VICIfast
All compliance

Call recording laws by state

One-party vs two-party consent, where each applies, and how to configure VICIdial's recording for compliance.

Recording laws are state-by-state, not federal. Get this wrong and you face civil + criminal liability under the same state's wiretap statute. This is operator guidance — talk to a lawyer before any recording program.

The two camps

One-party consent (most states)

You (the agent) are a party to the call, and your consent is sufficient. You can record without informing the other side.

States: most. Federal default (when call crosses state lines via federal carriers) is also one-party.

Two-party consent (or all-party)

All parties must be informed AND consent. Just announcing "this call may be recorded" is generally enough to establish implied consent if the caller stays on the line.

States enforcing two-party consent (as of 2026):

  • California — strict, criminal exposure
  • Florida — strict
  • Illinois — relaxed in 2014 ruling but still applies in some cases
  • Maryland — strict
  • Massachusetts — strict, criminal
  • Montana — strict
  • New Hampshire — strict
  • Pennsylvania — strict
  • Washington — strict

Mixed bag

Some states are tricky:

  • Connecticut — civil one-party, criminal two-party
  • Nevada — federal interpretation of one-party
  • Oregon — one-party for in-person, but disclosure required for telephone

When in doubt, follow two-party rules.

How to comply operationally

The standard pattern for high-volume call centers:

  1. Beep + announcement at call start: "This call may be recorded for quality assurance."
  2. Stay on the line = implied consent. Hangup before answering = no recording (drop the recording for that call).
  3. Per-campaign recording flag so you can disable for specific lead segments (e.g., HIPAA-covered calls might require additional consent).

VICIdial config

Per campaign:

  • Allow Closer Recordings = Y
  • Recording Override = ALLFORCE (records all calls) or ALLFORCE_VM (records all + voicemails)

Per agent:

  • Recording Filename template — include {lead_id} and {campaign_id} so you can correlate later

For two-party state campaigns, also wire your dial-plan to play a beep before connecting to the agent. VICIdial supports this via MixMonitor flags or a custom AGI script.

Storage + retention

Recordings live at /var/spool/asterisk/monitorDONE. Plan for:

  • ~250KB per minute of mono recording
  • 50 agents × 4 hours/day × 250 days = ~150GB/year

Add the Volume — 500GB addon for larger fleets, or run nightly archival to S3-compatible storage.

Retention policy

Set by your industry + state:

  • Collections: 2-7 years (FDCPA + state)
  • Insurance: 7+ years (state insurance regulators)
  • Healthcare: 6+ years (HIPAA)
  • Financial advisory: 5-7 years (FINRA / state)

Document your retention policy + delete on schedule. Deleting before the policy minimum or keeping after the maximum both create legal exposure.

Related