AI calls, recording consent and disclosure: a practical checklist

An AI voice agent collects personal data the moment a caller gives a name, a number or a reason for calling, and many businesses also record the audio. Two questions follow on every call: does the caller know they are talking to an AI, and do they know the call is recorded and why? Our guide to AI call recordings and transcripts covers what recordings are useful for; this checklist covers what callers should be told.

The rules differ by country and sometimes by state or province, and they change. This article summarises primary sources as practical guidance. It is not legal advice, so agree your wording and retention period with whoever handles compliance for each market. The Vistrow Voice security overview lists the controls in place today.

For what to do with recordings once you have them, read AI call recordings and transcripts and the Vistrow Voice security overview.

In the European Union, Article 50 of the AI Act requires AI systems that interact directly with people to be designed so that people are informed they are interacting with an AI system, unless that is obvious. The European Commission says this applies from 2 August 2026 and that the notice should come at the start of the first interaction. In the United States, the Federal Communications Commission ruled in February 2024 that AI-generated voices count as an “artificial” voice under the Telephone Consumer Protection Act, so outbound calls using them need the called party’s prior express consent unless an exemption applies.

Even where no rule requires it, saying so is good practice. Callers who work it out on their own can lose trust in the whole call. One short sentence at the start is enough, in the caller’s language. See how Vistrow Voice handles this in the consent, recording and retention settings.

Tell callers the call is recorded before the conversation starts, and say why in plain words. Canada’s Office of the Privacy Commissioner says organisations must inform customers that a call is recorded and state the purpose as clearly and narrowly as possible. The UK Information Commissioner’s Office says people must be told the purposes and retention period when their data is collected.

Consent rules vary. India’s Digital Personal Data Protection Act, 2023 says a request for consent must come with a notice describing the personal data and the purpose, and that consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action; it also lets the person read the notice in English or a language listed in the Eighth Schedule. Its provisions come into force on dates the government notifies, so check which apply to you. In Canada, the privacy commissioner says customers must be given a choice about being recorded, with an alternative where recording is not integral to the service.

Plan what happens when someone declines. They should still be able to get help, by continuing without recording, by speaking to a person, or by another channel. For outbound calls in India, also respect Do-Not-Call preferences and calling windows, which the outbound campaigns page covers.

Vistrow Voice lets each account control this from the Compliance page. These are the settings as they work today, described in consent, recording and retention settings.

Keep them only as long as the purpose needs. The UK ICO expects you to tell people your retention period, and Canada’s privacy commissioner says recordings should be kept no longer than their purpose requires. Pick a period for each use, such as resolving disputes or training, and write it down.

On Vistrow Voice, the data retention setting deletes transcripts and recordings older than the number of days you choose, every day; zero keeps them indefinitely, which is rarely the right choice. The guide to finding a call, transcript or recording shows where they are stored.

Limit access to the people who need it. Recordings often contain names, numbers, addresses and sometimes health or financial details. Review who has a dashboard login, remove people who leave, and give viewers the lowest role that lets them do their job. Vistrow Voice workspaces have Owner, Admin, Member and Viewer roles, set under workspace and team settings.

Check where call data goes after the call too. If transcripts or leads are sent to a CRM, a spreadsheet or a chat channel, the same retention and access rules should apply there.

Run through this list for each market and each agent, then test it by calling the agent yourself and listening to the first ten seconds. Our AI voice agent platform checklist covers the wider evaluation.