California call recording consent and AI phone systems

I am not a lawyer and nothing here is legal advice. What follows is the operator version: what the requirement is, where AI phone systems quietly create exposure, and which questions to put in front of counsel so the conversation takes twenty minutes instead of an hour.

The reason this matters more with AI than with a human front desk is simple. A human answering your phone is not recording anything. An AI is recording by design, because transcription is how it works at all.

What does two party consent actually mean?

Every party to the call has to consent before recording begins. Not partway through, not in a disclosure the caller hears after the useful part of the conversation.

The operative provision for an inbound business line is Penal Code section 632.7, which prohibits recording a communication transmitted between cellular, cordless and landline telephones without the consent of all parties. Three features of it are worth knowing before you talk to anyone.

It applies to you, not just to eavesdroppers. The California Supreme Court settled that in Smith v. LoanMe in April 2021, holding that section 632.7 applies to parties as well as nonparties. "I am on the call, so I can record it" is the intuition the case rejected.

There is no confidentiality element. Section 632.7 reaches all communications, not just confidential ones. The reasonable-expectation argument that might help a restaurant under section 632 is not available here.

There is no business purpose exemption. The exemptions in section 632.7(b) cover public utilities, tariffed equipment and correctional facilities.

Then the damages provision. Section 637.2 sets recovery at the greater of $5,000 per violation or three times actual damages, and subsection (c) states that it is not a necessary prerequisite that the plaintiff has suffered or is threatened with actual damages. Five thousand dollars, no injury required, and class certification available.

Two practical consequences follow.

The disclosure has to be at the very top of the call, before the agent starts collecting anything. The Ninth Circuit's decision in Javier v. Assurance IQ in May 2022 is the reason to be strict: it reversed a district court that had accepted an after-the-fact privacy policy agreement as retroactive consent, predicting that California would require prior consent. If your greeting is warm and friendly and gets to the recording notice on line four, you have already collected the caller's name on a recording they had not agreed to.

And consent needs to be recorded as having happened. A notice nobody can prove was played is worth less than one you can produce a log for.

The most common mistake I see is a greeting that mentions recording after the agent has already asked "how can I help you today." That question and its answer are both on the tape.

There is also the out of state question. Callers dialing your California number from elsewhere raise their own issues, and that is a question for counsel rather than a vendor support article.

Does a transcript count the same as a recording?

Assume yes until your attorney tells you otherwise.

Vendors sometimes suggest that if audio is discarded and only text is kept, the analysis changes. Building your compliance posture on that distinction is a bad trade for the money involved.

Practically, most platforms keep both. Ask your vendor three questions in writing:

What exactly is stored, audio, transcript, or both. How long is each retained. And who else has access, including subprocessors and any model provider.

That last one surprises people. Your call data may pass through several companies before it reaches your dashboard. For a dental practice or med spa that chain is also a HIPAA question. HHS guidance names an AI chatbot providing appointment scheduling as a business associate example, the conduit exception does not apply to a system that stores and transcribes, and the agreement chain has to be unbroken down to every subcontractor. California's Confidentiality of Medical Information Act adds a private right of action with $1,000 in nominal damages and no proof of harm required.

How much is actually sitting in storage right now?

Run the number, because the answer is usually larger than the owner expects.

Take your call volume. Say 40 calls a day, five days a week. That is roughly 10,400 calls a year.

Apply the vendor's default retention. Many platforms keep recordings and transcripts indefinitely or on a multi-year window. At three years you are holding roughly 31,200 audio files and 31,200 transcripts, most containing a name and a phone number, some containing health or financial detail.

Now ask what each one is. If the consent posture is sound, each is an asset: quality control material, dispute evidence, training material for your own script. If it is defective, each is a unit that a plaintiff's lawyer counts, at $5,000 apiece with no harm required.

The conclusion is not to stop recording. It is that retention length is a risk decision, not an IT default. Pick a period you can justify, write it down, and make the vendor confirm in writing that deletion actually happens rather than being hidden from your dashboard. Ninety days covers almost every legitimate operational use.

Where does the disclosure go, and what does it cost you?

First thing, before anything else, in the shortest form your counsel will accept.

Owners resist this because they assume a legal notice at the top of the call drives people away. One short line in a normal voice does not. What drives people away is a forty word notice read by a different, robotic voice than the rest of the call.

Keep it to one sentence and get straight into being useful. The caller has heard recording notices their whole adult life.

There is also a design shortcut worth taking. Since the disclosure has to satisfy California anyway, apply the California script to 100% of calls rather than building state-conditional logic. Caller ID geolocation is unreliable, misrouting is worse than over-disclosing, and Washington, Illinois, Pennsylvania, Florida, Massachusetts and several other states have all-party consent rules of their own. One script, every call, no branching.

Test it either way if you like, but be honest about whether you have the volume to test anything. Most local businesses do not have the traffic to run a valid test, and the right move at that volume is to do the compliant thing and stop wondering.

Is the law about to get easier?

No, and you will be told otherwise, so it is worth knowing what happened.

Senate Bill 690 was introduced to add a "commercial business purpose" exemption to sections 631, 632, 632.7 and 638.50. It passed the Senate 35 to nothing in June 2025, and the business community treated it as relief on the way.

Then the Assembly amendment of 2 July 2026 deleted all of it. The bill title changed from an act to amend sections 631, 632, 632.7, 637.2 and 638.50 to an act to amend section 637.2. What survived removes the private right of action only for pen register claims under section 638.51 arising from websites and apps, enforceable by the Attorney General only.

Call recording exposure is unchanged. Plan on the assumption that no relief is coming, and treat anyone who tells you the rules are about to loosen as someone who read a headline from 2025.

There is a second reason an agency should care. The high-growth theory in the current wave of California privacy litigation is section 638.51, the pen register provision, aimed at call tracking and dynamic number insertion scripts. That is exactly the artifact a marketing agency installs on a client site. Enforcement is almost entirely private, so the practical exposure is settlement cost. Ask whoever manages your website which tracking scripts run and when the consent banner fires relative to them.

Does the agent have to say it is AI?

Not on a general business line in California, as things stand. There is currently no California law requiring an ordinary business phone call to disclose that the caller is speaking with AI. Any vendor telling you otherwise is selling you a feature.

The picture is different in specific settings. AB 3030, effective 1 January 2025, requires a health facility, clinic, physician's office or group practice using generative AI for written or verbal patient communications about clinical information to carry a prominent AI disclaimer and instructions for reaching a human. AB 489, in force since 1 January 2026, separately bars any persona implying a licensed professional. Dental and med spa practices should treat both as live questions for counsel rather than optional features. The limits on what a dental AI can say sit right alongside this and should be reviewed in the same sitting.

Outside those settings it is an operating choice, and I think disclosure is the right one anyway. What callers do when they work out it is AI is far better when they were told than when they figured it out and felt handled.

One more item belongs on the vendor list. California's AI Transparency Act, operative 2 August 2026, binds providers with more than a million monthly users. Your agency and your dental office are not covered. Your text to speech vendor very likely is, and the statute requires latent provenance disclosures embedded in generated audio. Ask each voice vendor in writing how they comply, and do not let anyone strip provenance data out of the audio.

What should you have counsel review, specifically?

Give them a short list rather than a general question. It saves you money and gets you a usable answer.

The exact wording and placement of your recording notice. Your retention period and where recordings and transcripts are stored. Whether your vendor's subprocessors change the analysis. Whether your industry carries any additional disclosure requirement, and whether AI disclosure applies to you. And what happens when a caller declines to be recorded, because your system needs a defined path for that, not a crash.

That last one is the item people forget. Decide now whether a caller who says "do not record this" gets transferred to a human, gets recording disabled for that call, or gets told you cannot proceed. Any of those can be workable. None of them can be improvised at runtime.

All of this belongs in the same document as everything else the system needs, which is why the information gathering that happens before an AI receptionist goes live should include a compliance section rather than treating it as a separate project.

What to do this week

Call your own AI line and listen to the first fifteen seconds with a stopwatch. Note the exact moment the recording notice plays and the exact moment the agent first asks for information. If the second comes before the first, stop and fix it today.

Email your vendor the three storage questions and keep the reply. Add the retention question and the provenance question.

Write your "caller declines recording" path in one sentence and put it in the script.

Then book thirty minutes with your attorney with the list above in hand. If you are also watching cost per lead and call outcomes, the numbers a home services owner should actually watch will tell you whether the phone system is earning its place at all.

Questions about your recording setup?

Email me at eric@seod.com with your industry, your platform name, and whether you know today if calls are being recorded. I will send you back the specific list of questions to put in front of your attorney, written so a lawyer can answer them quickly, plus what your vendor should be able to confirm in writing.

That is the whole offer. I will not tell you what the law requires for your situation, because that is what counsel is for, and anyone in marketing who tells you otherwise is doing you harm.

More on the rest sits in the AI phone and lead response library.