Is it legal to record calls handled by an AI agent?
RavinaroDo I need consent to record?
It depends where the caller is, and the answer is not uniform. A number of jurisdictions require that every party to the call consents — Florida, California, Pennsylvania, Illinois, Massachusetts, Maryland and Washington among them. Others require only one party. Rules in the EU and UAE add their own requirements on top.
Because a phone number does not tell you where the person dialling it is standing, the only workable rule is to disclose on every call and treat continuing the call as consent. This is general information, not legal advice; if you take calls across borders, have a lawyer look at your specific setup.
| Where the caller is | Typical consent rule | What we do |
|---|---|---|
| US — all-party states | Every party must consent. Includes California, Florida, Pennsylvania, Illinois, Massachusetts, Maryland, Washington. | Disclose on every call |
| US — one-party states | One party's consent is enough | Disclose on every call |
| EU / UK | GDPR: a lawful basis, plus notice before recording | Disclose on every call |
| UAE | Notice and consent expected | Disclose on every call |
General orientation, not legal advice. A phone number does not tell you where the person dialling it is standing, which is why the rule is the same everywhere: disclose at the start of every call.
What should the agent say?
It should say it at the start, before anything worth recording has been said. The opening line covers both facts at once: that it is an AI, and that the call is recorded so the business can follow up accurately.
Disclosing at the end, or in a privacy policy nobody reads, does not help. The caller has to be able to hang up before they have said something they would not want recorded.
Why record at all?
Because the transcript is the product. Recording is what produces the summaries, the qualified-lead list, and the monthly report — and it is what lets you check what the agent actually said when a customer claims otherwise.
If you do not want recording, an agent can be built without it. You lose the transcripts and most of the reporting, and that is a real trade rather than a setting.
How long are recordings kept?
For a defined retention period, not indefinitely, and they belong to you. You own your recordings, your transcripts, your conversation data and your CRM records. If you leave, they are handed over rather than withheld, and there is no exit fee for asking.
Sources
The rules quoted above come from the primary sources below. They are the law itself, not a summary of it — worth reading before you rely on anything here. This page is general information, not legal advice.
- Florida Statutes § 934.03 — interception of communications — Recording is lawful under § 934.03(2)(d) only where every party to the call has given prior consent. Florida is an all-party consent state.
- GDPR, Article 6 — lawfulness of processing — Regulation (EU) 2016/679. Processing is lawful only where at least one of six bases applies.
- UAE Federal Decree-Law No. 45 of 2021 (Personal Data Protection Law) — Article 4 prohibits processing personal data without the data subject’s consent, subject to enumerated exceptions. Article 6 requires consent to be provable, clear, unambiguous and withdrawable.
- Autoriteit Persoonsgegevens — direct marketing and recording — The Dutch DPA states that direct marketing needs a legal basis under the AVG, and that a caller must be told at the start of a call that it is being recorded.