AI Call Answering and Call Recording Rules: A Global Overview
Rules on answering and recording calls with AI differ by country, and sometimes by state or sector. Official UK and EU sources treat call audio as personal data, and a US state attorney general has enforced recording notices. Other countries differ. This is not legal advice, so check your own jurisdiction.
Why the answer changes from country to country
A call with an AI assistant can involve several different laws at once: data protection law, rules on recording or intercepting communications, and rules on automated or marketing calls. Each country, and in some places each state, writes these differently. A business that takes calls from customers in more than one place may have to think about more than one set of rules.
This page is a map, not a rulebook. We have only included statements that we read on official regulator or government pages, and where we could not verify something we say so and point you to the regulator. It is not legal advice.
United Kingdom
In the UK, the Information Commissioner's Office (ICO) is the data protection regulator. Its guide to lawful basis says you must have a valid lawful basis to handle personal information, and its guide to the right to be informed says individuals have the right to be informed about the collection and use of their personal data. A recorded call or transcript is personal data, so those principles are relevant.
The ICO gives an example of a company relying on legitimate interests to use helpline call recordings for staff training. We could not retrieve a dedicated ICO page on recording telephone calls, and we could not open the legislation.gov.uk pages on lawful business monitoring of communications, so we do not state specific rules on consent or notices. Read the ICO guidance directly. Our more detailed UK guide is linked below.
European Union
The European Commission describes the GDPR as the EU's main data protection law. It says the GDPR applies to organisations established in the EU, and also to organisations outside the EU that offer goods or services to individuals in the EU or monitor their behaviour.
The Commission lists the data protection principles as lawfulness, fairness and transparency, purpose limitation, data minimisation, storage limitation, accuracy, integrity and confidentiality, and accountability. It also lists individual rights, including the right to be informed and rights relating to automated decision-making. How these apply to call recording, and what national rules add, depends on the member state, so check your national data protection authority and the European Data Protection Board.
United States
In the US there is no single national data protection law of the GDPR type that we verified, and recording rules are set partly at state level. One official example we could read is from California. The California Attorney General's privacy enforcement page describes a settlement in which a bank agreed to pay for recording consumers' phone calls without a timely disclosure, as required by sections 632 and 632.7 of the California Penal Code, and agreed to make clear, conspicuous and accurate disclosures when recording confidential communications.
On automated calls, the Federal Communications Commission (FCC) announced a declaratory ruling that calls made with AI-generated voices are 'artificial' under the Telephone Consumer Protection Act. The FCC says AI-generated voices in calls are held to the same standards as other prerecorded messages, which require prior express written consent for telemarketing robocalls. That concerns calls that a business places. We did not verify how it applies to a business answering inbound calls, so do not assume it does or does not. State laws vary, so check the rules for each state you operate in.
Other countries
Other countries differ, often in important ways. Some require everyone on a call to be told about recording, some are more permissive, and many have their own data protection regulator and rules on automated decisions or cross-border transfers. We have not covered them because we could not verify them from official pages in this session. Look up your national regulator before you deploy.
Common threads worth planning for
Despite the differences, the official sources we read share a few themes. They are not a substitute for local advice, but they are a sensible starting point for any deployment.
Tell people what is happening: who is recording, why, and where to read more.
Keep recording to what you need, and decide how long you keep it.
Be careful about solely automated decisions that significantly affect people.
Know which suppliers handle your calls, and where they store the data.
Offer a route to a real person, and keep sensitive or urgent matters with one.
Write down which country's or state's rules apply to each group of callers.
A simple way to approach a multi-country rollout
The tools can usually be configured for different notices and retention periods. Which settings are legally required is a question for your adviser, not your software provider.
List the countries and states your callers are in.
Find the data protection regulator and the recording rules for each.
Start with the strictest rule that applies, and use one consistent announcement.
Ask your provider where data is held and whether you can set retention per region.
Take local legal advice before going live in a new country.
Sources
ICO: A guide to lawful basis
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/
ICO: The right to be informed
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/
ICO: What is the legitimate interests basis? (call recording example)
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/legitimate-interests/what-is-the-legitimate-interests-basis/
European Commission: Data protection explained
https://commission.europa.eu/law/law-topic/data-protection/data-protection-explained_en
California Attorney General: Privacy enforcement actions
https://oag.ca.gov/privacy/privacy-enforcement-actions
FCC: AI-generated voices in robocalls (declaratory ruling announcement)
https://docs.fcc.gov/public/attachments/DOC-400393A1.txt
Erudience services related to this guide
Use cases related to this guide
Industries this guide applies to
Terms used in this guide
More guides to read next
- Is It Legal to Use AI to Answer Business Calls in the UK?
- What Can an AI Receptionist Do, and What Can't It?
- Missed-Call Text Back: How It Works and How to Set It Up
Frequently asked questions
Is it legal to record AI-answered calls everywhere?
No single answer applies everywhere. Rules differ by country and sometimes by state or sector. Official UK and EU sources treat call data as personal data, and some US states enforce recording notices. Check your own jurisdiction or take legal advice.
Do I have to tell callers a call is recorded?
Often you should. The UK ICO says people have a right to be informed about use of their data, and the California Attorney General has enforced timely recording disclosures. Exact rules vary, so check the regulator for each place you operate.
Does the GDPR apply to businesses outside the EU?
According to the European Commission, it can. It applies to organisations outside the EU that offer goods or services to individuals in the EU or monitor their behaviour. Check the Commission and your national authority for how that applies to you.
What did the FCC decide about AI voices?
The FCC said calls made with AI-generated voices are 'artificial' under the US Telephone Consumer Protection Act, so the same standards apply as for other prerecorded messages. We did not verify how it applies to inbound call answering.
Where can I check the rules for my country?
Start with your national data protection regulator, such as the ICO in the UK or your national authority in the EU, and your state attorney general in the US. For anything binding, take advice from a qualified local adviser.