Recording calls with AI: the consent rules every voice startup needs to know

If your product records, transcribes or analyzes conversations, whether it's a meeting assistant, a contact-center tool, a voice agent or in-store voice capture, consent isn't a checkbox for later. It's one of the first legal questions an enterprise customer will ask, and one of the most actively litigated.

One-party vs. all-party consent

US states fall into two broad groups.

• One-party consent. Federal law and many states allow recording if one participant consents, which can be the person recording.
• All-party consent. California, Washington and several other states require the consent of everyone in the conversation, at least for private or confidential communications.

Because a single call can cross state lines, most companies design for the strictest rule.

California

Penal Code section 632 makes it unlawful to record a confidential communication without the consent of all parties. A communication is confidential if a participant reasonably expects it isn't being overheard or recorded.

The financial exposure is what gets attention: under Penal Code section 637.2, a person can recover the greater of $5,000 per violation or three times actual damages, and the statute doesn't require proof of actual damage. In a class action covering thousands of calls, that adds up fast.

California's wiretapping provision, Penal Code section 631, is also being used against AI vendors themselves. In Ambriz v. Google (N.D. Cal. 2025), a federal court let claims proceed against Google's contact-center AI, reasoning that a vendor that's able to use call data for its own purposes may be treated as a third-party eavesdropper, not just a tool of the business. That was an early ruling on the pleadings, and the theory is being contested, but it shows where plaintiffs are aiming.

Washington

Washington also requires all-party consent (RCW 9.73.030). It offers a practical path: consent is treated as given when one party announces to everyone that the conversation will be recorded, and the announcement itself is recorded.

Building consent into the product

• Announce at the start. An audible, recorded notice, such as "This call is recorded and transcribed by [product]", before substantive conversation.
• Give a way out. Let people object, and stop recording or route them to a human.
• Cover in-person capture. Signage and notice at the point of capture, and a plan for bystanders who never agreed.
• Limit your own use. Courts look at whether the vendor can use the data for itself, such as training models. Make that off by default or contractually limited, and say so clearly.
• Keep records. Log when and how consent was given.

Put it in your contracts

Your customer agreement and data processing addendum should say who's responsible for obtaining consent (usually the customer, using tools you provide), what you may and may not do with recordings and transcripts, how long you keep them, and what happens when a person asks for deletion.

Get these terms right before your first large customer's security and legal review. They will ask.