US rules on reusing call recordings for AI
10 US rules that bite when call recordings are reused for AI, read 28 October 2026.
What the rule covers
What it asks before data is reused or passed on
Whether a person can sue
The rule, in its words
All the answers, rule by rule
Each row is one rule. Click an answer to see the sentence behind it, quoted from the statute or rule page with the date we read it. Where it says "not stated", the statute or rule page we read is silent on that question.
| Rule | What the rule covers | What it asks before data is reused or passed on | Whether a person can sue | The rule, in its words |
|---|---|---|---|---|
| 16 CFR Part 313 (GLBA privacy rule) | financial customer information | notice and a right to opt out | not statedNot addressed in 16 CFR Part 313 | you may not, directly or through any affiliate, disclose any nonpublic personal… |
| 18 U.S.C. 2511 (federal Wiretap Act) | recording or intercepting calls | consent of the person | not statedNot addressed in 18 U.S.C. 2511 | It shall not be unlawful under this chapter for a person not acting under color of law to… |
| 45 CFR 164.514 (HIPAA de-identification) | health information | de-identification | not statedNot addressed in 45 CFR 164.514 | A covered entity may determine that health information is not individually identifiable… |
| California Civil Code 1798.120 (CCPA) | personal information and its sale | notice and a right to opt out | not statedNot addressed in Civil Code section 1798.120 | A business to which another business transfers the personal information of a consumer as… |
| California Civil Code 1798.140 (CCPA) | voiceprints and other biometric identifiers | not statedNot addressed in Civil Code section 1798.140 | not statedNot addressed in Civil Code section 1798.140 | a consumer’s personal information by the business to a third party for monetary or other… |
| California Penal Code 632.7 | recording or intercepting calls | consent of the person | enforced by a regulator or prosecutor | Every person who, without the consent of all of the parties to a communication… |
| California Penal Code 637.2 | recording or intercepting calls | not statedNot addressed in Penal Code section 637.2 | a private right of action | It is not a necessary prerequisite to an action pursuant to this section that the… |
| FCC Declaratory Ruling 24-17 (TCPA and AI voices) | AI-generated voices on calls | consent of the person | not statedNot addressed in FCC 24-17 | calls that use such technologies fall under the TCPA and the Commission’s implementing… |
| FTC Act section 5, as the FTC applies it to changed terms | changing terms to reuse data for AI | clear disclosure | enforced by a regulator or prosecutor | It may be unfair or deceptive for a company to adopt more permissive data practices |
| Washington RCW 19.375.020 | voiceprints and other biometric identifiers | consent of the person | not statedNot addressed in RCW 19.375.020 | A person may not enroll a biometric identifier in a database for a commercial purpose… |
The source sentence behind every answer (40)
- 16 CFR Part 313 (GLBA privacy rule), 16 CFR Part 313, read 2026-10-08, What the rule covers:
you may not, directly or through any affiliate, disclose any nonpublic personal information about a consumer to a nonaffiliated third party unless
- 16 CFR Part 313 (GLBA privacy rule), 16 CFR Part 313, read 2026-10-08, What it asks before data is reused or passed on:
You have provided to the consumer an opt out notice as required in § 313.7
- 16 CFR Part 313 (GLBA privacy rule), 16 CFR Part 313, read 2026-10-08, Whether a person can sue: No answer on the statute or rule page, which ran to 107,343 characters when read on 2026-10-08.
- 16 CFR Part 313 (GLBA privacy rule), 16 CFR Part 313, read 2026-10-08, The rule, in its words:
you may not, directly or through any affiliate, disclose any nonpublic personal information about a consumer to a nonaffiliated third party unless
- 18 U.S.C. 2511 (federal Wiretap Act), 18 U.S.C. 2511, read 2026-10-24, What the rule covers:
intentionally intercepts, endeavors to intercept, or procures any other person to intercept or endeavor to intercept, any wire, oral, or electronic communication
- 18 U.S.C. 2511 (federal Wiretap Act), 18 U.S.C. 2511, read 2026-10-24, What it asks before data is reused or passed on:
where such person is a party to the communication or where one of the parties to the communication has given prior consent to such interception
- 18 U.S.C. 2511 (federal Wiretap Act), 18 U.S.C. 2511, read 2026-10-24, Whether a person can sue: No answer on the statute or rule page, which ran to 28,101 characters when read on 2026-10-24.
- 18 U.S.C. 2511 (federal Wiretap Act), 18 U.S.C. 2511, read 2026-10-24, The rule, in its words:
It shall not be unlawful under this chapter for a person not acting under color of law to intercept a wire, oral, or electronic communication where such person is a party to the communication
- 45 CFR 164.514 (HIPAA de-identification), 45 CFR 164.514, read 2026-10-22, What the rule covers:
Health information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual is not individually identifiable health information.
- 45 CFR 164.514 (HIPAA de-identification), 45 CFR 164.514, read 2026-10-22, What it asks before data is reused or passed on:
The following identifiers of the individual or of relatives, employers, or household members of the individual, are removed
- 45 CFR 164.514 (HIPAA de-identification), 45 CFR 164.514, read 2026-10-22, Whether a person can sue: No answer on the statute or rule page, which ran to 19,506 characters when read on 2026-10-22.
- 45 CFR 164.514 (HIPAA de-identification), 45 CFR 164.514, read 2026-10-22, The rule, in its words:
A covered entity may determine that health information is not individually identifiable health information only if
- California Civil Code 1798.120 (CCPA), Civil Code section 1798.120, read 2026-10-08, What the rule covers:
A consumer shall have the right, at any time, to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer’s personal information.
- California Civil Code 1798.120 (CCPA), Civil Code section 1798.120, read 2026-10-08, What it asks before data is reused or passed on:
shall provide notice to consumers, pursuant to subdivision (a) of Section 1798.135, that this information may be sold or shared and that consumers have the “right to opt out”
- California Civil Code 1798.120 (CCPA), Civil Code section 1798.120, read 2026-10-08, Whether a person can sue: No answer on the statute or rule page, which ran to 6,371 characters when read on 2026-10-08.
- California Civil Code 1798.120 (CCPA), Civil Code section 1798.120, read 2026-10-08, The rule, in its words:
A business to which another business transfers the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction
- California Civil Code 1798.140 (CCPA), Civil Code section 1798.140, read 2026-10-08, What the rule covers:
and voice recordings, from which an identifier template, such as a faceprint, a minutiae template, or a voiceprint, can be extracted
- California Civil Code 1798.140 (CCPA), Civil Code section 1798.140, read 2026-10-08, What it asks before data is reused or passed on: No answer on the statute or rule page, which ran to 36,374 characters when read on 2026-10-08.
- California Civil Code 1798.140 (CCPA), Civil Code section 1798.140, read 2026-10-08, Whether a person can sue: No answer on the statute or rule page, which ran to 36,374 characters when read on 2026-10-08.
- California Civil Code 1798.140 (CCPA), Civil Code section 1798.140, read 2026-10-08, The rule, in its words:
a consumer’s personal information by the business to a third party for monetary or other valuable consideration
- California Penal Code 632.7, Penal Code section 632.7, read 2026-10-28, What the rule covers:
intercepts or receives and intentionally records, or assists in the interception or reception and intentional recordation of, a communication transmitted between two cellular radio telephones
- California Penal Code 632.7, Penal Code section 632.7, read 2026-10-28, What it asks before data is reused or passed on:
Every person who, without the consent of all of the parties to a communication
- California Penal Code 632.7, Penal Code section 632.7, read 2026-10-28, Whether a person can sue:
shall be punished by a fine not exceeding two thousand five hundred dollars ($2,500)
- California Penal Code 632.7, Penal Code section 632.7, read 2026-10-28, The rule, in its words:
Every person who, without the consent of all of the parties to a communication, intercepts or receives and intentionally records
- California Penal Code 637.2, Penal Code section 637.2, read 2026-10-28, What the rule covers:
Any person who has been injured by a violation of this chapter may bring an action against the person who committed the violation
- California Penal Code 637.2, Penal Code section 637.2, read 2026-10-28, What it asks before data is reused or passed on: No answer on the statute or rule page, which ran to 1,749 characters when read on 2026-10-28.
- California Penal Code 637.2, Penal Code section 637.2, read 2026-10-28, Whether a person can sue:
Five thousand dollars ($5,000) per violation.
- California Penal Code 637.2, Penal Code section 637.2, read 2026-10-28, The rule, in its words:
It is not a necessary prerequisite to an action pursuant to this section that the plaintiff has suffered, or be threatened with, actual damages.
- FCC Declaratory Ruling 24-17 (TCPA and AI voices), FCC 24-17, read 2026-10-28, What the rule covers:
artificial or prerecorded voice” encompass current AI technologies that generate human voices
- FCC Declaratory Ruling 24-17 (TCPA and AI voices), FCC 24-17, read 2026-10-28, What it asks before data is reused or passed on:
require the prior express consent of the called party to initiate such calls absent an emergency purpose or exemption
- FCC Declaratory Ruling 24-17 (TCPA and AI voices), FCC 24-17, read 2026-10-28, Whether a person can sue: No answer on the statute or rule page, which ran to 23,748 characters when read on 2026-10-28.
- FCC Declaratory Ruling 24-17 (TCPA and AI voices), FCC 24-17, read 2026-10-28, The rule, in its words:
calls that use such technologies fall under the TCPA and the Commission’s implementing rules
- FTC Act section 5, as the FTC applies it to changed terms, FTC Office of Technology, 13 February 2024, read 2026-10-22, What the rule covers:
to start sharing consumers’ data with third parties or using that data for AI training—and to only inform consumers of this change through a surreptitious, retroactive amendment
- FTC Act section 5, as the FTC applies it to changed terms, FTC Office of Technology, 13 February 2024, read 2026-10-22, What it asks before data is reused or passed on:
any firm that reneges on its user privacy commitments risks running afoul of the law
- FTC Act section 5, as the FTC applies it to changed terms, FTC Office of Technology, 13 February 2024, read 2026-10-22, Whether a person can sue:
the FTC has a long history of challenging deceptive and unfair practices in connection to a company’s privacy policy
- FTC Act section 5, as the FTC applies it to changed terms, FTC Office of Technology, 13 February 2024, read 2026-10-22, The rule, in its words:
It may be unfair or deceptive for a company to adopt more permissive data practices
- Washington RCW 19.375.020, RCW 19.375.020, read 2026-10-28, What the rule covers:
A person may not enroll a biometric identifier in a database for a commercial purpose
- Washington RCW 19.375.020, RCW 19.375.020, read 2026-10-28, What it asks before data is reused or passed on:
without first providing notice, obtaining consent, or providing a mechanism to prevent the subsequent use of a biometric identifier for a commercial purpose
- Washington RCW 19.375.020, RCW 19.375.020, read 2026-10-28, Whether a person can sue: No answer on the statute or rule page, which ran to 4,259 characters when read on 2026-10-28.
- Washington RCW 19.375.020, RCW 19.375.020, read 2026-10-28, The rule, in its words:
A person may not enroll a biometric identifier in a database for a commercial purpose, without first providing notice, obtaining consent
Read and excluded
4 named documents were read but are not the kind of document this board answers from; see why below. They are counted and never answered.
- California Privacy Protection Agency, laws and regulations: the California Privacy Protection Agency's index of laws and rulemakings; the rules themselves are read from the Civil Code sections recorded here
- HHS, guidance on de-identification of protected health information: HHS guidance explaining 45 CFR 164.514, which is recorded from its own text; guidance is not a separate rule
- FCC, AI-generated voices in robocalls: the FCC news release index for Declaratory Ruling 24-17, which is recorded from the ruling itself
- Colorado SB24-205, consumer protections for artificial intelligence: Colorado SB24-205 governs algorithmic discrimination by high-risk AI systems; it sets no rule on reusing call recordings as training data
How this was built
Each rule's own US federal and state statutes, regulations and regulators guidance were read through estate-fetch and stored whole (sha256 on every row).
For every statute or rule page, four questions were answered from its own words: what the rule covers, what it asks before data is reused or passed on, whether a person can sue, the rule, in its words.
Every stated answer carries the sentence it rests on, checked against the stored text; 'not stated' means the statute or rule page read does not address the question.
A rule with several statute and rule pages reads 'varies' where they disagree.
10 rules, 10 statute and rule pages.
14 sources, with links
- California Penal Code 632.7 (recording cellular and cordless calls) (quoted for reporting from the publisher's US federal and state statutes, regulations and regulators guidance)
- California Penal Code 637.2 (private right of action) (quoted for reporting from the publisher's US federal and state statutes, regulations and regulators guidance)
- California Civil Code 1798.140 (CCPA definitions: sale, biometric information, personal information) (quoted for reporting from the publisher's US federal and state statutes, regulations and regulators guidance)
- California Civil Code 1798.120 (right to opt out of sale or sharing) (quoted for reporting from the publisher's US federal and state statutes, regulations and regulators guidance)
- California Privacy Protection Agency, laws and regulations (read, set aside)
- RCW 19.375.020 (Washington biometric identifiers: enrollment, retention, use) (quoted for reporting from the publisher's US federal and state statutes, regulations and regulators guidance)
- 18 U.S.C. 2511 (interception and disclosure of wire, oral or electronic communications) (quoted for reporting from the publisher's US federal and state statutes, regulations and regulators guidance)
- 45 CFR 164.514 (HIPAA de-identification of protected health information) (quoted for reporting from the publisher's US federal and state statutes, regulations and regulators guidance)
- HHS, guidance on de-identification of protected health information (read, set aside)
- 16 CFR Part 313 (Gramm-Leach-Bliley privacy of consumer financial information) (quoted for reporting from the publisher's US federal and state statutes, regulations and regulators guidance)
- FTC, quietly changing terms of service to use data for AI could be unfair or deceptive (quoted for reporting from the publisher's US federal and state statutes, regulations and regulators guidance)
- FCC 24-17, declaratory ruling: AI-generated voices are artificial under the TCPA (quoted for reporting from the publisher's US federal and state statutes, regulations and regulators guidance)
- FCC, AI-generated voices in robocalls (read, set aside)
- Colorado SB24-205, consumer protections for artificial intelligence (read, set aside)
Take this figure with you
10 US rules that bite when call recordings are reused for AI, read 28 October 2026.
What the rule covers, by rule: recording or intercepting calls 3 of 10, voiceprints and other biometric identifiers 2 of 10, AI-generated voices on calls 1 of 10, changing terms to reuse data for AI 1 of 10, financial customer information 1 of 10, health information 1 of 10, personal information and its sale 1 of 10 (10 rules, read 28 October 2026).
What it asks before data is reused or passed on, by rule: consent of the person 4 of 10, not stated 2 of 10, notice and a right to opt out 2 of 10, de-identification 1 of 10, clear disclosure 1 of 10 (10 rules, read 28 October 2026).
Whether a person can sue, by rule: not stated 7 of 10, enforced by a regulator or prosecutor 2 of 10, a private right of action 1 of 10 (10 rules, read 28 October 2026).
The rule, in its words, by rule: stated 10 of 10 (10 rules, read 28 October 2026).
Suggested citation: "US rules on reusing call recordings for AI", updated 2026-10-28, https://sellcallcenterdatatoai.com/datasets/call-recording-ai-training-law/.
The data as a CSV (40 answers, updated 2026-10-28)