Do you need consent to use recorded sales calls?
In most cases yes, you need some form of consent, and the rules depend on where you and the customer are. Under GDPR a call recording that identifies someone is personal data, and using it for something beyond the original purpose, like marketing, needs its own lawful basis. In the US, several states require every party on the call to agree to being recorded at all, before the marketing question even comes up.
Key takeaways
- Under GDPR, a recording of someone who can be identified, even only by name, is personal data.
- The Digital Media Law Project names ten all-party consent states, with caveats for Illinois, Hawai'i and Massachusetts.
- Agreeing to be recorded for internal notes does not carry over to a quote on your website by default.
- A consent request should name the exact use and tell the customer they can take it back at any time.
What counts as personal data in a call recording under GDPR?
Any information relating to a person who can be identified from it, directly or indirectly, for example by a name. Under GDPR, the act of recording is itself a form of processing.
You are probably reading this with one call in mind and one line from it you want on your homepage. We are not lawyers and this is not legal advice, so have a lawyer confirm the rules for your states and your customers before that line goes anywhere public.
GDPR Article 4(1) defines personal data as any information relating to an identified or identifiable natural person, and a person is identifiable if they can be identified directly or indirectly, for example by a name. Article 4(2) lists recording among the operations that count as processing, so the rules apply from the moment the call is captured.
Taking the name off a quote does not settle it, because the definition also covers people who can be identified indirectly.
Which US states require all parties to consent to being recorded?
The Digital Media Law Project's legal guide names ten, California, Connecticut, Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Pennsylvania and Washington. It says thirty-eight states and the District of Columbia have one-party consent laws.
The Digital Media Law Project's guide says eleven states require the consent of every party to a call, then names ten. We have not guessed at the eleventh.
Three of the guide's notes change how you read the list. Illinois' two-party consent statute was held unconstitutional in 2014. Hawai'i is generally one-party, but it requires every party's consent if the recording device is installed in a private place. Massachusetts bans "secret" recordings rather than requiring explicit consent from all parties.
The guide also says that on a call with more than two people, consent is needed from every party. One-party consent where you sit does not cover a buyer dialing in from a state on the list.
Does recording a call for internal notes cover using it in marketing later?
We would not assume it does. Under GDPR's purpose limitation rule, marketing use needs its own lawful basis or a check that it fits the original purpose.
Article 5(1)(b) sets out purpose limitation, which says personal data is collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes. Recording a call for your own notes is one purpose, and a line from it on a landing page is another.
Article 6 lists the lawful bases for processing, and at least one has to apply. The first is consent for one or more specific purposes. When the new use is not based on consent or a law, Article 6(4) asks the controller to assess whether the new purpose is compatible with the original one. For a public quote the customer never pictured when they agreed to be recorded, asking is faster than building that case.
We treat the recording and the published quote as two decisions. When you upload a call to Corvan, it stays private unless you say otherwise, and our agents leave names and figures out of the posts they write from it. Our piece on sales calls and LinkedIn covers the writing side.
What should a consent request actually say?
It should name the marketing use, sit apart from your other terms in plain language, and tell the customer they can withdraw at any time. You also need to be able to show later that they agreed.
GDPR Article 4(11) defines consent as a freely given, specific, informed and unambiguous indication of the person's wishes, given by a statement or by a clear affirmative action. Recital 32 rules out silence, pre-ticked boxes and inactivity. A line in your calendar invite that the customer never answers is that silence.
Article 7 sets the conditions the request has to meet. You have to be able to demonstrate that the person consented. A request inside a document that covers other matters has to be clearly distinguishable from them, in clear and plain language. The customer can withdraw at any time, has to be told so before agreeing, and withdrawing has to be as easy as giving consent.
So the request can be one short email after the call that quotes the exact sentence, says where it will appear, and says they can take it back by replying. Our piece on customers' own words covers which lines to ask about. Keep the thread. A year from now the customer may reply asking you to take the quote down, and that reply has to work as easily as their yes did.
Where the facts in this piece come from
- GDPR Article 4, Definitions (gdpr-info.eu)
- GDPR Article 5, Principles relating to processing of personal data (gdpr-info.eu)
- GDPR Article 6, Lawfulness of processing (gdpr-info.eu)
- GDPR Article 7, Conditions for consent (gdpr-info.eu)
- GDPR Recital 32, Conditions for consent (gdpr-info.eu)
- Digital Media Law Project, Recording Phone Calls and Conversations
FAQs about Do you need consent to use recorded sales calls
1. Is it legal to record a sales call without telling the customer?
It depends on where each person on the call is, and the all-party states the Digital Media Law Project names include California, Florida and Pennsylvania. Getting everyone's agreement at the start is the simplest way to handle a call that crosses state lines. This is not legal advice.
2. Can I quote a customer anonymously without asking?
Removing the name may not be enough under GDPR, because Article 4(1) covers people identified indirectly. We would ask either way, since asking costs one email.
3. Does a pre-ticked box in a sales contract count as consent?
Not under GDPR. Recital 32 says silence, pre-ticked boxes or inactivity should not constitute consent.
About Corvan
Corvan makes Corvan AI, AI agents that run your marketing: they plan your campaigns, write every post in your voice, and show you which posts booked meetings. The team also runs go-to-market services: consultation, ad operations, and AI search ranking. Every piece under Resources is written by the team that runs the work, with sources. Meet the team on the team page, or read what it returned for Drive Me Barcelona.
Keep reading
What churn rate is normal for an early-stage startup?
Monthly logo churn of 3 to 5 percent is typical below 1 million dollars in ARR, by CRV's 2026 benchmarks. What changes after that, and when we worry.
Read more →
How do you use customers' own words in positioning?
Start from the phrases customers repeat when they describe the problem, check each one against other customers, and keep listening after the page ships.
Read more →
How long should a free trial be for a B2B SaaS product?
Fourteen days is the default B2B SaaS free trial, but length barely moves conversion. What ChartMogul and Userpilot report, and why the card question is first.
Read more →