Recording customer calls: when you need consent, and what to say.

The short answer

Three questions sit behind "can we record our calls": whose law applies, what that law asks, and what your phone tools are already doing. The answer to the first is often more than one law, because the caller may be in another state or another country.

In the US, federal law allows a recording when one person on the call agrees, and that person can be you. A number of states go further and require every party to agree. In the UK and the EU, recording for business purposes is allowed, but data protection law applies to every recording, and in some countries recording a conversation without permission is a crime.

For a small business the workable answer is the same everywhere. Tell people at the start of the call, give them a way to talk without being recorded if they object, keep recordings only as long as you need them, and know which of your tools record.

The US: one-party and all-party states

The federal Wiretap Act says it is not unlawful for someone who is a party to a call, or who has the prior consent of one of the parties, to record it, unless the recording is made to commit a crime or a civil wrong. That is the one-party rule, and many states follow it.

Other states require the consent of everyone on the call. From the statutes themselves:

• California makes it a crime to record a confidential communication without the consent of all parties. A separate section requires everyone's consent to record calls involving a mobile or cordless phone, whether or not the call is confidential.
• Florida allows interception only when all of the parties have given prior consent, apart from the exceptions its law lists.
• Maryland's law uses the same all-parties wording.
• Washington requires the consent of all participants, and counts consent as given when one party announces, in any reasonably effective manner, that the call is about to be recorded. If the call is recorded, the announcement must be recorded too.

Other states also require all parties to agree, and the details differ, for example on what counts as a confidential call or how consent can be given. Check the law in the states where most of your customers are, as well as the one you are in.

Calls that cross state lines

A phone number says little about where someone is. A customer with a Florida mobile number may ring you from Ohio, and your own staff may answer from home in a third state. When a call crosses state lines, you cannot count on the more relaxed state's rule being the one that applies.

So treat every recorded call as if the strictest rule applied, and announce the recording at the start. California's wording shows why that works. Its rule for confidential calls covers conversations where people do not expect to be recorded, and a clear notice at the start changes that expectation. For calls with mobile phones it asks for the consent of all parties, and an announcement with a real way to say no is how a business asks for it.

The habit costs one sentence per call. Arguing afterwards about which state's law applied costs far more.

The line to put in your greeting

Put the notice before anyone says anything that matters, and keep it short enough that nobody tunes out. For calls coming in, the phone system plays it before the call rings through:

• "Thanks for calling Harbour Plumbing. Calls are recorded so we can check job details and train our team. If you would rather not be recorded, tell us when we answer."
• "You are through to Northfield Lettings. We record calls to this line so that repair reports are logged accurately. If you prefer not to be recorded, say so to the person who answers."

For calls you make, the person calling says it in the first sentence and waits for the answer: "Before we start, I'd like to record this call so I have the details right. Is that all right with you?" If the answer is no, stop the recording, or arrange another way to talk.

For video calls, put it in the invitation and say it again when the meeting starts: "I'd like to record this so I can send you the notes afterwards. Is that OK?" A recording light on the screen is not the same as asking.

Then check every route into your phones: the main number, direct lines, the after-hours line, calls passed to an answering service, transferred calls and the mobiles staff use for work. A notice on the main number does nothing for a call that never passes through it. The rest of the greeting, and how staff should answer, is in how to answer the business phone.

Tools that record without anyone deciding to

Many businesses record calls without having chosen to, because a tool does it for them. Open the settings of each of these and write down whether it records, transcribes or summarises calls, where it keeps them and for how long:

• Your phone system. Internet phone systems can record at the level of the account, the number or the user, so check all three.
• Call tracking numbers, used to see which ads bring calls. Recording and transcription can be settings on each number, so check every number, including old campaigns. Call tracking for a small business explains how the numbers work.
• Voicemail transcription, which turns each message into text in an inbox.
• An AI receptionist or an answering service, which works from a recording or a transcript of each call. Our guide to AI receptionists and answering services covers what to ask them.
• AI note-takers in video meetings. Check whether yours joins meetings on its own once it is connected to a calendar, and switch that off for client calls unless the client has agreed.
• Call recording apps on staff mobiles.

Then decide what you actually need. Recording every call because the tool allowed it is the setup most likely to cause trouble: more recordings to protect, more personal data to answer for, and more calls where someone never heard the notice.

The UK: a business purpose and reasonable notice

UK regulations allow a business to record calls on its own phone system for set purposes, including establishing facts, checking compliance with regulatory rules, checking the standards staff achieve and preventing or detecting crime. One condition is that the business has made all reasonable efforts to inform every person who may use the system that calls may be intercepted.

Data protection law applies on top. A recording of a customer's voice, with their name and what they asked for, is personal data under the UK GDPR. You need a lawful reason for each kind of recording, a mention in your privacy notice, a set period after which recordings are deleted, and a way to find a caller's recordings if they ask for a copy. Financial firms can also have recording duties set by their regulator, which a mortgage broker or an insurance agency should check with its compliance adviser.

The EU: data protection, and sometimes criminal law

In the EU, the GDPR treats recordings the same way: a lawful basis, information for callers, limited retention and the caller's right to a copy. The ePrivacy Directive protects the confidentiality of calls, but leaves room for legally authorised recording in the course of lawful business practice, to provide evidence of a commercial transaction or another business communication. How that room is used is up to each country.

Some countries treat recording without permission as a crime. Germany's criminal code punishes anyone who, without authorisation, records the non-public spoken word of another person, or uses such a recording or makes it available to someone else. A business in Germany, or one that calls people there, should ask an adviser before it records any calls.

If you speak to customers in several European countries, plan for the strictest of them, and always give people a way to say no.

Keep recordings safe, and not for ever

• Set a retention period for each reason you record: short for training, longer only where a recording is evidence of an agreed job or a regulatory duty. Then make the system delete them on schedule.
• Limit who can listen. Recordings belong in the phone system or a secure store, not in email attachments or a shared drive.
• Never record card details. If you take payments by phone, pause the recording or send a payment link instead.
• Take care with health and legal matters. A dental clinic's recorded call can hold health information, which has extra rules such as HIPAA in the US, and a law firm's calls are confidential by profession.
• Know how to find one caller's recordings, because people can ask for a copy under the GDPR and under some US state privacy laws.
• Write the rules down in a few lines, so the next person who sets up a phone line follows them.

Your own staff are on the call too

Recording customer calls means recording your staff. Tell them in writing, before recording starts, what is recorded, why, who can listen and how long recordings are kept. In the UK and the EU that is part of data protection, and in the US some states have their own rules on monitoring employees.

Use recordings only for what you told staff and callers. A call kept to check job details should not turn up later in a disciplinary meeting or a marketing video unless that use was explained first.

Before you switch recording on

Copy this list and tick each line before the first recorded call:

• Write down why you record: evidence of what was agreed, coaching staff, handling complaints or a rule from your regulator.
• List every number, line and tool that will record.
• Add the notice to each route in, and to the script for calls you make.
• Decide how a caller can say no, and what staff do when someone does.
• Set a deletion period for each reason, and switch on automatic deletion where the system has it.
• Name who can listen, and remove everyone else's access.
• Add a short paragraph to your privacy notice: what you record, why, how long you keep it and how to ask for a copy.
• Tell staff in writing.
• Make a test call to each number and listen to the recording, notice included.

Run the last check again whenever a number is added, a provider changes or someone edits the greeting.

Four businesses, four setups

• A two-van plumbing firm uses call tracking numbers on its ads. Its home state allows one-party consent, but callers' mobiles can be from anywhere, so each tracking number plays the notice before it rings through, and recordings are kept only while a job is being quoted.
• A mortgage broker records calls to keep an exact note of what each client asked for. The notice plays on every line, recordings are kept for the period its compliance rules require, and only the broker and the compliance lead can listen.
• A property management company records its repairs line, so a reported leak and the time it was reported are on record. It deletes recordings once the job is closed and any dispute about it is settled.
• A law firm records no intake calls at all. A first call is covered by careful notes from the person who answers, which hold less sensitive detail than a recording would.

Mistakes to avoid

• A notice on the main number only, while direct lines and the after-hours number record without one.
• Recording outbound calls with no notice, because the inbound greeting says calls are recorded.
• An AI note-taker that joins client meetings by itself.
• Keeping every recording for ever because nobody set a deletion rule.
• Recording card numbers read out over the phone.
• Assuming your own state's rule is the only one that matters.
• Using a recording for something you never told callers or staff about.

This is general information, not legal advice. Recording rules differ by state and by country, and they change. Before you record calls, ask an adviser which rules apply where you and your callers are.