Call recording, consent and retention: what to check

The short answer

A company using an AI voice agent should say at least two things clearly at the start of the call: that the call may be recorded, and that the caller is speaking with artificial intelligence. The questions after that — what form consent must take, how long the recording is kept, who can access it — vary by country, sector and the purpose of the call, and must be settled with a lawyer.

This article is not legal advice. Its aim is to give a list of questions to check, show a practical form for the notice, and avoid confusing technical capabilities with legal requirements.

Why the topic matters more with AI

In a classic contact center some calls are recorded and often listened to only for quality purposes. An AI voice agent usually records every call, turns it into text, produces a summary and writes fields to the customer card. So one call creates several kinds of data: an audio file, a transcript, a summary and structured fields. Each needs rules for retention, access and deletion.

The notice at the start of the call

The notice should be short, clear and in the first seconds of the call. A long legal text tires the caller and the key meaning gets lost. An illustrative form:

1. 1Who"Hello, [company name]."
2. 2AI"I'm the company's virtual assistant."
3. 3Recording"This call is recorded for service quality."
4. 4ChoiceIf your lawyer requires it: "If you'd prefer it not to be recorded, just say so and I'll connect you with a colleague."

Saying openly that it is AI

Some jurisdictions have, or are developing, requirements to inform people when they interact with artificial intelligence. Regardless of legal requirements, telling the caller that the agent is AI protects trust: when a caller asks "why didn't you tell me I was talking to a robot?", the lost trust is hard to win back. The agent should never answer "yes" to "are you a person?"

Questions for your lawyer: consent

• In our country and sector, is a notice enough for call recording, or is explicit consent needed?
• If the caller is in another country, which rules apply?
• If the caller declines recording, how should we continue the call?
• Does AI processing of the call (transcript, summary) need a separate notice?
• Do the rules differ for outbound calls?

Questions for your lawyer: retention

• How long must, or may, the audio recording be kept?
• Are the transcript and summary subject to the same period as the audio?
• What is the period for structured fields written to the customer card (name, number, request)?
• Do sector requirements (finance, healthcare) require additional periods?
• How should deletion be documented when the period ends?

Retention is not only a legal question but a practical one: the longer recordings are kept, the higher the leak risk and storage cost. "Keep everything just in case" is not a good policy.

Questions for your lawyer: access and rights

• In the company, who can listen to recordings, who can see only transcripts, who only summaries?
• Does the vendor's (platform's) support team access the data, and on what terms?
• In which country is the data stored, and is that a problem for you?
• What is the procedure if a customer asks for their recording or asks for it to be deleted?
• Is the data used to train the model?

When a caller declines recording

If your lawyer requires giving the caller a choice, the flow for declining must be written in advance. The simplest route is to transfer the call to an unrecorded line or to a member of staff. If that is not possible, offer an alternative channel: a website form, a message or email. What matters is that a caller who declines is not left without service, and that the refusal itself is recorded — so you can later answer "was there consent?"

The data minimisation principle

When you write the fields to extract from a call in the scenario, ask: why is this field needed? For an appointment, name, number and time are enough — date of birth, address or health information should only be asked for when there is a real need. The less data collected, the less risk and work around retention, access and deletion.

A technical capability is not legal compliance

A platform that stores recordings, has a delete function or access roles does not automatically make a company compliant. These are tools; compliance comes from the company's policy, processes and their actual application. When a vendor mentions a certification or compliance claim, ask for the document and check with a lawyer whether it covers your cases.

Illustrative example: a policy document

Not a real customer case. Before launching an AI agent, a mid-sized service company prepared a one-page policy with its lawyer: the notice wording and its version; separate retention periods for recordings, transcripts and summaries; access by role; a procedure for responding to customer requests; and who deletes data, and how, when the period ends.

The document is kept alongside the agent's scenario, and every scenario change is checked to make sure the notice was not touched. Once a quarter the legal lead opens random calls and checks that the notice actually played.

Common mistakes

• Giving the notice as a long legal text
• Hiding that the agent is AI
• Assuming the same rule for audio, transcript and summary
• Not setting a retention period — "keep forever"
• Accepting a vendor's compliance claim without checking it

Limits

This article is not legal advice and does not describe the law of any country. Rules on call recording, personal data and communicating with AI differ by jurisdiction, sector and call purpose, and can change. Establish the specific requirements with a specialist lawyer and from the official sources of the relevant regulator.

Recordings and transcripts in Vexvon

In Vexvon AI Call Center every call's audio recording and full transcript go to the panel, and the summary and the fields you define in the scenario are written to the customer card. What the agent says, including the greeting and the notice, is written in the scenario, so the wording approved by your legal team can be added there. Questions such as retention periods, access roles and data location should be discussed separately with us under the contract and technical terms; general security information is on the security page.

Access, masking and deletion in call recordings are covered in personal data in call recordings, and financial-sector specifics in financial services voice AI.

First step

Send the three question lists above to your lawyer and collect the answers into a one-page policy. Do not open the agent to real customers until the notice wording is approved. More articles are in the reliability & pilots section.