Two-party consent and restaurant call recording: a 50-state guide.

If you record customer calls — for training, dispute resolution, AI transcription, or modern voice agents like R.ai — the law cares about whether everyone on the call consented. Eleven US states require all parties to consent. The rest only require one. Here's the map. Not legal advice.

This post is informational, not legal advice. Talk to a lawyer in your state before relying on any of the below. Laws change; we'll update this post when they do.

The one-party vs all-party baseline.

Federal law (the Wiretap Act, 18 U.S.C. § 2511) allows a call to be recorded with the consent of just one party. If you're the restaurant and you're a party to the call, you can record it under federal law.

Most US states followed federal law and adopted one-party consent. But eleven states are stricter — they require all parties to a call to consent before recording. Calling into one of those states, or calling from one, from anywhere in the country, exposes you to their stricter rule.

The eleven all-party states.

As of 2026:

• California (Cal. Penal Code § 632)
• Connecticut (Conn. Gen. Stat. § 52-570d)
• Delaware (Del. Code tit. 11 § 1335)
• Florida (Fla. Stat. § 934.03)
• Illinois (720 ILCS 5/14-2)
• Maryland (Md. Code Cts. & Jud. Proc. § 10-402)
• Massachusetts (Mass. Gen. Laws ch. 272 § 99)
• Montana (Mont. Code § 45-8-213)
• Nevada (Nev. Rev. Stat. § 200.620)
• New Hampshire (N.H. Rev. Stat. § 570-A:2)
• Washington (Wash. Rev. Code § 9.73.030)

Pennsylvania is sometimes counted as a twelfth — the statute is murky and case law has interpreted it as all-party in practice (18 Pa. Cons. Stat. § 5704). Treat Pennsylvania as all-party to be safe.

What consent actually means.

In all-party states, you need affirmative knowledge or consent from every party on the line before recording. The two operational ways to get this:

1. A pre-call disclosure played first.“This call is being recorded for data analytics.” Continuing the call is treated as implied consent in all of the all-party states above — but the disclosure has to be played before any substantive conversation. Not at the end.
2. Explicit verbal consent.“Do you consent to this call being recorded?” followed by a yes. Rare in practice for inbound customer-service lines because it adds friction.

How R.ai handles this by default.

Every R.ai call opens with the same line, before any greeting:

“This call is being recorded for data analytics.”

This is hardcoded into the R.ai pipeline. You can't turn it off, you can't reorder it, you can't replace it with something cuter. The disclosure plays before the standard greeting on open-hours calls and before the after-hours message on closed-hours calls. It plays on the first ring, every ring, every time.

We made it non-configurable on purpose. We'd rather lose half a second of conversion to a slightly clunkier intro than let a restaurant accidentally violate Mass. Gen. Laws ch. 272 § 99 because someone decided the greeting was too long.

What about credit card recording?

Recording laws are a distinct concern from PCI scope. Even in a one-party state where the recording itself is legal, you cannot store an audio clip containing card number, CVV, and expiration without taking on full PCI-DSS scope.

R.ai handles this by pausing the recording before card collection and resuming it after the payment resolves. The card audio never enters storage. The pre-payment audio and post-payment audio are saved as separate clips so the “the recording was tampered with” dispute argument doesn't hold up.

State-by-state restaurant compliance checklist.

If you're in an all-party state:

• Play the recording disclosure before any greeting, every call.
• Pause recording before card collection. Resume after. Never store audio containing card data.
• Train staff who answer the back-line transfers to repeat the disclosure verbally if the call wasn't initially recorded but you've started recording (e.g. on a complaint call).
• Retention: keep recordings only as long as you need them. We default R.ai to 90 days for completed orders and 30 days for transferred / incomplete calls. Configurable.

If you're audited.

State attorneys general rarely audit small restaurants for call recording violations on their own — these laws are usually enforced when a customer complains, files a private civil suit, or names you in a class action.

The damages can be steep — California allows $5,000 per violation and attorney's fees. Don't skip the disclosure.

The TL;DR.

Eleven (twelve if you count PA) US states require everyone on a call to consent to recording. The cheap, effective way to satisfy this is a single-sentence pre-call disclosure played before the greeting. R.ai does this by default. If you record customer calls without that disclosure, you're carrying risk you don't need to be carrying.