Call Recording Laws by State: The 2026 Compliance Guide for Business Phone Systems

What Are the Call Recording Laws by State?

Call recording laws by state determine whether your business needs consent from one party or all parties before recording a phone call. Federal law under the Electronic Communications Privacy Act sets a one-party consent baseline, meaning the person pressing record can serve as the consenting party. However, 11 states require all-party consent, which means every person on the call must know the recording is happening before it starts. For any business recording customer calls across state lines, the stricter law applies.

One-party vs. all-party: 38 states and the District of Columbia follow one-party consent. 11 states require all-party consent: California, Delaware, Florida, Illinois, Maryland, Massachusetts, Montana, Nevada, New Hampshire, Pennsylvania, and Washington. A handful of additional states have mixed or unsettled rules.

Interstate calls: When a call crosses state lines, courts have generally applied the stricter state’s law. If your business is in a one-party state but you call a customer in California, California’s all-party consent rule applies to that call.

The safe default: Play a recorded disclosure at the start of every call stating the call may be recorded. The caller’s continued participation after hearing the disclosure is treated as implied consent in all 50 states. This is the simplest path to compliance for any business using call recording.

Federal Call Recording Law Explained

The Electronic Communications Privacy Act of 1986, which updated the original federal Wiretap Act of 1968, sets the floor for call recording consent in the United States. Under 18 U.S.C. 2511, recording a phone call is legal as long as at least one party to the conversation consents. That party can be the person doing the recording, which means a business owner or employee can record their own calls without telling the other person, as far as federal law is concerned.

That federal baseline is the starting point, not the finish line. States are free to impose stricter requirements, and 11 of them do. The federal one-party rule only protects you in states that have not passed their own all-party consent statute. This is where businesses get into trouble: they read the federal rule, assume it covers them everywhere, and start recording calls to customers in California or Florida without any disclosure. The federal law does not preempt stricter state law. If the state requires all-party consent, that is the standard your business must meet.

One pattern we see regularly with businesses setting up call recording for the first time is the assumption that their state’s law is the only one that matters. A business based in Texas, a one-party state, still needs to comply with Florida’s all-party consent law when calling a Florida customer. The location of the caller and the location of the recipient both matter, and the stricter rule wins.

What Is the Difference Between One-Party and All-Party Consent?

One-party consent means at least one person involved in the conversation must know the call is being recorded. That person is usually the one pressing record. In a one-party state, a business can record a customer call without telling the customer, because the employee on the call serves as the consenting party. 38 states and the District of Columbia follow one-party consent.

All-party consent, sometimes called two-party consent, means every person on the call must know and agree to the recording before it begins. In practice, this means the business must provide notice, typically through an automated announcement that plays before the call connects. 11 states require all-party consent by statute.

The terminology can be misleading. The phrase two-party consent implies there are only two people on the call. But if three people are on a conference call in California, all three must consent. All-party consent is the more accurate term, and it is the one the statutes themselves use.

For businesses using a cloud phone system with built-in call recording, like the recording features included in Phone Service Now’s Business Plus and Business Platinum plans, the compliance question is straightforward: configure the system to play a disclosure announcement on every recorded call. Most modern business phone systems support this as a standard setting, and it eliminates the need to track which state each caller is in.

Which States Require All-Party Consent?

As of 2026, 11 states clearly require all-party consent to record a phone call. Four additional states, Connecticut, Michigan, Oregon, and Vermont, have mixed or unsettled interpretations that make them risky to treat as one-party. The safest compliance approach treats all 15 as all-party consent states.

The table below lists the 12 states where all-party consent is established or strongly indicated by statute, along with the governing statute and potential penalties for noncompliant recording.

State	Consent Type	Statute	Potential Penalties
California	All-party	Cal. Penal Code 632	Up to $2,500 per violation plus criminal misdemeanor
Connecticut	All-party (disputed)	Conn. Gen. Stat. 52-570d	Civil damages, injunctive relief
Delaware	All-party	11 Del. C. 1335(a)(4)	Class D felony
Florida	All-party	Fla. Stat. 934.03	Up to 5 years imprisonment, civil damages
Illinois	All-party	720 ILCS 5/14-2	Class 4 felony
Maryland	All-party	Cts. & Jud. Proc. 10-402	Up to 5 years, $10,000 fine
Massachusetts	All-party	Mass. Gen. Laws ch. 272 99	Up to 5 years, $10,000 fine
Montana	All-party	Mont. Code 45-8-213	Up to $500 fine, 6 months
Nevada	All-party	Nev. Rev. Stat. 200.620	Category D felony
New Hampshire	All-party	N.H. RSA 570-A:2	Class B felony
Pennsylvania	All-party	18 Pa.C.S. 5703	Up to 7 years, third-degree felony
Washington	All-party	RCW 9.73.030	Up to 5 years, $10,000 fine

The remaining 38 states and the District of Columbia follow one-party consent. In those states, the person pressing record can serve as the consenting party, and no disclosure to the other caller is required under state law. However, the safe business practice is to disclose on every call regardless of the state, because you cannot always predict where the other party is located.

How Do Call Recording Laws Apply to Interstate Calls?

When a business in one state calls a customer in another state, the question of which state’s law controls becomes critical. Courts have not adopted a single universal rule, but the dominant trend, reinforced by the frequently cited California case Kearney v. Salomon Smith Barney (2006), is to apply the stricter state’s recording consent law.

In practical terms, this means a business based in Georgia, a one-party state, calling a customer in Pennsylvania, an all-party state, should comply with Pennsylvania’s all-party requirement. The reverse is also true: a Pennsylvania business calling a Georgia customer can rely on one-party consent for that specific call, but only if Pennsylvania’s own all-party requirement does not apply to the recording regardless of where the call terminates.

The safest approach, and the one we recommend to every business we work with, is to stop thinking about it on a per-call basis. If your business records calls and your customers are in more than one state, play the disclosure announcement on every call. This is not overcompliance. It is the only approach that scales without requiring your team to check a state map before every conversation.

How to Set Up Compliant Call Recording

Compliant call recording does not require a legal team reviewing every call. It requires the right system configuration and a clear internal policy. Here is what a compliant setup looks like for a small business using a cloud VoIP phone system.

1. Enable a pre-call disclosure announcement. Configure your phone system to play a recorded message before the call connects, such as “This call may be recorded for quality and training purposes.” The caller’s continued participation after hearing this message is treated as implied consent.
2. Apply the announcement to every recorded line. Do not selectively record some calls without disclosure. Inconsistency creates the exact exposure that a blanket announcement eliminates.
3. Set a retention policy. Decide how long recordings are stored and delete them on schedule. Keeping recordings indefinitely increases your data exposure without adding business value. Phone Service Now’s Business Plus plan stores recordings for 30 days, while the Business Platinum plan offers unlimited recording storage.
4. Restrict access to recordings. Not every employee should be able to listen to recorded calls. Limit access to managers, compliance staff, and the employees directly involved in the recorded conversation.
5. Document your recording policy in writing. Your internal policy should state which calls are recorded, how consent is obtained, how long recordings are kept, and who can access them. This document protects you if a recording is ever challenged.
6. Honor stop-recording requests. If a caller says they do not want to be recorded, stop the recording or end the call. Continuing to record after a caller withdraws consent creates liability even in one-party states.

The businesses that run into recording compliance problems are almost never doing it intentionally. The pattern we see is a business that turned on call recording for training purposes, never configured a disclosure announcement, and only learned about the consent requirement after a customer complained. The fix is simple and takes less than five minutes on most VoIP phone systems. The risk of skipping it is not.

HIPAA and Industry-Specific Recording Rules

State consent laws are the floor. Certain industries layer additional requirements on top of them that affect how recordings are stored, accessed, and transmitted.

Healthcare practices recording calls that involve protected health information must comply with HIPAA’s privacy and security rules. That means call recordings containing patient data must be encrypted at rest and in transit, stored in a system with access controls and audit logging, and retained or destroyed according to the practice’s retention policy. A phone system that records calls but stores them in an unencrypted, unaudited location does not meet the standard, regardless of whether the consent disclosure was played.

Phone Service Now is HIPAA compliant, which means the call recording infrastructure meets the encryption, access control, and audit trail requirements that healthcare practices need. For businesses in regulated industries, HIPAA compliance in your phone system is not optional. It is the difference between a recording that protects your practice and one that creates a liability. For a broader look at how FCC compliance requirements affect VoIP providers, our compliance guide covers the regulatory landscape.

Financial services firms recording calls may also need to comply with PCI DSS if payment card data is discussed on the call. The safest approach is to pause recording during any payment card transaction and resume after. Some phone systems support automatic pause-and-resume triggered by a key press or an IVR prompt.

Common Call Recording Compliance Mistakes

Recording compliance is not complicated, but the same mistakes come up repeatedly. These are the ones that create the most exposure for small businesses.

Assuming federal law is enough. The federal one-party rule does not override stricter state laws. A business recording calls without disclosure in Florida, California, or any all-party state is violating state law regardless of what federal law permits.

Relying on area codes to determine location. A phone number with a 212 area code can ring a phone in Los Angeles. Ported numbers and mobile phones make geographic assumptions unreliable. The only safe approach is to disclose on every call.

Recording without a system-level announcement. Relying on employees to verbally disclose that a call is being recorded creates inconsistency. An automated announcement configured at the system level ensures every call gets the same disclosure, every time.

Storing recordings without access controls. An unprotected folder of call recordings is a data liability. Restrict access, encrypt storage, and set a retention schedule.

Continuing to record after a caller objects. If a caller says they do not consent to recording, the recording must stop. Ignoring the objection creates liability in every jurisdiction.

Frequently Asked Questions

Next Steps

If you are evaluating phone systems with built-in call recording, our 2026 business phone system guide covers the features and compliance tools to look for. For businesses already using Phone Service Now, our team can verify that your recording disclosure is configured correctly and that your storage settings meet your retention policy.

If your current phone system does not support automated recording disclosures or HIPAA-compliant storage, we can get you set up in one business day with a system that handles both.