself. The practical standard is to capture the disclosure inside the audio on every call.
What are the penalties for recording a call without consent?
They vary by state and can be both criminal and civil. California is the most frequently litigated: its Invasion of Privacy Act provides statutory damages of $5,000 per violation or three times actual damages, whichever is greater, with no requirement to prove harm. Because damages are per call and classes are defined from the business’s own call logs, recording claims scale quickly. A 2023 California case covering fifteen months of customer service calls resolved for $3.95 million.
Check your exposure across the states you call into
The compliance risk calculator walks through your calling footprint, your recording setup and your consent capture, and returns the states where your current protocol falls short.
