Call Recording Laws in North America: What Every Business Needs to Know

Call recording is one of the most valuable tools a business can have — for training, quality assurance, dispute resolution, and compliance documentation. It’s also a legal minefield if you do it wrong. In both the US and Canada, call recording obligations are governed by a combination of federal legislation and state/provincial privacy laws, and the rules vary significantly by jurisdiction.

The US Legal Framework

The Electronic Communications Privacy Act (ECPA) at the federal level permits one-party consent recording — meaning only one party to the call needs to consent. However, individual states set their own rules, and many are stricter.

Two-party (all-party) consent states — including California, Florida, Illinois, Maryland, Massachusetts, Nevada, New Hampshire, Oregon, Pennsylvania, and Washington — require all parties to consent to the recording. If your business calls customers in any of these states, you must notify all parties.

TCPA (Telephone Consumer Protection Act) governs automated calls and texts but also has notification requirements that overlap with recording scenarios.

Best practice for US businesses: Treat every recorded call as if it requires all-party consent. A blanket disclosure (“This call may be recorded”) protects you regardless of which state the other party is calling from.

The Canadian Legal Framework

PIPEDA (Personal Information Protection and Electronic Documents Act) is the federal privacy law that applies to most private sector organizations collecting personal information in commercial activities. Call recordings contain personal information — the voice, statements, and account details of the person on the call.

Under PIPEDA, you must:

• Have a legitimate purpose for collecting the recording
• Notify the person that the call is being recorded
• Not use the recording for purposes beyond what was disclosed
• Protect the recording with appropriate security measures
• Retain it only as long as necessary

Provincial equivalents: Alberta, British Columbia, and Quebec have substantially similar provincial privacy legislation that applies within those provinces. Quebec’s Law 25 (Bill 64), which came into full effect in 2023, has additional requirements for data protection and breach notification.

The Consent Question

In the US, the federal baseline is one-party consent, but roughly a dozen states require all-party consent. When calling across state lines, the stricter standard typically applies.

In Canada, the federal framework under PIPEDA is also one-party consent. However, PIPEDA’s notification requirements effectively require you to inform the other party that recording is occurring, even if their affirmative consent isn’t required.

Best practice: Begin every recorded call with a disclosure: “This call may be recorded for quality assurance and training purposes.” This is the standard language, and it’s both legally protective and expected by callers.

Important distinction: Consent for recording is separate from consent for how the recording is used. Recording a call for QA purposes and then using it as a marketing testimonial without the caller’s permission crosses a different line.

Where Businesses Get Into Trouble

Recording and forgetting. Recordings must be retained only as long as needed for their stated purpose. A policy of retaining all recordings indefinitely creates both legal exposure and storage costs. Define retention periods (e.g., 90 days for QA, 7 years for a recorded agreement) and enforce them.

No notification. Failing to notify callers that recording is occurring is the most common violation. It doesn’t require explicit consent from the other party, but it does require notification.

Inadequate security. Call recordings stored insecurely — accessible to anyone, unencrypted, or stored with a vendor without a data processing agreement — violate PIPEDA’s safeguarding requirements.

Cross-border recording. Cross-border calls are subject to both jurisdictions’ rules. Canadian businesses calling US customers must comply with applicable US state laws (notably California’s two-party consent requirement). US businesses calling Canadian customers must account for PIPEDA notification requirements.

Quebec-Specific Considerations

Quebec’s Law 25 imposes stricter requirements than PIPEDA, including mandatory privacy impact assessments for high-risk activities, a dedicated privacy officer for most organizations, and breach notification obligations with tighter timelines. If your business operates in Quebec, review these requirements with legal counsel.

Building a Compliant Recording Program

Start with a recording policy. Document why you record, how long you retain recordings, who can access them, and how they’re secured.

Implement consistent disclosure. Every recorded call should begin with an audible disclosure. Automate this in your phone system so it’s never missed.

Choose a compliant platform. Your phone system vendor should store recordings in your jurisdiction (with data processing agreements covering any cross-border transfers), encrypt recordings at rest and in transit, and support configurable retention periods.

Train your team. Employees who handle customer calls should understand what can and can’t be done with recordings.

Call recording is a legitimate and valuable business tool. Done correctly, it protects your business. Done carelessly, it creates the liability it was meant to prevent.