← All Blogs

Call recording consent laws by state, and what to fix this week

By Best IT MSP Editorial Team - Updated October 21, 2026 - 9 min read

The Best IT MSP editorial team maintains this directory's provider data across the US and Canada. We rank providers on verified rating and firmographic data, label paid placement, and do not sell IT services. We are not lawyers, and this article is not legal advice.

Is it legal to record a business call?

Recording a business call is legal under federal law when one person on the call agrees to it, and that person can be you. The federal wiretap statute carves out a private person who is a party to the communication, or who has one party's prior consent. Several states require every party to agree instead, and your state decides which rule governs your recorded line.

This is a buyer's guide, not legal advice. Best IT MSP ranks managed IT and voice providers and does not practice law. A lawyer licensed in the state that matters is the only person who can tell you whether your setup is lawful. What we can do is show you the statutory text, the distinction it turns on, and the questions to put to whoever configured your phones.

The usual story is short. Your phone system shipped with a record button, somebody switched it on for training purposes, and nobody checked the law for the calls your team actually makes. The problem surfaces later, when a customer in another state asks for the file.

Four things follow. The distinction that decides everything, the five statutes we read word for word, why the risk concentrates in an interstate call, and the seven fixes that fit in one afternoon. If you are still choosing a platform, read Hosted VoIP vs On-Premise Phone Systems and Unified Communications Explained first.

One-party consent and all-party consent, in plain English

One-party consent means one person on the call can agree to the recording, and that person can be you. All-party consent means everyone on the line must agree. Nothing else about call recording matters as much as which of those two rules applies to the call in front of you.

Federal law sets the floor. The wiretap statute makes it an offense to intentionally intercept a wire, oral or electronic communication, then states that it is not unlawful "for a person not acting under color of law to intercept a wire, oral, or electronic communication" where that person is a party to the call or has one party's prior consent. The exception is written for private parties, meaning you and your staff.

Interception is defined broadly. The same chapter defines intercept as "the aural or other acquisition of the contents of any wire, electronic, or oral communication" through any electronic, mechanical or other device. The definition names no product, which is why a cloud recording feature is a question for a local lawyer rather than an obvious exemption.

Does saying "for training purposes" help?

The phrase that carries weight is "in the ordinary course of business", and it sits in the definitions rather than in the exceptions. The statute's definition of a recording device excludes telephone equipment "furnished to the subscriber or user by a provider of wire or electronic communication service" in the ordinary course of its business and used in the ordinary course of the subscriber's business. Whether your recorded line fits that description is a question a lawyer answers and a sales engineer does not.

The federal exception has state law inside it

The one-party exception stops applying when the recording is made "for the purpose of committing any criminal or tortious act in violation of the Constitution or laws of the United States or of any State". Read the last four words again. State law sits inside the federal rule, so "federal law allows one-party consent" is the start of the analysis rather than the end of it.

What a violation costs

A federal criminal violation carries a fine or imprisonment of "not more than five years, or both". The civil side is the part a small business feels. A person whose call was intercepted can sue, and the court may award statutory damages of whichever is the greater of $100 a day for each day of violation or $10,000. Damages that accrue daily fit badly with a recording nobody remembered to turn off.

The five state statutes we read, word for word

We read five state wiretap statutes at their official source and quote each one below. Two require one party's consent. Three require all parties. That is the entire table we are willing to publish, and every line links to the text we read.

• New York defines wiretapping as recording a telephonic communication "by a person other than a sender or receiver thereof, without the consent of either the sender or receiver". Consent from either end is enough, which is one-party consent on the face of the text.
• Virginia makes intentional interception "a Class 6 felony", then exempts a recording made "where such person is a party to the communication" or with one party's prior consent.
• Florida permits interception only "when all of the parties to the communication have given prior consent". A private claim carries liquidated damages of $100 a day for each day of violation or $1,000, whichever is higher.
• Maryland applies the same all-party test, permitting interception "where all of the parties to the communication have given prior consent to the interception".
• Washington bans recording a private communication "without first obtaining the consent of all the participants in the communication".

Why there is no fifty-state table here

A fifty-state table is the most common feature of articles on this subject and the least trustworthy. One wrong cell sends a reader into a recorded call believing the opposite of the truth, and fifty statutes cannot be verified to the standard this site holds inside one article. A qualified count you can check beats a complete table you cannot. California, Illinois, Pennsylvania and Massachusetts are absent above for one reason, which is that their official text would not open for us on the day we wrote this. This guide states no position on them, and absence here is evidence of nothing.

How to check your own state in twenty minutes

• Open the state legislature's own website rather than a law firm summary.
• Search the criminal or evidence title for the words "intercept" and "consent".
• Read the exception list rather than the headline prohibition, because the consent rule almost always sits in an exception.
• Count the parties the exception names. "One of the parties" and "all of the parties" are four words apart and a world apart.
• Send the section number to a lawyer in that state and ask whether your actual recorded line fits the exception.

Why the risk lives in interstate calls

An interstate call is where the two rules collide, because the person dialing sits under one state's statute and the person answering sits under another. One end may need one consent. The other end may need everyone's. Nobody on the call knows which, and no phone system asks.

A mobile number also tells you almost nothing about where its owner is standing. A 206 number can answer in Phoenix. The federal statute does not settle it for you either, because the one-party exception falls away where the purpose is a criminal or tortious act in violation of the laws of any State.

The safe operating posture does not depend on resolving the question. Run every recorded line to the stricter rule. Disclose the recording out loud to every caller, and keep that verbal disclosure inside the file. The posture is lawful where one consent is enough, and it is the behavior an all-party statute describes.

Washington writes the mechanics down more plainly than most. Consent "shall be considered obtained whenever one party has announced to all other parties" that the conversation is about to be recorded, "in any reasonably effective manner", and the statute adds that "if the conversation is to be recorded that said announcement shall also be recorded". That last clause is a configuration instruction. Your proof lives inside the audio, not in a policy document.

None of the five statutes we read requires a notification tone. The periodic beep some systems offer is a convention rather than a rule those texts impose, and a beep does not tell a caller who is recording or why. A spoken line in the first five seconds does both.

The record button your phone system cannot ask consent for

Microsoft documents that the Teams consent prompt does not work on the line you are most likely to record. Its call recording page states that "explicit consent is not supported for call queue calls". A call queue is the main business number, the one your customers dial, and in an all-party state that is the gap that matters.

The consent prompt is a real feature and it behaves sensibly on a one-to-one call. With the agreement policy on, the other participant starts muted with camera and sharing off, and the user who starts recording is considered to have given consent and remains unmuted. When that participant tries to unmute or share, they are asked to respond Yes or No to consent to be included in the recording. A No leaves them in a view-only call.

The useful part for a buyer is the evidence it leaves behind. Microsoft states that the consent choice for each participant is visible by the admin and is included in the Purview audit log for the call. Ask your provider to pull one. A provider who retrieves that entry for a call from last month is operating the control rather than selling it.

Always-on recording answers differently. Microsoft's comparison of the two modes marks participant notification as enforced in both convenience and compliance recording, and participant consent as supported only in convenience recording. Compliance recording, the kind a regulated firm or a contact center runs through a third-party solution, notifies and does not ask. If your business records every call automatically, that single table row is the question to take to your lawyer and your provider together.

Where your call recordings live, and how long they stay

Call recording retention is the setting nobody checks, and in Microsoft 365 the answer surprises most owners. For a one-to-one or group call, the recording files go to the OneDrive account of the user who selected Record. Your archive is a collection of personal folders rather than a company system, and on an external call the other party has no access at all until the file is shared.

Automatic deletion is narrower than people assume. Teams meeting recordings and transcripts carry a default expiration time of 120 days, and Microsoft scopes that policy to meetings and events, such as webinars and town halls. Call recordings are handled like any other file. Once an expired file reaches a work or school recycle bin, items are automatically deleted after 93 days unless an administrator changed the setting. So the platform deletes what you may need and keeps what you may not.

If a card number is ever read out loud

Pause the recording before the card number and resume after it. The PCI Security Standards Council states that requirement 3.3.1 prohibits storing sensitive authentication data after authorization, and that storing card validation codes "in any form of digital audio recording" after authorization violates it. Its guidance adds that "where technology exists to suppress or redact audio during data entry, it should be enabled", and that data captured anyway "should be securely deleted immediately upon authorization of the transaction".

PCI pause-and-resume is a configuration rather than a product. Amazon Connect's administrator guide describes the pattern directly, noting that recording starts as soon as it is set to on, pauses when a later step sets it to off, and can be turned on again to resume. The same page flags a detail worth testing, that when an agent puts a customer on hold, the agent is still recorded and the customer is not. Run one test call and listen to the file before trusting any of it.

What to put in place this week

Seven actions close most of the exposure, and six of them fit in a single afternoon.

• List every recorded line, including the main number, each call queue, softphone apps and any contact center seat.
• Turn off recording on any line whose files nobody has opened in 90 days.
• Add a verbal disclosure to the first five seconds of every recorded line, then verify it is inside the saved file.
• Write a call recording retention period into one page, and check that the platform deletes on that schedule.
• Pause recording while a card number is spoken, and confirm the pause by listening to a test call.
• Move call recordings out of individual OneDrive folders into a location the business controls and can search.
• Ask a lawyer in each state where your team places or answers calls to confirm the rule.

Two of the seven get skipped. Nobody wants to turn a recording off, because it feels like discarding evidence, and nobody wants to pay for legal advice on a problem that has not happened yet. Turning off an unused recorded line removes risk for free, and storage is not the argument either, because one hour of recording is 400 MB. Phone changes also surface other problems, which is why we wrote Phone Number Porting Problems: The Four Ways It Fails.

Five questions for the provider who manages your phones

Ask these five on Tuesday. A provider who runs your phone system answers all five from memory or from the admin console inside ten minutes.

• Which lines are recording today, and who switched each one on?
• What does a caller hear in the first five seconds, and is that announcement inside the recording?
• Where do the files land, who can download them, and when do they delete?
• Does the consent prompt work on our call queue, and what is the fallback if it does not?
• Can you show me the consent entry in the audit log for one recorded call from last month?

A provider who names the platform is selling it. A provider who plays you the first five seconds of a recorded line is operating it.

Those questions have the same shape as the ones your own customers now send you, so the answers get reused. Read When your customer sends you a security questionnaire for the inbound version, and IT due diligence before you buy another company if you are buying a firm whose recorded lines become yours on closing day.

A buyer's guide, not legal advice

Nothing above is legal advice, and no article can be. We quote one federal statute and five state statutes read at their primary sources on 21 October 2026. Statutes get amended, courts interpret them, and the facts of your own calls decide the outcome. A lawyer licensed in the relevant state is the only person who can tell you whether your recorded line is lawful.

The operating posture does not have to wait for that answer. Announce the recording out loud, keep the announcement inside the file, record only the lines somebody uses, retain them on a written schedule, and pause before anyone reads out a card number. Then get the legal confirmation in writing, state by state, for the places your team calls. None of that makes a recorded line risk-free, and no honest provider claims it does. It moves you from hoping nobody asks to being able to answer.

FAQ

Do I have to tell someone I am recording a phone call?

Federal law requires consent from one party to the call, and the person recording counts as that party. Several states require consent from everyone on the line instead. A spoken disclosure in the first five seconds satisfies both rules, so announce it rather than reasoning about which statute applies.

Which states require all parties to consent to a call recording?

We verified three all-party states at primary source. Florida permits interception only when all of the parties have given prior consent, Maryland applies the same all-party test, and Washington bans recording without the consent of all the participants. Other states have all-party rules we did not verify, so check your own.

Is a beep or notification tone enough?

None of the five statutes we read requires a notification tone. Washington asks instead that one party announce the recording "in any reasonably effective manner", and that the announcement shall also be recorded. A spoken line does more than a beep, because it names who is recording and leaves proof in the file.

What about a call between a one-party state and an all-party state?

An interstate call can touch two rules at once, and no phone system resolves which one governs. The federal one-party exception also falls away where the purpose is a criminal or tortious act under the laws of any State. Operate every recorded line to the stricter rule and the question stops mattering day to day.

How long should we keep call recordings?

Retain them only as long as a named business reason needs them, then delete on a written schedule. Teams meeting recordings default to a 120-day expiration, but that policy covers meetings and events rather than calls, and a one-to-one call recording lands in the OneDrive of whoever pressed record.

← All Blogs