Guides
Federal wiretap law sets a one-party consent baseline, but 12 states require all-party consent for call recordings. This guide maps every state's rules, explains the FCC's 2024 AI voice ruling, and provides a practical compliance checklist for teams deploying AI voice agents at scale.
Last updated
Every AI voiceAI voiceAn artificially generated, natural-sounding voice produced by a TTS model. Thoughtly supports a library of AI voices and brand-specific cloning. agent call is recorded. That means every call is subject to federal and state wiretapping and recording-consent laws — statutes that were written decades before conversational AI existed but apply with full force today. For revenue teams deploying AI agents across insurance, mortgage, real estate, healthcare, and home services leads, the patchwork of one-party and all-party consent rules is not academic. A single campaign touching callers in California, Florida, or Illinois without proper disclosure can trigger per-call statutory damages that dwarf the revenue the campaign was supposed to generate.
This guide maps the federal baseline, identifies which states require all-party consent, and provides a practical checklist for teams running AI voice agents at scale.
The federal Wiretap Act (18 U.S.C. § 2511) prohibits intentionally intercepting wire, oral, or electronic communications. The key exception: interception is lawful when one party to the communication consents. This makes the federal standard a one-party consent rule. Criminal penalties can reach five years of imprisonment, and § 2520 provides for civil damages.
Because AI voice agents are a party to the call and are controlled by the deploying organization, the federal one-party rule is generally satisfied. However, state laws often impose stricter requirements.
In February 2024, the FCC issued Declaratory Ruling FCC-24-17, confirming that AI-generated voices fall under the TCPATCPAUS federal law governing telemarketing calls and SMS. Thoughtly enforces consent capture, time-of-day windows, and DNC scrubbing automatically.’s definition of “artificial or prerecorded voice.” This means outbound calls using AI-generated speech require prior express consent (for informational calls) or prior express written consent (for marketing calls). The FCC has also proposed mandatory AI disclosure at the start of every AI-generated call.
Most states follow the federal one-party consent model. A smaller group — critical for teams running multi-state campaigns — requires all-party consent: every person on the call must be informed and consent to the recording.
The following states require consent from all parties to a phone call recording. Revenue teams running AI voice agents that touch leads in these states must deliver a clear recording disclosure at the start of every call.
| State | Statute | Consent requirement | Penalty notes |
|---|---|---|---|
| California | Cal. Penal Code § 632 | All-party | Up to 1 year imprisonment; civil damages; applies to cross-state calls per Kearney v. Salomon Smith Barney |
| Connecticut | Conn. Gen. Stat. § 52-570d | All-party (civil liability) | Civil damages for phone recordings without all-party consent; criminal wiretap is one-party |
| Delaware | 11 Del. Code § 1335 | All-party (some ambiguity) | Class A misdemeanor; federal court has questioned scope |
| Florida | Fla. Stat. § 934.03 | All-party | Third-degree felony, up to 5 years; civil damages |
| Illinois | 720 ILCS 5/14-2 | All-party | Class 4 felony (1–3 years) for first offense; civil damages |
| Maryland | Md. Cts. & Jud. Proc. § 10-402 | All-party | Felony, up to 5 years; civil damages |
| Massachusetts | Mass. Gen. Laws ch. 272 § 99 | All-party | Up to 5 years state prison; civil damages |
| Montana | Mont. Code § 45-8-213 | All-party knowledge | Up to 6 months jail; requires knowledge, not explicit consent |
| Nevada | NRS § 200.620 | All-party (phone calls) | Category D felony (1–4 years); one-party for in-person |
| New Hampshire | NH RSA § 570-A:2 | All-party | Class B felony; reduced to misdemeanor if one-party consented |
| Pennsylvania | 18 Pa.C.S. § 5703 | All-party | Third-degree felony, up to 7 years; civil damages |
| Washington | RCW § 9.73.030 | All-party | Exceptions for anonymous, repeated, or extremely inconvenient-hour calls |
All other states follow one-party consent rules. Oregon is a hybrid: one-party consent for phone calls, all-party for in-person conversations. Michigan courts have interpreted the all-party statute to apply only to third-party eavesdroppers, not call participants. For a complete 50-state reference, see the Justia 50-State Survey.
When a call crosses state lines, courts have reached different conclusions about which state’s law applies. The safest approach — and the one recommended by most compliance counsel — is to comply with the more restrictive state’s law. California’s Supreme Court explicitly held in Kearney v. Salomon Smith Barney, Inc. that the all-party rule applies when one party is in California, regardless of where the other party is located.
For AI voice agent teams calling leads across multiple states, this means: if any lead could be in an all-party consent state, the recording disclosure should run on every call.
Use this checklist to configure recording-consent handling for AI voice agent deployments.
| Step | Action | Notes |
|---|---|---|
| 1 | Add a verbatim recording disclosure to the start of every call | Example: "This call may be recorded for quality and training purposes." Use the Start node or a Speak → Message node for exact wording. |
| 2 | Deliver the disclosure before any substantive conversation | The disclosure must come before qualification questions, appointment offers, or any data collection. |
| 3 | Do not rely on implied consent alone in all-party states | Some states accept implied consent (continuing the call after disclosure), but best practice is explicit verbal acknowledgment or a clear recorded notice. |
| 4 | Maintain state-aware disclosure scripts | If your agent calls leads in multiple states, the disclosure should satisfy the strictest applicable standard (all-party consent with clear notice). |
| 5 | Log disclosure delivery in call metadata | Record that the disclosure was delivered, the timestamp, and the caller's response for audit readiness. |
| 6 | Scrub call lists against DNC registries before dialing | Required under TCPA; separate from recording consent but part of the same compliance workflow. |
| 7 | Configure quiet hours / dark windows per state | Calling-time restrictions vary by state and channel. Enforce them alongside recording consent. |
| 8 | Review consent requirements when entering new states or verticals | HIPAA, GLBA, insurance regulations, and state consumer protection laws may add requirements beyond general recording consent. |
| 9 | Train internal teams on disclosure requirements | Anyone configuring agent scripts or approving call campaigns should understand state-specific rules. |
| 10 | Retain call recordings with audit-ready transcripts | Recordings and transcripts should be retained per your data-retention policy and any applicable regulatory requirement. |
Thoughtly provides several platform-level features that support recording-consent compliance for AI voice agent deployments:
Thoughtly is a platform with features that help teams implement compliant workflows — it is not a compliance certification body. Teams should work with legal counsel to confirm their specific configurations meet applicable requirements.
In many one-party consent states, implied consent — continuing the conversation after a clear disclosure — is generally accepted. In all-party consent states, the standard varies. Some states accept implied consent if the disclosure is clear and unambiguous, while others (like Massachusetts) define consent more narrowly. The safest approach is to treat every call as requiring explicit notice.
The FCC has proposed (but not yet finalized as of this writing) mandatory AI disclosure at the start of AI-generated calls. Several states, including California and Colorado, are advancing AI-specific disclosure requirements. Regardless of the current mandate, disclosing AI use at the start of the call is an emerging best practice and reduces regulatory risk.
Penalties vary by state. In Pennsylvania, unauthorized recording is a third-degree felony carrying up to seven years. In Florida, it can be a third-degree felony with up to five years. Even in states with lighter criminal penalties, civil damages — often statutory damages per violation — can accumulate rapidly across a high-volume campaign. The FCC has noted TCPA violations carry $500–$1,500 per call with no cap.
Yes. Recording-consent laws apply regardless of who initiated the call. If your AI agent records inbound calls — which most do by default — the same disclosure requirements apply. The disclosure should be part of the agent’s opening script.
If the lead disconnects before the recording disclosure is delivered, the safest practice is to not retain or use that partial recording for any purpose. Configure your workflowWorkflowAn automated, multi-step process — usually triggered by an event (form fill, new lead) and orchestrating one or more voice / SMS / email actions. to flag incomplete-disclosure calls for review.
This article is informational and does not constitute legal advice. Consult qualified legal counsel for compliance decisions specific to your organization. Recording-consent laws are subject to change, and enforcement varies by jurisdiction.
