One-Party vs Two-Party Consent States 2026: All 50 Listed

This guide is informational only and does not constitute legal advice. Call recording statutes and the case law interpreting them change frequently. Before deploying call recording in any commercial, employment, or investigative context, consult a licensed attorney in every jurisdiction whose residents you may record. Nimitai and the author assume no liability for actions taken based on this guide.

One-party consent is the legal standard under which a conversation can be lawfully recorded as long as at least one participant in the conversation has agreed to the recording. That participant can be the person doing the recording. Practically, if you are on a phone call in a one-party consent state, you can press record without announcing it to the other person on the line and the recording is legal under that state's wiretapping statute.

One-party consent is the federal default under the Electronic Communications Privacy Act of 1986 (ECPA), codified at 18 USC § 2511. The federal statute sets the floor: states can be more permissive in narrow situations but, more commonly, states have chosen to be stricter, which is how the 12 two-party states arrived at their current posture. If you are a journalist gathering evidence, a small business owner documenting a vendor conversation, or a customer trying to capture a bad-faith interaction with a service provider, one-party consent is what makes that recording possible without a court order.

The single biggest misunderstanding about one-party consent is that it lets you record anyone, anywhere. It does not. One-party consent only applies when you are a party to the conversation. Recording a conversation between two other people, where you are not a participant, is a federal felony under 18 USC § 2511 regardless of which state you are in. It is also a felony to record in places where the speaker has a reasonable expectation of privacy (a bedroom, a bathroom, a private medical consultation room) even if you are technically a participant. One-party consent is a permission, not a license.

Two-party consent, more accurately called all-party consent because most of these statutes require every participant to agree, not just two, is the stricter standard that requires every person whose voice is captured to be informed and to consent before the recording becomes legal. Consent can be express (verbally saying "yes, I consent") or implied (continuing the conversation after being told it is being recorded). Twelve US states currently apply this stricter rule, although the exact mechanics differ across jurisdictions.

The most important practical implication of all-party consent is that the typical US-wide assumption, that you can just press record without saying anything, is wrong in roughly a quarter of the country, and that quarter happens to include the largest US states by population (California, Florida, Illinois, Pennsylvania, Massachusetts, and Washington). If you operate a B2B sales team, run a contact center, or sell into the US from abroad, the all-party states cover so much population that the safest universal default is to disclose every recording every time. That single behavioural change eliminates almost all consent-related liability without meaningful business cost.

"Two-party" is a misnomer: it means all parties

The shorthand "two-party consent" is historic. It dates from an era when most recorded conversations involved exactly two people. Modern statutes in California (Penal Code § 632), Illinois (720 ILCS 5/14), Massachusetts (Mass. Gen. Laws ch. 272 § 99), Pennsylvania (18 Pa. Cons. Stat. § 5704), and Washington (RCW 9.73.030) require every participant to consent, not just two. On a five-person Zoom call originating from California, you need all five to consent, not any two of them.

The table below lists all 50 states plus the District of Columbia with the consent rule that applies to a conversation you are part of, the governing statute, and the practical wrinkle where one exists. The 12 two-party states and the Michigan hybrid case are explained in detail in the next section.

For statutes and fines per state in a sales-specific format, use our state-by-state sales recording reference.

Below is the canonical list of US two-party consent states as of 2026. Each entry cites the relevant statute or case law and notes the most important practical wrinkle for that jurisdiction. Note: a 13th state, Michigan, is often listed as a hybrid because the statute reads two-party but state court decisions have produced conflicting interpretations. The conservative posture is to treat Michigan as two-party.

California: Cal. Penal Code § 632

California is the canonical all-party consent state. § 632 makes it a misdemeanor to record a "confidential communication" without the consent of all parties. "Confidential" is interpreted broadly: a business phone call between a sales rep and a prospect generally qualifies. Penalties include up to $2,500 per violation plus $5,000 in civil damages under Cal. Penal Code § 637.2. The California Supreme Court's 2006 decision in Kearney v. Salomon Smith Barney extended § 632's reach to out-of-state callers recording California residents, which is why California consent law effectively governs any interstate B2B call touching a California participant.

Connecticut: Conn. Gen. Stat. § 52-570d

Connecticut is two-party for telephone calls under § 52-570d, which requires either verbal notification at the start of the recording, a written agreement, or a recorded warning tone every 15 seconds. In-person recording is governed by the separate eavesdropping statute (§ 53a-189), which is closer to one-party. The telephone-specific carve-out makes Connecticut one of the trickier jurisdictions for hybrid in-person/phone businesses.

Delaware: Del. Code Title 11 § 2402

Delaware's wiretapping statute is technically all-party under § 2402, but a separate statute (Title 11 § 1335) makes it a misdemeanor to record a "private conversation" without consent of all parties, with a one-party exception for participants. The practical effect is two-party for most commercial use cases. Conservative default: disclose every time.

Florida: Fla. Stat. § 934.03

Florida § 934.03 makes it a third-degree felony to intercept any "oral communication" without the consent of all parties. Penalties include up to 5 years imprisonment plus civil damages. Florida courts have applied § 934.03 aggressively in commercial settings, including against out-of-state callers recording Florida residents. Florida is the second-most-important state to comply with because of its combination of strict statute and aggressive enforcement.

Illinois: 720 ILCS 5/14-2

Illinois has the most complicated recent history of any two-party state. The original eavesdropping statute was struck down by the Illinois Supreme Court in 2014 as overbroad. The legislature rewrote it as 720 ILCS 5/14-2, which now requires consent of all parties for any "private conversation", a narrower definition than the prior statute but still broader than most one-party states. Penalties can reach Class 3 or Class 4 felony levels for repeat or aggravated violations.

Maryland: Md. Code Cts. & Jud. Proc. § 10-402

Maryland § 10-402 mirrors California in requiring all-party consent. The 1998 recording of Monica Lewinsky's calls by Linda Tripp was, famously, a Maryland violation. Maryland courts have generally held that consent must be explicit, not merely implied by continued participation, making Maryland one of the stricter jurisdictions for verbal disclosure compliance.

Massachusetts: Mass. Gen. Laws ch. 272 § 99

Massachusetts ch. 272 § 99 is the strictest US wiretapping statute by some measures: it prohibits the secret recording of any conversation, irrespective of whether the recorder is a party. The statute does allow non-secret recording with disclosure, meaning the test is not "did you consent" but "did you know." Recording that is announced to all participants, even if they do not verbally agree, is generally lawful under the secret-recording standard.

Montana: Mont. Code § 45-8-213

Montana § 45-8-213 requires all parties to be notified of the recording. Knowledge (not active consent) is sufficient: continuing the conversation after notification counts. Montana is generally treated as two-party for compliance purposes despite the technically lighter "notification" framing.

New Hampshire: N.H. Rev. Stat. § 570-A:2

New Hampshire § 570-A:2 makes interception without all-party consent a Class B felony. The statute is broadly worded and has been interpreted by NH courts to extend to in-person recordings as well as phone calls. The conservative default in New Hampshire is to assume any recording requires verbal disclosure.

Oregon: Or. Rev. Stat. § 165.540

Oregon is a split state: in-person conversations are one-party, but telephone and electronic communications under § 165.540 require all-party consent. This split matters for hybrid sales motions that mix in-person meetings and Zoom calls. The same conversation may be governed by different statutes depending on the medium.

Pennsylvania: 18 Pa. Cons. Stat. § 5704

Pennsylvania § 5704 requires all-party consent for any "oral communication." PA courts have interpreted the statute strictly and have refused to recognize most business-purpose exceptions that other states allow. Pennsylvania is one of the top-three risk jurisdictions for non-compliant B2B call recording.

Washington: RCW 9.73.030

Washington RCW 9.73.030 requires consent of all parties and explicitly provides that consent must be either verbal at the start of the recording or established by a recorded announcement. Like California, Washington courts have applied the statute to out-of-state recorders capturing Washington residents.

The hybrid case: Michigan

Michigan Compiled Laws § 750.539c)/mileg.aspx?page=getObject&objectName=mcl-750-539c) reads as a two-party statute on its face, but the Michigan Court of Appeals has interpreted it to permit one-party recording when the recorder is a participant. Federal courts applying Michigan law have split. The conservative compliance posture is to treat Michigan as two-party until the state supreme court resolves the split.

These states follow the federal one-party consent rule under ECPA. Recording is legal as long as at least one participant in the conversation consents, and that participant can be the recorder. The District of Columbia is also one-party. Some of these states have additional in-person eavesdropping statutes that add wrinkles (Alaska, Hawaii, Nevada notably), but for ordinary phone, video, or in-person business conversations between participants, recording is legal without disclosure. The full list with statute citations is in the state table above: Alabama, Alaska, Arizona, Arkansas, Colorado, Georgia, Hawaii, Idaho, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maine, Minnesota, Mississippi, Missouri, Nebraska, Nevada, New Jersey, New Mexico, New York, North Carolina, North Dakota, Ohio, Oklahoma, Rhode Island, South Carolina, South Dakota, Tennessee, Texas, Utah, Vermont, Virginia, West Virginia, Wisconsin, Wyoming, and Washington DC.

Primary sources for the largest one-party jurisdictions: New York (Penal Law § 250.00), Texas (Penal Code § 16.02), Georgia (O.C.G.A. § 16-11-66), Ohio (Rev. Code § 2933.52), New Jersey (§ 2A:156A-4), North Carolina (§ 15A-287), Virginia (§ 19.2-62), Colorado (§ 18-9-303), and Arizona (§ 13-3005). The full 50-state citation set, every statute linked to its state legislature or Justia/Cornell LII entry, lives in our state-by-state sales recording reference.

Note that Nevada deserves special attention. The in-person statute (NRS § 200.620) is one-party, but the Nevada Supreme Court in Lane v. Allstate (1998) effectively converted the phone-call standard into all-party consent. Practically, treat Nevada phone calls as two-party.

The federal Electronic Communications Privacy Act of 1986 (ECPA), codified at 18 USC § 2511, is the federal floor for call recording in the United States. Three things to know about it.

First, ECPA is one-party. Under § 2511(2)(d), it is not unlawful for a person to intercept a wire, oral, or electronic communication if that person is a party to the communication, or if one of the parties has given prior consent. That is the federal default. States can be more permissive only in extremely narrow scenarios (rare); states can, and 12 do, impose stricter all-party consent rules.

Second, ECPA criminalizes interception by non-participants. If you are not a party to the conversation and you have not been given consent by a party, you are wiretapping under federal law regardless of which state you are in. Maximum criminal penalty: 5 years imprisonment. Civil damages: the greater of (a) actual damages, (b) statutory damages of $100 per day of violation, or (c) $10,000, plus attorney's fees and punitive damages where applicable.

Third, ECPA contains a "business use exception" (§ 2510(5)(a)(i)) that allows employers to monitor calls on telephone equipment furnished in the ordinary course of business. The exception is narrow and does not survive when the call becomes personal. Courts have consistently held that employers must stop recording the moment they realise the call is personal in nature. The business use exception also does not override state two-party consent statutes; an employer in California still needs all-party consent regardless of the federal exception.

For a sales-team specific walkthrough of how ECPA interacts with daily call recording practice, see our companion state-by-state sales recording reference.

This is the single most-asked compliance question in this space, and the answer is simpler than most people think: apply the strictest law that touches the call. If even one participant is in a two-party state, treat the entire call as two-party.

The legal foundation for this conservative posture comes from *Kearney v. Salomon Smith Barney*, 39 Cal. 4th 95 (2006), in which the California Supreme Court held that California's two-party consent statute applies to out-of-state callers who record California residents, including a Georgia-based broker recording a California-based client without consent. Federal circuit courts have generally followed the Kearney logic; the FCC and most state attorneys general have also taken the "apply the stricter law" position for enforcement purposes.

The practical rule:

• If any participant is in California, Florida, Illinois, Maryland, Massachusetts, Pennsylvania, or Washington, get explicit verbal consent at the start of the call regardless of where you are calling from.
• If you do not know the location of the other participant(s), disclose and get consent anyway. This is the universal default that eliminates the need to maintain a state-by-state lookup table.
• Multi-state conference calls with five or more participants are functionally always two-party calls. Disclose and capture consent on the recording itself.

For US-wide compliance posture across a B2B sales team, the operationally simplest policy is "always disclose, always get verbal acknowledgement." That single standard satisfies all 50 states plus DC, removes the need for any caller-location inference, and adds approximately 4 seconds of overhead per call.

The legal framework varies meaningfully by medium. The same conversation, captured in three different ways, can produce three different compliance answers.

In-person conversations

In-person recording is governed by state eavesdropping statutes (separate from the wiretapping statutes that govern phone calls). The same one-party / two-party split applies, and most one-party states are also one-party for in-person, but the definition of a "private" conversation varies more widely. Conversations in public (a restaurant, a sidewalk, a conference hall) generally do not carry a reasonable expectation of privacy and can be recorded under most state laws. Conversations in a private office, home, or closed meeting room typically do require consent at the level applicable to that state.

Phone calls

Phone calls are the original target of both federal ECPA and state wiretapping statutes. The one-party / two-party split applies directly. Native iOS 18.1 call recording and stock Android call recording both play a mandatory disclosure tone when recording begins, which generally satisfies notice requirements in two-party states. Third-party recording apps may not include this tone. Review the app's disclosure behaviour before using it.

Video conferences (Zoom, Google Meet, Teams)

Video conferences are treated as "electronic communications" under federal ECPA and most state statutes. Zoom and Google Meet display a recording-in-progress visual indicator to all participants when host recording starts; that indicator generally satisfies one-party state notice requirements but is typically NOT sufficient in two-party states. In two-party jurisdictions, the host should verbally announce the recording at the start of the call and ideally get verbal acknowledgement.

Bot-based notetakers introduce extra risk. When a third-party AI notetaker joins the meeting as a separate participant, the bot itself is arguably a "third party" to the conversation, and in some interpretations its presence triggers the higher-scrutiny standards applied to non-party interception. The safer architecture is a no-bot AI meeting assistant: capture audio through the host's existing meeting client without injecting a separate participant, so the recording remains a participant-controlled action rather than a third-party interception. For B2B sales call workflows specifically, see our broader sales call recording software guide for compliance-aware platform options.

Workplace call recording sits at the intersection of federal ECPA, state wiretapping law, the National Labor Relations Act (NLRA), and state-specific workplace privacy laws. The compliance picture varies by both jurisdiction and employment context.

Federal baseline: ECPA's business use exception allows employers to monitor business calls in the ordinary course of business, typically for quality assurance, training, compliance, or supervisor coaching. The exception applies only to calls on equipment furnished by the employer for business purposes. The moment a call becomes personal in nature, the exception evaporates and the employer must stop listening or recording.

State overlay: In two-party consent states, employers must also comply with the state wiretapping statute. The common compliance pattern: (a) written notice in the employee handbook that calls may be recorded, (b) recorded greeting on inbound and outbound lines ("This call may be monitored or recorded for quality assurance"), (c) verbal disclosure at the start of any internal coaching review, and (d) explicit signed consent at hire for any recording beyond the routine quality-assurance scope.

NLRA considerations: The National Labor Relations Board has held that overly broad employer recording policies can chill protected concerted activity (i.e., employees discussing wages or working conditions). Employer recording policies must be narrowly tailored to legitimate business purposes and must not prohibit employees from recording their own conversations about protected topics.

The "this call may be recorded" disclosure

The ubiquitous recorded greeting at the start of customer service calls exists specifically to satisfy two-party consent in jurisdictions like California, Florida, and Pennsylvania. The disclosure functions as constructive consent: customers who continue the call after the disclosure are deemed to have consented by continued participation. This pattern is the operational template most multi-jurisdiction businesses follow.

Sales call recording is the most common commercial use case for this entire body of law. The compliance framework is largely the same, federal ECPA plus state two-party consent where applicable, but a few sales-specific patterns are worth calling out briefly here. For the full sales-team compliance playbook and a programmatic state lookup, see the state-by-state sales recording reference.

The single most important compliance shift for B2B sales teams in 2026 is the universal-disclosure default. Rather than maintaining a state-by-state matrix and inferring caller location from area code or IP, the operationally simplest posture is to verbally disclose at the start of every recorded call ("Quick note: we record our sales calls for coaching purposes. Is that okay with you?") and capture the consent on the recording itself. That single behavioural change satisfies all 50 states plus DC, eliminates the need for location inference, and removes the largest source of consent-related liability for distributed sales teams. Compliance-aware sales call recording software that announces itself on join layers a platform disclosure on top of the verbal one, and putting the prospect's state into your AI sales meeting prep notes means reps know the rule before they dial.

For coverage of how compliant call recording integrates with AI-driven sales workflows, including conversation intelligence, real-time coaching, and automated follow-up, see our overview of the AI meeting assistant and our guide to what meeting intelligence is. Startups evaluating compliant tooling may also find our sales call recording software guide useful as a starting point.

US-based businesses recording calls with international participants face a fundamentally different legal regime. EU and UK law are not consent-floor regimes like the US. They are lawful-basis regimes, in which recording requires both a lawful basis under GDPR Article 6 AND, in most cases, explicit opt-in consent. Recording an EU resident without GDPR compliance creates exposure to fines of up to €20 million or 4% of global annual turnover, whichever is higher.

EU GDPR

Call recording involving any EU data subject must satisfy GDPR Article 6 (lawful basis) and Article 7 (consent). The most common lawful basis for sales call recording is "legitimate interests" (Article 6(1)(f)), but the legitimate interests assessment must weigh the controller's interest against the data subject's reasonable expectations. Recording for AI coaching is a recognized legitimate interest in some jurisdictions but is being actively scrutinized by EU data protection authorities. The conservative posture is to obtain explicit consent at the start of every recorded call with any EU participant.

UK GDPR + PECR

The UK post-Brexit retained GDPR (now "UK GDPR") plus the Privacy and Electronic Communications Regulations (PECR) create a regime nearly identical to EU GDPR for call recording purposes. The Information Commissioner's Office (ICO) has issued specific guidance on call recording that requires either explicit consent or a documented legitimate-interests assessment, plus clear notice at the start of every recorded call. Maximum fines: £17.5 million or 4% of global annual turnover.

Canada: PIPEDA

The Personal Information Protection and Electronic Documents Act (PIPEDA) governs call recording involving Canadian participants. PIPEDA requires (a) consent, typically express, sometimes implied through continued participation after notice, (b) limitation to purposes the participant would reasonably expect, and (c) reasonable security safeguards. Quebec, Alberta, and BC have their own substantially similar provincial statutes. Penalties are lower than GDPR but can reach CAD $100,000 per violation.

Australia: Privacy Act 1988

The Australian Privacy Act and the state-level Surveillance Devices Acts produce an all-party consent default in most Australian states (NSW, Victoria, Queensland, South Australia, Western Australia, Tasmania, ACT, Northern Territory) for the recording of private conversations. Recording without consent can trigger both civil penalties under the Privacy Act and criminal penalties under the state-level Surveillance Devices Acts (typically 1-5 years imprisonment).

US vs international at a glance

Penalties for illegal call recording fall into three categories: criminal penalties under state and federal wiretapping statutes, civil damages under those same statutes, and downstream evidentiary consequences (illegally obtained recordings are generally inadmissible in court and may taint adjacent evidence under the "fruit of the poisonous tree" doctrine).

1. 01.Federal criminal: up to 5 years imprisonment. 18 USC § 2511 makes the unauthorized interception of wire, oral, or electronic communications punishable by up to 5 years in federal prison. The DOJ prosecutes ECPA violations selectively but does prosecute commercial cases, especially against repeat offenders and those who profit from the interception.
2. 02.Federal civil damages: $10K floor per violation. ECPA civil damages under § 2520 are the greater of (a) actual damages, (b) statutory damages of $100 per day or $10,000 per violation, whichever is greater. Plus attorney's fees, punitive damages where applicable. Class-action exposure is real when call recording programs sweep up many violations at once.
3. 03.State criminal: felonies in CA, FL, IL, MA, PA. California § 632 is a misdemeanor on the first offense, felony on repeat. Florida § 934.03 is a third-degree felony (5 years). Illinois eavesdropping can be Class 3 or 4 felony. Massachusetts ch. 272 § 99 is a felony. Pennsylvania § 5704 is a felony. State criminal penalties typically exceed federal in the strict-state jurisdictions.
4. 04.State civil damages: California $5,000 floor. California § 637.2 provides civil damages of $5,000 per violation or three times actual damages, whichever is greater, plus attorney's fees. Florida § 934.10 provides civil damages plus punitive damages plus attorney's fees. Many state statutes mirror or exceed the federal ECPA civil framework.
5. 05.Evidentiary inadmissibility. Illegally obtained recordings are generally inadmissible as evidence in court, both in the proceedings where the recording is offered and, under the "fruit of the poisonous tree" doctrine, in any case that derives evidence from the illegal recording. This is often the most painful downstream consequence: a recording made to protect against a future dispute becomes inadmissible in that exact dispute.
6. 06.Tort exposure: invasion of privacy. Independent of statutory wiretapping law, illegal recording exposes the recorder to tort claims for invasion of privacy, intentional infliction of emotional distress, and (in commercial settings) tortious interference. These claims typically survive even where statutory claims fail and can be pursued by individual plaintiffs without the prosecutorial discretion barrier that limits criminal exposure.

The legal sufficiency of a disclosure depends on (a) whether it is delivered before recording starts, (b) whether the other party is given a chance to decline, and (c) whether the disclosure is captured on the recording itself for future evidentiary purposes. Below are tested scripts for the four most common recording contexts.

Phone call to an individual prospect or customer

"Quick housekeeping note: we record our calls for coaching and quality purposes. The recording stays internal to our team. Is that okay with you to continue?"

(Wait for verbal acknowledgement before continuing. Capture the acknowledgement on the recording.)

Inbound customer service line

"Thank you for calling [Company]. This call may be monitored or recorded for quality assurance and training purposes. By continuing, you consent to this recording. If you do not consent, please hang up now."

(Plays before the call is connected to an agent. Continued participation constitutes implied consent in all 50 states.)

Zoom or Google Meet for sales / customer calls

"Before we dive in, I'm recording this so we can refer back to it and so my team can use it for coaching. The recording is internal-only. Let me know if you'd prefer I turn it off."

(Combined with the platform's visual recording indicator, this satisfies both one-party and two-party state requirements when the participant continues without objection.)

Internal employee coaching review

"Before we start, I'm going to record this coaching session so we can both refer back to the feedback later. It stays between you, me, and HR. Sound good?"

(Required in two-party states even for internal employer-employee conversations. Pair with written notice in the employee handbook.)

One important pattern across all four scripts: the disclosure happens BEFORE the substantive conversation starts AND is captured on the recording itself. A disclosure that happens after recording has started, or that is not captured on the recording, may be challenged later as either untimely or unprovable. The "capture the consent on the recording" discipline is what makes a recording legally defensible in a future dispute.

Operational compliance for call recording is not just about delivering the right disclosure. It is about maintaining the documentary record that proves you delivered the disclosure if you are ever challenged. The following six documentation practices are what separates a defensible call recording program from one that collapses under audit.

1. 01.Written recording policy. Document the lawful basis for recording, the categories of calls recorded, the retention period, the access controls, and the consent flow. Update annually.
2. 02.Per-call consent capture. The verbal consent should be captured on the recording itself, not just logged in a separate system. A consent flag in your CRM is helpful for analytics but is not the legally-defensible artefact. The audio itself is.
3. 03.Employee training records. Maintain documented training attendance for every employee who records customer calls, with annual refresher training. Forrester and the EU's CNIL both flag this as a leading indicator of compliance maturity.
4. 04.Retention schedule and deletion log. Define how long recordings are retained (typically 6-24 months for sales calls, 7+ years for regulated industries), document the deletion process, and log every deletion event for audit purposes.
5. 05.Access control audit log. Track who accessed which recording, when, and for what purpose. Required under GDPR Article 30 and under most US-state data breach notification statutes for any access that could constitute exposure.
6. 06.Data subject access response process. Under GDPR, UK GDPR, PIPEDA, and CCPA, recorded individuals have rights to access their recordings, request deletion, and (in some jurisdictions) export their data. Document the operational process for handling each request type within the statutory deadlines (typically 30 days under GDPR).

For B2B sales teams specifically, the recording platform should make most of these documentation requirements automatic. Capture-on-recording consent, retention scheduling, access logging, and DSAR export should be platform features, not manual processes. Compliance-aware platforms like Nimitai's AI meeting assistant include this tooling natively, with no bot joining your meetings because capture happens inside the host's existing client; legacy enterprise platforms often require professional services engagements to configure equivalent workflows. Nimitai is $149 per seat per month, month-to-month, no seat minimum.