# US rules on reusing call recordings for AI

> 10 US rules that bite when call recordings are reused for AI, read 28 October 2026.

Sell Call Center Data to AI · https://sellcallcenterdatatoai.com/datasets/call-recording-ai-training-law/ · computed 2026-10-28

**US rules on the register:** 10 rules (10 statute and rule pages read; 14 named).

## The answers, question by question

- **What the rule covers:** recording or intercepting calls 3, voiceprints and other biometric identifiers 2, financial customer information 1, health information 1, personal information and its sale 1, AI-generated voices on calls 1, changing terms to reuse data for AI 1
- **What it asks before data is reused or passed on:** consent of the person 4, notice and a right to opt out 2, not stated 2, de-identification 1, clear disclosure 1
- **Whether a person can sue:** not stated 7, enforced by a regulator or prosecutor 2, a private right of action 1
- **The rule, in its words:** stated 10

## Every rule

| Rule | What the rule covers | What it asks before data is reused or passed on | Whether a person can sue | The rule, in its words |
|---|---|---|---|---|
| 16 CFR Part 313 (GLBA privacy rule) | financial customer information | notice and a right to opt out | not stated | you may not, directly or through any affiliate, disclose any nonpublic personal… |
| 18 U.S.C. 2511 (federal Wiretap Act) | recording or intercepting calls | consent of the person | not stated | It shall not be unlawful under this chapter for a person not acting under color of law to… |
| 45 CFR 164.514 (HIPAA de-identification) | health information | de-identification | not stated | A covered entity may determine that health information is not individually identifiable… |
| California Civil Code 1798.120 (CCPA) | personal information and its sale | notice and a right to opt out | not stated | A business to which another business transfers the personal information of a consumer as… |
| California Civil Code 1798.140 (CCPA) | voiceprints and other biometric identifiers | not stated | not stated | a consumer’s personal information by the business to a third party for monetary or other… |
| California Penal Code 632.7 | recording or intercepting calls | consent of the person | enforced by a regulator or prosecutor | Every person who, without the consent of all of the parties to a communication… |
| California Penal Code 637.2 | recording or intercepting calls | not stated | a private right of action | It is not a necessary prerequisite to an action pursuant to this section that the… |
| FCC Declaratory Ruling 24-17 (TCPA and AI voices) | AI-generated voices on calls | consent of the person | not stated | calls that use such technologies fall under the TCPA and the Commission’s implementing… |
| FTC Act section 5, as the FTC applies it to changed terms | changing terms to reuse data for AI | clear disclosure | enforced by a regulator or prosecutor | It may be unfair or deceptive for a company to adopt more permissive data practices |
| Washington RCW 19.375.020 | voiceprints and other biometric identifiers | consent of the person | not stated | A person may not enroll a biometric identifier in a database for a commercial purpose… |

## The sentence each answer rests on (40)

- 16 CFR Part 313 (GLBA privacy rule), [16 CFR Part 313](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-313), read 2026-10-08, What the rule covers: "you may not, directly or through any affiliate, disclose any nonpublic personal information about a consumer to a nonaffiliated third party unless"
- 16 CFR Part 313 (GLBA privacy rule), [16 CFR Part 313](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-313), read 2026-10-08, What it asks before data is reused or passed on: "You have provided to the consumer an opt out notice as required in § 313.7"
- 16 CFR Part 313 (GLBA privacy rule), [16 CFR Part 313](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-313), read 2026-10-08, Whether a person can sue: No answer on the statute or rule page, which ran to 107,343 characters when read on 2026-10-08.
- 16 CFR Part 313 (GLBA privacy rule), [16 CFR Part 313](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-313), read 2026-10-08, The rule, in its words: "you may not, directly or through any affiliate, disclose any nonpublic personal information about a consumer to a nonaffiliated third party unless"
- 18 U.S.C. 2511 (federal Wiretap Act), [18 U.S.C. 2511](https://www.govinfo.gov/content/pkg/USCODE-2023-title18/html/USCODE-2023-title18-partI-chap119-sec2511.htm), read 2026-10-24, What the rule covers: "intentionally intercepts, endeavors to intercept, or procures any other person to intercept or endeavor to intercept, any wire, oral, or electronic communication"
- 18 U.S.C. 2511 (federal Wiretap Act), [18 U.S.C. 2511](https://www.govinfo.gov/content/pkg/USCODE-2023-title18/html/USCODE-2023-title18-partI-chap119-sec2511.htm), read 2026-10-24, What it asks before data is reused or passed on: "where such person is a party to the communication or where one of the parties to the communication has given prior consent to such interception"
- 18 U.S.C. 2511 (federal Wiretap Act), [18 U.S.C. 2511](https://www.govinfo.gov/content/pkg/USCODE-2023-title18/html/USCODE-2023-title18-partI-chap119-sec2511.htm), read 2026-10-24, Whether a person can sue: No answer on the statute or rule page, which ran to 28,101 characters when read on 2026-10-24.
- 18 U.S.C. 2511 (federal Wiretap Act), [18 U.S.C. 2511](https://www.govinfo.gov/content/pkg/USCODE-2023-title18/html/USCODE-2023-title18-partI-chap119-sec2511.htm), read 2026-10-24, The rule, in its words: "It shall not be unlawful under this chapter for a person not acting under color of law to intercept a wire, oral, or electronic communication where such person is a party to the communication"
- 45 CFR 164.514 (HIPAA de-identification), [45 CFR 164.514](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514), read 2026-10-22, What the rule covers: "Health information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual is not individually identifiable health information."
- 45 CFR 164.514 (HIPAA de-identification), [45 CFR 164.514](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514), read 2026-10-22, What it asks before data is reused or passed on: "The following identifiers of the individual or of relatives, employers, or household members of the individual, are removed"
- 45 CFR 164.514 (HIPAA de-identification), [45 CFR 164.514](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514), read 2026-10-22, Whether a person can sue: No answer on the statute or rule page, which ran to 19,506 characters when read on 2026-10-22.
- 45 CFR 164.514 (HIPAA de-identification), [45 CFR 164.514](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514), read 2026-10-22, The rule, in its words: "A covered entity may determine that health information is not individually identifiable health information only if"
- California Civil Code 1798.120 (CCPA), [Civil Code section 1798.120](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.120), read 2026-10-08, What the rule covers: "A consumer shall have the right, at any time, to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer’s personal information."
- California Civil Code 1798.120 (CCPA), [Civil Code section 1798.120](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.120), read 2026-10-08, What it asks before data is reused or passed on: "shall provide notice to consumers, pursuant to subdivision (a) of Section 1798.135, that this information may be sold or shared and that consumers have the “right to opt out”"
- California Civil Code 1798.120 (CCPA), [Civil Code section 1798.120](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.120), read 2026-10-08, Whether a person can sue: No answer on the statute or rule page, which ran to 6,371 characters when read on 2026-10-08.
- California Civil Code 1798.120 (CCPA), [Civil Code section 1798.120](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.120), read 2026-10-08, The rule, in its words: "A business to which another business transfers the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction"
- California Civil Code 1798.140 (CCPA), [Civil Code section 1798.140](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140), read 2026-10-08, What the rule covers: "and voice recordings, from which an identifier template, such as a faceprint, a minutiae template, or a voiceprint, can be extracted"
- California Civil Code 1798.140 (CCPA), [Civil Code section 1798.140](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140), read 2026-10-08, What it asks before data is reused or passed on: No answer on the statute or rule page, which ran to 36,374 characters when read on 2026-10-08.
- California Civil Code 1798.140 (CCPA), [Civil Code section 1798.140](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140), read 2026-10-08, Whether a person can sue: No answer on the statute or rule page, which ran to 36,374 characters when read on 2026-10-08.
- California Civil Code 1798.140 (CCPA), [Civil Code section 1798.140](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140), read 2026-10-08, The rule, in its words: "a consumer’s personal information by the business to a third party for monetary or other valuable consideration"
- California Penal Code 632.7, [Penal Code section 632.7](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=PEN&sectionNum=632.7), read 2026-10-28, What the rule covers: "intercepts or receives and intentionally records, or assists in the interception or reception and intentional recordation of, a communication transmitted between two cellular radio telephones"
- California Penal Code 632.7, [Penal Code section 632.7](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=PEN&sectionNum=632.7), read 2026-10-28, What it asks before data is reused or passed on: "Every person who, without the consent of all of the parties to a communication"
- California Penal Code 632.7, [Penal Code section 632.7](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=PEN&sectionNum=632.7), read 2026-10-28, Whether a person can sue: "shall be punished by a fine not exceeding two thousand five hundred dollars ($2,500)"
- California Penal Code 632.7, [Penal Code section 632.7](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=PEN&sectionNum=632.7), read 2026-10-28, The rule, in its words: "Every person who, without the consent of all of the parties to a communication, intercepts or receives and intentionally records"
- California Penal Code 637.2, [Penal Code section 637.2](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=PEN&sectionNum=637.2), read 2026-10-28, What the rule covers: "Any person who has been injured by a violation of this chapter may bring an action against the person who committed the violation"
- California Penal Code 637.2, [Penal Code section 637.2](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=PEN&sectionNum=637.2), read 2026-10-28, What it asks before data is reused or passed on: No answer on the statute or rule page, which ran to 1,749 characters when read on 2026-10-28.
- California Penal Code 637.2, [Penal Code section 637.2](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=PEN&sectionNum=637.2), read 2026-10-28, Whether a person can sue: "Five thousand dollars ($5,000) per violation."
- California Penal Code 637.2, [Penal Code section 637.2](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=PEN&sectionNum=637.2), read 2026-10-28, The rule, in its words: "It is not a necessary prerequisite to an action pursuant to this section that the plaintiff has suffered, or be threatened with, actual damages."
- FCC Declaratory Ruling 24-17 (TCPA and AI voices), [FCC 24-17](https://docs.fcc.gov/public/attachments/FCC-24-17A1.pdf), read 2026-10-28, What the rule covers: "artificial or prerecorded voice” encompass current AI technologies that generate human voices"
- FCC Declaratory Ruling 24-17 (TCPA and AI voices), [FCC 24-17](https://docs.fcc.gov/public/attachments/FCC-24-17A1.pdf), read 2026-10-28, What it asks before data is reused or passed on: "require the prior express consent of the called party to initiate such calls absent an emergency purpose or exemption"
- FCC Declaratory Ruling 24-17 (TCPA and AI voices), [FCC 24-17](https://docs.fcc.gov/public/attachments/FCC-24-17A1.pdf), read 2026-10-28, Whether a person can sue: No answer on the statute or rule page, which ran to 23,748 characters when read on 2026-10-28.
- FCC Declaratory Ruling 24-17 (TCPA and AI voices), [FCC 24-17](https://docs.fcc.gov/public/attachments/FCC-24-17A1.pdf), read 2026-10-28, The rule, in its words: "calls that use such technologies fall under the TCPA and the Commission’s implementing rules"
- FTC Act section 5, as the FTC applies it to changed terms, [FTC Office of Technology, 13 February 2024](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/02/ai-other-companies-quietly-changing-your-terms-service-could-be-unfair-or-deceptive), read 2026-10-22, What the rule covers: "to start sharing consumers’ data with third parties or using that data for AI training—and to only inform consumers of this change through a surreptitious, retroactive amendment"
- FTC Act section 5, as the FTC applies it to changed terms, [FTC Office of Technology, 13 February 2024](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/02/ai-other-companies-quietly-changing-your-terms-service-could-be-unfair-or-deceptive), read 2026-10-22, What it asks before data is reused or passed on: "any firm that reneges on its user privacy commitments risks running afoul of the law"
- FTC Act section 5, as the FTC applies it to changed terms, [FTC Office of Technology, 13 February 2024](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/02/ai-other-companies-quietly-changing-your-terms-service-could-be-unfair-or-deceptive), read 2026-10-22, Whether a person can sue: "the FTC has a long history of challenging deceptive and unfair practices in connection to a company’s privacy policy"
- FTC Act section 5, as the FTC applies it to changed terms, [FTC Office of Technology, 13 February 2024](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/02/ai-other-companies-quietly-changing-your-terms-service-could-be-unfair-or-deceptive), read 2026-10-22, The rule, in its words: "It may be unfair or deceptive for a company to adopt more permissive data practices"
- Washington RCW 19.375.020, [RCW 19.375.020](https://app.leg.wa.gov/RCW/default.aspx?cite=19.375.020), read 2026-10-28, What the rule covers: "A person may not enroll a biometric identifier in a database for a commercial purpose"
- Washington RCW 19.375.020, [RCW 19.375.020](https://app.leg.wa.gov/RCW/default.aspx?cite=19.375.020), read 2026-10-28, What it asks before data is reused or passed on: "without first providing notice, obtaining consent, or providing a mechanism to prevent the subsequent use of a biometric identifier for a commercial purpose"
- Washington RCW 19.375.020, [RCW 19.375.020](https://app.leg.wa.gov/RCW/default.aspx?cite=19.375.020), read 2026-10-28, Whether a person can sue: No answer on the statute or rule page, which ran to 4,259 characters when read on 2026-10-28.
- Washington RCW 19.375.020, [RCW 19.375.020](https://app.leg.wa.gov/RCW/default.aspx?cite=19.375.020), read 2026-10-28, The rule, in its words: "A person may not enroll a biometric identifier in a database for a commercial purpose, without first providing notice, obtaining consent"

## Read and set aside

- [California Privacy Protection Agency, laws and regulations](https://cppa.ca.gov/regulations/): the California Privacy Protection Agency's index of laws and rulemakings; the rules themselves are read from the Civil Code sections recorded here
- [HHS, guidance on de-identification of protected health information](https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html): HHS guidance explaining 45 CFR 164.514, which is recorded from its own text; guidance is not a separate rule
- [FCC, AI-generated voices in robocalls](https://www.fcc.gov/document/fcc-makes-ai-generated-voices-robocalls-illegal): the FCC news release index for Declaratory Ruling 24-17, which is recorded from the ruling itself
- [Colorado SB24-205, consumer protections for artificial intelligence](https://leg.colorado.gov/bills/sb24-205): Colorado SB24-205 governs algorithmic discrimination by high-risk AI systems; it sets no rule on reusing call recordings as training data

## Methodology

Each rule's own US federal and state statutes, regulations and regulators guidance were read through estate-fetch and stored whole (sha256 on every row). For every statute or rule page, four questions were answered from its own words: what the rule covers, what it asks before data is reused or passed on, whether a person can sue, the rule, in its words. Every stated answer carries the sentence it rests on, checked against the stored text; 'not stated' means the statute or rule page read does not address the question. A rule with several statute and rule pages reads 'varies' where they disagree. 10 rules, 10 statute and rule pages.

## Sources

- [California Penal Code 632.7 (recording cellular and cordless calls)](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=PEN&sectionNum=632.7) (read)
- [California Penal Code 637.2 (private right of action)](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=PEN&sectionNum=637.2) (read)
- [California Civil Code 1798.140 (CCPA definitions: sale, biometric information, personal information)](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140) (read)
- [California Civil Code 1798.120 (right to opt out of sale or sharing)](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.120) (read)
- [California Privacy Protection Agency, laws and regulations](https://cppa.ca.gov/regulations/) (not-terms)
- [RCW 19.375.020 (Washington biometric identifiers: enrollment, retention, use)](https://app.leg.wa.gov/RCW/default.aspx?cite=19.375.020) (read)
- [18 U.S.C. 2511 (interception and disclosure of wire, oral or electronic communications)](https://www.govinfo.gov/content/pkg/USCODE-2023-title18/html/USCODE-2023-title18-partI-chap119-sec2511.htm) (read)
- [45 CFR 164.514 (HIPAA de-identification of protected health information)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514) (read)
- [HHS, guidance on de-identification of protected health information](https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html) (not-terms)
- [16 CFR Part 313 (Gramm-Leach-Bliley privacy of consumer financial information)](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-313) (read)
- [FTC, quietly changing terms of service to use data for AI could be unfair or deceptive](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/02/ai-other-companies-quietly-changing-your-terms-service-could-be-unfair-or-deceptive) (read)
- [FCC 24-17, declaratory ruling: AI-generated voices are artificial under the TCPA](https://docs.fcc.gov/public/attachments/FCC-24-17A1.pdf) (read)
- [FCC, AI-generated voices in robocalls](https://www.fcc.gov/document/fcc-makes-ai-generated-voices-robocalls-illegal) (not-terms)
- [Colorado SB24-205, consumer protections for artificial intelligence](https://leg.colorado.gov/bills/sb24-205) (not-terms)

## Cite or embed

- 10 US rules that bite when call recordings are reused for AI, read 28 October 2026.
- What the rule covers, by rule: recording or intercepting calls 3 of 10, voiceprints and other biometric identifiers 2 of 10, AI-generated voices on calls 1 of 10, changing terms to reuse data for AI 1 of 10, financial customer information 1 of 10, health information 1 of 10, personal information and its sale 1 of 10 (10 rules, read 28 October 2026).
- What it asks before data is reused or passed on, by rule: consent of the person 4 of 10, not stated 2 of 10, notice and a right to opt out 2 of 10, de-identification 1 of 10, clear disclosure 1 of 10 (10 rules, read 28 October 2026).
- Whether a person can sue, by rule: not stated 7 of 10, enforced by a regulator or prosecutor 2 of 10, a private right of action 1 of 10 (10 rules, read 28 October 2026).
- The rule, in its words, by rule: stated 10 of 10 (10 rules, read 28 October 2026).

Cite as: "US rules on reusing call recordings for AI", updated 2026-10-28, https://sellcallcenterdatatoai.com/datasets/call-recording-ai-training-law/.

CSV: https://sellcallcenterdatatoai.com/datasets/call-recording-ai-training-law.csv
JSON: https://sellcallcenterdatatoai.com/datasets/call-recording-ai-training-law.json
Embed (plain HTML, static link back): see https://sellcallcenterdatatoai.com/datasets/call-recording-ai-training-law/#lead