Recording a call is technically a media fork: a copy of the RTP (or of a decoded mix) is written to storage while the live path continues. On VoIP that fork can be in the client, in an SBC, or in a conference/recording server that the call is hairpinned through. Each placement changes delay, failure modes, and whether you get true stereo.
The hard problems are not the encoder. They are consent, retention, access control, and not capturing data you are forbidden to store. A recording is a record. In many industries it is also evidence.
Why calls are recorded
- Quality management: sample conversations against a rubric.
- Training: new agents hear real calls, not scripts only.
- Dispute and confirmation: what was promised, at what price, with which authorization.
- Regulatory or contractual duty: some financial and healthcare workflows require recording or prohibit it. Check the regime that applies.
- Analytics: transcripts and categories, which depend on a usable audio mix. See call quality.
Stereo versus mixed
| Layout | What is stored | Why it is used | Cost |
|---|---|---|---|
| Mixed (mono or summed stereo) | One track with both parties combined | Simple playback, smaller files, enough for a human listener | Talk-over is hard to separate; speaker diarization is weaker |
| Stereo / dual-channel (each party on a channel) | Left = caller, right = callee (convention varies) | Transcription and QA can tell who spoke; overlapping speech is recoverable | Larger files; the recorder must not mix before encode |
Contact-center platforms that conference the agent, the caller, and a recorder can still produce dual-channel if they keep the RTP from each participant distinct until the file is written. A packet capture of mixed audio from a speakerphone cannot.
On-demand versus always-on
- Always-on
- Every call that matches a policy (queue, DID, direction) is recorded from answer to hangup, subject to pause rules.
- On-demand
- An agent or supervisor starts (and stops) recording during the call. Missed starts are a compliance risk if the policy required a record.
- Percentage / sampling
- A random or rule-based subset, used for QA when 100% storage is unnecessary or disallowed.
Announce-and-record IVRs ('this call may be recorded') are common on always-on inbound. They are not automatically valid consent in every jurisdiction. On-demand recording still needs a lawful basis. Direction matters: inbound and outbound campaigns may fall under different scripts and different TCPA constraints.
Transcripts
Automatic speech recognition turns the recording into text. Accuracy depends on codec generation loss, mix, accents, and domain vocabulary. Dual-channel audio plus a known agent script scores better than a noisy G.729 mix. Transcripts are a new repository of personal data: they can be searched, leaked, or subpoenaed independently of the audio. Retention and access control should match the recording, not a looser chat log policy.
Live captions are a related technology with a different retention profile if you do not store them. As soon as you store, treat them as a recording derivative.
Consent in the United States
Federal criminal law on intercepts (18 U.S.C. § 2511) is generally a one-party consent regime: a party to the call may record without telling the other parties, subject to important exceptions and to state law. Many states follow one-party consent. Several are all-party (sometimes called two-party) consent states, where every party must consent to the recording of a confidential communication. California, Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Pennsylvania, and Washington are commonly listed in that group; Connecticut, Delaware, Nevada, Oregon, and others have statutes that require care. Lists change with legislation and case law. The location of each party can pull in more than one state's law.
Consent can be captured by a spoken announcement plus continued participation, by a DTMF acknowledgment, or by a prior written policy in some business-to-business settings. Hidden recording of a call you are not a party to is a different (and often illegal) act.
| Regime (typical label) | Practical effect on a business recording policy |
|---|---|
| US federal one-party | A party to the call may record under federal criminal intercept law, but state law and sector rules still apply. |
| US all-party / two-party states | Obtain consent from every party before (or at the start of) recording a covered conversation. |
| Sector overlay | Financial services, healthcare, and debt collection can require or restrict recording independently of wiretap statutes. |
| International | Notice, legitimate interest or consent, and retention limits under local privacy law. Do not assume US one-party travels. |
PCI pause, retention, and storage
PCI DSS forbids storing sensitive authentication data (full magnetic-stripe data, CVV2/CVC2/CID, PIN) after authorization, and limits how primary account numbers may be kept. If a caller speaks or types a card number, the usual control is pause-and-resume: the agent hits pause, or an IVR payment step runs while recording and DTMF logging are suppressed, then recording resumes. Relying on agents to remember pause is weaker than an automated payment window.
Store recordings encrypted at rest, with access logged and role-scoped. Define retention by purpose (30 days for QA versus seven years for a regulated confirmation) and delete on schedule. Hairpin recording through a distant data center adds delay (see call quality and ITU-T G.114). On-box recording on the phone avoids the trombone but complicates collection and legal hold.
- Encrypt in transit to the archive (TLS) and at rest.
- Separate metadata (numbers, agent id, timestamps) so you can fulfill deletion requests without a full audio scan where the law requires it.
- Do not put raw recordings in an open object bucket or in a ticket comment.
- Test pause: confirm that DTMF telephone-event and in-band tones are absent from the file during payment.