Call recording laws aren't the same everywhere, and they don't always match what people assume. What's legal in one state or country can be a criminal offense in another, even for the same kind of call.

Getting consent wrong isn't just a compliance footnote. Recording a call without the right consent can carry criminal penalties or civil liability depending on where the parties are located. 

This guide breaks down the basic call recording rules in different countries that also apply to recruiters. Let’s start! 

When to record, and when not to

Recording calls has clear upside: nothing important gets lost, there's a reliable record to return to, and reviewing calls later helps improve how future ones go. But some conversations carry more legal sensitivity than others.

Two situations call for extra caution:

• Legal exposure varies by location: The same call might be perfectly legal to record in one state and unlawful in the next, depending on whether every participant needs to consent.
• Privacy-sensitive conversations: Performance reviews, one-on-one feedback sessions, and similar conversations can still be recorded with consent, but access to those recordings should be limited strictly to the people involved.

Understanding consent types

Before looking at specific states or countries, it helps to know the vocabulary regulators and vendors use:

• One-party consent: Only one person on the call needs to agree to the recording. If the person recording is a participant on the call, their own consent is enough.
• All-party (two-party) consent: Every person on the call must agree before recording starts. Missing even one person's consent makes the recording unlawful in these jurisdictions.
• Active consent: Someone explicitly agrees, out loud or by clicking a button, before recording begins.
• Passive (implied) consent: Someone hears a notice that the call is being recorded and stays on the line without objecting. Staying on the call after the notice generally counts as consent in most jurisdictions.

US call recording laws by state

Most US states follow one-party consent, meaning a participant on the call can record it without telling the other person. A smaller group of states requires consent from everyone on the call. The federal baseline, the Electronic Communications Privacy Act (also called the Wiretap Act), only requires one-party consent, but state law can be stricter, and the stricter state's rule wins if a call crosses state lines.

One-party consent states include: Alabama, Alaska, Arizona, Arkansas, Colorado, Georgia, Hawaii, Idaho, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maine, Minnesota, Mississippi, Missouri, Nebraska, New Jersey, New Mexico, New York, North Carolina, North Dakota, Ohio, Oklahoma, Rhode Island, South Carolina, South Dakota, Tennessee, Texas, Utah, Vermont, Virginia, West Virginia, Wisconsin, Wyoming, and Washington D.C.

All-party (two-party) consent states include: California, Delaware, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, New Hampshire, Pennsylvania, and Washington.

States with extra nuance worth double-checking:

• Connecticut: One-party consent generally avoids criminal liability, but recording without all-party consent can still trigger a civil lawsuit.
• Oregon: One-party consent for phone calls and texts, but all-party consent for in-person conversations.
• Nevada: All-party consent for phone calls, but one-party consent for in-person conversations.
• Michigan: The state's all-party consent statute has been read by courts to apply mainly to third parties, not someone who is on the call.
• Delaware: Written as an all-party consent state, though a federal court has found the statute was meant to mirror the one-party federal standard for a party recording their own call.
• Missouri: One-party consent covers phone calls, but the state takes a different, more restrictive approach to recording in-person conversations.
• Indiana and New Mexico: Both states are clear on one-party consent for phone calls, but their statutes don't clearly address in-person conversations or, in New Mexico's case, cell phone calls specifically.
• Vermont: Has no statute directly addressing consent to recording. Courts have ruled case by case based on whether a person had a reasonable expectation of privacy.

A few narrow exceptions show up across most states regardless of the general rule, most commonly for law enforcement activity or emergency response situations.

How long can recordings be kept?

Retention rules depend on the type of conversation and the industry. A general business call doesn't carry the same retention requirements as, say, a healthcare conversation. In the US, a call recording involving patient health information is treated as a healthcare record under HIPAA, which requires encryption at rest and password-protected sharing limited to authorized users.

Outside of regulated categories like healthcare, organizations commonly retain recordings anywhere from a few months up to 6-10 years depending on internal policy and any applicable regulation. The right retention period should tie back to why the recording was made in the first place, not run indefinitely by default.

International call recording laws

European Union (GDPR): Any recording that identifies a caller counts as personal data. A lawful basis is required to record, and GDPR recognizes several: consent, fulfilling a contract, a legal obligation, protecting the interests of a party, public interest, or legitimate interest (provided it doesn't override the recorded person's rights). Participants must be told in advance what's being recorded, why, how long it's kept, and who can access it, and recordings can only be stored for as long as needed to fulfill that purpose. GDPR also gives participants the right to access their recording and request details on how it's used, and the right to request erasure once the recording is no longer needed, consent is withdrawn, or it was recorded unlawfully.

United Kingdom: One-party consent covers private recording for personal use, but any recording used or shared in a business context also has to comply with UK GDPR, the Data Protection Act 2018, and the Human Rights Act 1998, meaning participants still need to be informed and a lawful basis established.

Canada: Section 184 of the Criminal Code allows recording with the consent of just one participant, so recording your own call clears the criminal law bar. Businesses recording calls also fall under PIPEDA, which requires informing the other party in advance, explaining why the call is being recorded, and sharing how the recording will be used, so most Canadian business recording ends up requiring notice even where the criminal standard would not. Some provinces add further workplace-specific obligations on top of PIPEDA.

Australia: Surveillance and recording laws are set at the state and territory level, not federally, and the exact rule depends on which law applies:

• Queensland, Victoria, and the Northern Territory allow "participant monitoring": a party to a conversation can record it without the other party's consent.
• New South Wales, Tasmania, Western Australia, and the ACT generally require consent from all parties to the conversation, but each carries a conditional exception: recording with only one party's consent is still lawful if it's reasonably necessary to protect that party's lawful interests, or if the recording isn't intended to be shared with anyone outside the conversation.
• South Australia allows recording with one party's consent where it's reasonably necessary to protect that party's lawful interests, structured somewhat differently from the NSW/Tasmania/WA/ACT model.

Note: this information is only for educational purposes and should not be considered as legal advice. 

Compliance capable vs. compliance optimized software

Most call recording software can technically comply with recording laws, but "capable" and "optimized" aren't the same thing.

• Compliance capable: The software has the settings needed to comply, but leaves it to the user to remember to turn them on. A common example is a tool that announces a recording notice to an entire meeting every time someone new joins, interrupting the conversation rather than notifying just the new participant quietly.
• Compliance optimized: The software handles compliance by default, with notices placed where people will see them, such as directly in a calendar invite, rather than a separate email that can go unread, and disclosures scoped to new participants only instead of the whole group.

Questions to ask before choosing call recording software

• What are your default settings in one-party versus all-party consent states? A tool that treats every call the same, regardless of jurisdiction, pushes the compliance burden back onto the user.
• Is obtaining consent automated across different regions? Manual consent tracking doesn't scale once calls start crossing state or country lines.
• How is compliance handled if a participant never opens a pre-call notice? Some tools rely entirely on an email that can be missed.
• How is the recording disclaimer announced? A voice announcement, an on-screen banner, and a chat notice all serve the same purpose but suit different call types.
• How is consent handled for outbound and cold calls specifically? These calls often need a different consent flow than scheduled meetings.

Best practices for recording calls

• Say it out loud: State that the call is being recorded at the start, even in one-party consent states. It builds trust and covers calls crossing jurisdictions.
• Pick a lawful basis and document it: Know why the call is being recorded (coaching, compliance, records) and keep that reasoning on file.
• Record only what's needed: Avoid recording side channels, screens, or extra data beyond the call itself unless there's a specific reason to.
• Set a retention policy: Decide how long recordings and transcripts are kept, then delete them on a schedule instead of indefinitely.
• Secure the recordings: Encrypt recordings at rest and in transit, and limit access with role-based permissions and logs.
• Avoid recording sensitive data: Card security codes and similar sensitive details shouldn't end up in a recording or transcript; pause or mask the recording if that information comes up.
• Give people an opt-out: If someone objects to being recorded, be ready to continue the call without recording or switch to notes instead.
• Default to the stricter rule: For calls crossing state or country lines, following the more restrictive jurisdiction's requirement is the safer approach.

‍

Disclaimer

This article is a general summary and not legal advice. Call recording laws change, vary by exact circumstance, and can differ from how they're summarized here. Anyone recording calls across multiple states or countries should confirm current requirements with qualified legal counsel before relying on this guide.

Our resources: 

https://www.justia.com/50-state-surveys/recording-phone-calls-and-conversations/ 

https://laws-lois.justice.gc.ca/eng/acts/c-46/section-184.html 

https://www.lexisnexis.com/en-gb/legal/q-a/under-the-data-protection-rules-do-you-have-to-obtain-consent-from-everyone-in-a-meeting-to-record-the 

https://www.edpb.europa.eu/sme/be-compliant/process-personal-data-lawfully_en 

https://www.alrc.gov.au/wp-content/uploads/2019/08/fr123_14._surveillance_devices.pdf