{"site":{"name":"Koji","description":"AI-native customer research platform that helps teams conduct, analyze, and synthesize customer interviews at scale.","url":"https://www.koji.so","contentTypes":["blog","documentation"],"lastUpdated":"2026-07-28T13:25:49.344Z"},"content":[{"type":"documentation","id":"61fd3b49-d9f2-49db-9b67-fde0865802cb","slug":"interview-recording-consent-laws","title":"Interview Recording Consent Laws: One-Party, All-Party, and Biometric Rules (2026)","url":"https://www.koji.so/docs/interview-recording-consent-laws","summary":"US federal law (18 U.S.C. 2511) permits recording with one-party consent, but roughly twelve states require all-party consent: California, Connecticut, Delaware, Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Oregon, Pennsylvania, and Washington - with Connecticut and Oregon applying different rules to phone versus in-person communications. Because participant location cannot be reliably determined, research teams should apply all-party consent universally, captured before recording starts. Biometric laws are separate: Illinois BIPA requires written notice and a written release before collecting voiceprints, with damages of $1,000 negligent and $5,000 intentional per violation. An audio recording is not automatically a voiceprint - the trigger is deriving a template to identify a person.","content":"## The short answer\n\n**Get affirmative, on-the-record consent from every participant before recording starts. Always. Everywhere.**\n\nThat one rule resolves nearly every legal question on this page, because it satisfies the strictest standard that could apply to you. The reason it matters:\n\n- **Federal law** (the Electronic Communications Privacy Act, [18 U.S.C. § 2511](https://www.law.cornell.edu/uscode/text/18/2511), originally the Wiretap Act of 1968) sets a **one-party consent** baseline — recording is permitted if at least one party to the conversation consents. As the person recording, you are that party.\n- **Roughly a dozen states** require **all-party consent** instead, and violations there can be criminal, not merely civil.\n- **Biometric privacy laws** are a completely separate regime. Illinois BIPA requires **written notice and a written release** before collecting a voiceprint — and consent to *record* is not the same as consent to create a **biometric identifier**.\n\n> This guide is written for research and product teams and is not legal advice. State law changes, and several of the distinctions below are genuinely unsettled. Confirm current requirements with counsel before rolling out a recording program — especially a multi-state one.\n\n## One-party vs all-party consent\n\nA **one-party consent** jurisdiction requires only one participant in the conversation to agree to the recording. A **two-party** — more accurately **all-party** — jurisdiction requires everyone.\n\nAs of 2026, the states commonly listed as all-party consent are:\n\n**California, Connecticut, Delaware, Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Oregon, Pennsylvania, and Washington.**\n\nTreat that list as a starting point rather than gospel. Published lists disagree at the margins because several statutes distinguish between *types* of communication, and courts keep refining the boundaries. Two documented examples of exactly that:\n\n- **Connecticut** requires all-party consent for recording **phone calls**, but follows a one-party rule for in-person conversations under its criminal statute.\n- **Oregon** requires all-party consent for **in-person oral** communications, but applies a one-party rule to electronic communications.\n\nThis is precisely why \"which list is right?\" is the wrong question for a research team to spend time on.\n\n## The rule that makes the map irrelevant\n\nIn research you almost never know a participant's physical location with legal certainty. Someone recruited as a New York customer may take the session from a hotel in Seattle. Remote panels cross state lines constantly, and cross-border sessions can pull in foreign law entirely.\n\nSo do not build a compliance program that depends on geolocating participants. **Apply the strictest applicable standard to everyone:**\n\n1. State the recording intent in the invitation, before anyone joins\n2. Capture explicit consent as a discrete step before the session begins\n3. Restate it on the record at the start of the session\n4. Give a genuine way to decline that still lets the person participate — or to withdraw partway through\n5. Log the consent with a timestamp alongside the recording\n\nStep 4 carries more weight than teams expect. Consent that is a precondition to getting paid is not obviously \"freely given,\" which matters a great deal under GDPR and is a fair criticism of many incentive-driven panels. Offer a text-only or notes-only path for people who decline recording.\n\n## Biometrics: the duty most teams miss\n\nHere is the distinction that catches sophisticated teams: **an audio recording is not automatically a voiceprint.**\n\nIllinois BIPA governs **biometric identifiers** — fingerprints, iris scans, face geometry, and **voiceprints**. A voiceprint is a template derived from a voice for the purpose of **identifying** a person. Simply storing an audio file of someone answering questions is generally not that. Running that audio through a system that builds a speaker template to recognize who is talking is.\n\nBIPA's requirements, when it applies:\n\n- **Written notice** that a biometric identifier is being collected, why, and for how long it will be retained\n- A **written release** — obtained before collection\n- A published retention and destruction schedule\n\nThe exposure is significant: statutory damages of **$1,000 per negligent violation** and **$5,000 per intentional or reckless violation**, plus attorney fees and injunctive relief. A 2024 amendment (Public Act 103-769) softened the arithmetic considerably by treating repeated collections of the same biometric from the same person as a **single** violation rather than one per scan — but the per-person exposure remains real.\n\nTwo 2026 developments worth knowing. First, litigation has expanded sharply: in **May 2026**, Illinois voice actors, narrators, podcasters, and journalists filed suits against a long list of major technology and AI companies, framing the claim around the **extraction of voiceprints** rather than copyright — a theory that travels further for class treatment. Second, practitioners have flagged that **passively** building voiceprints from ordinary call audio, with no enrollment step, is arguably *higher* risk than an explicit enrollment flow, because there is no consent moment at all.\n\nA spoken disclosure at the top of a call does not satisfy BIPA. The statute asks for a **written** release — an SMS link, an email confirmation, or a signed portal step.\n\nIllinois is the sharpest instrument, but not the only one: Texas and Washington have their own biometric statutes, and most of the 20 US state comprehensive privacy laws now treat biometric data as **sensitive** personal information requiring opt-in consent.\n\n## Outside the US\n\n**GDPR** does not have a one-party/all-party concept. A recording of an identifiable person is personal data, so you need a lawful basis (usually consent for research), purpose limitation, minimization, a retention limit, and a route for participants to exercise their rights. Voice data processed **to uniquely identify** someone is special category data under Article 9 and requires a stronger basis. See [GDPR-compliant AI user research](/docs/gdpr-compliant-ai-user-research).\n\nFrom **2 August 2026**, the EU AI Act adds a separate transparency duty when people interact with an AI system — a disclosure obligation about the AI itself, independent of anything recording law requires.\n\n## A practical policy you can adopt\n\n| Element | What to do |\n|---|---|\n| Default standard | All-party consent, applied to every participant regardless of location |\n| Timing | Consent captured **before** recording begins, never retroactively |\n| Record of consent | Timestamped, stored with the session |\n| Decline path | Text-based or notes-only participation, no loss of incentive |\n| Voiceprints | Do not create them for research. If a vendor does, demand written notice and release |\n| Speaker identification | Off unless there is a documented need |\n| Retention | Published schedule with automatic deletion — see [research data retention](/docs/research-data-retention-deletion) |\n| Minors | Parental consent plus child assent — see [research with children](/docs/user-research-with-children-teens) |\n| Sensitive topics | Extra care on withdrawal rights — see [trauma-informed research](/docs/trauma-informed-user-research) |\n\n## How Koji is structured around this\n\nThe mechanics of AI-moderated research remove several of the sharpest edges — not because the law differs, but because the workflow does.\n\n- **Participants start the session themselves.** There is no bot silently joining a meeting already in progress, which is the fact pattern generating most of the current recording-consent litigation.\n- **Consent is a structured step before the interview begins**, not a verbal aside a moderator may forget under time pressure. See [intake forms and consent](/docs/intake-forms-and-consent).\n- **Text mode sidesteps voice capture entirely.** For sensitive studies, multi-state panels, or Illinois participants, running text interviews means no audio and therefore no voiceprint question at all. [Voice vs text interviews](/docs/voice-vs-text-interviews) covers the tradeoffs — voice yields richer affect and detail, text yields cleaner compliance and faster review.\n- **Analysis works from the transcript, not from the voice.** Koji derives themes, quality scores, and a sentiment label from what the participant **said** — not from vocal timbre, prosody, or a speaker template. No voiceprints are created for identification and no biometric categorisation is performed.\n- **Structured questions reduce your reliance on inferred signal.** With six question types — `open_ended`, `scale`, `single_choice`, `multiple_choice`, `ranking`, `yes_no` — you can measure how strongly someone feels by **asking them** on a scale and letting the AI probe why, rather than inferring it from their voice. The [structured questions guide](/docs/structured-questions-guide) shows how to build that instrument.\n- **Every session produces a verbatim transcript** with a consent record attached, which is exactly the artifact you want if a participant later asks what you hold about them.\n\nConfirm current configuration, sub-processors, and retention settings during procurement — see [enterprise security for AI research platforms](/docs/enterprise-security-ai-research-platforms).\n\n## Common mistakes\n\n1. **Geolocating participants to pick a legal standard.** Fragile, and it fails the moment someone travels. Apply the strictest rule universally.\n2. **Treating a spoken \"is it okay if I record?\" as sufficient for biometrics.** BIPA wants written notice and a written release.\n3. **Assuming a recording is a voiceprint, or that it never is.** The trigger is whether a template is derived to identify someone.\n4. **Making consent a condition of payment.** Undermines the \"freely given\" requirement and reads badly to regulators.\n5. **Leaving speaker identification enabled by default** because a vendor ships it that way.\n6. **No published retention schedule.** BIPA explicitly asks for one, and GDPR storage limitation expects it.\n7. **Recording first and asking later.** In an all-party state this can be a criminal exposure, not a paperwork problem.\n\n## Related Resources\n\n- [Structured Questions Guide](/docs/structured-questions-guide) — measure intensity by asking rather than inferring from voice\n- [How to Record Customer Interviews](/docs/how-to-record-customer-interviews) — the practical capture-and-transcribe workflow\n- [GDPR-Compliant AI User Research](/docs/gdpr-compliant-ai-user-research) — the EU lawful-basis picture\n- [Research Consent Form Templates](/docs/research-consent-form-templates) — consent language you can adapt\n- [Research Data Retention and Deletion](/docs/research-data-retention-deletion) — publish the schedule these laws expect\n- [Voice vs Text Interviews](/docs/voice-vs-text-interviews) — when dropping audio is the cleaner choice\n- [Anonymizing Customer Interview Data](/docs/anonymizing-customer-interview-data) — reduce what you hold in the first place","category":"Research Operations","lastModified":"2026-07-27T03:19:42.141406+00:00","metaTitle":"Interview Recording Consent Laws: One-Party vs All-Party (2026)","metaDescription":"Federal law permits one-party consent recording, but about a dozen states require all-party consent and Illinois BIPA adds written-consent duties for voiceprints. A practical recording policy for research teams.","keywords":["interview recording consent laws","two party consent states 2026","all party consent recording research","is it legal to record a customer interview","bipa voiceprint consent","wiretap law research recording","recording consent research participants","biometric privacy voice research","one party consent states","call recording laws research"],"aiSummary":"US federal law (18 U.S.C. 2511) permits recording with one-party consent, but roughly twelve states require all-party consent: California, Connecticut, Delaware, Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Oregon, Pennsylvania, and Washington - with Connecticut and Oregon applying different rules to phone versus in-person communications. Because participant location cannot be reliably determined, research teams should apply all-party consent universally, captured before recording starts. Biometric laws are separate: Illinois BIPA requires written notice and a written release before collecting voiceprints, with damages of $1,000 negligent and $5,000 intentional per violation. An audio recording is not automatically a voiceprint - the trigger is deriving a template to identify a person.","aiPrerequisites":["Familiarity with running recorded customer or user interviews","Basic understanding of participant consent workflows"],"aiLearningOutcomes":["Distinguish one-party from all-party consent jurisdictions and know which states require which","Apply a single strictest-standard recording policy instead of geolocating participants","Recognize when audio collection becomes biometric voiceprint collection under BIPA","Build a consent workflow that captures agreement before recording begins","Decide when text-based interviews are the cleaner compliance choice"],"aiDifficulty":"intermediate","aiEstimatedTime":"15 min read"}],"pagination":{"total":1,"returned":1,"offset":0}}