Do customers know they're being recorded?

Recording customers without their knowledge violates federal law in most circumstances. The federal Wiretap Act (18 U.S.C. 2511) requires at least one party to consent to a recording. In practice, the business satisfies that requirement by initiating the recording. However, 11 states require all-party consent, meaning the customer must also be notified before recording begins, per legal consensus across state statutes. Playing a brief disclosure message at the start of every call satisfies both the federal standard and all-party consent requirements simultaneously. Operators who skip disclosure in all-party states face criminal and civil exposure. The safest policy is a universal disclosure played before every call, regardless of the caller's location. For a deeper look at how call recording fits into a compliant analytics workflow, see the call recording compliance solutions page.

Under federal law, no explicit notification to the customer is required as long as one party (the business) consents to the recording. That changes in all-party consent states, where the customer must be informed before the recording starts. The standard industry practice is a pre-call disclosure message: "This call may be recorded for quality and training purposes." That single sentence satisfies both frameworks. Businesses that rely on implied consent or post-call notification in all-party states are not compliant. The disclosure must occur before any substantive conversation begins. Convirza's platform delivers configurable disclosure prompts at the account level, so operators managing locations across multiple states do not need separate recording configurations per jurisdiction. See the call recording disclosure glossary entry for a full definition of consent frameworks.

All-party (two-party) consent states require that every participant in a conversation be notified before recording begins. The states with all-party consent laws include California, Connecticut, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Oregon, Pennsylvania, and Washington. That is 13 states, not 12, as the list has expanded through legislative updates. Violating California's Invasion of Privacy Act (CIPA) carries fines of $5,000 per violation, per Cal. Penal Code 637.2. The FTC's consumer privacy guidance adds a federal overlay that applies regardless of state law. Operators with locations in multiple states should apply the strictest standard (all-party consent) universally rather than managing state-by-state configurations. That approach eliminates the risk of misrouting a call and applying the wrong disclosure rule.

The "12 states" figure is a commonly cited approximation. The accurate count is 13 all-party consent states as of current statutes: California, Connecticut, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Oregon, Pennsylvania, and Washington. Some sources cite 11 or 12 because older lists predate Oregon's and Washington's updates. In California alone, each unauthorized recording carries a civil penalty of up to $5,000 per violation, per Cal. Penal Code 637.2. The remaining 37 states follow the federal one-party consent standard. Operators should verify current statutes annually, as state legislatures update consent requirements regularly. A compliance review every 12 months is a minimum standard for any multi-location business recording inbound calls.

In all-party consent states, yes. Businesses must notify customers before recording begins. In one-party consent states, notification is not legally required but is strongly recommended as a standard business practice. The notification does not need to be elaborate. A brief automated message before the call connects is sufficient. As David Danielson, VP of Product and Marketing at Convirza, notes: "The operators who get into trouble are almost never the ones who recorded too much. They're the ones who assumed their state was one-party consent and never checked, or who let their disclosure prompt expire without anyone noticing." Convirza's Conversation Analytics™ platform includes disclosure prompt management so operators receive alerts when prompts are not playing correctly. That single safeguard prevents the most common compliance failure in multi-location call recording programs.

Notifying customers about recording requires three elements: timing, clarity, and delivery method.

Video-only security camera recording in publicly accessible areas of a retail or commercial space is legal in all 50 states without customer notification, provided cameras are not placed in areas with a reasonable expectation of privacy (restrooms, fitting rooms, private offices). Audio recording on security cameras is a different matter entirely. Adding a microphone to a security camera system triggers the same consent requirements as phone recording. Recording audio in a retail space without disclosure violates wiretap statutes in all-party consent states, with penalties matching those for phone recording violations. The practical standard: post visible signage stating that the premises are under video surveillance. That satisfies the notice requirement for video-only systems in all jurisdictions. Do not activate audio capture on camera systems without a separate legal review.

Retail recording law covers two distinct channels: phone calls and in-store surveillance. Phone calls follow the federal Wiretap Act and state consent statutes described above. In-store video surveillance follows a separate framework rooted in reasonable expectation of privacy doctrine. The table below maps each recording type to its legal standard.

Federal penalties under the Wiretap Act (18 U.S.C. 2520) include civil damages of $100 per day of violation or $10,000 per violation, whichever is greater, plus attorney fees. Criminal penalties under 18 U.S.C. 2511 include up to 5 years imprisonment per violation for intentional interception without consent. State penalties layer on top of federal exposure. California's CIPA adds $5,000 per violation in civil damages, and plaintiffs do not need to prove actual harm to collect. Class action risk is significant: a single misconfigured disclosure prompt on a high-volume inbound line can generate thousands of individual violations in a short period. The FTC's consumer privacy guidance also authorizes enforcement actions that carry separate financial penalties. Operators should treat disclosure compliance as a revenue protection issue, not just a legal formality.