Call Recording Laws: A Practical Overview for Outbound Teams

One-Party vs. All-Party Consent: The Core Distinction

US federal law — the Electronic Communications Privacy Act (ECPA) — permits recording of a phone call with the consent of at least one party to the conversation. Since your agent is a party and knows the call is being recorded, this "one-party consent" standard is satisfied at the federal level without notifying the person being called.

However, 11 US states apply a stricter "all-party" or "two-party" consent standard, requiring that all participants consent to or be notified of recording. Those states include California, Connecticut, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, Oregon, Pennsylvania, and Washington. If your call center dials into those states — or if your agents are located in any of them — you may need to notify called parties before recording begins.

The practical implication: a single national outbound campaign will reach numbers in all-party consent states. Most compliance-oriented organizations treat all outbound calls as subject to the strictest applicable standard, providing a recording notice regardless of where the call originates or terminates.

International Recording Requirements

If your outbound program reaches beyond the US and Canada, recording law complexity multiplies. Some key examples:

• European Union (GDPR): Recording personal calls is a form of personal data processing. You need a lawful basis — typically consent or legitimate interest with a balancing test — and must address data retention, subject access rights, and cross-border transfer rules.
• United Kingdom: Similar to GDPR baseline post-Brexit; the UK GDPR and the Telecommunications (Lawful Business Practice) Regulations 2000 govern recording for business purposes.
• Australia: The Telecommunications (Interception and Access) Act requires consent from all parties for recording; notice at the start of the call is the standard approach.
• Canada: PIPEDA and provincial privacy laws govern recording; consent-based notice is the norm.

UnlimCall's outbound network spans 33 markets. Before extending a recorded campaign into any new market, your counsel should review the local recording law.

What "Notice" Looks Like in Practice

For outbound calls where notice is required or where your organization has chosen to provide it universally, the notice is typically delivered in the first few seconds of the call, before the agent begins their pitch. Common formulations include:

• "This call may be recorded for quality and training purposes."
• "To ensure quality service, this call is being recorded."

The notice should be audible, clear, and delivered before any substantive conversation begins. Some compliance programs pair the spoken notice with a DTMF option allowing the called party to request an unrecorded line, though this introduces operational complexity.

Storage, Retention, and Access Controls

Recording a call creates a data asset with its own compliance obligations:

Retention period. How long should recordings be kept? There is no single answer — it depends on the purpose of the recording, the jurisdiction, and your industry. FINRA-regulated firms face specific retention requirements. Healthcare organizations have HIPAA considerations. Most general outbound programs retain recordings for 12–36 months based on the applicable statute of limitations for TCPA claims.

Access controls. Recordings containing sensitive personal information should not be broadly accessible. Role-based access controls limit who can retrieve and play back recordings.

PCI DSS. If agents take payment card information over the phone, you may have an obligation to pause recording during the card capture segment. This is a specific technical requirement, not just a best practice — discuss with your payment processor and QSA.

Connecting Recording to Your Broader Compliance Program

Call recordings are evidence. They can exonerate an agent accused of misrepresentation and incriminate one who made unauthorized promises. They document whether your DNC and consent workflows functioned as designed. They are discoverable in litigation.

This means your audit trail design should treat recordings as first-class records: indexed by call ID, linked to the CDR, and stored in a location that cannot be overwritten. CDR exports from your outbound network tie call IDs to specific caller IDs, timestamps, and durations — the metadata that makes a recording retrievable and contextually meaningful.