By Siddharth Gangal TL;DR
- Federal baseline: Under the Electronic Communications Privacy Act (18 U.S.C. 2511), recording a phone call requires the consent of at least one party. If you are on the call, you satisfy this requirement in one-party consent states.
- 13 two-party states: California, Connecticut, Delaware, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, New Hampshire, Oregon, Pennsylvania, and Washington require all parties to consent before recording. Violations are felony-grade in several states.
- 38 one-party states + DC: You can record any call you participate in without notifying the other party. Best practice is to disclose anyway — it eliminates interstate exposure and builds trust.
- Safe rule for all teams: Announce recording at the start of every call, every time. This single step makes you compliant in all 50 states and costs under three seconds per call.
What are sales call recording laws?
Sales call recording laws are the federal and state statutes that govern when a party to a phone call may record that conversation and when they must notify or obtain consent from the other parties. In the US, federal law sets a one-party consent baseline, while 13 states impose stricter all-party consent requirements. Violations carry criminal penalties — up to felony charges in several states — plus civil liability of up to $10,000 or more per incident.
For sales teams, this matters on every single call. Recording a prospect conversation in California without disclosing it is not a gray area — it is a felony under Cal. Penal Code § 632, punishable by up to one year in jail and a $2,500 fine per incident, plus civil liability of $5,000 per recorded call. And that applies whether the rep is in California or simply calling someone who is.
The challenge for modern sales teams is that reps work across state lines constantly. An SDR in Austin calls a VP in Boston, a BDR in Chicago dials a prospect in Seattle. The law that governs that recording is not the rep's home state — it is the stricter of the two states. Compounding this: AI sales tools like Gong, Chorus, and AI call recording analysis platforms record calls by default. Every team using these tools carries compliance exposure if they have not configured proper disclosures.
This guide gives sales teams a complete reference: the 50-state consent table, the rules for interstate calls, GDPR and CCPA requirements for international prospect calls, and three tested disclosure scripts that work in every jurisdiction.
The federal baseline: ECPA and 18 U.S.C. 2511
The foundation of US call recording law is the Electronic Communications Privacy Act (ECPA), codified at 18 U.S.C. § 2511. The relevant provision states that it is unlawful to intentionally intercept a wire, oral, or electronic communication — with a key exception: consent of one of the parties to the communication.
This is the one-party consent rule at the federal level. If you are a participant in the call — as any sales rep making or receiving a prospect call is — you qualify as the consenting party. You can legally record the conversation without disclosing the recording to the other party, as long as you are in a one-party consent state and calling someone in a one-party consent state.
Key Federal Statute
18 U.S.C. § 2511(2)(d) — "It shall not be unlawful under this chapter for a person not acting under color of law to intercept a wire, oral, or electronic communication where such person is a party to the communication or where one of the parties to the communication has given prior consent to such interception."
Source: US Code, Electronic Communications Privacy Act (ECPA), 1986, as amended
State laws layer on top of the federal floor. States are free to enact stricter consent requirements — and 13 of them have. Federal law does not preempt these stricter state laws. This means that even if federal law permits one-party consent recording, a sales rep calling into California must comply with California's all-party consent requirement under Cal. Penal Code § 632.
Additionally, the Federal Communications Commission (FCC) maintains regulations under the Communications Act requiring that telephone companies and businesses that record calls announce the recording to callers. The FCC rule (47 C.F.R. § 64.501) applies primarily to common carriers, but it reinforces the industry norm of disclosure for commercial calls — including sales calls made on VoIP or cloud telephony platforms.
One-party vs two-party consent: the core difference
The distinction between one-party and two-party (all-party) consent determines how you handle recording on every call. Here is the practical difference:
| Dimension | One-Party Consent | Two-Party / All-Party Consent |
|---|---|---|
| Who must consent | At least one party (the rep qualifies) | Every party on the call |
| Disclosure required? | No — but recommended | Yes — before recording begins |
| Verbal confirmation needed? | No | Required in most two-party states |
| Criminal risk if violated | No violation possible (rep is consenting party) | Felony-grade in PA, NH, OR, MA, FL, CT, MD |
| Civil risk if violated | None from recording itself | $100–$10,000+ per violation; class actions possible |
| Number of US states | 37 states + DC | 13 states |
| Key examples | TX, NY, OH, GA, CO, VA, MN | CA, FL, IL, MA, PA, WA, MD |
The term "two-party consent" is technically a misnomer for calls with more than two participants. On a three-way or conference call, every person on the call must consent in all-party consent states — not just two of them. For sales teams running multi-stakeholder calls with procurement, legal, and the champion on the line, each participant needs to be informed before recording begins.
For live call coaching tools that analyze calls in real time, the recording occurs at the moment the call begins. This means the disclosure must happen in the opening seconds — before any substantive conversation takes place. Most modern AI coaching tools support automated disclosure prompts that play before the rep speaks.
All 50 states: consent type, statute, and penalties
This table is the core reference. It covers all 50 states plus Washington DC. For the 13 two-party consent states, penalties are included. For the 37 one-party consent states, the relevant statute is listed so legal teams can verify.
Note: Laws change. This table reflects research through May 2026. Confirm current statutes with qualified legal counsel before implementing recording policies.
Two-Party (All-Party) Consent States: 13 States
Every party on the call must consent before recording begins. Failure to obtain consent is a criminal offense in all 13 states.
| State | Statute | Max Criminal Penalty | Civil Exposure | Notes |
|---|---|---|---|---|
| California | Cal. Penal Code § 632 | Up to 1 year jail + $2,500 fine | $5,000 per violation or 3× actual damages | Highest civil exposure; class actions common. Covers phone AND in-person. |
| Connecticut | Conn. Gen. Stat. § 53a-187 | Up to 5 years prison + $5,000 fine | Civil damages available | Criminal and civil provisions both active. |
| Delaware | Del. Code tit. 11, § 1335 | Up to 5 years prison | Civil damages available | Covers electronic communications broadly. |
| Florida | Fla. Stat. § 934.03 | Up to 5 years prison + $5,000 fine | $100/day or actual damages, whichever is greater | One of the strictest enforcing states. TCPA claims also common. |
| Illinois | 720 ILCS 5/14-2 | Class 4 felony (1–3 years) | Actual damages or $10,000, whichever is greater | Eavesdropping Act covers all parties on the call. |
| Maryland | Md. Code, Cts. & Jud. Proc. § 10-402 | Up to 5 years prison + $10,000 fine | Actual damages + attorney fees | Strict; covers interception and disclosure. |
| Massachusetts | Mass. Gen. Laws ch. 272, § 99 | Up to 5 years prison + $10,000 fine | Actual damages or $100/day, whichever is greater | Among the strictest in the US. No business exception. |
| Michigan | Mich. Comp. Laws § 750.539c | Up to 2 years prison + $2,000 fine | Civil action available | Covers recording without permission of all parties. |
| Montana | Mont. Code Ann. § 45-8-213 | 6 months–5 years depending on offense | Civil damages available | Phone interception statute applies to sales calls. |
| New Hampshire | N.H. Rev. Stat. Ann. § 570-A:2 | Up to 7 years prison | Civil damages available | One of the harshest criminal penalties in the US. |
| Oregon | Or. Rev. Stat. § 165.540 | Up to 5 years prison + $125,000 fine | Civil action available | Highest criminal fine in the US. Covers electronic communications. |
| Pennsylvania | 18 Pa. Cons. Stat. § 5704 | Up to 7 years prison + $15,000 fine | Actual damages + $100/day or punitive | Interception statute; strict enforcement. Felony-grade violation. |
| Washington | Wash. Rev. Code § 9.73.030 | Up to 5 years prison + $10,000 fine | Actual damages or $1,000/day | Covers both oral and electronic communication interception. |
One-Party Consent States: 37 States + DC
Recording is lawful when at least one party on the call (the rep) consents. Disclosure to the other party is not legally required but is strongly recommended for national sales teams.
| State | Relevant Statute | State | Relevant Statute |
|---|---|---|---|
| Alabama | Ala. Code § 13A-11-30 | Alaska | Alaska Stat. § 42.20.310 |
| Arizona | A.R.S. § 13-3005 | Arkansas | Ark. Code Ann. § 5-60-120 |
| Colorado | C.R.S. § 18-9-303 | Georgia | O.C.G.A. § 16-11-62 |
| Hawaii | H.R.S. § 803-42 | Idaho | Idaho Code § 18-6702 |
| Indiana | IC 35-33.5-1-5 | Iowa | Iowa Code § 808B.2 |
| Kansas | K.S.A. § 21-6101 | Kentucky | KRS § 526.010 |
| Louisiana | La. R.S. § 15:1303 | Maine | Me. Rev. Stat. tit. 15, § 710 |
| Minnesota | Minn. Stat. § 626A.02 | Mississippi | Miss. Code Ann. § 41-29-531 |
| Missouri | Mo. Rev. Stat. § 542.402 | Nebraska | Neb. Rev. Stat. § 86-290 |
| Nevada | NRS § 200.620 | New Jersey | N.J.S.A. § 2A:156A-4 |
| New Mexico | N.M. Stat. Ann. § 30-12-1 | New York | N.Y. Penal Law § 250.00 |
| North Carolina | N.C. Gen. Stat. § 15A-286 | North Dakota | N.D. Cent. Code § 12.1-15-02 |
| Ohio | Ohio Rev. Code § 2933.52 | Oklahoma | Okla. Stat. tit. 13, § 176.3 |
| Rhode Island | R.I. Gen. Laws § 12-5.1-1 | South Carolina | S.C. Code Ann. § 17-30-30 |
| South Dakota | S.D. Codified Laws § 23A-35A-1 | Tennessee | Tenn. Code Ann. § 39-13-601 |
| Texas | Tex. Penal Code § 16.02 | Utah | Utah Code Ann. § 77-23a-4 |
| Vermont | Vt. Stat. Ann. tit. 13, § 4601 | Virginia | Va. Code Ann. § 19.2-62 |
| West Virginia | W. Va. Code § 62-1D-3 | Wisconsin | Wis. Stat. § 968.31 |
| Wyoming | Wyo. Stat. § 7-3-702 | District of Columbia | D.C. Code § 23-542 |
Interstate calls: which law applies?
Interstate calls are where most sales teams create unintended legal exposure. The general rule courts have applied: when participants are in different states with different consent requirements, the stricter law governs.
This means a rep in Texas — a one-party consent state — calling a prospect in California must comply with California's all-party consent law. The rep must disclose the recording and obtain the prospect's explicit agreement before starting the recording. Failure to do so exposes the rep and their company to California's civil and criminal penalties, even though neither the rep's employer nor the rep is domiciled in California.
The Interstate Recording Rule
When a sales call crosses state lines, the consent requirement of the stricter state applies. A rep in a one-party state calling a prospect in a two-party state must comply with the two-party state's disclosure requirement. The safe universal practice for any sales team that dials nationally: announce recording at the start of every call, in every state.
Scenarios that create risk
- 1
Rep moves states mid-campaign
An SDR working remotely moves from Ohio (one-party) to Illinois (two-party). Every call they record after the move requires explicit consent — even calls to prospects in one-party states, if a court determines Illinois law governs based on the rep's location.
- 2
Prospect is in California
California has the most litigated call recording statute in the US. Cal. Penal Code § 632 applies regardless of where the recording party is located, if the call involves a California-based party. Civil plaintiffs have successfully sued out-of-state companies recording calls to California residents.
- 3
Multi-state conference calls
A deal call with participants in Texas, Pennsylvania, and Washington state must satisfy both Pennsylvania's and Washington's all-party consent requirements. Every participant must be informed before recording starts — not just the participants in two-party states.
- 4
Work-from-home teams with unknown locations
Distributed sales teams often have reps in any of the 50 states — including two-party consent states — without the company's real-time knowledge. A blanket "always disclose" policy removes this uncertainty entirely.
GDPR, CCPA, and international call recordings
US state law governs calls to prospects within the US. International calls — including calls to EU, UK, and Canadian prospects — introduce a separate layer of data protection requirements that are more demanding than even California's wiretapping statute.
GDPR: calls to EU and UK prospects
Under the General Data Protection Regulation (GDPR), a call recording is personal data because it contains the voice, name, and often the phone number of an identifiable individual. Processing personal data — which includes recording — requires a lawful basis under GDPR Article 6. For a B2B sales call, the two most applicable bases are:
- Legitimate interest (Article 6(1)(f)): The recording serves a legitimate business purpose (training, quality assurance, legal compliance) that is not overridden by the individual's rights. A legitimate interest assessment (LIA) is required.
- Consent (Article 6(1)(a)): The data subject gives clear, specific, and freely given consent. Consent must be as easy to withdraw as it is to give. Silence does not constitute consent under GDPR.
In practice, this means every call to an EU or UK prospect must include: (1) notification that the call is being recorded, (2) the purpose of the recording, (3) the legal basis for processing, (4) the data retention period, and (5) the prospect's rights regarding the recording (access, deletion, portability). GDPR violations carry fines up to €20 million or 4% of annual global revenue, whichever is higher.
CCPA: calls involving California consumers
The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), applies when a business collects personal information from California residents. A call recording containing a California resident's voice qualifies as personal information under CCPA. Requirements include:
- Informing the individual at or before the point of data collection (the start of the call) that their personal information is being collected and the purpose
- Honoring opt-out requests — a prospect who declines recording cannot have their voice recorded under CCPA
- Retaining call recordings only for the stated purpose and for no longer than necessary
- Honoring data deletion requests — if a prospect requests their call recording be deleted, companies must comply
For B2B SaaS teams selling to enterprise buyers, CCPA and GDPR concerns also arise when recording conversations that involve employees of regulated industries (healthcare, finance). If the prospect's employer processes regulated data, additional compliance layers may apply beyond call recording law.
Disclosure scripts and best practices for sales teams
The fastest way to eliminate call recording compliance risk is a consistent, scripted disclosure — delivered verbally on every call or played automatically by your dialer. The scripts below are structured for three scenarios. Have your legal counsel review and approve the version your team adopts.
Script 1: Two-party consent states (explicit consent required)
Use when prospect is in: CA, CT, DE, FL, IL, MD, MA, MI, MT, NH, OR, PA, WA
"Hi [Name], before we get started — I want to let you know that this call may be recorded for quality and training purposes. Is it okay with you if I record our conversation today?"
If yes: Begin recording. Log consent timestamp and representative name in CRM.
If no: Do not record. Note in CRM that recording was declined.
Script 2: One-party consent states (disclosure optional, recommended)
Use when prospect is confirmed in a one-party state and rep is also in a one-party state
"Just a quick heads-up — this call will be recorded so I can refer back to our conversation and make sure I have your details right. Ready to start?"
No verbal confirmation required. The statement itself is the disclosure. Proceed without waiting for a response.
Script 3: Universal — works in all 50 states
Recommended for ALL sales teams regardless of state distribution
"Hi [Name], quick note before we dive in — I record calls so I can focus on our conversation rather than taking notes. Does that work for you?"
Compliant in all 50 states. Obtains implicit consent in two-party states (prospect proceeds = consent). Builds trust. Takes under five seconds. Recommended as the single script for any team that calls nationally or internationally.
Automated dialer and AI tool configuration
Most AI sales tools — including Gong, Chorus, Salesloft, and Outreach — support automated recording disclosure prompts that play before the rep's first word. This is the most reliable compliance mechanism: it does not rely on rep memory, it creates a timestamp log of the disclosure, and it works consistently across every call in the queue. Check your tool's settings for "recording disclosure," "compliance message," or "recording notification" to enable this feature.
When Gangly's call prep workflow prepares a brief before each call, it surfaces the prospect's state and flags whether a two-party disclosure is required — so the rep does not need to remember which state requires what before every dial.
Compliance mistakes sales teams make
These are the most common compliance failures in B2B sales teams that use call recording. Each has a direct fix.
- 1
Assuming rep location = applicable law
The applicable law is the stricter of the rep's state and the prospect's state — not just the rep's. A rep in New York calling a prospect in Florida must comply with Florida's all-party consent law.
Fix: Use the universal disclosure script on every call. Remove the need to evaluate states at dial time.
- 2
Recording without notifying in AI tools
AI call recording tools like Gong record by default from the moment a call connects. If the rep has not set up a disclosure prompt and starts talking to a prospect in California before the disclosure plays, the rep may have already committed a violation before the first substantive sentence.
Fix: Enable automated disclosure prompts in every tool that records calls. Audit tool settings quarterly.
- 3
Treating silence as consent in two-party states
Saying "this call is being recorded" and then proceeding without waiting for acknowledgment is not sufficient in two-party states. In states like Massachusetts, explicit consent is required — not implied consent from the prospect failing to object.
Fix: Script 1 above requires a yes/no response. Do not proceed to recording until you receive it.
- 4
Not logging consent in the CRM
If a prospect later claims they were recorded without consent, the only defensible evidence is a CRM timestamp showing that consent was requested and given before the recording began. Teams that do not log this have no defense.
Fix: Add a mandatory "Recording Consent: Yes/No + Timestamp" field to every call disposition in the CRM.
- 5
Ignoring international prospects
A US-based SDR who records a call with a prospect in Germany without GDPR-compliant disclosure has created a GDPR violation that can result in fines orders of magnitude larger than any US state wiretapping penalty.
Fix: Flag international-region calls in your sequencer with a mandatory disclosure workflow before recording is enabled.
How Gangly handles call recording compliance
Gangly is a sales workflow tool, not a legal compliance platform. But because Gangly's call prep workflow runs before every call, it is the natural place to surface consent requirements.
The Gangly Call Recording Compliance Check — 3 Steps Before Every Call
- Step 1 — Location flag: The call prep brief pulls the prospect's LinkedIn-verified location. If the prospect is in a two-party consent state, the brief flags "Two-Party State: Consent Required Before Recording" in the prep output.
- Step 2 — Script surface: The prep brief includes the pre-approved disclosure script for the applicable jurisdiction. The rep reads it verbatim at call open — no memory required.
- Step 3 — CRM log: After the call, Gangly's post-call note automation includes a consent field in the structured summary. The rep confirms consent was obtained; the timestamp logs automatically to the CRM contact record.
This approach eliminates the rep's need to remember which state requires what, removes the risk of skipping the disclosure in the first 10 seconds of a call, and creates an audit trail in the CRM without additional manual entry. It does not replace legal counsel — every team implementing a recording policy should have their legal team review the specific disclosure language before deployment.
To see how the full workflow — call prep, live coaching, post-call notes, and CRM update — connects, visit the Gangly product page or book a 20-minute demo.