In October 2023, two California small businesses sued Wells Fargo over sales calls they say were recorded without disclosure. The calls were not placed by the bank. They were placed by an independent sales organization selling payment-processing services on its behalf, from outside California. The case settled in 2025 for $19.5 million.
This post is general information about US recording consent law, not legal advice. Statutes and case law change, and outcomes turn on facts specific to each situation. Consult counsel licensed in the relevant jurisdiction before setting recording policy.
Why US Call Recording Law Is a Compliance Priority
US call recording violations have generated tens of millions in class-action settlements, most stemming from enterprises that applied one-party consent rules where all-party consent was legally required. In 2025, Wells Fargo, Priority Technology Holdings and The Credit Wholesale Company agreed to a $19.5 million settlement over sales calls to California businesses that were recorded without disclosure. The calls were placed by Wholesale, an independent sales organization; Wells Fargo and Priority denied any principal-agent relationship and settled without admitting liability. See the order granting preliminary approval in Aguilar Auto Repair, Inc. v. Wells Fargo Bank, N.A., Case No. 3:23-cv-06265-LJC (N.D. Cal. 2025). The exposure came from a vendor’s recording practices, not the bank’s own. The same case pattern produced the largest CIPA recording settlement to date. In 2022, Fifth Third Bank, Vantiv and National Processing agreed to pay $50 million, and the Wells Fargo defendants in that same action had settled separately for $28 million the year before, according to the order granting final approval in Sat Narayan v. Fifth Third Bank, Case No. 1:16-cv-11223 (N.D. Ill., final approval Aug. 4, 2022).
CIPA call-recording claims have produced at least $97.5 million in publicly disclosed settlements since 2021 — $28 million and $50 million in the Narayan action, and $19.5 million in Aguilar in 2025. These figures represent only the settlements that became public. Many more cases resolve quietly through private arbitration or confidential agreements.
For compliance teams at mid-market and enterprise B2B organizations, the operational stakes extend beyond litigation costs. Regulated industries face examination scrutiny. The Consumer Financial Protection Bureau has cited recording consent violations in consent orders. Healthcare organizations risk HIPAA investigations when recording practices intersect with patient communications. Sales and support teams with multi-state footprints face the highest exposure because interstate calls create jurisdictional ambiguity.
The core challenge is the federal-state split. The US has no single recording consent standard. Instead, a federal floor plus 50 state overlays create a compliance matrix that varies by participant location, communication type, and sometimes by the content of the conversation itself.
How US Recording Consent Law Is Structured
The federal Wiretap Act, codified at 18 U.S.C. § 2511, establishes one-party consent as the national baseline. Under this statute, a person who is a party to a communication may record it, or may consent to a third party recording it, without informing other participants. The statutory language states that it "shall not be unlawful… for a person not acting under color of law to intercept a wire, oral, or electronic communication where such person is a party to the communication or where one of the parties to the communication has given prior consent" (Cornell Law School Legal Information Institute, 2024).
States may enact stricter standards. When they do, the state law governs any communication where a party to the call is physically present in that state. This federal-state interaction creates three consent frameworks.
One-party consent means any participant may record without informing others. The recorder must be a party to the conversation, or must have consent from a party. Thirty-eight states plus the District of Columbia follow this standard for telephone calls, making one party consent the majority approach in US law. Three of them — Hawaii, Michigan and Oregon — apply stricter rules to in-person recording, flagged in the table below.
All-party consent requires every participant to consent before recording begins. Twelve states enforce this stricter standard. The phrase "two-party consent" is a colloquial misnomer because the statute governs all parties, not just two. A three-person conference call in California requires three-party consent.
Mixed-rule states operate under nuanced frameworks that depend on communication medium, context, or the parties’ expectations. Connecticut, Oregon, Hawaii, and Michigan have statutes or court interpretations that apply different consent requirements depending on whether the communication is in-person, telephonic, or electronic, or on whether the recorder is a participant.
One-Party Consent States: The Complete 38-State Reference
The following table lists all one-party consent states with their governing statutes.
|
State |
Statute Citation |
Note |
|---|---|---|
|
Alabama |
Ala. Code § 13A-11-30 | |
|
Alaska |
Alaska Stat. § 42.20.310 | |
|
Arizona |
Ariz. Rev. Stat. § 13-3005 | |
|
Arkansas |
Ark. Code Ann. § 5-60-120 | |
|
Colorado |
Colo. Rev. Stat. § 18-9-303 | |
|
Georgia |
Ga. Code Ann. § 16-11-62 | |
|
Hawaii |
Haw. Rev. Stat. § 803-42 |
One-party for phone calls; all-party consent required to install a recording device in a private place |
|
Idaho |
Idaho Code § 18-6702 | |
|
Indiana |
Ind. Code § 35-33.5-1-5 | |
|
Iowa |
Iowa Code § 727.8 | |
|
Kansas |
Kan. Stat. Ann. § 21-6101 | |
|
Kentucky |
Ky. Rev. Stat. § 526.010 | |
|
Louisiana |
La. Rev. Stat. Ann. § 15:1303 | |
|
Maine |
Me. Rev. Stat. tit. 15, § 710 | |
|
Michigan |
Mich. Comp. Laws § 750.539c |
Statute reads as all-party on its face; a 1982 Court of Appeals decision (Sullivan v. Gray) created a participant exception the Michigan Supreme Court has never confirmed — treat as unsettled |
|
Minnesota |
Minn. Stat. § 626A.02 | |
|
Mississippi |
Miss. Code Ann. § 41-29-531 | |
|
Missouri |
Mo. Rev. Stat. § 542.402 | |
|
Nebraska |
Neb. Rev. Stat. § 86-290 | |
|
New Jersey |
N.J. Stat. Ann. § 2A:156A-4 | |
|
New Mexico |
N.M. Stat. Ann. § 30-12-1 | |
|
New York |
N.Y. Penal Law § 250.05 | |
|
North Carolina |
N.C. Gen. Stat. § 15A-287 | |
|
North Dakota |
N.D. Cent. Code § 12.1-15-02 | |
|
Ohio |
Ohio Rev. Code § 2933.52 | |
|
Oklahoma |
Okla. Stat. tit. 13, § 176.4 | |
|
Oregon |
Or. Rev. Stat. § 165.540(1)(a) |
One-party for telephone and electronic communications; in-person recording requires that all participants be informed under § 165.540(1)(c) |
|
Rhode Island |
R.I. Gen. Laws § 11-35-21 | |
|
South Carolina |
S.C. Code Ann. § 17-30-30 | |
|
South Dakota |
S.D. Codified Laws § 23A-35A-20 | |
|
Tennessee |
Tenn. Code Ann. § 39-13-601 | |
|
Texas |
Tex. Penal Code § 16.02 | |
|
Utah |
Utah Code Ann. § 77-23a-4 | |
|
Vermont |
Vt. Stat. Ann. tit. 13, § 4601 |
No general wiretap statute; federal 18 U.S.C. § 2511 applies — see State v. Geraw, 173 Vt. 350 (2002) |
|
Virginia |
Va. Code Ann. § 19.2-62 | |
|
West Virginia |
W. Va. Code § 62-1D-3 | |
|
Wisconsin |
Wis. Stat. § 968.31 | |
|
Wyoming |
Wyo. Stat. Ann. § 7-3-702 | |
|
District of Columbia |
D.C. Code § 23-542 |
For enterprise compliance teams, the practical implication is straightforward. Calls where all participants are in one-party consent states require no disclosure or consent beyond the recorder’s own participation. The recorder must be a party to the call. Third-party recording requires explicit consent from at least one participant.
High-traffic states for B2B operations apply one-party consent. New York, Texas, Georgia, Ohio, and Colorado all follow the federal standard. A sales team in Atlanta may record customer calls with Georgia-based contacts without disclosure. The same team recording a call with a California contact faces a different standard.
For individual contributors recording on personal devices, one-party consent has direct practical implications. In these states, native or third-party call recording apps on iPhone and Android are legally usable without notifying the other party — as long as every participant on the call is also in a one-party consent state. The moment any participant is in an all-party state, the stricter standard applies regardless of the recorder’s location.
All-Party Consent States: The 12-State Reference
Eleven states require all parties to consent before a conversation is recorded. The statutes vary in how consent must be obtained, but the principle is consistent. If one participant refuses or is unaware, recording is illegal.
|
State |
Statute Citation |
Consent Requirement |
Criminal Classification |
Maximum Fine |
Maximum Imprisonment |
|---|---|---|---|---|---|
|
California |
Cal. Penal Code §§ 632, 632.7 |
All parties must consent; § 632.7 covers cellular/cordless calls with no confidentiality requirement |
Misdemeanor (first); Felony (repeat) |
$2,500 (first); $10,000 (repeat) |
1 year (first); 3 years (repeat) |
|
Connecticut |
Conn. Gen. Stat. § 52-570d |
All parties must consent to recording a telephone call; in-person recording by a participant is not covered |
Civil liability only (participant); criminal eavesdropping under § 53a-189 reaches third parties, not participants |
— |
— |
|
Delaware |
11 Del. C. § 1335(a)(4) |
All parties must consent; conflicts with one-party exception in § 2402(c)(4) — treat as all-party pending court resolution |
Felony |
$10,000 |
Up to 5 years |
|
Florida |
Fla. Stat. § 934.03 |
All parties must consent |
Felony of the third degree |
$5,000 |
Up to 5 years |
|
Illinois |
720 ILCS 5/14-2 |
All parties must consent |
Class 4 felony (first); Class 3 felony (subsequent) |
$25,000 |
1–3 years (first); 2–5 years (subsequent) |
|
Maryland |
Md. Code, Cts. & Jud. Proc. § 10-402 |
All parties must consent |
Felony |
$10,000 |
Up to 5 years |
|
Massachusetts |
Mass. Gen. Laws ch. 272, § 99 |
Secret recording prohibited; open, disclosed recording is lawful |
Felony |
$10,000 |
Up to 5 years |
|
Montana |
Mont. Code Ann. § 45-8-213 |
All parties must be informed (notice required; explicit consent not required) |
Misdemeanor |
$500 |
Up to 6 months |
|
Nevada |
Nev. Rev. Stat. § 200.620 |
All parties must consent for telephone calls (Lane v. Allstate, 1998; extended to cellular by Sharpe v. State, 2015) |
Category D felony |
$5,000 |
1–4 years |
|
New Hampshire |
N.H. Rev. Stat. § 570-A:2 |
All parties must consent |
Class B felony |
$2,000 |
Up to 7 years |
|
Pennsylvania |
18 Pa. C.S. § 5703 |
All parties must consent |
Felony of the third degree |
$15,000 |
Up to 7 years |
|
Washington |
Wash. Rev. Code § 9.73.030 |
All parties must consent |
Gross misdemeanor |
$5,000 |
Up to 364 days |
The Interstate Call Problem: Which State’s Law Applies?
When a caller and recipient are in different states, determining which law applies is not straightforward. Federal and state courts have reached different conclusions, and no single rule governs. Some courts apply the law of the state where the recording device sits; others apply the law of the state where a participant is located. Because the outcome is unpredictable, compliance programs should assume the strictest applicable standard rather than rely on a favorable choice-of-law ruling.
The California Supreme Court addressed this question in Kearney v. Salomon Smith Barney, 39 Cal.4th 95 (2006). A Georgia-based employee of a brokerage firm recorded calls with California customers. Georgia follows one-party consent. California requires all-party consent. The employee did not disclose recording. The court held that California’s all-party consent law applied because California clients were parties to the calls, while declining to award damages for past conduct and limiting relief to prospective injunctive relief — a fairness limitation later defendants have not been able to count on.
For enterprise compliance, this creates a practical framework. Any recorded call that includes a participant in an all-party consent state should be treated as subject to all-party consent requirements. A sales team in Texas recording a call with a customer in Massachusetts must obtain consent from all participants. A support team in Georgia speaking with a California policyholder must disclose and obtain consent before recording.
Organizations with multi-state operations face the highest compliance burden when they cannot reliably determine participant location at call initiation. A call center receiving inbound calls may not know whether the caller is in an all-party state until after the call begins. Consent-capture architectures must account for this uncertainty.
A related question concerns calls that cross international borders. Canada requires one-party consent federally, though some provinces have stricter standards. The United Kingdom’s Regulation of Investigatory Powers Act 2000 requires consent for business recordings. International call recording compliance is beyond this post’s scope, but multi-national organizations should consult jurisdiction-specific counsel.
Penalty Exposure by State: What Non-Compliance Actually Costs
Penalty exposure for illegal call recording varies significantly by jurisdiction. Some violations are misdemeanors. Others are felonies with prison time and substantial fines. Civil liability multiplies per-violation damages across class-action exposure.
California Penal Code § 632 imposes criminal fines up to $2,500 per violation, rising to $10,000 for repeat offenses, according to the California Legislative Information (2025). Civil liability under CIPA § 637.2 adds statutory damages of $5,000 per violation in private actions. A class action with 10,000 recorded calls can generate $50 million or more in statutory damages before punitive damages and attorney fees.
Massachusetts makes secret recording a felony. General Laws ch. 272, § 99 imposes up to five years in state prison and fines up to $10,000, according to the Massachusetts Legislature (2025). Civil damages start at $100 per day of violation or $1,000 minimum.
Florida treats illegal recording as a third-degree felony, carrying up to five years imprisonment and a $5,000 fine, per Florida Statutes § 934.03 (2025). First-time non-commercial violations may be charged as misdemeanors, but business-related recording violations typically face felony prosecution.
Federal civil damages under 18 U.S.C. § 2520 provide $100 per day of violation or $10,000, whichever is greater, plus punitive damages and attorney fees, according to US Code via GovInfo (2024). Federal damages stack on top of state liability in dual-enforcement scenarios.
The following table summarizes criminal penalty classes for all-party states.
|
State |
Criminal Classification |
Maximum Criminal Fine |
Maximum Imprisonment |
|---|---|---|---|
|
California |
Misdemeanor (first); Felony for subsequent |
$10,000 |
1 year (misd.); 16 months–3 years (felony) |
|
Delaware |
Misdemeanor |
$1,000 |
1 year |
|
Florida |
Third-degree felony |
$5,000 |
5 years |
|
Illinois |
Class A misdemeanor |
$2,500 |
1 year |
|
Maryland |
Felony |
$10,000 |
5 years |
|
Massachusetts |
Felony |
$10,000 |
5 years state prison |
|
Montana |
Misdemeanor |
$500 |
6 months |
|
Nevada |
Category C felony |
$10,000 |
1–5 years |
|
New Hampshire |
Class B felony |
$4,000 |
3.5–7 years |
|
Pennsylvania |
Misdemeanor |
$2,500 |
1–2 years |
|
Washington |
Class C felony |
$10,000 |
5 years |
The settlement data demonstrates that civil exposure vastly exceeds criminal fines in class actions. The $50 million Fifth Third Bank settlement and the $19.5 million Wells Fargo settlement reflect statutory damages multiplied across thousands of recorded calls, not the underlying criminal penalties.
Operationalizing Call Recording Consent Across Multiple States
Enterprise compliance programs typically deploy one of three consent-capture architectures. The choice depends on call volume, participant location predictability, and the organization’s risk tolerance.
IVR and passive disclosure is the most common approach for inbound call centers. An automated announcement plays at call initiation. The recording states that the call may be recorded for quality or training purposes. Continued participation after the announcement constitutes implied consent. This architecture works well for high-volume inbound operations where location is unknown at call start. The disclosure must be clear and audible. A mumbled or rapid announcement may not satisfy all-party requirements.
Pre-call click-wrap agreements require explicit consent before recording begins. Sales teams using CRM-integrated dialers may present a consent checkbox or modal before call initiation. The participant clicks to agree. The consent record is timestamped and stored. This architecture suits outbound calling where the organization controls call initiation. It provides stronger evidentiary support than passive disclosure.
Compliant-by-design recording hardware enforces consent at the device level. Recording devices with built-in consent workflows require explicit user action to initiate capture. Hardware-level encryption ensures recorded data remains secure. This architecture suits organizations where individual employees control recording decisions, such as field sales teams or consultants. Vibe’s Vibe Dot wearable AI recording device offers configurable recording modes that support consent-first workflows.
In 2025, 21% of C-Suite executives ranked regulatory compliance as a top strategic priority for the following 18 months, up from 2% in 2024, according to the Thomson Reuters Institute C-Suite Survey (2025). For organizations using call recording tools, that priority translates directly to consent-capture architecture decisions.
The checklist above summarizes the six-step sequence. For distributed teams, the most common failure point is the mapping step: teams that know their own state’s rules often skip verifying where participants are located when calls originate remotely.
For organizations using meeting intelligence platforms or AI notetakers, the same principles apply. Any tool that records, transcribes, or summarizes a conversation must comply with applicable consent law. AI meeting assistant tools have proliferated rapidly, and many teams deploy them without evaluating compliance. The same all-party state rules govern AI-generated recordings as govern traditional call recording.
Recording Tools Built for Compliance: What to Look For
Vibe Dot wearable AI device clipped to a professional's lapel, office environment in the background, showing the small circular device with its minimalist design.Selecting a recording tool for compliance-sensitive environments requires evaluation across several dimensions. The device or platform must support the organization’s consent-capture architecture. Certification and security standards matter for regulated industries.
A compliant recording tool should satisfy three evaluation criteria. First, it needs verifiable security certifications: SOC 2 Type II for enterprise security audits, HIPAA for healthcare-adjacent use cases, and NDAA eligibility for government or contractor environments. Second, it needs hardware-level encryption for data at rest, consumer recording apps typically store data in software-accessible plaintext, leaving it exposed if a device is lost or access credentials are compromised. Third, recording modes should support explicit consent initiation rather than passive background capture by default.
Vibe Dot is a wearable AI recording device that addresses all three criteria. It holds SOC 2, HIPAA, and NDAA certifications, and includes a dedicated hardware encryption chip (FIPS 140-3, Common Criteria EAL 6+) that renders recorded data inaccessible if the device is lost. Its default recording mode, Tap to Record, requires a deliberate double-tap to begin capture, a workflow that aligns with explicit-consent requirements in all-party states. Scheduled capture and auto-capture standby modes are also available for recurring meetings, and both require policy configuration to define when disclosure is required before activation.
Transcription, summarization, and action-item generation are downstream of the recording. These AI features do not change the consent analysis: a conversation that required two-party consent at recording time still requires it, regardless of what processing follows.
The video conferencing technology guide from Vibe covers broader meeting room recording considerations.
Frequently Asked Questions
What states require all-party consent for call recording?
Twelve states require all-party consent. California, Delaware, Florida, Illinois, Maryland, Massachusetts, Montana, Nevada, New Hampshire, Pennsylvania, and Washington enforce this standard. Montana requires notice rather than consent, and Massachusetts prohibits secret recording rather than requiring consent as such, so the eleven are not identical in what they demand.
Is it legal to record a phone call without telling the other person?
It depends on location. In 38 one-party consent states, a call participant may record without informing others, per the federal Wiretap Act. In 12 all-party consent states, recording without disclosure is illegal and may carry felony penalties, including up to $10,000 fines in Massachusetts.
Which state’s law applies when caller and recipient are in different states?
Courts typically apply the stricter standard, as established in Kearney v. Salomon Smith Barney (Cal. Supreme Court 2006). If one party is in an all-party state, that state’s consent requirement governs.
How do businesses comply with recording laws across multiple states?
Most enterprises use IVR announcements for inbound calls, pre-call click-wrap consent for outbound calls, and compliant-by-design hardware for field recording, each architecture mapped to a different call type based on where participants are located.
What are the penalties for illegal call recording in California?
California Penal Code § 632 imposes fines up to $2,500 per violation, increasing to $10,000 for repeat offenders. Civil damages under CIPA § 637.2 add $5,000 per violation. In 2025, the Wells Fargo defendants settled CIPA claims over undisclosed sales calls for $19.5 million in Aguilar Auto Repair v. Wells Fargo Bank (N.D. Cal.).
Can an employee record a meeting without consent from other participants?
Only in one-party consent states where the employee is physically present and is a participant in the meeting. In all-party states, all participants must consent. CIPA filings tell the story more directly: the $19.5 million Aguilar settlement in 2025 followed a $50 million settlement in 2022 and a $28 million settlement in 2021 in the same line of cases, all over calls placed by third-party vendors rather than by the companies that paid.
Do AI meeting assistants have to comply with call recording laws?
Yes. Any tool that records, transcribes, or processes a conversation must comply with applicable consent law. AI-generated recordings are legally equivalent to traditional recordings. Organizations deploying AI meeting assistants should ensure disclosure and consent mechanisms match the all-party state standard.
What should a call recording disclosure announcement include?
A compliant disclosure should state that the call may be recorded, identify the purpose of recording, and request continued participation as consent. The disclosure must be clear and audible. Rapid or mumbled announcements may not satisfy all-party requirements in states like California.
Summary
US call recording law splits between 38 one-party consent states and 11 all-party consent states, with four states operating nuanced mixed frameworks. The federal Wiretap Act sets a baseline, but states may enforce stricter standards. When parties are in different states, courts typically apply the stricter law.
A professional compliance checklist document clipped to a clipboard, showing checked items for consent procedures, state-by-state requirements, and certification standards.Penalty exposure is substantial. California generated $69.5 million in settlements in 2024-2025. Massachusetts imposes felony penalties. Compliance teams managing multi-state recording operations must ensure consent architectures satisfy the strictest applicable standard.
Three implementation approaches serve different call types. IVR disclosure suits high-volume inbound. Click-wrap consent suits outbound. Compliant-by-design hardware suits field deployment. Vibe Dot, with SOC 2, HIPAA, and NDAA certifications, supports consent-first workflows with hardware-enforced encryption.
For organizations evaluating compliance-ready recording tools, the Vibe Dot product page provides specifications and certification details. Comparison resources like Vibe Dot vs Plaud cover alternative devices. For broader meeting room solutions, the hybrid collaboration guide addresses workspace strategy.











