Call Recording Compliance in 2026: Consent & AI

Why Call Recording Became a Board-Level Risk

For most of my career, call recording was a contact center feature. A supervisor wanted to coach agents, a compliance team wanted evidence of trades, and the recorder sat quietly in a rack next to the PBX. Nobody outside IT and compliance thought much about it.

That is no longer true. Three shifts over the past few years have moved recording from a feature to a governance problem that boards and regulators now ask about directly.

Regulators proved they will enforce recordkeeping at scale. Since fiscal year 2022 the SEC brought 95 actions and $2.3 billion in penalties against firms that failed to preserve business communications, and the CFTC added roughly $1.2 billion more. In April 2026 the SEC signalled that it will de-prioritize stand-alone recordkeeping cases, but it did not repeal a single books-and-records rule. The obligation is unchanged. Only the enforcement appetite has moved, and that can move back.

AI made every conversation a dataset. Transcription, summarization and speech analytics are now switched on by default in most UC and contact center platforms. A recording that used to sit untouched for seven years is now transcribed, indexed, summarized and, in some vendor contracts, used to improve someone else's models. In California, consumers are already suing AI vendors under the state's wiretapping law for listening to customer service calls.

The EU drew a hard line on emotion AI. Since February 2025 the EU AI Act has prohibited systems that infer the emotions of employees in the workplace, and the European Commission's own guidance names call center voice analytics as an example. Plenty of "agent sentiment" dashboards are now a legal liability in Europe.

In fifteen years of designing and auditing recording platforms for banks, insurers, healthcare groups and public bodies, I have learned that most organizations are not short of recording technology. What they lack is a defensible answer to four questions: who are we allowed to record, what are we required to record, how do we protect it, and when must we destroy it. This guide works through each one.

Is Call Recording Legal? Four Questions to Answer First

The short answer is yes, almost everywhere, provided you do it properly. Whether a specific recording is lawful depends on four things, and I ask clients to answer them in this order:

Consent and notice. Has every party who must know about the recording been told, and where required, agreed?
Jurisdiction. Where is each party physically located when the call takes place? The answer decides which rules apply, and it is often more than one set.
Purpose and lawful basis. Why are you recording? Regulatory obligation, contract, dispute resolution, quality and training, and fraud prevention are all legitimate purposes, but each one needs to be documented and each one limits what you may later do with the recording.
Storage, access and retention. Is the recording encrypted, access-controlled, kept for the right period and then destroyed?

Most organizations answer the first question reasonably well because the "this call may be recorded" message is familiar. The failures I see in audits sit almost entirely in questions two, three and four.

Under a one-party rule, a conversation may be recorded as long as at least one participant consents. If your employee is on the call and your organization records it, that participant's consent is usually enough. The US federal Wiretap Act (18 U.S.C. 2511(2)(d)) works this way, as do most US states and Canada's Criminal Code.

One-party consent is a legal floor, not a design standard. It tells you what is not a crime. It does not tell you what is transparent, what satisfies privacy law, or what holds up when the other party turns out to be in a stricter jurisdiction.

Under an all-party rule, every participant must consent before recording starts. In the US, nine states are consistently treated as all-party jurisdictions for phone calls: California, Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Pennsylvania and Washington. Connecticut, Delaware, Michigan and Nevada have mixed or contested rules that most counsel advise treating as all-party for business recording.

The penalties are not trivial. California allows civil damages of $5,000 per violation, and in several of these states unlawful recording is a felony. The California Supreme Court confirmed in Kearney v. Salomon Smith Barney that a firm recording calls from a one-party state can still be liable under California law when the person on the other end is in California.

Consent can be obtained in several ways, and they are not equally strong:

Implied consent comes from a clear announcement at the start of the call followed by the caller choosing to continue. This is the standard approach for inbound service lines and is accepted in most jurisdictions, provided the announcement plays before recording starts and states that recording is happening, not merely that it "may" happen.
Explicit consent is an affirmative action, such as pressing a key or saying "yes". It is stronger evidence and is advisable for outbound calls, for sensitive conversations, and where privacy law makes consent your lawful basis.
Contractual notice in terms of business or employment contracts covers ongoing relationships, but it does not cover a first-time caller or a third party who joins the call.

What I tell clients: one announcement, played on every external call, worded for the strictest jurisdiction you serve. A single global standard is cheaper to operate and easier to defend than a matrix of regional exceptions.

When a caller objects

Every recording policy needs an answer for the caller who says "I don't want to be recorded". Under GDPR, where consent is your lawful basis, you must be able to honour that objection. Elsewhere it is simply good practice. Practical options include an IVR option that routes to a non-recorded queue, an agent control that stops recording with a logged reason, or an offer to continue by email or in writing. Where recording is a regulatory obligation, as it is for MiFID II order taking, the right answer is often that the firm cannot proceed with the transaction by phone, and agents need a script that says so politely.

The global call recording consent landscape compared across eight regions No two regions frame the question the same way. US law asks who consented; European law asks whether you have a lawful basis and told people about it.

United States

Federal law sets a one-party floor and each state can raise it. When a call crosses state lines, assume the stricter state applies. For a national contact center that effectively means designing every call to California and Florida standards. Two further US developments matter in 2026:

AI vendors are now defendants. In the consolidated In re Google Cloud Contact Center AI Privacy Litigation, consumers allege that an AI vendor acting for retailers "listened" to customer service calls in breach of California Penal Code 631. The court has dismissed claims where account holders had consented, but allowed plaintiffs to amend where consent was unclear. The lesson for deployers is that your consent notice must cover every system that processes the audio, including third-party AI.
State privacy laws add data rights. Comprehensive privacy laws in California and more than a dozen other states give consumers rights to know, access and delete personal information, and recordings and transcripts are in scope.

European Union

Under GDPR, a voice recording of an identifiable person is personal data, and the question is not "who consented" but "what is your lawful basis". The usual bases are:

Legal obligation, for example MiFID II order recording. No consent is needed, but you must still inform the caller.
Contract, where the recording is genuinely necessary to perform the contract.
Legitimate interests, for quality and dispute resolution. This requires a documented balancing test and an easy way to object.
Consent, which must be freely given, specific, informed and as easy to withdraw as to give. That makes it a poor fit for mandatory recording.

Alongside the lawful basis you need transparency (Articles 13 and 14), data minimization, a defined retention period, a Data Protection Impact Assessment for large-scale or AI-driven processing, and working processes for access and erasure requests. The maximum fine is €20 million or 4% of worldwide annual turnover, whichever is higher. Several member states also have national telecoms or criminal law rules on recording, so local counsel still matters.

United Kingdom

The UK combines UK GDPR and PECR with the Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-keeping Purposes) Regulations 2018. These regulations allow a business to record on its own telecoms system for defined purposes, such as establishing facts, regulatory compliance, quality and preventing crime, provided it makes all reasonable efforts to inform users that recording may take place. FCA-regulated firms have a separate, mandatory recording duty under SYSC 10A, covered below.

Canada, Australia and the rest of the world

Canada is one-party under the Criminal Code, but PIPEDA and the provincial privacy laws require organizations to tell people why their information is being collected. In practice that means the same up-front notice you would use anywhere else.
Australia is more complex than most summaries suggest. The federal Telecommunications (Interception and Access) Act 1979 prohibits intercepting communications passing over the network without the parties' knowledge, and each state and territory has its own surveillance or listening devices act. Most require all-party consent, while Queensland allows a participant to record. Because callers can be anywhere in the country, the only workable approach is to notify every caller before recording starts.
Brazil's LGPD follows the GDPR model of lawful basis and transparency, and Mexico and Argentina have comparable data protection requirements.
APAC markets such as Singapore (PDPA), Japan (APPI) and India (DPDP Act) generally permit business recording but require that people are told the purpose of collection, with growing obligations around retention and cross-border transfer.

Industry Mandates: When Recording Is Required, Not Optional

Consent law tells you when you may record. Sector regulation tells you when you must, what you must capture, and how long you must keep it. Most of the enterprises we work with fall under two or three of these frameworks at the same time.

Matrix comparing recording mandates under MiFID II, SEC and FINRA, CFTC, HIPAA, PCI DSS and GDPR Where frameworks overlap, the longest retention and the strictest control win. Design for the union of your obligations, not the minimum of any one.

Financial services

MiFID II and FCA SYSC 10A require investment firms to record telephone conversations and electronic communications that relate to, or may result in, transactions. That includes calls that do not end in a trade. Clients must be told in advance, records must be tamper-resistant and available to the client on request, and retention is five years, extendable to seven at the FCA's request.
SEC Rule 17a-4 requires broker-dealers to preserve business communications for three years, the first two readily accessible, on WORM storage or a compliant audit-trail system. FINRA Rule 3170 goes further for designated "taping firms", which must record all telephone conversations between registered persons and customers.
CFTC Rules 1.31 and 1.35 require futures commission merchants and certain other registrants to keep oral communications that lead to a commodity interest transaction for at least one year, and written records for five.

The off-channel enforcement wave taught the industry an expensive lesson: the regulator does not care which app the conversation happened in. If a trader discusses a deal on WhatsApp or a personal mobile, that conversation is in scope. A compliant recording program today covers mobile voice and messaging, not just the desk phone and Teams.

Healthcare

HIPAA does not require recording, but any recording or transcript that contains protected health information (PHI) falls under the Privacy and Security Rules. That means access controls, audit logging, encryption, workforce training and a Business Associate Agreement with every vendor that stores or processes the audio, including transcription and AI providers. HIPAA does not set a retention period for recordings themselves; that comes from state medical-records law. HIPAA policies and documentation must be kept for six years.

Civil penalties remain substantial. Because the federal 2026 inflation adjustment was cancelled, the 2025 amounts still apply: up to $2,190,294 per calendar year for violations of an identical provision.

Public sector and emergency services

Government bodies, utilities and emergency services often record by statute or policy, and their recordings become public records subject to freedom-of-information requests and formal retention schedules. The design challenge is less about consent and more about retrieval: being able to find, review, redact and release a specific call within a statutory deadline.

Designing the Recording Platform

Most compliance failures I investigate are architectural, not legal. The policy said "record all trader calls", but a new Teams user was never assigned the recording policy, the SBC fork was not configured on a backup trunk, or recordings were silently dropped when the recorder was busy. The architecture has to make the compliant outcome the default.

Reference architecture for enterprise compliance recording from sources through capture, recording, processing, preservation and use Capture by policy, record in one place, preserve in an evidential vault and govern every downstream use.

Microsoft Teams

Teams' built-in meeting recording is a productivity feature. It is not a compliance recording solution: users start and stop it, and files land in OneDrive or SharePoint under user control. For regulated recording, Microsoft supports policy-based compliance recording through certified third-party partners. An administrator assigns a compliance recording policy to users, and a recorder bot is automatically invited into every call and meeting those users join.

Three design decisions matter most:

Fail closed where the regulation demands it. Compliance recording policies can require the recorder to be present before a call is established and throughout it. For traders this is usually the right setting, because an unrecorded call is a breach. For general staff it may be too disruptive.
Resilience. The recorder bot runs in Azure. Deploy it in at least two regions and monitor recording success rates, not just bot health.
Policy coverage. Tie policy assignment to HR or identity group membership so that new joiners and movers are covered from day one. Reconcile it monthly.

Webex, Zoom and SIP platforms

Webex Calling and Zoom Phone both support policy-driven automatic recording and integration with specialist recorders. For on-premises PBXs, SIP trunks and contact center platforms, the standard capture method is SIPREC (RFC 7866): the session border controller forks a copy of the media to the recorder without involving the endpoint. Configure SIPREC on every trunk and SBC in the HA pair, including disaster-recovery paths, and test it as part of your failover drills.

The evidential vault

Recordings are only useful as evidence if you can prove they have not been altered. That requires:

Immutable storage, whether WORM or object storage with retention locks, so recordings cannot be modified or deleted before their retention date, even by administrators.
Integrity controls, such as hashing at capture and chain-of-custody metadata, so you can demonstrate that the file produced in court is the file recorded.
Rich metadata, including participants, numbers, timestamps, regulatory tags and retention class, so a recording can be found by trade, customer or employee within hours rather than weeks.
Data residency controls that keep recordings in approved regions, which matters for GDPR transfer rules and for many public sector contracts.

Securing Recordings Across Their Lifecycle

A call recording library is one of the most sensitive data sets an organization holds. It contains voices, from which biometric voiceprints regulated under laws such as Illinois BIPA can be derived, along with account details, health information, trading intentions and unguarded internal conversations. Protect it with the same rigour as your customer database.

The seven-stage compliant recording lifecycle: notify, capture, protect, store, control, retain and dispose Auditors test every stage. Most of the findings we raise sit in the last three.

Encrypt in transit and at rest. Use TLS for signalling and SRTP for media on every hop, including the SIPREC leg to the recorder, which is often left unencrypted. Use AES-256 at rest with keys in a managed KMS or HSM, and use customer-managed keys where your risk profile warrants it.
Control access tightly. Use SSO with MFA, role-based access scoped by team, region and recording class, and just-in-time elevation for bulk export. A quality manager should hear their own team's calls, not the trading floor's.
Log every access. Record every search, playback, download and export, forward the logs to your SIEM, and review unusual patterns. Recording libraries are a favourite target for insiders.
Define retention by class. Map each recording type to its longest applicable obligation, for example MiFID orders for five years, CFTC oral communications for one year and service calls for 90 days, and enforce it automatically.
Make legal hold override deletion. When litigation or an investigation is anticipated, holds must suspend deletion for the affected recordings, and only those.
Delete defensibly. Automated deletion at the end of retention, with an auditable record of what was destroyed and when. Keeping recordings "just in case" is itself a GDPR breach and expands your discovery exposure.

PCI DSS: Keeping Card Data Out of Recordings

If your agents take card payments by phone, PCI DSS is non-negotiable. Requirement 3.3.1 of PCI DSS v4.0.1 prohibits storing sensitive authentication data, including the card verification code (CVV), after authorization, even if it is encrypted. The PCI Security Standards Council has confirmed that a CVV captured in a .wav or .mp3 recording violates this requirement.

In order of preference, the controls are:

DTMF masking or payment IVR. The customer types card details on their keypad, the tones are suppressed or flattened before they reach the agent and the recorder, and the payment goes straight to the processor. The agent stays on the line, the full call is recorded, and card data never enters your environment. This also removes much of the contact center from PCI scope.
Automated pause and resume. The recorder pauses when the agent's desktop reaches the payment screen and resumes afterwards. This is better than manual pausing, but the agent still hears the card number.
Manual pause and resume. Agents press a button. In every audit where we have tested this, we have found recordings in which the agent forgot.

Screen recordings need the same treatment: mask payment fields in the recorder, or exclude payment applications from capture.

AI Transcription and Speech Analytics

AI is where recording programs now carry most of their new risk, and also where they deliver most of their new value. Automated QA, compliance phrase detection, complaint identification and trade surveillance are genuinely transformative. They must be governed as carefully as the recordings themselves.

Light-themed speech analytics dashboard showing a call waveform, a transcript with redacted personal data, and governance controls Transcripts are recordings in text form. Redact them, secure them and retain them under the same rules as the audio.

Treat transcripts and summaries as records. They contain the same personal data as the audio and are far easier to search, copy and leak. Apply the same retention, access and legal hold controls.
Redact automatically. Detect and redact card numbers, national ID numbers, health details and credentials in transcripts before they reach analytics, search or LLM summarization.
Read the model-training clause. Many AI services reserve the right to use customer content to improve their models. For regulated recordings, insist on contractual and technical opt-outs, regional processing and deletion commitments. As the California litigation shows, a vendor's ability to reuse audio can be enough to create exposure.
Remove emotion inference on employees in the EU. Under Article 5(1)(f) of the EU AI Act, inferring the emotions of workers is prohibited unless it is for medical or safety reasons. Analysing a customer's tone is not prohibited, but the European Commission's guidance is explicit that systems must not infer the agent's emotions at the same time. Audit your "sentiment" features per channel and per speaker.
Keep a human in the loop for consequential decisions. If AI scores influence performance ratings, disciplinary action or credit decisions, GDPR Article 22 and, from December 2027, the AI Act's high-risk obligations for employment-related systems require transparency, human oversight and documentation.
Run a DPIA before go-live. Large-scale speech analytics is a textbook case for a Data Protection Impact Assessment. Done early, it is also the cheapest place to design out the risks above.

Seven Findings We See in Almost Every Audit

The announcement plays after recording starts. The first five seconds of every call are recorded without notice, and in an all-party state that is enough to found a claim.
Policy coverage drift. New hires, contractors and role changes are not assigned the compliance recording policy, so regulated users go unrecorded for weeks.
Silent capture failures. The recorder dropped calls during a failover or license exhaustion, and nobody was alerted because monitoring checked the server, not the recordings.
Mobile and messaging gaps. Desk phones and Teams are recorded, but the business also happens on mobile voice and WhatsApp.
Card data in recordings. Manual pause and resume, inconsistently used, leaves CVVs in the archive and puts the whole platform in PCI scope.
Over-retention. Everything is kept forever because nobody owns the retention schedule, which turns a compliance asset into a discovery liability.
Shadow AI. Teams have connected an AI notetaker or analytics tool to the recording library without a DPIA, a BAA or a review of the training clause.

Enterprise Call Recording Compliance Checklist

Recording inventory covering every platform, trunk, SBC, mobile and messaging channel in scope
Lawful basis and purpose documented per recording population, with a DPIA where required
One consent announcement, played before recording starts, written for the strictest jurisdiction served
Documented process for callers who object, including non-recorded routing where permitted
Policy-based capture tied to identity groups, reconciled monthly against HR records
Fail-closed recording for regulated users where the rules demand it
SIPREC configured and tested on every SBC and trunk, including DR paths
Capture-success monitoring with alerts on gaps, not just on server health
TLS and SRTP on every hop, AES-256 at rest with managed keys
SSO, MFA, least-privilege roles and full access logging to the SIEM
Immutable storage with integrity hashing and data residency controls
Retention schedule by recording class, automated deletion and working legal hold
DTMF masking or payment IVR for every card-taking queue
Transcript redaction, vendor model-training opt-outs and BAAs in place
No emotion inference on employees in EU operations
Annual end-to-end audit: place a test call, then retrieve, verify and delete it

Conclusion

Call recording compliance is not a product you buy, and it is not a message you play at the start of a call. It is a chain: notice, capture, protection, storage, access, retention and disposal, now extended by AI processing that regulators and courts are only beginning to test. Every link has to hold, and you have to be able to prove that it held.

The organizations that handle this well have three things in common. They write their consent and retention rules for the strictest jurisdiction they serve rather than the most convenient one. They make capture a platform policy rather than a user choice. And they treat recordings and transcripts as regulated records from the moment of capture to the moment of verified deletion.

XeroStop designs, deploys and audits compliance recording platforms across Microsoft Teams, Webex, Zoom and SIP-based contact centers. See how Xero Recorder delivers policy-based capture, immutable storage and governed AI analytics, read our guide to securing unified communications in 2026, or talk to our team about a recording compliance assessment.

This article is general guidance and not legal advice. Recording law varies by jurisdiction and changes frequently; confirm your obligations with qualified counsel.

Call Recording Compliance in 2026: An Enterprise Guide to Consent, Retention and AI

Why Call Recording Became a Board-Level Risk