Call Recording Compliance: Consent Laws Every Sales Team Must Know

Recording a sales call without thinking twice about legality is one of the fastest ways to hand your legal team a crisis. The fines are real, the lawsuits are public, and the laws vary by state, country, and sometimes by the specific tool you use to record. Sales teams that have built serious conversation intelligence programs have done it by getting call recording compliance right first, not as an afterthought.

This post covers what compliance actually requires: which US states have all-party consent laws, how GDPR and CCPA apply to recorded sales conversations, and the practical steps your team needs to follow before hitting record. This is not legal advice - always consult qualified counsel for your specific situation - but this is the framework that informed sales leaders use to think through the problem.

What Is Call Recording Compliance?

Call recording compliance refers to the legal requirements governing when, how, and with whose knowledge a phone or video call can be recorded. These rules exist at multiple levels: federal law in the US, state law (which can be significantly stricter), and international regulations like GDPR for EU and UK calls.

At its core, the legal question is about consent - specifically, how many parties to a conversation must agree before it can be recorded. This is where most confusion starts, and where most compliance failures originate.

One-Party vs. All-Party Consent

US federal law - the Electronic Communications Privacy Act (ECPA) - requires only "one-party" consent. That means one person in the conversation must consent to the recording, and that person can be you. A sales rep in a one-party consent state can legally record a call without explicitly telling the prospect, as long as the rep is a party to the call.

Individual states can, and many do, set stricter standards. Eleven states currently require "all-party" consent, meaning every person on the call must know about and agree to the recording before it begins. The term "two-party" is a shorthand, but "all-party" is more accurate when there are multiple participants.

The critical detail: the law that applies is typically the law in the state where the person being recorded is located, not where your company or your rep is based. A rep in Texas calling a prospect in California must follow California's rules, even though Texas has no all-party consent requirement.

Why Remote Work Complicated Everything

Before widespread remote work, you could make reasonable assumptions about prospect locations based on phone area codes or company headquarters. That stopped being reliable. A prospect with a New York area code may be working from Massachusetts or Florida on any given day. Building compliance policy around area codes is not defensible.

The practical answer: treat every US call as if it requires all-party consent. Disclose at the start of every call. This single policy covers you in every state, removes the need to track prospect locations in real-time, and is simple enough that reps actually follow it consistently.

Which US States Require Two-Party Consent for Sales Calls?

As of 2025, the states requiring all-party consent are California, Connecticut, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, New Hampshire, Oregon, Pennsylvania, and Washington. If you are calling into any of these states regularly, your compliance procedure needs to account for them.

California carries the most legal weight for sales teams. The California Invasion of Privacy Act (CIPA) makes it a crime to record a confidential communication without all-party consent. Civil penalties under CIPA run up to $5,000 per violation - per call - and the statute has been used aggressively in class-action suits against companies using third-party call recording and AI tools.

Recording on Video Conferencing Platforms

Platforms like Zoom, Teams, and Google Meet typically display a notification banner when a recording starts, which satisfies disclosure requirements in most jurisdictions for participants who stay on the call after the notification appears. However, that in-app alert does not substitute for state law requirements in all cases, particularly when participants join before the recording notification is shown.

Use platform-native recording notifications as a supplement, not a replacement, for verbal disclosure. Check your platform's compliance documentation and add a verbal notice regardless. Platform compliance covers the platform's infrastructure; your consent obligations are your own.

Multi-Line and Conference Call Considerations

For calls with multiple participants across different states, the strictest applicable state law governs. A six-person enterprise call with participants in California, Illinois, and Florida all requires all-party consent. This is one of the strongest arguments for a universal disclosure policy rather than a state-by-state approach that depends on knowing every participant's location before the call begins.

Does GDPR Apply to Sales Call Recordings?

Yes, and the answer does not depend on where your company is incorporated. GDPR applies to the processing of personal data belonging to people in the European Union or UK. Recording a voice conversation is processing personal data - voice itself qualifies - so if your prospect is in the EU or UK, GDPR governs that recording regardless of whether you are based in Austin, Sydney, or London.

This matters for sales teams at companies that are technically "US companies" but have inbound interest from European markets. Even a handful of recorded calls with EU prospects puts you inside GDPR's scope for those recordings.

Lawful Basis for GDPR Call Recording

GDPR requires a lawful basis for every processing activity. For sales call recordings, two bases are commonly used:

• Legitimate interests: You have a legitimate business interest in recording calls for quality assurance, coaching, and compliance purposes, and this interest is not overridden by the individual's rights. This works for most B2B calls but requires a documented Legitimate Interests Assessment (LIA) that you can produce on request.
• Explicit consent: The individual agrees to the recording before it starts. This is a higher standard - consent must be freely given, specific, informed, and unambiguous. It cannot be buried in terms of service, and it cannot be a condition of the meeting.

Whichever basis you use, informing the caller before recording begins is a separate, non-negotiable requirement. Even under legitimate interests, the individual has the right to know their data is being processed.

Retention Limits and the Right to Erasure

GDPR also requires that personal data is not retained longer than necessary. For call recordings, this means having a defined retention policy - typically 90 days to one year for most sales teams - and the technical ability to delete specific recordings when an individual exercises their right to erasure. "We cannot delete individual recordings" is not a compliant answer.

Reviewing how your recording and transcription infrastructure handles data deletion is worth doing before you scale any conversation intelligence program. You can see how Koachly approaches this in our privacy policy.

CCPA and Call Recording: What California Requires

The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), applies when you record calls with California consumers and use those recordings in ways that involve data sharing or sale. For most B2B sales teams, the more immediate California risk comes from CIPA rather than CCPA - but both can apply simultaneously and you need to address both.

Under CCPA, California residents have the right to know what personal data you collect (including recordings), the right to opt out of the "sale" or "sharing" of that data, and the right to deletion. If your recording vendor shares call data with third parties - even for analytics or model training - that may constitute "sharing" under CCPA and trigger disclosure and opt-out obligations.

The Vendor Risk in Your Recording Stack

Every tool in your recording stack - the recorder, the transcription service, the conversation intelligence platform - becomes a data processor under GDPR and a service provider or potential third party under CCPA. You are responsible for ensuring your vendors process data lawfully. This means reading data processing agreements carefully, not just checking a compliance box at procurement.

When evaluating call recording and transcription tools, ask specifically: where is data stored, who can access it, what are the retention defaults, and how do you support deletion requests? A vendor that cannot answer these questions clearly represents a compliance liability, not just a product risk.

How to Get Consent Before Recording a Sales Call

Getting consent consistently is simpler than most teams make it. The following four-step process covers US state law requirements and GDPR disclosure obligations for the vast majority of sales calls:

1. Add a recording notice to every calendar invite. Include one line: "This call may be recorded for quality and training purposes." This gives attendees advance written notice and an opportunity to raise concerns before the call begins.
2. Open every call with a verbal disclosure. Train reps to say in the first 30 seconds: "Just a heads-up - I'll be recording this call for notes and coaching. Is that okay with you?" A clear verbal confirmation captured on the recording itself is your strongest protection.
3. Use platform-native recording notifications. On Zoom or Teams, use the built-in recording start notification. Do not disable it. The notification serves as supplemental notice and is logged by the platform.
4. Send a pre-call email for EU, UK, or high-stakes calls. For enterprise deals or calls with prospects in GDPR-scope jurisdictions, send a brief email confirming the session will be recorded and providing a clear opt-out option. Keep these emails as part of the deal record.

One point on how coaching tools integrate with this: Koachly delivers real-time coaching to reps during and after calls through a private in-ear model, not a visible bot joining the call as a separate participant. This keeps the consent disclosure straightforward - one company, one recording - rather than introducing ambiguity about what a third-party participant is capturing and who controls it.

What Not to Do

Relying on website terms of service as your consent mechanism for live call recordings is not sufficient. The prospect answering your call has typically not read your terms, and courts have consistently declined to accept click-wrap consent for telephone recordings under CIPA. Consent must be obtained at or before the time of recording, not weeks earlier during a website visit.

Do not assume that because your dialer or recording vendor says they are "GDPR compliant" your obligations are covered. Vendor compliance refers to their infrastructure - data centers, access controls, encryption. It does not mean they have obtained the consent you need from the people you are calling.

Building a Call Recording Compliance Program That Scales

Compliance is not a one-time setup. Sales teams grow, territories expand into new markets, and regulations change. The teams that handle this well treat call recording compliance as an ongoing operational practice built on three components: policy, training, and tooling.

Policy: Write a one-page call recording policy that specifies your consent procedure, data retention limits, who can access recordings internally, and how deletion requests are handled. Review it annually and update it when you expand into new markets or add new recording vendors.

Training: New rep onboarding should include a 10-minute segment on call recording law: which states require all-party consent, how to deliver the verbal disclosure, and what to do if a prospect objects or asks for their recording to be deleted. This is not a legal lecture - it is a practical script that protects the rep and the company.

Tooling: Choose tools that make compliance operationally sustainable at scale. The ability to search, export, and delete specific recordings matters as much as transcription quality. Teams scaling their use of AI-driven conversation intelligence need to understand what happens to recordings downstream - not just where they are stored, but how they are used in model training, what third parties can access them, and whether the data can be scoped by geography.

Koachly surfaces call analysis and coaching insights without requiring recordings to leave your control in ways that complicate compliance obligations. As regulators and plaintiffs' attorneys look more closely at AI-driven sales tools, the question will not only be "did you disclose the recording?" but "what did you do with it?" Having clear answers to that question, supported by tools built with data governance in mind, is what lets you scale a recording program confidently rather than reactively.