State Call Recording Laws (CA, FL, IL): One-Party vs Two-Party in 2026

Federal law and 38 US states allow one-party consent for call recording. Twelve states require all-party consent. An AI receptionist that records every call is exposed in any of those twelve unless its opening disclosure does the legal work for it.

What the rule says

flowchart LR
  Phone["PSTN caller"] --> Carrier["Carrier"]
  Carrier -- "SIP INVITE" --> SBC["Session Border Controller"]
  SBC -- "SIP" --> PBX["Twilio / Asterisk"]
  PBX -- "RTP · Opus" --> Bridge["AI Voice Gateway"]
  Bridge --> AI["OpenAI Realtime"]
  AI --> Bridge
  Bridge --> PBX

Federal law (18 U.S.C. § 2511) requires only one party to a call to consent to recording. A majority of states follow the federal one-party rule. Twelve states (California, Connecticut, Delaware, Florida, Illinois, Maryland, Massachusetts, Montana, Nevada, New Hampshire, Pennsylvania, Washington) require all-party consent. California's Invasion of Privacy Act (CIPA, Cal. Penal Code §§ 630-637.9), Florida's Wiretapping Act (Fla. Stat. § 934.03), and Illinois's Eavesdropping Statute (720 ILCS 5/14) are the three most-litigated. Penalties: California up to one year imprisonment plus $5,000+ per offense plus statutory civil damages of $5,000 or three times actual damages; Florida up to five years imprisonment as a third-degree felony; Illinois Class 4 felony for the first offense, civil damages.

What it means for AI voice agent operators

A practical view: any AI agent that records calls and operates nationally must assume an all-party consent rule and disclose at the start. If the called or calling party is in California, Florida, or Illinois, the disclosure is mandatory. If both parties are in one-party states, federal rules suffice but disclosure does not hurt.

The simplest compliant pattern: a single-sentence disclosure at the very start of every call: "This call may be recorded for quality and training." That sentence, spoken before any substantive exchange, satisfies all-party consent in the twelve strict states under the well-established "implied consent by continuing the call" doctrine.

For AI specifically, two extensions matter:

CIPA's "pen register" provisions have been weaponized against website chat / SMS analytics in 2024-2025 case law (Javier v. Assurance IQ, etc.). A conservative reading: AI conversation analytics that capture content (sentiment, transcripts) need disclosure, not just recording itself.

Florida's FTSA and CIPA both reach across state lines if the called party is in-state. A New York AI calling a Florida number is regulated by Florida.

How CallSphere stays compliant

CallSphere's AI receptionist opens every call with a single-sentence disclosure that combines AI identification, recording notice, and entity name: "Hi, this is the automated assistant for {practice}; this call may be recorded for quality and training." The line plays before any business question and before any AI-driven dialogue, satisfying the all-party consent doctrine across CA, FL, IL, MA, PA, WA, and the rest. For tenants who request stricter handling, recording can be disabled per call by a verbal "do not record" trigger; the suppression flag is logged. Healthcare AI calls add a HIPAA-aligned recording disclosure with retention metadata. The platform supports state-aware compliance flags so a tenant with operations limited to one-party states can opt out of the disclosure if they choose. Across 6 verticals, 50+ businesses, 4.8/5 rating, and a 14-day trial, the recording-disclosure preset is on by default.

Compliance checklist

1. Default to all-party consent: disclose at the start of every recorded call.
2. State the disclosure before any substantive AI question or response.
3. Include AI identification in the same opening line ("automated assistant").
4. Allow callers to disable recording by saying "do not record"; log the flag.
5. Tag calls by called-party state; trigger stricter retention if CA/FL/IL.
6. Apply the strictest applicable rule when state of either party is unknown.
7. Retain recordings only as long as needed; default to 90 days for transcripts.
8. Encrypt recordings at rest (AES-256) and in transit (TLS 1.2+).
9. Log access to recordings with tenant ID, user ID, and timestamp.
10. Honor data subject access requests where state law (e.g., CCPA, CPRA) requires.
11. Watch CIPA pen-register case law; expand disclosure to cover content analytics.
12. Disclose retention period in the privacy policy linked from your website.

FAQ

Does "this call may be recorded" satisfy all-party consent? In practice, yes, when played before substantive exchange. The legal theory is implied consent by continuing the call after notice.

What about Texas? Texas is one-party. No state-level disclosure required for recording, but federal and best practice still apply.

Are inbound calls subject to the same rules? Yes. Recording rules apply to both inbound and outbound when either party is in a strict-consent state.

Can I record without disclosure if I anonymize after? The act of recording without consent is the violation. Anonymization later does not cure it.

What's the litigation risk really like? CIPA class actions have grown rapidly since 2022. Settlements range from $1.5M to $20M+. Disclosure is cheap insurance.

Sources

• California CIPA (Cal. Penal Code §§ 630-637.9)
• Florida Wiretapping Act (Fla. Stat. § 934.03)
• Illinois Eavesdropping Statute (720 ILCS 5/14)

Start a 14-day trial, browse pricing, or read /about.