Your Recorded Calls Are Personal Information. California Treats Them That Way.

Most businesses think about call recording as a compliance question — do I need consent — and stop there. In California there is a second question that arrives later and is harder to unwind: what are you doing with everything you recorded?

Every recording and transcript is customer personal information. California's privacy regime gives consumers rights over it. And unlike the consent question, which is solved once at setup, this one compounds every day you keep collecting.

Here is what to decide before you have three years of archive. General information, not legal advice.

Why AI answering makes this urgent

A traditional answering service handed you a message. Two lines of text, a name, a number. Minimal data footprint.

A modern front desk records the call, transcribes it, summarizes it, and pushes structured fields into your CRM. That is what makes it useful — and it also means you are now accumulating full conversational records of every customer interaction, indefinitely, by default.

Most owners never make a conscious decision about this. It happens as a side effect of choosing a product, and three years later there is an archive nobody planned, nobody reviews, and nobody has a policy for.

The four decisions to make upfront

How long do you keep recordings?

Pick a period and configure it. Ninety days, one year, whatever fits your actual business need — quality review, dispute resolution, training. "Forever" is not a decision, it is the absence of one, and it maximizes your exposure for no operational benefit. Recordings from 2023 are not helping you run the business in 2026.

Who can access them?

Every recording contains a customer's name, address, phone number, and often details about their property, their schedule, and when they are not home. That last one deserves a moment's thought. Decide who on your team can pull recordings and whether access is logged.

Where does the data live, and who else touches it?

Ask your vendor directly: where is this stored, who has access, is it used to train anything, and what happens to it if we leave? Get the answers in writing before you sign, not after. A vendor who cannot answer clearly is telling you something.

What happens on a deletion request?

If a customer asks you to delete their information, can you actually find and remove their call recordings and transcripts? If the answer is "I have no idea," that is a gap worth closing while your archive is small.

What consumers can ask for

Under California's privacy framework, consumers have rights that include knowing what personal information a business has collected about them, requesting deletion, and requesting correction. Whether and how these obligations apply depends on the specifics of your business — thresholds and exemptions matter, and this is exactly the kind of question to put to your attorney rather than to a blog post.

The practical point is simpler than the legal analysis: if a customer called and asked what you have on them, could you answer? For most service businesses that have been recording calls for a couple of years, the honest answer is no. That is worth fixing regardless of which specific obligations apply to you.

The transcript detail people miss

Transcripts are searchable in a way recordings are not, which is precisely what makes them valuable and precisely what makes them sensitive.

A recording archive is functionally opaque — nobody is listening to two thousand hours of calls. A transcript archive is queryable. Anyone with access can search it for a name, an address, a phrase. That is a genuinely different risk profile, and it is the thing that turns "we keep recordings" into a real data-handling responsibility.

Treat transcripts with the same care you would treat a customer database, because that is what they are.

Practical configuration checklist

• Set a retention period and verify it is actually enforced, not just documented
• Restrict who can access recordings and transcripts, by role
• Confirm in writing where the vendor stores data and whether it is used for model training
• Confirm you can export everything if you leave, and that they delete their copy
• Know how to locate and remove one customer's records on request
• Include recordings and transcripts in whatever your privacy policy says about data collection
• Review the whole thing annually

None of that takes long. All of it is much easier to do at month one than at year three.

The upside nobody mentions

Doing this properly is not purely defensive.

A business that can answer "here is exactly what we collect, here is how long we keep it, and here is who can see it" is in a better position in every commercial conversation — with a property management company, with a commercial client, with a franchisor, with an insurer. Increasingly those parties ask.

It is also simply better operations. A retention policy means you are not paying to store six years of recordings you will never use, and an access policy means you know who has seen your customers' information.

The bottom line

Consent to record is the question everyone asks. Data handling is the question that actually gets harder over time, because the archive grows whether you decided anything or not.

Make the four decisions above before you turn it on. Twenty minutes now, or an uncomfortable conversation later.

Book a call if you want to see how we handle data on our side before you commit to anything.