Recording and transcribing multilingual calls — what's legal where

Disclosure: we make TellAcross, a call translation tool with transcript export, so we have an interest here. More importantly: I'm not a lawyer and this is not legal advice. Recording law is jurisdiction-specific, fact-specific and changes. Use this to know what to ask your counsel, not to replace them.

Two things make recording a translated call different from recording a normal one, and most guidance addresses neither.

A cross-language call is almost always cross-border. That's the point of it. So you're rarely under one jurisdiction's rules — you're under at least two, and the stricter one tends to govern.

A translated call produces several records, not one. Original audio, a transcript in the source language, the translated text, and often synthesised speech. Each is separately created, separately stored and separately subject to whatever rules apply. Consent to "record the call" doesn't obviously cover all four, and a searchable transcript is arguably more sensitive than the audio it came from.

The United States: a floor and twelve exceptions

Federal law — the Electronic Communications Privacy Act, 18 U.S.C. § 2511 — sets a one-party consent floor: a participant may record without notifying the others.

States can be stricter, and twelve are. As of 2026, California, Connecticut, Delaware, Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Oregon, Pennsylvania and Washington require all-party consent.

The detail matters within those, too. Connecticut requires all-party consent for phone calls but follows one-party for in-person conversations; Oregon is the reverse for oral versus electronic communications.

For interstate calls the stricter state's law usually controls — which is why most multi-state businesses simply default to all-party notice on every recorded call. If you're in an all-party state, federal one-party consent does not rescue you.

The stakes are not theoretical: the federal Wiretap Act carries up to five years per violation, alongside state criminal exposure, civil statutory damages and class action risk.

The EU: a lawful basis, and notice regardless

GDPR doesn't ban call recording; it requires a lawful basis under Article 6 — consent, contract, legal obligation, vital interest, public task or legitimate interest.

In practice, many European businesses rely on legitimate interest rather than consent for routine business recording — but only where the purpose is necessary, proportionate, documented and transparently communicated.

Two points people get wrong:

Notice is required either way. Individuals must be informed before recording begins; secret recording is not compliant. Disclosure and consent are different things, and disclosure is always needed.

Your lawful basis determines the rights you must honour. Rely on legitimate interest and people have a right to object, which needs a documented process and a real way to opt out. Rely on consent and they can withdraw it and ask for deletion.

Retention should be the minimum necessary for the stated purpose — which is precisely where the multiple-records problem bites, because deleting the audio while keeping the transcript may not be the deletion anyone thinks it is.

Enforcement is active: in 2025, EU data protection authorities issued 213 enforcement actions specifically on call recording, totalling €147 million.

The part specific to translated calls

Consent has to be understood. This is the recursive problem in this whole area: consent obtained in a language the person doesn't speak is not informed consent. If you announce recording in English to someone who needed a translator to take the call, you have a notice you can't rely on. Announce it in their language, at the start, before anything else.

Name what you're recording. "This call is recorded" is a weaker statement than "this call is recorded and transcribed, and a translated transcript is stored". If your compliance position depends on the transcript existing, say so.

Your sub-processors are part of the answer. Speech recognition, translation and voice synthesis are typically three different vendors, often in different countries. For GDPR purposes those are processors handling personal data, and they belong in your records and your DPA. Ask any vendor to name them; if they can't, that's a meaningful answer.

Deletion must be complete. A request to delete a call should remove the audio, both transcripts and any derived artefacts. Systems that delete the recording and retain the searchable text are common and are usually not what the person asked for.

A defensible default

Not legal advice, but this posture is hard to fault:

1. Announce recording at the start of every call, in the languages being used. Skip the jurisdictional analysis entirely by always meeting the stricter standard.
2. State that it's transcribed and translated, not merely recorded.
3. Write down your purpose and lawful basis, and don't record where you can't articulate one.
4. Set a retention period per purpose and enforce it automatically.
5. Make deletion cover everything derived from the call.
6. Keep a list of sub-processors and where processing happens.
7. Get local advice for the jurisdictions you actually operate in — especially if that includes all-party consent states, the EU, or countries with specific telecom recording rules.

The honest summary

The trap in multilingual calls isn't that recording law is unusually harsh. It's that these calls are cross-border by nature and generate more records than the consent language typically covers — so the two areas where people are casual are exactly the two that this format makes riskier.

Announce it, in their language, covering transcription as well as recording. Know your basis. Delete everything when asked. And accept that a translated call is one where the stricter rule almost always applies, because there's almost always a stricter rule in play.