Recording Sales Calls in California: CIPA Claims in TCPA Suits

Five thousand dollars per violation is what turns a TCPA case against a California caller into a bigger case. California’s Invasion of Privacy Act (CIPA) allows suits over calls recorded without everyone’s consent. Damages are $5,000 per violation or three times actual damages, whichever is greater. A TCPA complaint over recorded sales or service calls can carry that count too. In my view, a company that announces the recording at the start of each call, and can prove it did, has a strong answer.

What does California require before a business records a call?

Consent from everyone on the call. Two Penal Code sections do most of the work, and they overlap.

Section 632 covers “confidential” communications. Under Penal Code § 632, a person who, “intentionally and without the consent of all parties to a confidential communication, uses an electronic amplifying or recording device to eavesdrop upon or record the confidential communication” commits a crime. The statute’s definition of “person” expressly includes a “business association, partnership, corporation, limited liability company, or other legal entity.” Whether a call is confidential depends on the test the California Supreme Court adopted in Flanagan v. Flanagan, as restated in Smith v. LoanMe, Inc.: “a conversation is confidential if a party to that conversation has an objectively reasonable expectation that the conversation is not being overheard or recorded.”

Section 632.7 doesn’t ask whether the call was confidential. Penal Code § 632.7 reaches anyone who, “without the consent of all of the parties to a communication, intercepts or receives and intentionally records” a call in which at least one phone is a cell or cordless phone. If the customer was on a cell phone, § 632.7 is in play. Landline-to-landline calls fall outside § 632.7, so § 632 and its confidentiality test govern the recording.

Until 2021, some courts read § 632.7 to reach only outside eavesdroppers. The California Supreme Court rejected that reading. In Smith v. LoanMe, Inc., 11 Cal.5th 183, the court held that “section 632.7 applies to parties as well as nonparties.” A company recording its own calls with customers is a party, and it needs everyone’s consent.

Federal law is looser, which is where companies with national compliance programs can get caught. The federal Wiretap Act says it isn’t unlawful for a private person to intercept a call “where such person is a party to the communication or where one of the parties to the communication has given prior consent,” unless the purpose is to commit a crime or tort, under 18 U.S.C. § 2511(2)(d). A compliance program built on that one-party rule doesn’t satisfy California.

Why do recording claims show up in TCPA lawsuits?

Because the same phone call supports both, and the California count often carries the bigger number.

A TCPA claim is a federal claim, and the Supreme Court held in Mims v. Arrow Financial Services, LLC “that federal and state courts have concurrent jurisdiction over private suits arising under the TCPA.” Once a TCPA count is in federal court, 28 U.S.C. § 1367(a) gives the court supplemental jurisdiction over state claims “so related to claims in the action within such original jurisdiction that they form part of the same case or controversy.” In my view, a CIPA count about the recording of the same call the TCPA count is about will usually fit that description.

Then there’s the math. Under 47 U.S.C. § 227(b)(3), a TCPA plaintiff can recover $500 per violation, and a court may increase it to up to $1,500 if the violation was willful or knowing. Penal Code § 637.2 sets CIPA damages at the greater of $5,000 per violation or three times actual damages, and it adds: “It is not a necessary prerequisite to an action pursuant to this section that the plaintiff has suffered, or be threatened with, actual damages.” Ten times the TCPA’s base figure, with no proof of actual damages required, is why I think the recording count deserves as much attention as the TCPA count, even when the TCPA count gets the headline.

In my view, the pairing also raises the stakes on class certification. A plaintiff will argue that the company’s recording practice was uniform across the class, and the defense may turn on what the recordings themselves show.

Does it matter that our call center is outside California?

No, not for calls with people in California. The California Supreme Court settled that question for § 632 in 2006, and I see no reason its reasoning would stop at that section.

In Kearney v. Salomon Smith Barney, Inc., 39 Cal.4th 95, the plaintiffs alleged that a brokerage’s Atlanta office recorded calls with California clients without telling them, which Georgia’s one-party rule allowed. The California Supreme Court held that California law applies to those calls going forward. It spared the brokerage damages for its past recordings because the choice-of-law question had been unsettled, but the opinion warned that “out-of-state companies that do business in California now are on notice that, with regard to future conduct, they are subject to California law” for calls made to or received from California.

The court also addressed the argument that an out-of-state agent can’t tell where a caller is. It said there was no reason the agent “could not simply inquire where the client is calling from.” The court thought screening was feasible. In my view, it’s still a poor compliance strategy for a call center. Area codes don’t tell you where a person is standing, and if there’s no disclosure, an agent who forgets to ask may have recorded a California call without the consent the statute requires. One disclosure on every call is simpler and safer.

What does a disclosure at the start of the call actually do?

It’s the main defense. In Kearney, the California Supreme Court said a business that advises everyone at the outset that the call is being recorded doesn’t violate § 632. In LoanMe, it said a party can avoid § 632.7 liability by getting the consent the statute requires.

In Kearney, the court said: “A business that adequately advises all parties to a telephone call, at the outset of the conversation, of its intent to record the call would not violate the provision.” It also observed that “California consumers are accustomed to being informed at the outset of a telephone call whenever a business entity intends to record the call,” which cuts the other way when there’s no disclosure: a customer who hears nothing can argue they expected privacy.

In Smith v. LoanMe, the court said any perceived harshness in applying § 632.7 to a party’s recording of a nonconfidential call “is lessened by the fact that a party can avoid liability under the statute by taking reasonable precautions, such as obtaining the consent to record the statute requires.” In my view, a customer who hears a clear spoken disclosure and stays on the line will have a hard time saying they didn’t consent, though LoanMe left open a related question, whether a beep tone plus staying on the line is consent, as the next paragraph explains.

What LoanMe didn’t decide matters too. The company in that case played a beep a few seconds into the call instead of saying anything, and the trial court found the beep was enough notice. The Supreme Court sent the case back without ruling on the beep. I wouldn’t build a recording program on a tone. A spoken sentence at the start of the call costs nothing and leaves a plaintiff little to argue about.

The gap I’d check first is outbound calling. In my view, outbound sales calls, which are the calls TCPA suits are about, are likelier than inbound service lines to skip the disclosure, for instance when a dialer connects the call or a vendor places it. The same goes for warm transfers, where a third person joins a call after the disclosure has already played.

Do AI and call-analytics vendors create a separate risk?

They can, under a different section. Courts read Penal Code § 631 to reach an unauthorized third party who listens in, and plaintiffs have used it against vendors that transcribe or analyze calls for the business.

In Ambriz v. Google, LLC, No. 23-cv-05437-RFL (N.D. Cal. Feb. 10, 2025), the plaintiffs alleged that a contact-center AI product transcribed and analyzed their customer-service calls without their knowledge. The court denied the motion to dismiss. It noted that “Some courts require plaintiff to allege that the software vendor actually used the data it obtained for its own, independent purpose,” while others ask only whether the vendor could, and the order held that “the capability test is the better application of the statute” on the facts alleged. That’s one district court ruling on allegations, not a finding of liability, and other courts apply the narrower test. Still, in my view, a disclosure that names only the business, and says nothing about recording or analysis by a service provider, gives a plaintiff room to argue. Claims about website chat tools and tracking pixels rely on the same statute but are a separate subject from call recording.

Is California changing the law?

A bill is pending, and no business should plan around it yet. SB 690, as amended in the Senate on March 24, 2025, would add an exception for a commercial business purpose to the two recording statutes, §§ 632 and 632.7. It would add the same exception to § 631, and it would amend the private right of action in § 637.2 so that it doesn’t apply to the processing of personal information for a commercial business purpose. The amended version would apply to cases pending as of January 1, 2026. As of this post, the bill has cleared the Senate Public Safety Committee and sits in the Senate Appropriations Committee. Bills change and stall, so a business should run its recording program under the law as it stands today.

What should a business do when a recording claim arrives?

Move fast on the records, because the recordings and system settings are usually central evidence for both sides:

1. Put a litigation hold on the call recordings, the dialer and phone-system logs, and the consent records for the numbers named in the complaint, and keep the recordings in their original format.
2. Pull the opt-out and internal do-not-call logs with dates. The FCC’s rule lets a person revoke consent to autodialed and prerecorded calls and texts, along with some telemarketing calls, “by using any reasonable method to clearly express a desire not to receive further calls or text messages from the caller or sender,” under 47 C.F.R. § 64.1200(a)(10). In my view, a recorded request to stop calling can matter as much as the disclosure.
3. Pull the National Do Not Call Registry scrub records and the dates of the registry versions used.
4. Collect the scripts, the recorded-line greeting files, the dates each version went live, and the contracts with the dialer and call-recording vendors and any lead or analytics providers.
5. Talk to a lawyer before answering the demand letter, contacting the plaintiff, or offering anything to settle.

The firm’s California TCPA defense lawyers page explains how it approaches claims involving recorded sales and service calls.

Questions businesses ask about recording calls in California

Is “this call may be recorded for quality assurance” enough?

It’s common wording, and timing matters as much as the words. Kearney describes a business that advises all parties “at the outset of the conversation” of its intent to record. I prefer wording that says the call is being recorded over wording that says it may be, because the stronger version leaves less to argue about. The disclosure also needs to reach every party, including anyone added by transfer.

Can a customer who keeps talking after the disclosure still sue?

They can file, but I think the claim is weak. Kearney said that a person who doesn’t want to be recorded “simply may decline to continue the communication,” and LoanMe described obtaining consent as a precaution that avoids liability. In my view, the dispute is usually about proof: whether the disclosure actually played on that call, and whether the company can show it.

If the TCPA count is dismissed, does the CIPA count go away?

Not automatically. When a federal court dismisses every claim it has original jurisdiction over, 28 U.S.C. § 1367(c)(3) lets it decline to keep the state claims, which can leave a CIPA count to be refiled or remanded in state court instead of ending it. I wouldn’t treat a TCPA dismissal as the end of the case until the recording count is resolved too. If the case also qualifies for federal jurisdiction on its own, as some class actions do under 28 U.S.C. § 1332(d), the CIPA count can stay in federal court.

Does California law apply when the customer calls us?

Yes. Section 632.7 covers a person who “intercepts or receives and intentionally records” a covered call, whoever placed it. Kearney applied California law to calls “made to or received from California.” Inbound and outbound calls need the same disclosure.

If your company is defending a recording claim

If your company has been sued over recorded calls alongside TCPA claims, the first seconds of each recording and the phone-system settings behind them can decide the CIPA count. Rosenberger + Kawabata represents businesses defending TCPA lawsuits and class actions through its business litigation practice, including claims involving recorded sales and service calls. Contact Rosenberger + Kawabata online for a free and confidential consultation, or call (310) 894-6921.

Sources

The California statutes are Penal Code § 632, § 632.7, and § 637.2. The pending bill is SB 690 (2025 to 2026 Regular Session), as amended in the Senate on March 24, 2025. The federal statutes are the Telephone Consumer Protection Act at 47 U.S.C. § 227, the Wiretap Act’s consent provision at 18 U.S.C. § 2511(2)(d), and 28 U.S.C. §§ 1332 and 1367. The FCC’s rule is 47 C.F.R. § 64.1200, as published in the eCFR through May 15, 2025.

The court decisions are Smith v. LoanMe, Inc., 11 Cal.5th 183 (2021); Kearney v. Salomon Smith Barney, Inc., 39 Cal.4th 95 (2006); Flanagan v. Flanagan, 27 Cal.4th 766 (2002); Mims v. Arrow Financial Services, LLC, 565 U.S. 368 (2012); and Ambriz v. Google, LLC, No. 23-cv-05437-RFL (N.D. Cal. Feb. 10, 2025).

This post is general information about the Telephone Consumer Protection Act and related laws as of May 15, 2025. It is not legal advice, and reading it does not create an attorney-client relationship. Courts and the FCC change the rules in this area often, and the outcome of any claim depends on its facts. Past results do not guarantee future outcomes.