The Recording Rules Most Businesses Get Wrong

Most business owners assume call recording rules are simple — and that assumption is exactly what exposes them to statutory damages and, in some states, criminal charges. The law is a patchwork, and getting it wrong is expensive.

At the federal level, the ECPA Wiretap Act sets a one-party consent baseline: as long as one participant in the call consents to the recording, you're generally covered. That sounds business-friendly, but it's only the floor. According to state-by-state legal analysis, 38 states plus D.C. follow one-party consent — while roughly 11 to 13 states require all-party consent, meaning every participant must agree before you hit record.

The all-party states include California, Florida, Illinois, Maryland, Massachusetts, Pennsylvania, and Washington, among others — and sources differ slightly on the exact count, with practitioner guidance listing as many as 13 depending on interpretation. Michigan sits in a genuine gray area: its statute reads as all-party consent, but courts have recognized a participant exception.

Here's where most businesses get burned: cross-state calls. Under interstate conflict rules established in Kearney v. Salomon Smith Barney, if any party to the call is located in an all-party consent state, that state's stricter law applies — regardless of where your business is headquartered. As attorney Robert Tsigler explains in legal commentary on recording laws, even if you're in a one-party state, a caller in a two-party state means you must abide by their law.

The consequences are not theoretical. Violations in all-party consent states carry:

• Statutory damages amounting to thousands of dollars per violation, fueling class action lawsuits against calling platforms
• Criminal penalties in several all-party states that treat non-consensual recording as an offense
• Separate exposure under federal law (18 U.S.C. § 2511) if recording occurs without being a participant — classic eavesdropping or wiretapping

For a service like CallMyCustomers, which runs customer reactivation campaigns for US businesses across state lines, the practical answer is simple: default to all-party consent standards on every call. A clear opening disclosure before any substantive interaction — plus timestamped logs documenting that the disclosure played and the customer continued the call — creates the evidentiary record that makes the difference when a dispute arises. It's why every script and message gets signed off before it ever goes out, with consent handled up front rather than assumed.

Three Types of Calls You Legally Cannot Record

Most business owners assume recording a call is a simple internal decision — until a single recording in the wrong state triggers statutory damages that reach thousands of dollars per violation. The short answer is that three categories of calls are legally off-limits, and each one catches otherwise careful businesses by surprise.

First, you cannot record calls in all-party consent states without every participant's permission. While 38 states plus D.C. follow the more permissive one-party standard, roughly 11 states require all-party consent — including California, Florida, Illinois, Maryland, Massachusetts, and Washington. In those jurisdictions, recording without consent from everyone on the line can carry criminal penalties and civil liability.

Second, you cannot record a conversation you are not part of at all. Under the federal Wiretap Act (18 U.S.C. § 2511), eavesdropping on calls where the recorder isn't a participant is prohibited outright, regardless of which state the parties are in. This matters for any platform that captures audio — the recording system must be an active party to the call, not a silent third party listening in.

Third, interstate calls inherit the strictest applicable law. The landmark California case Kearney v. Salomon Smith Barney established that when any party to a call sits in an all-party consent state, that state's law protects its resident — no matter where your business is headquartered. As attorney Robert Tsigler puts it, even if you are in a one-party state, conversing with someone in a two-party state means you must abide by the stricter state's law.

The practical takeaway for national operations:

• Treat every call as if all-party consent applies, since you rarely know a customer's state in advance.
• Deliver a consent disclosure at the very start of the call — before any substantive conversation.
• Never capture audio on calls where your system is not a participant.
• Keep timestamped logs proving the disclosure played and the call continued.

One wrinkle worth knowing: Michigan is a genuine gray area. Its statute reads as all-party consent, but courts have recognized a participant exception, leaving businesses to make a judgment call. The conservative move is to assume all-party rules apply there too.

This is why permission-first outreach matters. CallMyCustomers builds its reactivation campaigns on approved messaging and explicit consent rather than silent capture — the same conservative posture attorneys recommend for any business calling customers across state lines.

How to Make Every Recorded Call Compliant

The good news is that the legal complexity of call recording has a straightforward answer: stop trying to figure out which law applies to which call, and hold every call to the strictest standard on the books.

The core problem with a state-by-state approach is geography. Under the interstate conflict rules established in Kearney v. Salomon Smith Barney, if any party to a call sits in an all-party consent state, that state's law protects them—regardless of where your business is headquartered. Since roughly 11 states require all-party consent, including California, Florida, Illinois, and Washington, a national operation that guesses wrong on a single cross-state call is exposed.

The practical solution, per AI voice platform compliance guidance, is to treat every call as if all-party consent applies. This eliminates the guesswork entirely and closes off the litigation risk that comes with statutory damages reaching thousands of dollars per violation.

Timing matters more than most businesses realize. A human agent could theoretically chat for a minute before mentioning recording; an AI voice platform cannot, because its core function depends on processing audio from the first second of the call. That puts the disclosure obligation at the very start of every conversation.

A well-drafted opening disclosure—one sentence covering recording consent, AI disclosure, and processing—satisfies multiple legal obligations simultaneously. And critically, this should be built into the default configuration, not left as a setting clients must enable. Most won't.

Consent that isn't documented is consent you can't prove. Experts recommend maintaining:

• Timestamped logs verifying the disclosure actually played on each call
• Records of call continuation after disclosure, which courts treat as implied consent
• Explicit written or recorded consent for clients who regularly do interstate business, as attorney Emma Alves recommends

This documentation becomes the evidentiary record needed when a dispute arises in an all-party state—several of which treat non-consensual recording as a criminal offense.

Recording consent is not the end of the compliance story. Stored voice data triggers a distinct set of obligations under biometric privacy statutes—Illinois BIPA and similar laws in Texas and Washington—whenever recordings create or could create voiceprints. Treat voice data handling as its own compliance layer, separate from call-recording consent.

This is why CallMyCustomers builds compliance into the campaign itself: every script and disclosure is approved before anything goes out, opt-outs are honored immediately, and consent is captured at the booking stage—not bolted on afterward. Compliance works best when it's designed in, not retrofitted after a campaign is already running.

Ready to reactivate your past customers the right way? Get a free list review and see what your customer list can produce before you spend a dollar.

How CallMyCustomers Handles Consent on Your Outreach

CallMyCustomers ensures every outreach call meets strict consent requirements by embedding disclosures directly into the call flow. Because AI voice platforms must process audio from the first second to function, consent cannot be added later in the conversation—it has to happen before any substantive interaction begins. This is especially critical given that approximately 11 states require all-party consent for call recording, and interstate calls trigger the stricter law of any participant’s state.

By default, every call initiated through the service includes a clear opening statement: “This call is being handled by an AI assistant and may be recorded and processed to provide you service.” This single disclosure satisfies call-recording consent in all-party consent states, aligns with FTC AI disclosure expectations, and meets state-specific AI voice laws. Unlike optional settings that clients might overlook, this is built into the platform’s core configuration—eliminating reliance on user action and reducing compliance risk for the business owner.

The service further strengthens compliance by operating exclusively from verified customer lists you provide. Every script, offer, and message is reviewed and approved by you before any outreach begins. Opt-outs are honored immediately, and responses route directly into your existing booking process. Since calls are made only to people with whom you already have a relationship—and never to third parties or non-participants—the platform avoids illegal eavesdropping or wiretapping under federal law.

This approach removes the burden of navigating complex, state-by-state recording laws from your team. Instead of managing consent as an afterthought or worrying about cross-state legal conflicts, you gain a done-for-you reactivation engine where permission, transparency, and legal adherence are designed in from the first ring.

Your next booked customer already knows your business—and with CallMyCustomers, reconnecting with them doesn’t come with hidden legal exposure. You approve the message, we handle the rest, and every call starts on the right side of the law.