Recording Calls With AI in the US: Consent, Notice, and Retention

Yes, recording calls with AI is legal in most US states: you can let the AI qualify the caller, dump the context into your CRM, and spare your team from starting cold every time. But it's not a free-for-all. The rules ask for three concrete things — give notice that you're recording, get the consent your state requires, and don't keep the audio forever — and the good news is that none of the three turns your customer service into an endless chore. They come down to one sentence at the start of the call, a consent approach you decide once, and a sensible deletion window. Let's walk through them without the scaremongering or the hidden fine print.

Is it legal to record calls with AI? Yes—with notice and consent

Recording calls isn't illegal in itself, anywhere in the US. What's off-limits is recording in secret — without telling anyone and without a legitimate reason. The line between doing it right and landing in trouble isn't the technology, it's the method: if the person knows from the first second that the call is being recorded and why, and you're following your state's consent rule, you're on solid ground.

Here's the one wrinkle worth knowing up front: consent for call recording is set at the state level. Federal law and most states are one-party consent — only one party to the call (that's you) has to agree. But about a dozen all-party (two-party) consent states — California, Florida, Illinois, Pennsylvania, Washington, and others — require everyone on the call to consent. Because a call can easily cross state lines, the safe habit is simple: announce the recording at the start, and treat the caller continuing as their consent. Do that and you're covered in both kinds of state.

When an AI is the one answering, add one more layer of transparency: tell the caller they're talking to an AI system. There's no blanket federal law forcing that yet, but the FTC scrutinizes deceptive AI practices and a growing set of state bot-disclosure laws point the same way — and it's simply good practice. (If you take calls from EU residents, the EU's AI Act makes that disclosure mandatory: Reg. (EU) 2024/1689, art. 50.1.) Offering a way to reach a person isn't legally required for a booking bot — under GDPR and comparable frameworks, the right to a human only applies to solely automated decisions with legal or similarly significant effects, and a reservations bot doesn't make those — but it's a trust best practice we recommend by default. We go deeper in whether an AI chatbot or voice agent is legal for customer service.

Consent: one-party vs two-party states, and the opening notice

This is where a lot of people get stuck, so let's cut to it. For call recording, what matters isn't a signed contract — it's consent, and how much of it you need depends on where you and your caller are.

In a one-party consent state — federal law and the majority of states — only one party to the conversation has to consent, and that party can be you. You can record your own business calls without asking, though telling people anyway is good manners and good defense.

In an all-party (two-party) consent state — California, Florida, Illinois, Maryland, Massachusetts, Pennsylvania, Washington, and a handful more — every person on the call has to consent before you record. In practice that consent is given by a clear announcement at the start plus the caller choosing to continue: "this call is being recorded" at the top of the call, and staying on the line, is the standard way businesses handle it.

Because you often can't know which state your caller is dialing from, the safe rule is to default to all-party consent: announce the recording on every call. It costs you one sentence, and it covers you everywhere.

Whichever approach you land on, one piece is non-negotiable: the notice at the start of the call. Don't bury it in a privacy policy nobody reads — the notice has to happen on the call itself, in the first few seconds, before the caller shares anything sensitive. A clear sentence, up front, every time.

The nice part of this approach is that transparency doesn't scare customers off — it relaxes them. Knowing they can jump to a person whenever they want makes them trust the AI instead of fighting it. And if you're worried the notice sounds cold or costs you conversions, we've collected lines that actually work in how to disclose AI use without losing customers.

How long can you keep a call recording? Minimization and retention windows

The second place people slip up isn't recording — it's not letting go. There's no magic federal number of days for call recordings. But the principle is firm everywhere data-privacy law reaches: keep it only as long as it serves the purpose you collected it for. When that purpose is done — quality, lead management, a record of a quote — the data is surplus, and surplus should be deleted, locked, or anonymized. You set and document the window based on the purpose and any statute of limitations that applies. Some state privacy laws make this explicit: California's CCPA/CPRA, for instance, expects you to disclose your retention periods and practice data minimization.

In practice that means short, deliberate windows. A recording kept "for quality" rarely needs to live for years — weeks or a few months usually do. A transcript that already dumped the useful context into your CRM can be deleted long before the lead itself. The trick is to decide the window in advance and make sure the deletion happens on its own, without depending on someone remembering.

Transcription, sentiment analysis, and where your data lives

A modern recording doesn't stop at audio: it's transcribed, analyzed, and turned into something useful for your business. That transcript is what lets the AI qualify the lead, move the card on the board based on how the call went, and let your team read in ten seconds what took five minutes of conversation. Sentiment analysis goes a step further: it flags whether the call ended lukewarm, happy, or tense, so you prioritize whoever deserves it.

All of this is still personal data, so the whole lifecycle matters from end to end — not just where it's recorded, but where it's transcribed, where it's analyzed, and where what's left gets stored. Here's a myth worth clearing up: no US law requires your data to sit in any particular country, and — contrary to what people assume — GDPR doesn't require your data to stay in the EU either. Its Chapter V (arts. 44-49) explicitly allows transfers outside the EEA as long as valid safeguards are in place, like an adequacy decision (art. 45) or standard contractual clauses (art. 46). So EU data residency isn't a legal requirement — it's a product choice. Totem makes that choice because a strict, first-world data baseline travels with you and saves you from having to stand up and document those transfer mechanisms yourself. We explain it in detail in where your chatbot data is stored.

1. 1

   Notice at the start

   The first sentence covers the recording, that it's an AI, and the option to speak with a person.

2. 2

   Recording and transcription

   The audio becomes useful text that drops the context into your CRM, with no manual note-taking.

3. 3

   Sentiment analysis

   The AI tags the call's tone and moves the lead on the board based on the outcome — no Zapier.

4. 4

   Limited retention

   Data is kept only while it serves its purpose, then deleted on a window you set in advance.

5. 5

   Data hosted in the EU

   Recording, transcription, and analysis are processed and stored to a strict EU baseline.

Recording calls with AI, done right vs done wrong: one table

You don't need to be a lawyer to tell the clean version from the sloppy one. The difference comes down to three columns.

By default, you're the one on the hook for how calls get recorded: you decide the purposes and the means, you pick the vendor, and you answer for your own duties — a valid consent approach, the notice, retention, choosing a solid vendor, and signing a data processing agreement with them. But watch out for the shortcut "the small business always pays the fine" — it's not accurate. Your software vendor, handling data on your behalf, has its own obligations and can face its own liability for its own failures — a security lapse, say, or going beyond your instructions. Toward the affected customer, both of you can be on the hook; each answers for its own role. We cover it in your AI vendor isn't the data controller — you are, and the fine lands on you. That's exactly why picking a platform that ships compliance in the box helps with your part of the job.

How Totem handles the notice, transcription, and EU hosting

In practice, with TotemAI these three rules aren't a chore you redo every morning — they're built into the design. The AI picks up the call in about a second, gives the recording and AI notice at the start, and always leaves the door open to a person — it hands the call to someone on your team with the full context. The conversation is transcribed, analyzed for sentiment, and turned into a lead the AI itself moves across the board based on how it went. And the data is hosted in the EU, to a strict data-protection baseline.

If you want to see piece by piece how it all fits together — notice, consent, data residency, and handoff — we break it down in built-in compliance: how Totem handles AI disclosure and EU hosting. And one note that puts a lot of people at ease: you pay a flat monthly plan with minutes and messages included, so you know what you're paying each month.

Recording calls the right way isn't about endless paperwork — it's about having a method: you give notice once, you decide a window once, and you let the tool do the rest, hosted in the EU to a strict standard. That's how recording stops being scary and turns into what it should be — context your team actually uses — without compliance stealing your hours.

Official sources

• Federal Wiretap Act (18 U.S.C. § 2511) — one-party consent baseline — Cornell LII
• State all-party (two-party) consent laws — vary by state (e.g., CA, FL, IL, MD, MA, PA, WA)
• TCPA (47 U.S.C. § 227) — call and text consent — Cornell LII
• CCPA / CPRA — California data rights, minimization and retention — California OAG
• FTC — guidance on AI and deceptive or unfair practices — FTC
• EU baseline, if you take calls from or handle data of EU residents: GDPR (Reg. (EU) 2016/679), arts. 5, 6, 13, 44-49, 82, 83 — EUR-Lex
• EU baseline: AI Act (Reg. (EU) 2024/1689), art. 50 (transparency) — EUR-Lex

Ready to see it in your own business? Book a free demo or check the plans to set up your account: live in 48-72 hours, with no lock-in.