Eleven States Where Recording a Call Can Be a Felony

Somewhere right now, an AI voice agent is picking up a lead and quietly hitting record. The caller is in California. The business is in Texas. Nobody in the chain has said the word "recorded" out loud. The audio file lands in a CRM, tidy and timestamped, and it sits there. It might win a dispute someday. It might also be a felony.

That gap, between the recording you meant to make and the recording the law lets you make, is where intake teams get hurt.

One party, all parties, and the line between them

Start with the federal floor. The Electronic Communications Privacy Act, the ECPA, generally allows one-party consent (Kixie). That means in plain federal terms, if you're on the call, you can record it. One person knowing is enough, and that person can be you.

Then the states get a vote. Eleven of them require all-party consent: California, Delaware, Florida, Illinois, Maryland, Massachusetts, Montana, Nevada, New Hampshire, Pennsylvania, and Washington (Kixie). In those eleven, "I knew I was recording" doesn't cut it. Everyone on the line has to know, and the silence of the other party is not a yes.

Here's the part operators skip. Federal law is the floor, not the ceiling. A state can demand more, and eleven do. So the question is never "what does federal law allow." It's "whose phones are on this call, and which of them lives in one of the eleven."

The felony part is not a metaphor

People hear "consent law" and picture a warning letter. Read the penalties.

Violations in California and Florida can be felonies (Kixie). Not a fine, not a slap. A felony, the kind that follows a person and a company around. In Maryland and Massachusetts, the cited exposure runs up to five years' imprisonment (Kixie). Five years for a recording your software made by default, before anyone thought about the rule.

Sit with the asymmetry. The recording you took to protect yourself in a "he said, she said" becomes the single cleanest piece of evidence against you. Same file. Same timestamp. The only thing that changed is who's reading it in court. That's the through-line of every call you keep: it's evidence either for you or against you, and consent is the switch that decides which.

For regulated intake, where the calls are leads and clients with real stakes, that switch can't be left to chance. (General information here, not legal advice. Verify the specifics for your states with counsel before you build anything around them.)

The interstate trap

Single-state operators have it easy. The rest of us live in the mess.

A wholesaler in Phoenix calls a seller in Sacramento. Arizona is a one-party state. California is one of the eleven. Which rule wins? The stricter one. When a call crosses state lines, you apply the strictest applicable law (Kixie), which in practice means you treat half the country as if it requires all-party consent, because you can't always know where the other phone is sitting.

This is the trap for AI voice. The agent doesn't know the caller drove to Vegas this morning. The lead's area code says one state. Their actual location says another. Default-record plus interstate calls plus eleven all-party states is a compliance problem that compounds every single day you run volume.

What the build actually has to do

The fix isn't to stop recording. Recordings are too useful for that. The fix is to make consent a system, not a hope.

Disclose at the start of every call. In all-party states the recording party has to disclose at the start of the call, and an automated greeting can satisfy that requirement (Kixie). That last point matters more than it looks. Your AI agent's opening line, the one it says before anything else, can be the disclosure. "This call may be recorded for quality and training." Built in. Every call. No human remembering to say it.

So the spec writes itself. Disclose recording in the agent's first sentence, every time, no exceptions. Geo-detect the parties and flag any call touching one of the eleven all-party states. Apply the strictest applicable rule by default, which means you behave as if all-party consent is required and you're rarely wrong. And then log the consent event to the audit trail: the disclosure played, when, on which call, captured.

That last piece is the whole game. A consent rule you followed but can't prove is a consent rule you might as well have skipped. The audit trail is what turns "we always disclose" into "here's the timestamped record that we disclosed on this exact call." When the recording becomes evidence, that log is what decides which direction it points.

Build it that way and the worst-case call, the one a lawyer pulls two years later, works for you instead of against you. The disclosure played. The consent logged. The recording clean. The same file that could've been a felony exhibit is just proof you did it right.

Record everything. Disclose first. Log the proof. The tape doesn't care whose side it's on, so make sure it's on yours.