Call recording laws

HubSpot's Conversation Intelligence (CI) and call recording features in HubSpot allow you to keep records of your phone calls with contacts to make follow-up calls easier and keep your team up-to-date.

The information below is designed to provide you with guidelines about some things you'll need to consider when recording and transcribing calls; however, HubSpot always recommends you speak with your legal team to ensure you have everything covered.

Disclaimer: this page is neither an exhaustive summary of call recording laws nor legal advice for your organization to use in complying with it. Instead, it provides background information to help you better understand call recording laws and how it can apply to your organization. This information is not the same as legal advice, where an attorney applies the law to your specific circumstances, so you should consult an attorney if you’d like advice on your interpretation of this information or its accuracy.

From a legal and compliance standpoint, it is important to understand your obligations when recording and transcribing your calls. Call recording laws differ across jurisdictions.

United States (U.S.)

In the United States, individual states approach call recording laws in two distinct ways:.

1. ‘One Party Consent’ state, where you must notify and get consent from at least one of the parties on the call.
2. ‘Two Party Consent’ or ‘All Party’ states, which prohibits recording of a call without the consent of all parties to the communication before recording the conversation. If a party does not want to be recorded after being notified, it is up to the party to leave the call.

If a contact’s area code is associated with a ‘Two Party Consent’ state, the recording feature is turned off by default. When you click the Record button, a dialog box will appear to remind you to obtain consent. You must inform the contact that you’ll be recording, then click I have informed them to continue recording the call.

However, because HubSpot can’t be sure where your contact is actually located when you call them, it’s good practice to get consent where there’s any uncertainty or to consider making it a policy to always ask for consent.

In the majority of U.S. states, you'll only need consent from one of the persons participating in a call in order to record it. The party making the call can provide consent. However, approximately 13 states have chosen to require all parties' consent in order to record the call and transcribe the call. These states are currently California, Connecticut, Delaware, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Pennsylvania, Vermont, and Washington State.

For more general information on the subject, refer to OrecX’s resource on telephone recording laws or the Digital Media Law Project's article on the basics of state recording laws.

United Kingdom (U.K.)

Several laws, including the Regulation of Investigatory Powers Act 2000 and the UK GDPR govern the practice of recording calls in the United Kingdom (U.K.). Because of restrictions around sharing recorded calls with third parties, you can think of the U.K. as an "all-parties' consent" jurisdiction.

Europe/data privacy

The GDPR, and other European regulations like the ePrivacy Regulation, generally require consent from all parties on a call for the call to be recorded. This means that the parties should be presented with an affirmative opt-in with a meaningful way to opt out of the recording. GDPR obligations also require a valid and legal reason for recording the call that would allow the information to be collected. You should also check call recording rules in your specific country, as the EU member states have implemented different rules that apply to call recording consent in different contexts.

Ireland

Under Irish law, to record calls, you must obtain consent, so Ireland joins the U.K. and 13 U.S. states as an "all-parties' consent" jurisdiction. Irish law makes clear that the purpose of the recording should be explained in detail, so the parties participating can give informed consent.

Read more about Ireland's approach to call recording at the end of the Data Protection Commissioner's FAQ page.

Germany

Germany is a two-party consent state, meaning call recording without both parties consent, when applicable, is deemed a criminal offense under Section 201 of German Criminal Code.

Canada

Like Ireland, Canada has established a single set of rules for call recording, built into its electronic privacy law (PIPEDA).

Joining the other countries and states mentioned above, Canada has adopted an "all-parties' consent" approach: to record a call, you need to obtain informed consent by notifying others on the call (1) that you intend to record the conversation, (2) any purposes the recording will be used for, and (3) that the call may only be recorded with each person's consent.

Read more about Canada's approach to call recording by referring to the Privacy Commissioner's Guidelines for Recording Customer Calls.

Other jurisdictions

While this article has chosen to highlight certain countries and jurisdictions above, it's by no means an exhaustive list. Since HubSpot doesn't know and can't enforce all international calling legal restrictions, HubSpot opts to display this consent message for all international calls except for Sweden, New Zealand, and one-party US states where automatic recording is permitted. Before making a call to a new country, HubSpot recommends making sure that you and your legal team have an understanding of any regulations there, and always obtain consent if you're in doubt.

Other privacy considerations

Employee monitoring

Another aspect to consider when recording and transcribing calls is employee privacy. Other users in the portal (i.e., your employees or coworkers) will also be recorded, so you may need to consider notifying other users in your HubSpot account that their calls will be monitored internally.

Call recording security and storage

HubSpot calling is powered by Twilio, a Voice Over IP (VOIP) service that connects the call between you and the number you're calling. HubSpot uses Twilio to record and store any calls that the user chooses to record. All call recordings are stored on Twilio’s servers and can be accessed by HubSpot. 

HubSpot's recording links are not authenticated, and therefore publicly accessible. It is important that you do not distribute recordings externally because anyone with the link will be able to access the recording. However, recording URLs are long and difficult to guess, so the contents of the recordings should be reasonably private unless you distribute the URL. For more information please review Twilio's documentation. 

The ability to record calls is an account-wide setting, affecting all users who are making calls in the account. It can be turned on or off by a user with Account access permissions. Newly created HubSpot accounts will have the Allow call recording checkbox enabled by default.