US Call Recording Laws: Complete One-Party & Two-Party Consent State List

A US map with states color-coded by recording consent requirement, teal for one-party consent states, amber for all-party consent states, alongside a compliance officer reviewing policy documents on a desk.

Consider the following scenario: a compliance officer at a regional bank discovers that an agent, based in Georgia, has been recording calls with California customers without disclosing the recording. The resulting class action costs the bank $19.5 million and requires a full audit of recording practices across 12 states. In 2024 and 2025, California’s Consumer Invasion of Privacy Act generated over $69.5 million in combined settlements against financial institutions that recorded calls without proper consent. For B2B organizations with customers or employees across multiple states, understanding recording consent law is an operational necessity.

Why US Call Recording Law Is a Compliance Priority

US call recording violations have generated tens of millions in class-action settlements, most stemming from enterprises that applied one-party consent rules where all-party consent was legally required. In 2025, Wells Fargo settled for $19.5 million after recording California customers without proper disclosure, according to the stipulated final judgment in Aguilar Auto Repair v. Wells Fargo Bank, Case No. 3:23-cv-06265 (N.D. Cal. 2025). The previous year, Fifth Third Bank agreed to a $50 million settlement in a similar CIPA claim, according to the court order granting final approval in Sat Narayan v. Fifth Third Bank, Case No. 1:16-cv-11223 (N.D. Ill. 2022).

California’s Consumer Invasion of Privacy Act generated over $69.5 million in class-action settlements in 2024 and 2025 alone. These figures represent only the settlements that became public. Many more cases resolve quietly through private arbitration or confidential agreements.

For compliance teams at mid-market and enterprise B2B organizations, the operational stakes extend beyond litigation costs. Regulated industries face examination scrutiny. The Consumer Financial Protection Bureau has cited recording consent violations in consent orders. Healthcare organizations risk HIPAA investigations when recording practices intersect with patient communications. Sales and support teams with multi-state footprints face the highest exposure because interstate calls create jurisdictional ambiguity.

The core challenge is the federal-state split. The US has no single recording consent standard. Instead, a federal floor plus 50 state overlays create a compliance matrix that varies by participant location, communication type, and sometimes by the content of the conversation itself.

How US Recording Consent Law Is Structured

A three-column comparison diagram showing the structure of US call recording consent: Federal Wiretap Act (one-party baseline) on the left, State Overlays in the center, and the resulting Consent Frameworks (one-party, all-party, mixed-rule) on the right.

The federal Wiretap Act, codified at 18 U.S.C. § 2511, establishes one-party consent as the national baseline. Under this statute, a person who is a party to a communication may record it, or may consent to a third party recording it, without informing other participants. The statutory language states that it "shall not be unlawful… for a person not acting under color of law to intercept a wire, oral, or electronic communication where such person is a party to the communication or where one of the parties to the communication has given prior consent" (Cornell Law School Legal Information Institute, 2024).

States may enact stricter standards. When they do, the state law governs any communication where a party to the call is physically present in that state. This federal-state interaction creates three consent frameworks.

One-party consent means any participant may record without informing others. The recorder must be a party to the conversation, or must have consent from a party. Thirty-eight states plus the District of Columbia follow this standard, making one party consent states the majority approach in US law.

All-party consent requires every participant to consent before recording begins. Eleven states enforce this stricter standard. The phrase "two-party consent" is a colloquial misnomer because the statute governs all parties, not just two. A three-person conference call in California requires three-party consent.

Mixed-rule states operate under nuanced frameworks that depend on communication medium, context, or the parties’ expectations. Connecticut, Oregon, Hawaii, and Michigan have statutes or court interpretations that apply different consent requirements depending on whether the communication is in-person, telephonic, or electronic, or on whether the recorder is a participant.

The accurate count matters for compliance teams. Some online resources incorrectly state that 12 to 15 states require all-party consent. The accurate number is 11 strict all-party states, plus four mixed-rule states that warrant case-by-case analysis. This post corrects the common miscount and explains the operational implications.

One-Party Consent States: The Complete 38-State Reference

Thirty-eight states and the District of Columbia follow the federal one-party consent standard, according to the Justia 50-State Survey on Recording Phone Calls and Conversations (2024). A participant in any of these jurisdictions may record a conversation without informing other parties.

The following table lists all one-party consent states with their governing statutes.

For enterprise compliance teams, the practical implication is straightforward. Calls where all participants are in one-party consent states require no disclosure or consent beyond the recorder’s own participation. The recorder must be a party to the call. Third-party recording requires explicit consent from at least one participant.

High-traffic states for B2B operations apply one-party consent. New York, Texas, Georgia, Ohio, and Colorado all follow the federal standard. A sales team in Atlanta may record customer calls with Georgia-based contacts without disclosure. The same team recording a call with a California contact faces a different standard.

For individual contributors recording on personal devices, one-party consent has direct practical implications. In these states, native or third-party call recording apps on iPhone and Android are legally usable without notifying the other party — as long as every participant on the call is also in a one-party consent state. The moment any participant is in an all-party state, the stricter standard applies regardless of the recorder’s location.

All-Party Consent States: The 11-State Reference

Eleven states require all parties to consent before a conversation is recorded. The statutes vary in how consent must be obtained, but the principle is consistent. If one participant refuses or is unaware, recording is illegal.

California, Delaware, Florida, Illinois, Maryland, Massachusetts, Montana, Nevada, New Hampshire, Pennsylvania, and Washington enforce all-party consent. The governing statute for each state is cited directly in the table below.

Montana requires notification rather than consent. All parties must be informed that recording is occurring, but explicit agreement is not required for continued participation. Nevada’s statute was interpreted by the state Supreme Court in Lane v. Allstate Ins. Co. (1998) and subsequent rulings to require all-party consent for telephonic communications, extending a statutory framework that is less explicit than other states on its face (Nev. Rev. Stat. § 200.650).

California’s statute is the most frequently litigated. Penal Code § 632 applies to any "confidential communication" where a party has an objectively reasonable expectation that the conversation is not being recorded. The statute has generated substantial class-action activity because California’s large population means many B2B calls include at least one California participant.

Four additional states have mixed rules. Connecticut requires all-party consent for telephonic communications but one-party consent for in-person conversations. Oregon is a one-party consent state for telephone and electronic communications, but requires all-party notice for private in-person conversations (the Ninth Circuit struck down the notice requirement for public in-person recordings in 2023). Hawaii applies one-party consent for telephone calls but requires all-party consent when a recording device is installed in a "private place." Michigan courts have held that a participant in a conversation may record without other parties’ consent under the "participant exception" established in Sullivan v. Gray (1982), though non-participants still need all-party consent. For organizations with high-volume operations in these states, legal counsel should review the specific recording use case.

The Interstate Call Problem: Which State’s Law Applies?

When a caller and recipient are in different states, determining which law applies is not straightforward. Federal courts and state courts have reached different conclusions, but the predominant approach applies the stricter standard.

The California Supreme Court addressed this question in Kearney v. Salomon Smith Barney, 39 Cal.4th 95 (2006). A Georgia-based employee of a brokerage firm recorded calls with California customers. Georgia follows one-party consent. California requires all-party consent. The employee did not disclose recording. The court held that California’s all-party consent law applied because a California resident was a party to the call.

The Kearney reasoning has been influential. State courts in Florida, Maryland, and Pennsylvania have reached similar conclusions. When the parties are in different states, the court typically applies the consent standard of the state with the stricter rule.

For enterprise compliance, this creates a practical framework. Any recorded call that includes a participant in an all-party consent state should be treated as subject to all-party consent requirements. A sales team in Texas recording a call with a customer in Massachusetts must obtain consent from all participants. A support team in Georgia speaking with a California policyholder must disclose and obtain consent before recording.

Organizations with multi-state operations face the highest compliance burden when they cannot reliably determine participant location at call initiation. A call center receiving inbound calls may not know whether the caller is in an all-party state until after the call begins. Consent-capture architectures must account for this uncertainty.

A related question concerns calls that cross international borders. Canada requires one-party consent federally, though some provinces have stricter standards. The United Kingdom’s Regulation of Investigatory Powers Act 2000 requires consent for business recordings. International call recording compliance is beyond this post’s scope, but multi-national organizations should consult jurisdiction-specific counsel.

Penalty Exposure by State: What Non-Compliance Actually Costs

Penalty exposure for illegal call recording varies significantly by jurisdiction. Some violations are misdemeanors. Others are felonies with prison time and substantial fines. Civil liability multiplies per-violation damages across class-action exposure.

California Penal Code § 632 imposes criminal fines up to $2,500 per violation, rising to $10,000 for repeat offenses, according to the California Legislative Information (2025). Civil liability under CIPA § 637.2 adds statutory damages of $5,000 per violation in private actions. A class action with 10,000 recorded calls can generate $50 million or more in statutory damages before punitive damages and attorney fees.

Massachusetts makes secret recording a felony. General Laws ch. 272, § 99 imposes up to five years in state prison and fines up to $10,000, according to the Massachusetts Legislature (2025). Civil damages start at $100 per day of violation or $1,000 minimum.

Florida treats illegal recording as a third-degree felony, carrying up to five years imprisonment and a $5,000 fine, per Florida Statutes § 934.03 (2025). First-time non-commercial violations may be charged as misdemeanors, but business-related recording violations typically face felony prosecution.

Federal civil damages under 18 U.S.C. § 2520 provide $100 per day of violation or $10,000, whichever is greater, plus punitive damages and attorney fees, according to US Code via GovInfo (2024). Federal damages stack on top of state liability in dual-enforcement scenarios.

The following table summarizes criminal penalty classes for all-party states.

The settlement data demonstrates that civil exposure vastly exceeds criminal fines in class actions. The $50 million Fifth Third Bank settlement and the $19.5 million Wells Fargo settlement reflect statutory damages multiplied across thousands of recorded calls, not the underlying criminal penalties.

Operationalizing Call Recording Consent Across Multiple States

A three-path diagram showing consent-capture architectures: IVR/Passive Disclosure path for inbound call centers, Pre-call Click-Wrap path for outbound sales, and Compliant-by-Design Hardware path for field teams.

Enterprise compliance programs typically deploy one of three consent-capture architectures. The choice depends on call volume, participant location predictability, and the organization’s risk tolerance.

IVR and passive disclosure is the most common approach for inbound call centers. An automated announcement plays at call initiation. The recording states that the call may be recorded for quality or training purposes. Continued participation after the announcement constitutes implied consent. This architecture works well for high-volume inbound operations where location is unknown at call start. The disclosure must be clear and audible. A mumbled or rapid announcement may not satisfy all-party requirements.

Pre-call click-wrap agreements require explicit consent before recording begins. Sales teams using CRM-integrated dialers may present a consent checkbox or modal before call initiation. The participant clicks to agree. The consent record is timestamped and stored. This architecture suits outbound calling where the organization controls call initiation. It provides stronger evidentiary support than passive disclosure.

Compliant-by-design recording hardware enforces consent at the device level. Recording devices with built-in consent workflows require explicit user action to initiate capture. Hardware-level encryption ensures recorded data remains secure. This architecture suits organizations where individual employees control recording decisions, such as field sales teams or consultants. Vibe’s Vibe Dot wearable AI recording device offers configurable recording modes that support consent-first workflows.

In 2025, 21% of C-Suite executives ranked regulatory compliance as a top strategic priority for the following 18 months, up from 2% in 2024, according to the Thomson Reuters Institute C-Suite Survey (2025). For organizations using call recording tools, that priority translates directly to consent-capture architecture decisions.

The checklist above summarizes the six-step sequence. For distributed teams, the most common failure point is the mapping step: teams that know their own state’s rules often skip verifying where participants are located when calls originate remotely.

For organizations using meeting intelligence platforms or AI notetakers, the same principles apply. Any tool that records, transcribes, or summarizes a conversation must comply with applicable consent law. AI meeting assistant tools have proliferated rapidly, and many teams deploy them without evaluating compliance. The same all-party state rules govern AI-generated recordings as govern traditional call recording.

Recording Tools Built for Compliance: What to Look For

Vibe Dot wearable AI device clipped to a professional's lapel, office environment in the background, showing the small circular device with its minimalist design.

Selecting a recording tool for compliance-sensitive environments requires evaluation across several dimensions. The device or platform must support the organization’s consent-capture architecture. Certification and security standards matter for regulated industries.

A compliant recording tool should satisfy three evaluation criteria. First, it needs verifiable security certifications: SOC 2 Type II for enterprise security audits, HIPAA for healthcare-adjacent use cases, and NDAA eligibility for government or contractor environments. Second, it needs hardware-level encryption for data at rest, consumer recording apps typically store data in software-accessible plaintext, leaving it exposed if a device is lost or access credentials are compromised. Third, recording modes should support explicit consent initiation rather than passive background capture by default.

Vibe Dot is a wearable AI recording device that addresses all three criteria. It holds SOC 2, HIPAA, and NDAA certifications, and includes TPM 2.0 hardware encryption that renders recorded data inaccessible if the device is lost. Its default recording mode, Tap to Record, requires a deliberate double-tap to begin capture, a workflow that aligns with explicit-consent requirements in all-party states. Scheduled capture and auto-capture standby modes are also available for recurring meetings, and both require policy configuration to define when disclosure is required before activation.

Transcription, summarization, and action-item generation are downstream of the recording. These AI features do not change the consent analysis: a conversation that required two-party consent at recording time still requires it, regardless of what processing follows.

The video conferencing technology guide from Vibe covers broader meeting room recording considerations.

Vibe Dot vs Plaud: compliance-ready recording comparisonHow two wearable AI recorders stack up on security certifications, recording modes, and consent-aware features — for compliance teams evaluating hardware options.

See the comparison

Summary

US call recording law splits between 38 one-party consent states and 11 all-party consent states, with four states operating nuanced mixed frameworks. The federal Wiretap Act sets a baseline, but states may enforce stricter standards. When parties are in different states, courts typically apply the stricter law.

A professional compliance checklist document clipped to a clipboard, showing checked items for consent procedures, state-by-state requirements, and certification standards.

Penalty exposure is substantial. California generated $69.5 million in settlements in 2024-2025. Massachusetts imposes felony penalties. Compliance teams managing multi-state recording operations must ensure consent architectures satisfy the strictest applicable standard.

Three implementation approaches serve different call types. IVR disclosure suits high-volume inbound. Click-wrap consent suits outbound. Compliant-by-design hardware suits field deployment. Vibe Dot, with SOC 2, HIPAA, and NDAA certifications, supports consent-first workflows with hardware-enforced encryption.

For organizations evaluating compliance-ready recording tools, the Vibe Dot product page provides specifications and certification details. Comparison resources like Vibe Dot vs Plaud cover alternative devices. For broader meeting room solutions, the hybrid collaboration guide addresses workspace strategy.