One-Party vs Two-Party Consent States: The Complete US Call Recording Law Guide (2026)

What is one-party consent?

One-party consent is the legal standard under which a conversation can be lawfully recorded as long as at least one participant in the conversation has agreed to the recording. That participant can be the person doing the recording. Practically, if you are on a phone call in a one-party consent state, you can press record without announcing it to the other person on the line and the recording is legal under that state's wiretapping statute.

One-party consent is the federal default under the Electronic Communications Privacy Act of 1986 (ECPA), codified at 18 USC § 2511. The federal statute sets the floor: states can be more permissive in narrow situations but, more commonly, states have chosen to be stricter — which is how the 12 two-party states arrived at their current posture. If you are a journalist gathering evidence, a small business owner documenting a vendor conversation, or a customer trying to capture a bad-faith interaction with a service provider, one-party consent is what makes that recording possible without a court order.

The single biggest misunderstanding about one-party consent is that it lets you record anyone, anywhere. It does not. One-party consent only applies when you are a party to the conversation. Recording a conversation between two other people, where you are not a participant, is a federal felony under 18 USC § 2511 regardless of which state you are in. It is also a felony to record in places where the speaker has a reasonable expectation of privacy — a bedroom, a bathroom, a private medical consultation room — even if you are technically a participant. One-party consent is a permission, not a license.

What is two-party (all-party) consent?

Two-party consent — more accurately called all-party consent because most of these statutes require every participant to agree, not just two — is the stricter standard that requires every person whose voice is captured to be informed and to consent before the recording becomes legal. Consent can be express (verbally saying "yes, I consent") or implied (continuing the conversation after being told it is being recorded). Twelve US states currently apply this stricter rule, although the exact mechanics differ across jurisdictions.

The most important practical implication of all-party consent is that the typical US-wide assumption — that you can just press record without saying anything — is wrong in roughly a quarter of the country, and that quarter happens to include the largest US states by population (California, Florida, Illinois, Pennsylvania, Massachusetts, and Washington). If you operate a B2B sales team, run a contact center, or sell into the US from abroad, the all-party states cover so much population that the safest universal default is to disclose every recording every time. That single behavioural change eliminates almost all consent-related liability without meaningful business cost.

The 12 two-party (all-party) consent states with citations

Below is the canonical list of US two-party consent states as of 2026. Each entry cites the relevant statute or case law and notes the most important practical wrinkle for that jurisdiction. Note: a 13th state, Michigan, is often listed as a hybrid because the statute reads two-party but state court decisions have produced conflicting interpretations. The conservative posture is to treat Michigan as two-party.

California — Cal. Penal Code § 632

California is the canonical all-party consent state. § 632 makes it a misdemeanor to record a "confidential communication" without the consent of all parties. "Confidential" is interpreted broadly — a business phone call between a sales rep and a prospect generally qualifies. Penalties include up to $2,500 per violation plus $5,000 in civil damages under Cal. Penal Code § 637.2. The California Supreme Court's 2006 decision in Kearney v. Salomon Smith Barney extended § 632's reach to out-of-state callers recording California residents, which is why California consent law effectively governs any interstate B2B call touching a California participant.

Connecticut — Conn. Gen. Stat. § 52-570d

Connecticut is two-party for telephone calls under § 52-570d, which requires either verbal notification at the start of the recording, a written agreement, or a recorded warning tone every 15 seconds. In-person recording is governed by the separate eavesdropping statute (§ 53a-189), which is closer to one-party. The telephone-specific carve-out makes Connecticut one of the trickier jurisdictions for hybrid in-person/phone businesses.

Delaware — Del. Code Title 11 § 2402

Delaware's wiretapping statute is technically all-party under § 2402, but a separate statute (Title 11 § 1335) makes it a misdemeanor to record a "private conversation" without consent of all parties, with a one-party exception for participants. The practical effect is two-party for most commercial use cases. Conservative default: disclose every time.

Florida — Fla. Stat. § 934.03

Florida § 934.03 makes it a third-degree felony to intercept any "oral communication" without the consent of all parties. Penalties include up to 5 years imprisonment plus civil damages. Florida courts have applied § 934.03 aggressively in commercial settings — including against out-of-state callers recording Florida residents. Florida is the second-most-important state to comply with because of its combination of strict statute and aggressive enforcement.

Illinois — 720 ILCS 5/14-2

Illinois has the most complicated recent history of any two-party state. The original eavesdropping statute was struck down by the Illinois Supreme Court in 2014 as overbroad. The legislature rewrote it as 720 ILCS 5/14-2, which now requires consent of all parties for any "private conversation" — a narrower definition than the prior statute but still broader than most one-party states. Penalties can reach Class 3 or Class 4 felony levels for repeat or aggravated violations.

Maryland — Md. Code Cts. & Jud. Proc. § 10-402

Maryland § 10-402 mirrors California in requiring all-party consent. The 1998 recording of Monica Lewinsky's calls by Linda Tripp was, famously, a Maryland violation. Maryland courts have generally held that consent must be explicit, not merely implied by continued participation — making Maryland one of the stricter jurisdictions for verbal disclosure compliance.

Massachusetts — Mass. Gen. Laws ch. 272 § 99

Massachusetts ch. 272 § 99 is the strictest US wiretapping statute by some measures: it prohibits the secret recording of any conversation, irrespective of whether the recorder is a party. The statute does allow non-secret recording with disclosure — meaning the test is not "did you consent" but "did you know." Recording that is announced to all participants, even if they do not verbally agree, is generally lawful under the secret-recording standard.

Montana — Mont. Code § 45-8-213

Montana § 45-8-213 requires all parties to be notified of the recording. Knowledge (not active consent) is sufficient — continuing the conversation after notification counts. Montana is generally treated as two-party for compliance purposes despite the technically lighter "notification" framing.

New Hampshire — N.H. Rev. Stat. § 570-A:2

New Hampshire § 570-A:2 makes interception without all-party consent a Class B felony. The statute is broadly worded and has been interpreted by NH courts to extend to in-person recordings as well as phone calls. The conservative default in New Hampshire is to assume any recording requires verbal disclosure.

Oregon — Or. Rev. Stat. § 165.540

Oregon is a split state: in-person conversations are one-party, but telephone and electronic communications under § 165.540 require all-party consent. This split matters for hybrid sales motions that mix in-person meetings and Zoom calls — the same conversation may be governed by different statutes depending on the medium.

Pennsylvania — 18 Pa. Cons. Stat. § 5704

Pennsylvania § 5704 requires all-party consent for any "oral communication." PA courts have interpreted the statute strictly and have refused to recognize most business-purpose exceptions that other states allow. Pennsylvania is one of the top-three risk jurisdictions for non-compliant B2B call recording.

Washington — RCW 9.73.030

Washington RCW 9.73.030 requires consent of all parties and explicitly provides that consent must be either verbal at the start of the recording or established by a recorded announcement. Like California, Washington courts have applied the statute to out-of-state recorders capturing Washington residents.

The 38 one-party consent states

These states follow the federal one-party consent rule under ECPA. Recording is legal as long as at least one participant in the conversation consents — and that participant can be the recorder. The District of Columbia is also one-party. Some of these states have additional in-person eavesdropping statutes that add wrinkles (Alaska, Hawaii, Nevada notably), but for ordinary phone, video, or in-person business conversations between participants, recording is legal without disclosure in all of the following:

Note that Nevada deserves special attention — the in-person statute is one-party, but the Nevada Supreme Court in Lane v. Allstate (1998) effectively converted the phone-call standard into all-party consent. Practically, treat Nevada phone calls as two-party.

Federal call recording law — ECPA / 18 USC § 2511

The federal Electronic Communications Privacy Act of 1986 (ECPA), codified at 18 USC § 2511, is the federal floor for call recording in the United States. Three things to know about it.

First, ECPA is one-party. Under § 2511(2)(d), it is not unlawful for a person to intercept a wire, oral, or electronic communication if that person is a party to the communication, or if one of the parties has given prior consent. That is the federal default. States can be more permissive only in extremely narrow scenarios (rare); states can — and 12 do — impose stricter all-party consent rules.

Second, ECPA criminalizes interception by non-participants. If you are not a party to the conversation and you have not been given consent by a party, you are wiretapping under federal law regardless of which state you are in. Maximum criminal penalty: 5 years imprisonment. Civil damages: the greater of (a) actual damages, (b) statutory damages of $100 per day of violation, or (c) $10,000 — plus attorney's fees and punitive damages where applicable.

Third, ECPA contains a "business use exception" (§ 2510(5)(a)(i)) that allows employers to monitor calls on telephone equipment furnished in the ordinary course of business. The exception is narrow and does not survive when the call becomes personal — courts have consistently held that employers must stop recording the moment they realise the call is personal in nature. The business use exception also does not override state two-party consent statutes; an employer in California still needs all-party consent regardless of the federal exception.

For a sales-team specific walkthrough of how ECPA interacts with daily call recording practice, see our companion guide on sales call recording laws in 2026.

Interstate calls — whose law applies?

This is the single most-asked compliance question in this space, and the answer is simpler than most people think: apply the strictest law that touches the call. If even one participant is in a two-party state, treat the entire call as two-party.

The legal foundation for this conservative posture comes from Kearney v. Salomon Smith Barney, 39 Cal. 4th 95 (2006), in which the California Supreme Court held that California's two-party consent statute applies to out-of-state callers who record California residents — including a Georgia-based broker recording a California-based client without consent. Federal circuit courts have generally followed the Kearney logic; the FCC and most state attorneys general have also taken the "apply the stricter law" position for enforcement purposes.

The practical rule:

• If any participant is in California, Florida, Illinois, Maryland, Massachusetts, Pennsylvania, or Washington — get explicit verbal consent at the start of the call regardless of where you are calling from.
• If you do not know the location of the other participant(s) — disclose and get consent anyway. This is the universal default that eliminates the need to maintain a state-by-state lookup table.
• Multi-state conference calls with five or more participants are functionally always two-party calls. Disclose and capture consent on the recording itself.

For US-wide compliance posture across a B2B sales team, the operationally simplest policy is "always disclose, always get verbal acknowledgement." That single standard satisfies all 50 states plus DC, removes the need for any caller-location inference, and adds approximately 4 seconds of overhead per call.

Recording in person vs phone vs video conference

The legal framework varies meaningfully by medium. The same conversation, captured in three different ways, can produce three different compliance answers.

In-person conversations

In-person recording is governed by state eavesdropping statutes (separate from the wiretapping statutes that govern phone calls). The same one-party / two-party split applies — most one-party states are also one-party for in-person — but the definition of a "private" conversation varies more widely. Conversations in public (a restaurant, a sidewalk, a conference hall) generally do not carry a reasonable expectation of privacy and can be recorded under most state laws. Conversations in a private office, home, or closed meeting room typically do require consent at the level applicable to that state.

Phone calls

Phone calls are the original target of both federal ECPA and state wiretapping statutes. The one-party / two-party split applies directly. Native iOS 18.1 call recording and stock Android call recording both play a mandatory disclosure tone when recording begins, which generally satisfies notice requirements in two-party states. Third-party recording apps may not include this tone — review the app's disclosure behaviour before using it.

Video conferences (Zoom, Google Meet, Teams)

Video conferences are treated as "electronic communications" under federal ECPA and most state statutes. Zoom and Google Meet display a recording-in-progress visual indicator to all participants when host recording starts; that indicator generally satisfies one-party state notice requirements but is typically NOT sufficient in two-party states. In two-party jurisdictions, the host should verbally announce the recording at the start of the call and ideally get verbal acknowledgement.

Bot-based notetakers introduce extra risk. When a third-party AI notetaker joins the meeting as a separate participant, the bot itself is arguably a "third party" to the conversation — and in some interpretations its presence triggers the higher-scrutiny standards applied to non-party interception. The safer architecture is what we describe in our no-bot meeting assistant page: capture audio through the host's existing meeting client without injecting a separate participant, so the recording remains a participant-controlled action rather than a third-party interception. For B2B sales call workflows specifically, see our broader sales call recording software guide for compliance-aware platform options.

Recording employees: workplace consent rules

Workplace call recording sits at the intersection of federal ECPA, state wiretapping law, the National Labor Relations Act (NLRA), and state-specific workplace privacy laws. The compliance picture varies by both jurisdiction and employment context.

Federal baseline: ECPA's business use exception allows employers to monitor business calls in the ordinary course of business — typically for quality assurance, training, compliance, or supervisor coaching. The exception applies only to calls on equipment furnished by the employer for business purposes. The moment a call becomes personal in nature, the exception evaporates and the employer must stop listening or recording.

State overlay: In two-party consent states, employers must also comply with the state wiretapping statute. The common compliance pattern: (a) written notice in the employee handbook that calls may be recorded, (b) recorded greeting on inbound and outbound lines ("This call may be monitored or recorded for quality assurance"), (c) verbal disclosure at the start of any internal coaching review, and (d) explicit signed consent at hire for any recording beyond the routine quality-assurance scope.

NLRA considerations: The National Labor Relations Board has held that overly broad employer recording policies can chill protected concerted activity (i.e., employees discussing wages or working conditions). Employer recording policies must be narrowly tailored to legitimate business purposes and must not prohibit employees from recording their own conversations about protected topics.

Recording prospects in a B2B sales context (brief)

Sales call recording is the most common commercial use case for this entire body of law. The compliance framework is largely the same — federal ECPA plus state two-party consent where applicable — but a few sales-specific patterns are worth calling out briefly here. For the full sales-team compliance playbook, see our dedicated sales call recording laws 2026 guide and the state-by-state sales recording reference. For a programmatic state lookup, see the call recording laws by state resource.

The single most important compliance shift for B2B sales teams in 2026 is the universal-disclosure default. Rather than maintaining a state-by-state matrix and inferring caller location from area code or IP, the operationally simplest posture is to verbally disclose at the start of every recorded call — "Quick note — we record our sales calls for coaching purposes. Is that okay with you?" — and capture the consent on the recording itself. That single behavioural change satisfies all 50 states plus DC, eliminates the need for location inference, and removes the largest source of consent-related liability for distributed sales teams.

For coverage of how compliant call recording integrates with AI-driven sales workflows — including conversation intelligence, real-time coaching, and automated follow-up — see our overviews of the AI meeting assistant and the broader conversation intelligence guide. Startups evaluating compliant tooling may also find our roundup of the best sales call recording software for startups useful as a starting point.

International: GDPR (EU), UK GDPR, Canada (PIPEDA), Australia

US-based businesses recording calls with international participants face a fundamentally different legal regime. EU and UK law are not consent-floor regimes like the US — they are lawful-basis regimes, in which recording requires both a lawful basis under GDPR Article 6 AND, in most cases, explicit opt-in consent. Recording an EU resident without GDPR compliance creates exposure to fines of up to €20 million or 4% of global annual turnover, whichever is higher.

EU GDPR

Call recording involving any EU data subject must satisfy GDPR Article 6 (lawful basis) and Article 7 (consent). The most common lawful basis for sales call recording is "legitimate interests" (Article 6(1)(f)), but the legitimate interests assessment must weigh the controller's interest against the data subject's reasonable expectations. Recording for AI coaching is a recognized legitimate interest in some jurisdictions but is being actively scrutinized by EU data protection authorities. The conservative posture is to obtain explicit consent at the start of every recorded call with any EU participant.

UK GDPR + PECR

The UK post-Brexit retained GDPR (now "UK GDPR") plus the Privacy and Electronic Communications Regulations (PECR) create a regime nearly identical to EU GDPR for call recording purposes. The Information Commissioner's Office (ICO) has issued specific guidance on call recording that requires either explicit consent or a documented legitimate-interests assessment, plus clear notice at the start of every recorded call. Maximum fines: £17.5 million or 4% of global annual turnover.

Canada — PIPEDA

The Personal Information Protection and Electronic Documents Act (PIPEDA) governs call recording involving Canadian participants. PIPEDA requires (a) consent — typically express, sometimes implied through continued participation after notice — (b) limitation to purposes the participant would reasonably expect, and (c) reasonable security safeguards. Quebec, Alberta, and BC have their own substantially similar provincial statutes. Penalties are lower than GDPR but can reach CAD $100,000 per violation.

Australia — Privacy Act 1988

The Australian Privacy Act and the state-level Surveillance Devices Acts produce an all-party consent default in most Australian states (NSW, Victoria, Queensland, South Australia, Western Australia, Tasmania, ACT, Northern Territory) for the recording of private conversations. Recording without consent can trigger both civil penalties under the Privacy Act and criminal penalties under the state-level Surveillance Devices Acts (typically 1-5 years imprisonment).

Criminal vs civil penalties for illegal recording

Penalties for illegal call recording fall into three categories: criminal penalties under state and federal wiretapping statutes, civil damages under those same statutes, and downstream evidentiary consequences (illegally obtained recordings are generally inadmissible in court and may taint adjacent evidence under the "fruit of the poisonous tree" doctrine).

How to disclose recording legally — sample scripts

The legal sufficiency of a disclosure depends on (a) whether it is delivered before recording starts, (b) whether the other party is given a chance to decline, and (c) whether the disclosure is captured on the recording itself for future evidentiary purposes. Below are tested scripts for the four most common recording contexts.

Phone call to an individual prospect or customer

Inbound customer service line

Zoom or Google Meet for sales / customer calls

Internal employee coaching review

One important pattern across all four scripts: the disclosure happens BEFORE the substantive conversation starts AND is captured on the recording itself. A disclosure that happens after recording has started, or that is not captured on the recording, may be challenged later as either untimely or unprovable. The "capture the consent on the recording" discipline is what makes a recording legally defensible in a future dispute.

Best practices for compliance documentation

Operational compliance for call recording is not just about delivering the right disclosure — it is about maintaining the documentary record that proves you delivered the disclosure if you are ever challenged. The following six documentation practices are what separates a defensible call recording program from one that collapses under audit.

1. Written recording policy. Document the lawful basis for recording, the categories of calls recorded, the retention period, the access controls, and the consent flow. Update annually.
2. Per-call consent capture. The verbal consent should be captured on the recording itself, not just logged in a separate system. A consent flag in your CRM is helpful for analytics but is not the legally-defensible artefact — the audio itself is.
3. Employee training records. Maintain documented training attendance for every employee who records customer calls, with annual refresher training. Forrester and the EU's CNIL both flag this as a leading indicator of compliance maturity.
4. Retention schedule and deletion log. Define how long recordings are retained (typically 6-24 months for sales calls, 7+ years for regulated industries), document the deletion process, and log every deletion event for audit purposes.
5. Access control audit log. Track who accessed which recording, when, and for what purpose. Required under GDPR Article 30 and under most US-state data breach notification statutes for any access that could constitute exposure.
6. Data subject access response process. Under GDPR, UK GDPR, PIPEDA, and CCPA, recorded individuals have rights to access their recordings, request deletion, and (in some jurisdictions) export their data. Document the operational process for handling each request type within the statutory deadlines (typically 30 days under GDPR).

For B2B sales teams specifically, the recording platform should make most of these documentation requirements automatic. Capture-on-recording consent, retention scheduling, access logging, and DSAR export should be platform features, not manual processes. Compliance-aware platforms like Nimitai's AI meeting assistant include this tooling natively; legacy enterprise platforms often require professional services engagements to configure equivalent workflows.

Frequently asked questions

Is it illegal to record someone without their permission?

In 12 US states (California, Connecticut, Delaware, Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Oregon, Pennsylvania, Washington), recording a conversation without the consent of all participants is illegal and in several states is a felony. In the other 38 states plus DC, recording is legal as long as you are a party to the conversation. Recording a conversation you are not part of is a federal felony under ECPA almost everywhere.

How many states are one-party consent?

38 US states plus the District of Columbia are one-party consent states. The 12 two-party states are California, Connecticut, Delaware, Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Oregon, Pennsylvania, and Washington. Michigan is sometimes counted as a hybrid (statute reads two-party, case law has been mixed).

What is the difference between one-party and two-party consent?

In a one-party consent state, only one participant must consent — and that person can be you, the recorder. In a two-party (all-party) consent state, every participant must be informed and must consent before recording is legal. One-party is the federal default under ECPA; two-party is the stricter standard 12 states have adopted.

Can I record a call to my own protection?

In a one-party consent state, yes — you can record any call you are part of without informing the other party. In a two-party state, you must disclose and obtain consent before recording, even if the purpose is self-protection. "I needed to record it to protect myself" is not a defense to a state two-party violation in most jurisdictions.

Can I use the recording in court?

A legally-obtained recording is generally admissible as evidence, subject to normal authentication and hearsay rules. An illegally-obtained recording is generally inadmissible and may trigger sanctions against the party who attempted to introduce it. The admissibility question turns on whether the recording was lawful at the moment of capture — which is governed by the consent rules in the state(s) where the participants were located at the time.

Do I need consent to record a video conference?

Yes. Zoom, Google Meet, and Teams display a visual recording indicator that satisfies one-party state notice requirements, but in two-party jurisdictions you should also verbally announce the recording and capture the acknowledgement on the recording itself. Bot-based notetakers introduce additional risk because the bot is a separate participant; capture-in-client architectures (like the no-bot meeting assistant pattern) avoid that third-party-interception complication.

Can my employer record my work calls without telling me?

Generally yes under the federal ECPA business-use exception, but the employer must stop the moment a call becomes personal. In two-party states, employers must also provide written notice (typically in the employee handbook) and often use a recorded greeting on inbound lines.

What is the penalty for illegal recording?

Federal ECPA: up to 5 years imprisonment plus $10,000+ civil damages per violation. State penalties vary — California, Florida, Illinois, Massachusetts, and Pennsylvania classify violations as felonies in many circumstances. Civil damages stack on top of criminal penalties; the recording is also generally inadmissible in court.

Whose law applies when participants are in different states?

The conservative compliance posture is to apply the strictest law that touches the call. If any participant is in a two-party state, treat the entire call as two-party. Federal case law (Kearney v. Salomon Smith Barney) supports this posture for civil enforcement.

Does GDPR apply to US-based call recording?

Yes, when the recording captures EU residents. GDPR has extraterritorial reach under Article 3 — a US business recording calls with EU customers must comply with GDPR Article 6 (lawful basis), Article 7 (consent), and Article 30 (processing records). Maximum penalties: €20 million or 4% of global annual turnover, whichever is higher.