California Insurance Leads: Call Recording Law

Is it legal to record a sales call to a California lead? Only if both of you agree to it, and “both of you” is the part most agencies skip. California Penal Code Section 632 requires the consent of every party to a confidential telephone communication before it can be recorded, which makes California what lawyers call an all-party or two-party consent state. Most of the country, and federal wiretap law itself, only requires one party, meaning you, to consent. If your calling process was built assuming the federal rule is the whole story, and you are calling into California, it is not.

This matters right now because California is one of the largest insurance markets in the country, and every agency chasing volume eventually dials into it. The urgency to reach a lead fast, the subject of TheAffordableAI’s speed-to-lead guide, doesn’t go away just because the lead lives in a state with a stricter privacy law. Whether you record calls for training, for dispute protection, or because CMS requires it on Medicare business, the question of whether you were allowed to record that specific call is a separate question from whether you were allowed to call at all. Getting the second one right and skipping the first one is how a routine follow-up call turns into a five-figure liability.

What California’s recording law actually requires

California Penal Code Section 632 makes it a criminal offense to use an electronic recording device to record a confidential communication, including a telephone call, without the consent of every party to that communication. The statute’s own language covers a “telegraph, telephone, or other device,” which courts have applied squarely to ordinary phone calls, and it does not carve out an exception for business, sales, or customer service calls. A confidential communication, for purposes of this law, is essentially any call where the parties have a reasonable expectation that it isn’t being recorded, which describes the overwhelming majority of outbound calls an insurance agent places.

This is a genuinely different legal standard from the states TheAffordableAI has covered before on this blog. Florida and Texas both regulate the timing, volume, and technology behind outbound calls, through the Florida Telephone Solicitation Act and the Texas Business and Commerce Code’s mini-TCPA provisions respectively. Neither one is primarily about whether you can press record. California’s statute is a privacy law first, not a telemarketing law, and it applies to the recording itself, independent of whether the call was a marketing pitch, a service call, or a claims conversation.

Why calling from outside California does not solve this

The most common assumption TheAffordableAI hears from agencies and call centers based outside California is some version of “our office is in Texas, so Texas rules apply to how we operate.” For dialing hours, that instinct is roughly right. For recording consent, it is wrong, and a 2006 California Supreme Court case settled the question directly.

In Kearney v. Salomon Smith Barney, Inc., California clients of a brokerage firm sued after learning that the firm’s Atlanta office had been recording calls with them without disclosure. Georgia, where the recording actually happened, is a one-party consent state, so the brokerage argued Georgia law should control. The California Supreme Court disagreed. It held that Penal Code 632 reaches a call recorded from a one-party-consent state into California, because part of the confidential communication takes place inside California, with a California resident, regardless of where the recording device physically sits. The court’s own language describes the communication as happening “in part in California and in part in another state,” which is enough to trigger the state’s protection for the California-based party.

Federal law, for context, sets a much lower bar. Under 18 U.S.C. § 2511(2)(d), it is not unlawful under federal wiretap law to record a call if you are a party to it, or if one party has consented, as long as the recording is not being made to commit a crime or a tort. That one-party standard is the federal floor, and it is also the law in most states. California, along with a handful of other states, sets a stricter floor of its own, and under the Supremacy Clause and ordinary conflict-of-laws principles, the stricter state rule controls when a California resident is one of the parties. Federal law permitting a recording does not override California’s requirement that the recorded party also consent.

What it actually costs to get this wrong

Two separate penalty tracks exist under California law, and they run independently of each other. Read them as what they are: a criminal exposure and a civil exposure, both real, both sourced directly from the current Penal Code text.

Two details in that table are easy to miss and worth spelling out. First, Penal Code 637.2 does not require the person suing you to show they were actually harmed by the recording. The statute explicitly allows the civil action “without requiring that the plaintiff has suffered, or be threatened with, actual damages,” which removes the defense that “nothing bad actually happened” from the table entirely. Second, the $5,000 figure is per violation, meaning per call, not per lawsuit. A call center that recorded 40 California leads over a bad month without disclosure is not looking at a single $5,000 exposure; the statute’s language supports counting each call separately, which is exactly the fact pattern that has fueled a wave of CIPA class-action filings against businesses with call centers in recent years.

None of this is a promise about what would happen to any specific agency; it’s a description of what the statute allows a plaintiff to seek. Whether a given call ever becomes a lawsuit depends on facts TheAffordableAI has no way to predict. What is not speculative is that the legal exposure exists on every unconsented recording, whether or not anyone ever acts on it.

How this actually shows up as a lawsuit

The mechanism is worth understanding, because it explains why this risk is not theoretical. A civil claim under Penal Code 637.2 does not require the plaintiff to prove they were harmed, which means the entire case can rest on the recording itself and the absence of a disclosure at the start of it. That is a low bar to plead and a straightforward one to prove: either the disclosure is on the recording, at the top, before substance, or it isn’t. Plaintiffs’ firms that focus on this area typically start from a consumer complaint or a demand for a copy of “any recordings of my calls with you,” which most agencies are already obligated to produce under normal discovery or CMS record-keeping rules on the Medicare side. If the recording exists and the disclosure doesn’t, the case largely proves itself from the audio file alone. That is also exactly why the fix is procedural rather than legal strategy: a disclosure that is present on every call removes the evidence a claim would be built on, before the question of intent or harm ever comes up.

Where this collides with the CMS recording mandate

Here is the part that catches Medicare-focused agencies off guard: CMS does not just permit call recording, it requires it, and the two requirements do not cancel each other out.

Under 42 CFR § 422.2274(g)(2)(ii), Third Party Marketing Organizations must record all marketing and sales calls in their entirety and retain those recordings, with the minimum retention period cut to six years for CY2027, down from the prior 10-year standard, with the first three years required in audio format. TheAffordableAI’s CMS 2027 Medicare rules guide covers that retention change and the other CY2027 marketing updates in full. The point that matters here is narrower: CMS telling you to record the call is a federal requirement about what you must preserve. It says nothing about whether California law lets you press record on that particular call in the first place.

Meeting the CMS obligation while skipping the California disclosure does not average out to compliant. It produces a recording CMS is satisfied with and a recording California law says you were not allowed to make, sitting in the same audio file. The fix is not choosing one rule over the other. It’s sequencing them correctly: disclosure and consent happen first, and only then does the recording that CMS requires actually begin.

It’s also worth keeping the two CMS retention clocks straight, since confusing them creates its own gap. The six-year window under 42 CFR 422.2274(g)(2)(ii) applies specifically to marketing and sales call recordings. Enrollment-related records sit on a separate, unchanged 10-year retention track. Neither clock has anything to do with whether California’s consent requirement was satisfied on the call in question. A recording can be retained for exactly the right number of years under CMS’s rule and still have been made unlawfully under Penal Code 632 if nobody said a word about recording before the plan discussion started.

How to get valid consent without losing your speed-to-lead window

None of this requires slowing the call down in any way that matters. The fix agencies actually use is a short, spoken disclosure at the top of the call, delivered before any substantive discussion of coverage, price, or benefits begins, followed by continuing the call as the lead’s agreement to proceed.

California courts have generally treated a clear recording disclosure, followed by the other party choosing to keep talking, as consent to be recorded. That is the entire legal basis for the “this call may be recorded for quality and training purposes” line every consumer has heard a thousand times. It works because it does two things at once: it tells the person the recording is happening, and it gives them a real chance to hang up before anything substantive is said. A disclosure that comes after the pitch, or that’s mumbled into a script nobody enforces, does not do either of those things and is much weaker ground to stand on if the recording is ever challenged.

1. Put the disclosure first in the call flow, not the script. It has to be the first thing said, before the agent's name, before the reason for the call, before anything about coverage. "This call is being recorded for quality and compliance purposes" is a defensible line, delivered before the conversation moves anywhere else. Putting it second, after a warm opener or a rapport-building question, undercuts the entire point, because by then the substantive part of the call may have already started.
2. Treat a lead who stays on the line as having consented, and log that they did. If a lead objects or hangs up immediately after hearing the disclosure, stop recording for that call and don't treat their continued presence as an assumption you get to make later. The log entry matters as much as the behavior: a timestamped note that the disclosure played and the call continued is what turns "we probably did this right" into a record you can actually point to.
3. Apply this to every outbound call into a California area code, regardless of who the caller is. Human agent, live transfer, or AI voice agent, the rule doesn't change based on who or what is speaking. It also doesn't change based on call type: a renewal check-in, a service call, or a claims follow-up carries the same consent requirement as a new-business sales pitch, because Penal Code 632 covers confidential communications broadly, not just marketing calls specifically.
4. Separate this from your TCPA consent language entirely. Prior express written consent to be called and consent to be recorded are two different legal questions. Getting one does not get you the other, and your forms and scripts should say so explicitly rather than assuming one covers both. A lead form that only discloses "you may receive calls and texts" has said nothing about recording, and treating it as if it had is the exact gap this article is about.
5. Build it into your dialer or CRM workflow so it can't be skipped under pressure. A rule that depends on every agent remembering to say a line correctly, every time, on a busy Friday, is a rule that will eventually get skipped. A workflow that plays or requires the disclosure before the line connects to a live conversation removes that risk entirely, and it scales the same way whether you're making twenty calls a day or two thousand.

You can build every piece of this yourself with a script, a dialer setting, and a compliance checklist your team actually follows. Plenty of agencies do exactly that, and it costs nothing but the discipline to enforce it consistently. The failure mode isn’t usually a bad script. It’s a good script that nobody audits after the first month, once the team that wrote it has moved on to the next priority.

Does an AI voice agent calling California change anything?

No, and this is worth stating plainly because it’s the question TheAffordableAI gets asked most often on this exact topic. Penal Code 632 does not distinguish between a human caller and an automated one; it governs the act of recording a confidential communication, regardless of who or what is on the other end of the microphone. An AI voice agent calling a California lead is bound by the same disclosure-then-consent sequence as a live agent would be.

If anything, an AI system removes one specific risk: the disclosure line becomes a fixed part of every call’s opening, not something a rushed human has to remember correctly on the two-hundredth dial of the day. That does not make the underlying legal analysis any different. It just makes consistent compliance easier to guarantee, which is a real, practical advantage, not a loophole.

Where TheAffordableAI fits

The California-specific piece of this is a compliance workflow question, and TheAffordableAI’s role in it is straightforward: the recording disclosure is built into the call flow as a fixed opening step, not something left to a script an agent might skip. Combined with number warmup and spam defense so the call actually connects, and warm transfers that hand a qualified California lead to a licensed agent live, the calling side of this problem is handled the same way for every state, with the disclosure sequencing adjusted for wherever the lead actually is. The full breakdown of what’s included lives on the features page.

Pricing is published, not quoted privately. A Single Account runs $200 a month plus a $500 one-time setup fee, at $0.20 a minute, down to $0.15 a minute at bulk volume. An Agency plan runs $500 a month plus a $1,000 one-time setup fee, at $0.18 a minute, down to $0.16 a minute at bulk. Both are month to month with no long-term contract, so the cost of testing this against your current California call volume is, at most, one month either way.

What you get from fixing this

You do not get a guarantee that no California lead will ever object to being recorded, and nobody, including TheAffordableAI, can promise that. What you get is a defensible, consistent process: a disclosure that happens first on every single call, a documented basis for treating a continued call as consent, and a recording workflow that satisfies the CMS retention requirement without skipping the state-level consent step underneath it. That is the actual difference between a compliance program that would hold up if a call were ever challenged and one that has been quietly skipping a step nobody flagged until it became a problem.

When this is not actually your biggest problem

If your agency writes a small handful of California policies a month and your team already reads a disclosure line before every call as a matter of habit, none of this requires new software. A written script, a compliance checklist, and a manager who actually spot-checks calls will get you there. Where agencies get into trouble is scale: the disclosure line that one careful agent never forgets is also the line a fifteen-person team, working fast on a Friday afternoon, eventually skips on call 340. That is a workflow problem, not a knowledge problem, and it is worth being honest about which one you actually have before deciding whether to change your tooling or just tighten your script enforcement.

California’s recording law is not a telemarketing rule, and treating it like one is how agencies miss it. It is a privacy statute that requires the person on the other end of the call to agree before you record them, it reaches calls placed from anywhere in the country, and the penalties attach per call, not per campaign. The fix costs about five seconds per call and a workflow that doesn’t let anyone skip it. Put the disclosure first, log the consent, and keep the CMS-required recording underneath it, in that order, and the calls you’re already making into California stop carrying a risk that had nothing to do with what you actually said to the lead.