Call Recording Laws by State: What Your Business Needs to Know

This article is for general informational purposes only and does not constitute legal advice. Recording laws change frequently and vary by jurisdiction. We make no guarantees about the accuracy or completeness of this information. Always consult with your business attorney before implementing any call recording practices.

If your business records phone calls, you are subject to a patchwork of federal and state laws that determine when recording is legal and what happens when you get it wrong. The penalties range from civil lawsuits to criminal charges, depending on the state. This is not an area where "we didn't know" works as a defense.

The challenge for VoIP deployments is that recording is often a platform feature that can be enabled with a checkbox. The technology makes it trivially easy. The legal landscape makes it anything but.

Federal law: the baseline

The federal Wiretap Act (18 U.S.C. § 2511) establishes the floor. Under federal law, recording a phone call requires the consent of at least one party to the conversation. If you are a participant in the call and you consent to the recording, that is generally sufficient under federal law. You do not need to tell the other person.

This is called one-party consent. It means that as long as one person on the call knows it is being recorded, the recording is generally legal at the federal level — with one carve-out worth knowing: under 18 U.S.C. § 2511(2)(d), one-party consent does not protect an interception made for the purpose of committing a criminal or tortious act.

But federal law is just the minimum. States are free to impose stricter requirements, and several do.

One-party consent states

The majority of states follow the federal one-party consent standard. In these states, you can legally record a call you are a party to without informing the other person. This covers most business use cases where an employee records their own calls.

One-party consent does not mean you can record calls you are not a party to. Intercepting and recording a conversation between two other people without any of their knowledge is illegal everywhere. The "one party" who consents must be a participant in the call.

For business purposes in one-party states, the main practical question is whether your employees count as the consenting party when the company's system automatically records their calls. Generally, yes, if the employee knows and agrees that calls are being recorded. The employee's consent satisfies the one-party requirement.

Two-party consent states

These states require that all parties to the call consent to the recording before it begins. "Two-party" is the common shorthand, but the actual requirement in most of these states is all-party consent. If there are five people on a conference call, all five need to know.

Two caveats before the list. First, it is dated: this reflects the statutes as of this article's last update (August 2026), and recording law changes — treat any undated state list, including a stale copy of this one, with suspicion. Second, the one-party/all-party binary is a simplification. Statutes differ on which media they cover, whether the conversation must be confidential or private, whether violations are criminal or civil, and what exceptions apply — and some states (Oregon, which applies different rules to in-person versus telephone conversations, and Nevada, where court interpretation of the phone-recording statute diverges from its one-party text, among others) do not fit cleanly in either column.

California. California Penal Code § 632 requires consent from all parties for recording confidential communications. The key word is "confidential" — conversations where a party has an objectively reasonable expectation that the conversation is not being overheard or recorded. Business calls generally qualify as confidential.

Connecticut. The classic example of a state that resists the binary. Its criminal eavesdropping law is narrower, but C.G.S. § 52-570d creates civil liability for recording telephone conversations without the consent of all parties — subject to statutory exceptions, including verbal or written notification and an automatic tone warning. Connecticut is sometimes overlooked on these lists, but the civil exposure is real and has been consistently enforced.

Florida. Florida Statute § 934.03 requires all-party consent. Florida courts have been active in enforcing this, and the statute provides for civil damages and criminal penalties.

Illinois. The Illinois Eavesdropping Act (720 ILCS 5/14) has a complicated history. The original all-party consent law was struck down as unconstitutional in 2014, and the legislature passed a revised version that reinstated all-party consent with narrower scope. The current law prohibits recording private conversations without consent of all parties.

Maryland. Maryland Courts and Judicial Proceedings § 10-402 requires all-party consent. Maryland courts have interpreted this broadly.

Massachusetts. M.G.L. c. 272, § 99 is one of the strictest recording laws in the country. It requires all-party consent and has been interpreted to apply even when the recording party is a participant in the conversation. The statute's language around "secret" recording has been the basis for numerous prosecutions.

Montana. Montana Code § 45-8-213 prohibits recording without consent of all parties. Montana's statute is less frequently litigated than California's or Massachusetts', but the requirement is clear.

New Hampshire. RSA 570-A:2 requires all-party consent for recording telephone communications. New Hampshire's statute applies specifically to telecommunications and has limited exceptions.

Pennsylvania. 18 Pa.C.S. § 5703 requires all-party consent. Pennsylvania is notable because its statute has been enforced aggressively, including in cases where one party recorded a call they were participating in without telling the other party.

Washington. RCW 9.73.030 requires all-party consent. Washington's law extends to in-person conversations as well and has been broadly interpreted by state courts.

The interstate problem

This is where it gets complicated for VoIP specifically. Phone calls cross state lines routinely. If you are in Texas (one-party consent) and you call someone in California (all-party consent), which law applies?

There is no clear federal rule that resolves this conflict. Courts have gone different directions depending on the jurisdiction, the specific facts, and which state's law the plaintiff chose to invoke. Some courts apply the law of the state where the recording was made. Others apply the law of the state where the recorded party was located. Some have applied the stricter standard.

For businesses, the practical answer is straightforward even if the legal answer is not: follow the stricter standard. If there is any chance the other party is in a two-party consent state, treat it as a two-party consent call. The cost of adding a recording disclosure is near zero. The cost of getting it wrong can be substantial.

This is especially relevant for businesses with customers or clients in multiple states. If you are a call center, an MSP handling support calls, or any business that regularly calls across state lines, the safest approach is to treat every call as if two-party consent applies.

What this means for VoIP platforms

Modern VoIP and UCaaS platforms make call recording a feature, not a project. That is both a convenience and a risk. The same checkbox that enables recording for legitimate quality assurance also creates a potential legal liability if consent requirements are not met.

Automatic vs on-demand recording

Platforms typically offer two modes. Automatic recording captures every call without any per-call action. On-demand recording lets a user press a button to start recording mid-call.

Automatic recording is the most legally exposed mode. Every call is recorded whether or not the appropriate consent was obtained. If your platform records every call and you do not have a disclosure playing at the start of each one, you are creating a recording of every call that arguably violates two-party consent laws when the other party is in an all-party state.

On-demand recording gives you more control but creates its own problems. The user needs to know when they need consent, and they need to actually get it before pressing the button. Training and compliance procedures become critical.

Recording announcements

The standard mitigation is a pre-call announcement: "This call may be recorded for quality assurance purposes." Played at the start of every call, this disclosure puts the other party on notice. Courts in many jurisdictions have treated continuing the call after a clear announcement as implied consent — but that is a risk control with a strong track record, not a universal rule. Whether implied consent is legally sufficient depends on the jurisdiction and the facts, and some states specify the form consent must take.

The details matter. The announcement should be clear and audible. It should play before any substantive conversation begins. It should be present on every call, not just calls your agent initiates (inbound calls need it too). Some organizations use a beep tone at regular intervals during recording, though this is not a legal requirement in most states.

Encryption and storage

Recording consent is not the only legal consideration. How you store and secure recordings matters too. Recorded calls often contain sensitive information — account numbers, health information, financial details. Encrypting the media stream protects the call in transit, but you also need to think about encryption at rest for stored recordings, access controls, and retention policies.

The regulatory landscape for VoIP extends well beyond recording consent. If your business handles calls subject to HIPAA, PCI-DSS, or other compliance frameworks, the recording storage requirements layer on top of the consent requirements.

Best practices

Default to disclosure. Play a recording announcement on every recorded call. This is the simplest way to reduce consent risk across jurisdictions, even though it is not a guarantee of sufficiency in every one.

Document your policy. Have a written call recording policy that specifies which calls are recorded, why, how recordings are stored, who has access, and how long they are retained. Train your employees on it.

Know where your callers are. If you have a STIR/SHAKEN implementation or caller ID data, you may be able to identify the geographic origin of calls. But do not rely on this for legal compliance. Area codes do not reliably indicate a caller's physical location.

Configure your platform correctly. Work with your VoIP provider to ensure recording announcements play at the right time, that recordings are properly secured, and that on-demand recording workflows include consent prompts.

Audit regularly. Recording features can be enabled accidentally, policies can drift, and new employees may not receive proper training. Regular audits of your recording configuration and compliance procedures catch problems before they become legal exposure.

When in doubt, ask your attorney. This area of law is genuinely complicated, it varies by state, and it changes. A business attorney familiar with telecommunications law in your operating states is the right resource for specific guidance. This article gives you the framework to ask informed questions. It does not replace legal counsel.