Do you legally have to tell someone the call is being recorded?

The Patchwork Problem: Why Most Businesses Get This Wrong

Most companies assume federal law covers them. It doesn't. The Electronic Communications Privacy Act sets a one-party consent baseline, but 13 states — including California, Florida, Illinois, and Pennsylvania — have enacted stricter all-party consent statutes that criminalize silent recording. Research from Avoma confirms that 37 states plus Washington D.C. follow the federal one-party model, while the remaining jurisdictions require every participant to know and agree before any substantive conversation begins.

Withallo's compliance analysis describes California as "the most litigated all-party consent state in the country" with the most active plaintiff's bar around recording violations. Penalties are severe: up to $2,500 per violation in criminal fines for first offenses, $10,000 for repeat violations, and $5,000 in statutory civil damages per call under Penal Code 637.2. Trillet.ai notes that these statutes apply to the act of recording itself — even if audio is immediately transcribed and deleted, the initial capture still requires consent in two-party jurisdictions.

The jurisdictional trap springs when your team dials across state lines. A sales rep in Texas (one-party) calling a prospect in California (all-party) must comply with California law. Compliance experts recommend defaulting to the strictest standard for every outbound call because caller location isn't always knowable at dial time. This patchwork creates three failure modes that expose businesses daily:

• Silent recording in all-party states triggers criminal and civil liability per call
• Inconsistent disclosure scripts create gaps that plaintiff attorneys exploit
• AI voice agents that don't disclose recording violate both TCPA and state consent laws simultaneously

State AI guidance from Massachusetts, California, and Hawaii converges on one rule: always disclose recording and AI identity upfront. Retell AI's playbook shows a single sentence in the first 30 seconds satisfies most jurisdictions: "This is an AI assistant calling from [Company] on a recorded line. Is this a good time to talk?" GrowthPros builds this disclosure into every lead touchpoint — each lead carries a consent record with disclosure text, timestamp, IP address, and the named contacting party so the compliance trail travels with the contact.

What the Law Actually Requires: Disclosure Timing, Language, and Consent

Disclosure timing, language, and consent method are critical elements of lawful call recording. In all-party consent states such as California, Florida, and Illinois, businesses must explicitly disclose that a call is being recorded before any substantive conversation begins, as required by state statutes and reinforced by compliance guidance. This disclosure should occur within the first 10 to 30 seconds of the call to satisfy both recording notice laws and emerging AI disclosure requirements like Texas SB 140, which mandates AI identification within 30 seconds of call initiation. Using clear, unambiguous language ensures participants understand they are being recorded and can make an informed decision about continuing the conversation.

Passive consent — where a recording announcement is made and participation continues without objection — may be legally sufficient in one-party consent jurisdictions under federal ECPA rules. However, this approach fails under GDPR, which requires unambiguous, affirmative consent from all parties before processing personal data, including audio recordings. Similarly, stricter state regimes like California’s Invasion of Privacy Act do not recognize implied consent; businesses must obtain clear agreement, either verbal or through documented opt-in mechanisms, to avoid civil penalties of up to $5,000 per violation or criminal fines reaching $2,500 for repeat offenses. For businesses like GrowthPros that operate across multiple states and handle AI-driven lead follow-up, adopting a universal disclosure standard — such as stating, “This is an AI assistant calling from GrowthPros on a recorded line. Is this a good time to talk?” — aligns with the strictest legal standards while supporting compliance with TCPA, AI disclosure laws, and consent-tracking best practices. This approach also facilitates audit readiness by logging that the disclosure was played and the call proceeded, creating a defensible record of compliance across voice, SMS, and email touchpoints.

The Cost of Non-Compliance: Statutory Damages, Class Actions, and Vendor-Chain Liability

The financial exposure from failing to disclose call recording can escalate rapidly, turning routine outreach into costly legal exposure. Under the TCPA, businesses face statutory damages of $500 per call, increasing to $1,500 per call for willful or knowing violations — with each call treated as a separate offense and no aggregate cap on liability. In California, civil penalties under Penal Code 637.2 reach $5,000 per violation, while criminal fines under Penal Code 632 can climb to $2,500 for a first offense and $10,000 for repeat violations. These penalties apply regardless of whether the recording is stored or immediately transcribed, as the act of recording itself triggers consent requirements in all-party consent states.

Recent TCPA class-action settlements underscore the scale of potential liability, with 2025–2026 resolutions ranging from $5 million to $20 million. Notable examples include Gen Digital’s $9.95 million settlement for prerecorded voice calls to non-customers and QuoteWizard’s $19 million settlement, which serves as a reference point for vendor-chain liability. Aggregate TCPA verdicts have already exceeded $925 million across the docket, and filings are up 95% year-over-year, signaling intensified enforcement. Crucially, the entity on whose behalf calls are made bears full liability, even if a third-party vendor initiated the call — as confirmed in cases like Lamb v. Mortgage One Funding, where courts held the hiring business responsible for compliance failures downstream.

• Statutory TCPA damages: $500–$1,500 per call, no aggregate cap
• California civil: $5,000 statutory damages per violation; criminal: up to $2,500 first offense
• 2025–2026 TCPA class-action settlements: $5M–$20M range

For GrowthPros, this means every lead delivered includes a verifiable consent trail — disclosure text, timestamp, IP address, and the named contacting party — precisely to shield clients from these cascading risks. When AI-driven follow-up occurs within the five-minute speed-to-lead window, the accompanying recording notice ensures compliance isn’t an afterthought but a built-in safeguard against million-dollar exposure.

Operational Compliance: Building Disclosure Into Every Call Flow

Knowing the law is one thing; operationalizing it across thousands of calls is another. The teams that stay out of court are the ones that build disclosure into their call architecture rather than relying on agents to remember a script.

Start with a universal disclosure delivered in the first moments of every call. Compliance guidance consistently recommends placing disclosure within the first 10 seconds, using clear language, and logging that the disclosure played and the call continued, per voice AI compliance research. A single sentence can satisfy multiple obligations at once: "This is an AI assistant calling from [Company] on a recorded line. Is this a good time to talk?" That one line covers recording notice, AI identification, and Texas's requirement that AI disclosure occur within the first 30 seconds.

For outbound calls, jurisdiction detection matters. With 37 states following one-party consent and 13 requiring all-party consent — including California, Florida, and Illinois, per state-by-state analysis — the safest protocol is to default to the strictest standard whenever the recipient's location can't be confirmed. That's the approach GrowthPros builds into its outbound sequences, since every lead it delivers carries a consent trail regardless of where the contact sits geographically.

Your operational stack needs four components working together:

• Consent logging — capture the disclosure text, timestamp, and acknowledgment that the call continued after notice
• Opt-out capture — honor revocation immediately and permanently across voice, SMS, and email
• Jurisdiction routing — flag outbound numbers against all-party consent states before dialing
• Retention policy — align storage windows with every applicable regime

Retention deserves its own attention, because the windows vary widely. Healthcare call recordings fall under HIPAA, which requires six-year retention of compliance documentation. Under GDPR, France's CNIL recommends keeping audio recordings just six months. And because the TCPA statute of limitations runs four years — with defense counsel recommending seven years of retention, per TCPA compliance analysis — most teams settle on a tiered policy: short audio windows, longer consent records.

Remember that recording laws apply to the act of recording, not storage. Transcribing and deleting audio immediately doesn't erase the consent obligation in two-party jurisdictions — which is exactly why disclosure, not deletion, has to be the first line of defense.

How GrowthPros Delivers Compliant Leads With Consent Trails Attached

Most businesses that buy leads never ask one question: can you prove this person consented? If the answer is no, you didn't buy a lead — you inherited a liability, and courts have made clear that liability follows the entity on whose behalf the call was made, regardless of which vendor pressed dial.

That vendor-chain exposure is not theoretical. TCPA class-action filings are up 95% year-over-year, with recent settlements landing in the $5M–$20M range. Statutory damages run $500–$1,500 per call with no aggregate cap, and in all-party consent states like California, criminal fines can reach $2,500 per violation. A lead without a consent trail is a bet against that entire docket.

This is why GrowthPros treats the consent record as part of the product itself. Every lead delivered carries four documentation points: the exact disclosure text the contact saw or heard, the timestamp of that disclosure, the contact's IP address, and the named party who initiated contact. Compliance experts recommend exactly this kind of operational control — logging that disclosure was played and the call continued — to support audit readiness and legal defense.

Each lead's trail includes:

• The verbatim disclosure text shown or spoken to the contact
• A timestamp proving disclosure occurred before any substantive conversation
• The contact's IP address, anchoring the consent to a verifiable event
• The named contacting party, so responsibility is traceable end-to-end

The pipeline behind that trail matters as much as the documentation. Lists are DNC-scrubbed before any outbound contact, and opt-outs are honored immediately and permanently across SMS, voice, and email. Reactivation campaigns target only pre-existing, opted-in relationships — never cold lists — which matters because the FCC has ruled that AI-generated voices count as artificial voice under the TCPA, and an established business relationship alone does not exempt a call from consent requirements.

Because 13 states require all-party consent — meaning all participants must be informed and agree before recording begins — the safest practice is to disclose universally rather than jurisdiction-by-jurisdiction. The same compliance guidance recommends defaulting to the strictest standard when you operate across state lines.

The result is straightforward: when a lead arrives in your CRM — via webhook, Zapier, or native integration — the consent trail arrives with it. You get a qualified, time-stamped contact backed by documentation you can produce if a regulator or plaintiff's attorney ever asks. That is the difference between buying a name and buying a defensible lead.

Want leads that arrive with their consent trail already attached? Book the 15-minute qualification call — free, honest about fit, and it commits you to nothing.