Call Recording Consent Policy

1. Purpose

This document defines how RepCoach handles the legal exposure created by accepting user-uploaded call recordings. It addresses Risk #1 (CIPA) from the Risk Register and provides:

1. The mandatory upload-time consent disclosure shown to every customer
2. The contractual warranty customers must accept
3. A 50-state map of one-party vs. two-party consent jurisdictions
4. A consent script template customers can use on their own sales calls
5. RepCoach's own liability position and indemnification framework
6. Geographic gating recommendations

2. Federal vs. state consent law — the foundation

Federal law (ECPA — 18 U.S.C. §2511): One-party consent. A party to the call may record without notifying the other party. Federal law sets the floor; states are free to impose stricter requirements.

Two-party (all-party) consent states. These states require ALL parties to a call to consent to the recording. A person uploading a recording made in violation of these laws has potentially committed a criminal offense AND created civil statutory damages exposure for themselves and any downstream processor.

All-party consent jurisdictions as of 2026

One-party consent states: All other 34 states + District of Columbia + US territories follow federal ECPA — only one party (the recorder) must consent.

Confidentiality requirement (California specifically): CIPA only prohibits recording "confidential communications" — defined as communications where a party has a reasonable expectation that the communication is not being recorded. Commercial sales calls have been litigated extensively and case law is mixed. Treat all calls as confidential for RepCoach's purposes. The cost of being wrong is statutory damages × number of recordings.

3. RepCoach's liability position

RepCoach is not the recording party. RepCoach does not initiate, participate in, or have first-party knowledge of the calls customers upload. Under CIPA and most state recording statutes, the primary liability rests with the person who made the recording without consent — the RepCoach customer.

However, RepCoach can still be exposed in three ways:

1. Aiding and abetting / civil conspiracy theories. If RepCoach "knows or should know" that a recording was unlawfully obtained and processes it anyway, plaintiff's counsel will argue RepCoach facilitated the violation. The mitigation is the upload-time disclosure and consent affirmation.
2. Storage and processing as a separate tort. Some courts have held that storing or analyzing an unlawfully-obtained recording is itself a separate violation under wiretapping statutes. The mitigation is an indemnification clause shifting liability to the uploading customer.
3. Joint and several liability in class actions. Even if RepCoach's share of liability is small, class action plaintiffs typically name every defendant with assets. The mitigation is the indemnification clause and cyber liability insurance with a wiretapping endorsement.

4. Mandatory upload-time consent disclosure

Before uploading any call recording or transcript to RepCoach, you must affirmatively confirm the following:

5. Customer-facing consent script template

This is a script RepCoach customers can use on their own sales calls to obtain valid consent from the prospect.

Wait for an affirmative response. Document the response at the beginning of the recording.

Acceptable responses:

• "Yes" / "Sure" / "That's fine" / "Go ahead"
• "Okay" (followed by continued conversation — implied consent)

Unacceptable responses (do NOT proceed with recording):

• "No" / "I'd rather not" / "Please don't"
• Silence (in two-party consent states, silence is not consent)
• Hesitation followed by a question (give them time, re-explain, get a clear yes)

If they decline, you may continue the call without recording, or end the call. Do not record after a refusal. Do not upload any recording where consent was not clearly obtained.

State-specific script enhancements

For California, Florida, Illinois, Maryland, Massachusetts, Pennsylvania, Washington customers (the most aggressive enforcement states), add this language:

6. RepCoach's own use of customer information

RepCoach does NOT record any calls itself. RepCoach processes recordings that customers upload. The customer is the recording party. RepCoach is the processor (under GDPR terminology) or service provider (under CCPA terminology).

RepCoach commits to:

1. Using uploaded recordings only for the purpose of analysis, scoring, and coaching report generation for the uploading customer.
2. Not selling, renting, or sharing recordings or transcripts with third parties (other than essential infrastructure subprocessors — Anthropic for AI processing, Cloudflare for edge delivery, the cloud storage provider).
3. Encrypting recordings and transcripts at rest using AES-256.
4. Encrypting all data in transit using TLS 1.2 or higher.
5. Retaining recordings for the customer's chosen retention period (default 90 days, customer-configurable).
6. Deleting recordings on customer request within 30 days, including from backups within an additional 60 days.
7. Notifying customers within 72 hours of confirmed unauthorized access.
8. Maintaining a Business Associate Agreement framework for HIPAA-covered customers (when that program is in place — currently NOT in place).

7. Geographic gating recommendations

Geographic gating is a defense-in-depth measure, not a primary defense. The primary defense is the universal upload-time disclosure and the contractual warranty in the Terms of Service. Geographic gating adds an additional record of constructive notice that strengthens the "the user knew the law" position in any future litigation.

8. Indemnification framework

The Terms of Service contains the binding indemnification clause. The relevant language:

9. What RepCoach CANNOT promise

To preserve the integrity of this policy, RepCoach does not and cannot promise:

1. That uploading a recording is legal in your jurisdiction. You must determine that.
2. That your customer's consent script is sufficient. You must verify that.
3. That your employer authorizes you to use RepCoach for company calls. You must obtain that authorization.
4. That RepCoach's analysis is accurate or appropriate for any particular purpose.
5. That uploading a recording will not result in a claim against you. The disclosure and warranty exist precisely because the legal landscape is uncertain.

The customer bears primary legal responsibility for the lawfulness of any recording uploaded. RepCoach provides the tooling, the disclosure framework, and the indemnification mechanism — but the customer must do the work of obtaining valid consent.