Every call your AI voice agent answers raises two legal questions before the caller says a word.
Is this call being recorded?
Am I talking to a machine?
They sound like one question. They are not. Different statutes govern each, different plaintiffs sue over each, and a script that handles one can leave you exposed on the other.
If you build or deploy an AI receptionist, an AI customer-service line, or an outbound voice agent, Technology Lawyer Andrew S. Bosin’s firm has already covered the TCPA and FTC side of AI disclosure — consent to place the call, and Section 5 deception risk. This article covers the other half: recording and wiretap law, and the state and EU statutes that now require an AI voice to identify itself.
Why Every AI Voice Agent Call Is a “Recording”
Founders sometimes tell Andrew, “We don’t record calls. We just transcribe them.”
Under wiretap law, that distinction rarely helps. To work at all, a voice agent has to:
- Capture the caller’s audio in real time
- Convert it to text through a speech-recognition model
- Pass that text (and often the audio) to a language model hosted by a third party
- Log transcripts for quality review, analytics, or debugging
Capturing and storing the content of a conversation is what recording statutes regulate. Whether the output is an .mp3 or a transcript usually makes no difference.
Assume every AI voice call is a recorded call, and build your consent flow accordingly.
One-Party vs. All-Party Consent: The Map Your Voice Agent Has to Follow
The federal baseline
The federal Wiretap Act (18 U.S.C. § 2511(2)(d)) is a one-party consent statute. If one participant consents, recording is generally lawful — unless it’s done to commit a crime or tort.
Because your business operates the voice agent, your business is a party to the call. Under the federal rule, your own consent usually covers it.
New Jersey follows the same one-party approach under its Wiretapping and Electronic Surveillance Control Act.
The all-party states
A meaningful group of states requires every party to consent. California, Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Pennsylvania, and Washington are the states most commonly cited. Several others — including Connecticut, Michigan, Nevada, and Delaware — have rules that vary by context or have been interpreted inconsistently by courts.
Penalties are not trivial:
- California allows a private action for $5,000 per violation under the California Invasion of Privacy Act (CIPA), Penal Code § 637.2.
- Pennsylvania treats unlawful interception as a felony.
- Florida and Maryland carry criminal exposure as well as civil claims.
The rule that catches out-of-state startups
You cannot pick your home state’s rule and stop there. In Kearney v. Salomon Smith Barney (Cal. 2006), the California Supreme Court applied California’s all-party rule to a Georgia company that recorded calls with California clients.
The practical consequence for a voice agent that answers a national phone number:
- You usually don’t know where the caller is physically located.
- Area codes are not reliable — people keep their numbers when they move.
- The safe default is to treat every call as if it were in an all-party state.
That means a clear recording notice at the start of every call, before substantive conversation begins.
The CIPA “Capability” Problem: When Your Vendor Becomes the Wiretapper
This is the risk most voice-AI startups miss — and it sits in the vendor contract, not the call script.
What happened in Ambriz v. Google
In Ambriz v. Google, LLC, plaintiffs called the customer-service lines of several large companies that used Google Cloud Contact Center AI. They alleged that Google itself — not just the companies they called — was listening to and transcribing their calls without their consent.
Google argued it was simply a software tool, like a tape recorder in the business’s hands.
In February 2025, the Northern District of California denied Google’s motion to dismiss the CIPA § 631(a) claims. The key reasoning:
- Courts in the Ninth Circuit have split between two tests for whether a software vendor is a “third party” eavesdropper.
- The stricter “extension test” asks whether the vendor actually used the call data for its own purposes.
- The looser “capability test” asks only whether the vendor could use it for its own purposes.
- Applying the capability test, the court found it plausible that Google could use call data for its own benefit — largely because Google’s own terms allowed that use with the business customer’s permission.
Why this matters for your company
Read that last bullet again. The plaintiffs’ best evidence came from the vendor’s own contract terms.
If your voice agent runs on a speech or LLM provider whose terms let it use customer call data to improve its models, a California plaintiff can argue that vendor is a third-party listener — and that your callers never consented to it.
The exposure runs in two directions:
- If you deploy a voice AI vendor, your callers’ consent may not extend to that vendor’s independent use.
- If you are the voice AI platform, you may be the “Google” in the next Ambriz — named directly as the third-party eavesdropper on your customers’ calls.
Defense arguments are developing, but don’t build on them
The law here is unsettled. A 2025 Ninth Circuit decision in Popa v. Microsoft, a website session-replay case, took a harder line on whether plaintiffs alleging this kind of privacy harm have standing to sue at all, and defendants are now pressing that argument in AI-transcription cases. Whether it carries over to phone calls — which California has long treated as especially private — remains to be seen.
California’s legislature has also been debating CIPA reform through SB 690. But the bill was narrowed in mid-2026: the broad “commercial business purpose” exemption was stripped out, and the remaining version targets pen-register claims from website tracking. As amended, it would not resolve recording claims involving phone calls.
Bottom line: Andrew advises voice-AI clients to treat the capability test as the rule in California until an appellate court says otherwise.
“This Call May Be Recorded” Is Not Enough Anymore
The classic call-center line was written for a world where a recording sat on the company’s own server.
An AI voice call is different. The audio and transcript may be processed by:
- A speech-to-text provider
- One or more LLM providers
- An analytics or quality-assurance tool
- Your own team, for prompt tuning or model improvement
Consent is only as broad as the notice that preceded it. A caller who hears “this call may be recorded for quality purposes” has not plainly been told that a third party may process it with AI, or that it may be used to train models.
A stronger disclosure covers three things in plain language:
- The call is recorded and transcribed.
- It is processed by AI, including by service providers acting on our behalf.
- What the caller can do if they don’t want that — an opt-out path.
If your company (or your vendor) wants to use calls to train or improve models, that is a separate and larger ask. The firm’s guide on using customer data to train AI models walks through why training consent has to be specific, not buried.
The Second Question: Laws Requiring an AI Voice to Identify Itself
Recording law asks whether the call is captured. A newer set of laws asks whether the caller knows a machine is speaking.
Federal: the FCC has acted on consent, not yet on in-call disclosure
- In February 2024, the FCC issued a Declaratory Ruling confirming that AI-generated voices are “artificial” voices under the TCPA. That ruling is about consent to place outbound calls.
- In August 2024, the FCC proposed rules (CG Docket No. 23-362) that would require callers using AI-generated voices to disclose that fact at the beginning of each call. Notably, the proposal defined “AI-generated call” around outbound calls. Founders should monitor that docket rather than assume a final rule is in place.
California: AI voice disclosure for automated dialing
Since January 1, 2025, California Public Utilities Code § 2874 (amended by AB 2905) has required automated dialing-announcing devices to include, in the required live-voice announcement, a statement that the prerecorded message uses an artificial voice — defined as a voice generated or significantly altered by AI.
If your platform places automated outbound calls to Californians, this applies now.
Utah: disclosure on request, and up front for high-risk interactions
Utah’s Artificial Intelligence Policy Act, as amended in 2025 (SB 226), works on two tracks:
- A business using generative AI with consumers must disclose it when the consumer clearly asks whether they’re dealing with a human.
- Providers in regulated occupations must disclose proactively at the start of “high-risk” AI interactions — for example, where sensitive personal, financial, or health information is collected.
- There’s a safe harbor for systems that clearly disclose they are AI at the outset of the interaction and throughout it.
Maine: no pretending to be human
Maine’s chatbot disclosure law (LD 1727, effective September 2025) makes it an unfair trade practice to use an AI chatbot — which can include a voice agent — in a way that could mislead a reasonable consumer into believing they’re dealing with a person, without clear disclosure. Enforcement runs through the Maine Unfair Trade Practices Act.
EU AI Act Article 50: in force since August 2, 2026
If your voice agent takes calls from people in the EU, Article 50(1) of the EU AI Act now applies. AI systems that interact directly with people must be designed so those people are informed they are interacting with AI, unless it’s obvious from context.
Two points founders keep getting wrong:
- The EU’s “Digital Omnibus” delay did not touch Article 50. It pushed back high-risk AI obligations. Chatbot and voice-agent disclosure still applied on schedule.
- Penalties for transparency breaches can reach €15 million or 3% of worldwide annual turnover.
GDPR separately governs the recording itself, so EU-facing deployments need both an AI disclosure and a lawful basis for recording.
Building a Compliant Opening Line
Here’s an example of an opening that addresses both questions in one breath. It’s a starting point, not a universal script — your industry, call direction, and jurisdictions may require more:
“Hi, this is Ava, an AI assistant for [Company]. This call is recorded and transcribed, and our service providers process it with AI to run this service. If you’d prefer not to be recorded, just say ‘no recording’ and I’ll connect you another way.”
What makes it work:
- AI identity comes first. No ambiguity about whether a human is speaking.
- Recording notice comes before the substance. The caller hears it before describing their problem.
- It names AI processing by service providers, which narrows the Ambriz-style consent gap.
- It offers a real exit. In most all-party states, clear notice followed by the caller staying on the line is treated as consent — but an opt-out path makes that consent much easier to defend.
Design rules Andrew recommends building into the product, not just the prompt:
- Disclose before recording starts — or, if the platform can’t technically delay capture, before any substantive exchange.
- Re-disclose after a transfer. If a human hands a caller to the AI, or vice versa, say so.
- Never deny being AI. If a caller asks “Am I talking to a real person?”, the agent must answer truthfully. Hard-code this outside the model’s discretion.
- Honor “no recording.” Route to a non-recorded path, a callback, or a human — and make sure the system actually stops capturing.
- Log the disclosure. Keep evidence that the notice played on each call. In a class action, “our script includes it” is weaker than “here is the log for this call.”
Where This Belongs in Your Contracts
Scripts handle the caller. Contracts handle everyone else in the call chain.
If you’re deploying a voice AI vendor, review its terms for:
- Any right to use your call audio or transcripts to train or improve its own models — the exact fact the Ambriz court relied on
- Whether you can contractually prohibit that use (see the firm’s article on the no-training clause)
- Service-provider or processor restrictions that limit the vendor to processing on your behalf
- Retention and deletion of recordings and transcripts
- Indemnity for claims arising from the vendor’s own use of call data
If you’re the voice AI platform, your customer agreement should spell out:
- Who is responsible for the recording notice and AI disclosure — the platform’s default script, or the customer’s custom script
- Whether compliant disclosures ship on by default (many customers never change defaults)
- Your own data-use rights, drafted narrowly enough that they don’t hand plaintiffs a capability argument
- Customer representations about the jurisdictions they call into
The firm’s breakdown of what goes inside an AI phone receptionist agreement and its analysis of two-front compliance risk for AI customer-service platforms cover how platform and customer responsibilities should be allocated.
Quick Compliance Checklist for AI Voice Agents
- Treat every call as recorded, including transcription-only flows
- Play an all-party-compliant recording notice on every call, nationwide
- Identify the agent as AI at the outset, not only when asked
- Mention AI processing by service providers in the notice
- Provide a working opt-out from recording
- Re-disclose on transfers between AI and humans
- Hard-code truthful answers to “Are you a person?”
- Log disclosures per call
- Audit every vendor’s terms for training or independent-use rights on call data
- Allocate disclosure and consent responsibility in customer and vendor contracts
- For EU callers, confirm Article 50 disclosure and a GDPR lawful basis for recording
- Monitor the FCC’s AI-call disclosure docket and new state bot-disclosure laws
Frequently Asked Questions
Do AI voice agents need consent to record calls?
In one-party consent states, the business deploying the agent is a party to the call and its own consent generally suffices. But California, Florida, Illinois, Pennsylvania, Washington, and several other states require all parties to consent. Because you rarely know where a caller is located, the safe practice is to give a clear recording notice at the start of every call.
Does transcribing a call without saving the audio avoid recording laws?
Usually not. Recording and wiretap statutes focus on capturing the contents of a communication. A real-time transcript that is stored or sent to a third-party AI provider captures those contents, so it should be treated the same as an audio recording.
What is the “capability test” under CIPA?
It’s an approach some California federal courts use to decide whether a software vendor is an unlawful third-party eavesdropper. Under it, a plaintiff only has to allege that the vendor could use call data for its own purposes, not that it actually did. In Ambriz v. Google (N.D. Cal. 2025), the court applied this test to an AI contact-center product and let the case proceed.
Is there a federal law requiring AI voice agents to say they’re AI?
Not a final one yet. The FCC confirmed in 2024 that AI-generated voices are covered by the TCPA’s consent rules, and it has proposed requiring an AI disclosure at the start of AI-generated outbound calls, but that proposal has not been confirmed as a final rule. Separately, the FTC treats undisclosed AI interactions as potentially deceptive. Several states — including California for automated dialers, Utah, and Maine — already impose their own disclosure duties.
Does the EU AI Act apply to a U.S. startup’s voice agent?
It can. Article 50 applies based on whether the AI system interacts with people in the EU, not where the company is incorporated. Since August 2, 2026, voice agents interacting with people in the EU must inform them they’re dealing with AI unless that’s obvious.
Should the AI disclosure and recording notice be combined?
Combining them in one opening statement is efficient and usually effective, as long as both points are clear and come before substantive conversation. What matters is that the caller understands both that they are speaking to AI and that the call is being recorded and processed.
Get Your Voice AI Disclosures and Contracts Right — on a Flat Fee
Voice AI compliance isn’t one document. It’s the opening script, the product’s default settings, the vendor contract, the customer agreement, and the privacy policy — all saying the same thing.
Andrew S. Bosin is a two-time SaaS and AI founder who now represents AI and SaaS startups nationwide on a fixed-fee basis. He reviews your actual call flow and vendor stack, then drafts or revises the customer agreement, vendor terms, privacy policy, and disclosure language so recording consent and AI disclosure are handled together — not patched in after a demand letter arrives.
All packages are fixed-fee and paid up front. The fee covers all drafting, revisions, calls, and emails with Andrew.
Call Andrew for a free consultation at 201-446-9643.
Andrew S. Bosin, Esq.
Andrew S. Bosin LLC
36 Highland Road, Glen Rock, NJ 07452
201-446-9643 | andrewbosin@gmail.com
www.njbusiness-attorney.com
This article is provided for general informational purposes only and does not constitute legal advice. Recording and AI-disclosure laws vary by state and country and change frequently. Contact our office to discuss how these requirements apply to your platform and call flows.
#AIVoiceAgents #CallRecording #CIPA #AICompliance #AIDisclosure #VoiceAI #AIReceptionist #EUAIAct #SaaSLaw #AISaaS #StartupLaw #TechLaw