Call Recording Laws by Country: A Compliance Reference for US, UK, Australia, and Canada
Call recording for quality assurance, compliance, and training is standard practice in virtually every call center. But the legal requirements around notifying callers and obtaining consent before recording vary significantly between countries and, in the United States, between states. Recording calls without proper consent exposes your organization to civil liability, regulatory fines, and in some US states, criminal penalties under wiretapping statutes.
United States: One-Party vs. Two-Party Consent States
Federal law under the Electronic Communications Privacy Act requires at least one party's consent to record a telephone conversation—and since agents are always a party to the call, federal law is effectively satisfied by any recording where at least the agent's organization consents. However, 13 US states have enacted two-party or all-party consent requirements that require all parties to consent before a call is recorded. These states include California, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Oregon, Pennsylvania, Washington, and Connecticut.
- Best practice for multi-state operations: Apply the most restrictive standard (all-party consent with verbal notice) to all calls regardless of the called party's state. Determining a called party's state in real time is unreliable; a uniform policy eliminates the risk of incorrectly applying a one-party consent standard to a two-party consent state call.
- Notice language: "This call may be recorded for quality assurance and training purposes" at the start of each call satisfies notice requirements in all US states when delivered before substantive conversation begins.
UK and EU Recording Law
"UK GDPR requires a lawful basis for processing call recordings as personal data—legitimate interest alone is not always sufficient."
In the UK, call recordings are personal data under UK GDPR and must be processed under a lawful basis—typically legitimate interest (for QA/training purposes) or contractual necessity. The ICO guidance requires organizations to document their lawful basis, provide privacy notice information to callers (including the right to request deletion of their recording), and retain recordings only as long as necessary for the stated purpose. Recording retention periods must be defined and enforced—indefinite retention is not permitted under UK GDPR.
Australia and Canada Recording Requirements
- Australia: The Telecommunications (Interception and Access) Act 1979 prohibits recording without the consent of all parties. Implied consent (through announcement at call start) is accepted in most commercial contexts. Recordings are also regulated as personal information under the Privacy Act 1988 and must be managed under the Australian Privacy Principles.
- Canada: PIPEDA and provincial privacy legislation require that individuals be informed when their call is being recorded and for what purpose. Quebec's Law 25 (effective 2023) imposes additional requirements for organizations processing Quebec residents' personal information, including call recordings, and requires a privacy impact assessment for high-risk processing activities.
Recording Compliance
Automatic Recording Disclosure and Retention Controls in Eleven Solutions
Our platform supports per-country recording disclosure announcements, configurable retention periods, secure encrypted recording storage, and role-based access controls for recording review—supporting compliance across all four jurisdictions we serve.
Learn About Call Recording →