Call Recording and Consent

Recording a conversation is regulated. The rules are not uniform and a contact centre serving several regions is subject to several regimes at once.

General description of common requirements. Rules differ substantially and change; take advice for your jurisdictions.

The consent models

All-party consent. Every participant must consent. Several US states operate this way, and it applies to the location of the parties, not the company.

One-party consent. Consent of one participant suffices. The federal position in the US and the rule in many states.

Notification-based. Recording permitted with notice, common in European frameworks, alongside a separate lawful basis requirement under data protection law.

Purpose-limited. Some regimes permit recording for defined purposes — quality, training, transaction evidence — and not for others.

The practical consequence: a call from a two-party consent state to a one-party state raises a question about which applies, and the conservative answer is the stricter rule.

What notice usually has to do

Be given before recording begins.

Be clear about the fact of recording, not buried.

State the purpose, in most data protection regimes.

Be available in an accessible form, which for an automated announcement means audible and comprehensible.

Where consent is required, provide a route to decline and an alternative way to transact. A notice saying continuing implies consent is not consent in every regime.

Data protection, separately

Consent to being recorded and lawful basis for processing personal data are different questions, and both must be satisfied where the relevant framework applies.

A lawful basis is needed for the processing, and consent is frequently not the best one in a service context, because it can be withdrawn.

Purpose limitation. Recordings taken for quality assurance and later used for something else — training a model, marketing analysis, performance management — may exceed the stated purpose.

This matters for analytics specifically. A recording captured for dispute resolution and then processed for sentiment analysis and agent scoring is being used for purposes the customer was not told about, unless the notice covered it.

Review the notice against what you actually do with the recordings. In many operations these have diverged, because the analytics arrived years after the notice was written.

Special categories

Health, religion, ethnicity, sexuality, union membership and biometric data carry additional restrictions in most data protection regimes.

Callers disclose these incidentally, constantly, in any sector where they explain their situation.

Voice as biometric data has its own note, because it changes the analysis substantially.

Automated analysis of recordings containing special category data engages stricter requirements than the recording itself.

Practical measures

Region-specific recording policies, configured by where the parties are rather than by where the company is.

Notice reviewed against actual use, annually, including analytics.

A documented lawful basis and, where required, an impact assessment covering the analytics as well as the recording.

A route to decline where consent is the basis, with a workable alternative.

Retention defined by purpose, which has its own note.

Legal review before adding a new analytics capability, because it may exceed the stated purpose even though the recording was already permitted.

The question that catches people

"We have always recorded calls" answers the recording question and not the analytics question.

Adding speech analytics to an existing recording estate is a new processing purpose applied to data collected under an older notice. Whether that is permitted depends on the notice, the basis and the jurisdiction, and it is a question worth asking before deployment rather than after.

The notice-versus-practice audit

An annual check that catches the most common compliance drift in this area.

Read the recording notice as customers hear it. Write down what it says you do.

List what you actually do: transcription, categorisation, sentiment, scoring, model training, retention period, third-party processing.

Compare. The gap is what you are doing without having said so.

Analytics almost always exceeds the notice in operations where the notice predates the platform, which is most of them.

Update the notice, or stop the activity. There is no third option.

Check the agent-facing notice separately, since employee monitoring obligations differ from customer ones.

Record the audit and its date. Evidence that it is reviewed annually is a materially different position from a notice written once in 2016.