Recording Consent Laws in the US: A Guide for Researchers

Here's the short version: US recording consent laws fall into two camps. One-party consent states let a single participant record a conversation without telling anyone else. All-party consent states (sometimes called two-party states) require everyone to agree first. 38 states and the District of Columbia sit in the one-party group, and roughly a dozen require all-party consent.

The exact count is debated because several states apply different rules to phone calls than they do to in-person conversations. If you record research interviews, though, that split is almost beside the point.

I've observed enough ethics protocols to tell you that institutional requirements override state law in practice. Your IRB will almost always require explicit informed consent from every participant before you record a thing, no matter how permissive your state happens to be. So the question is more about what your protocol requires than what your state allows.

I’m gonna guide you through the whole process so your research work always stays on the right side of the law.

State recording laws are only half the picture for researchers

Picture this: you're a qualitative researcher at a university in New York, interviewing a participant who's sitting in California over Zoom. New York is a one-party consent state, so you figure you're covered. You're a party to the conversation; you consent, and that's it.

Except you're not covered. California is an all-party consent state, and when a call crosses state lines, the stricter law tends to win. And this is where most researchers are caught off guard.

The federal standard comes from the Wiretap Act (18 U.S.C. § 2511), which requires one-party consent. If you're part of the conversation, federal law lets you record it. But states can be stricter, and many are. Research ethics boards are stricter still; that is the body that governs your work.

Here's how the two models work for a researcher:

A few states refuse to sit neatly in either column.

• Connecticut, Michigan, Oregon, and Nevada switch rules depending on whether the conversation happens by phone or in person
• Delaware has two statutes that openly conflict, so the safe reading there is all-party
• Hawaii and Maine run on one-party consent, but tend to ban or restrict recordings in private settings like bathrooms or dressing rooms

The exact all-party count ranges from 11 to 13, depending on how a source treats these mixed cases. This is why you don't lean on the number alone.

For a researcher, the takeaway is that even in a one-party state, recording a participant without their knowledge will almost certainly breach your IRB protocol, and it could rise to research misconduct.

The IRB layer: Why institutional requirements override state law

If your work counts as human subjects research, the authority that governs you is your Institutional Review Board. The Common Rule (45 CFR 46) requires IRB review and informed consent before you collect data, and most universities apply that standard to all such research, not only the federally funded kind. Assume it covers you.

For recording, that consent has to be explicit. Your protocol and consent form must tell participants that you're recording, why, and what happens to the file, and every participant has to agree before you start.

The reason IRB tends to outrank state law is that the bar is higher. It expects informed consent from everyone, so if you clear the IRB requirement, you're most likely to clear the state law as well.

When do you need to follow HIPAA requirements?

The good news is that HIPAA doesn't apply to every study. It’s relevant when your research handles protected health information (PHI) connected to a covered entity.

That includes research conducted by or for a hospital, clinic, or health plan, and research that uses health data obtained from any of them. If no covered entity is part of that process, HIPAA likely won't reach your work, though your IRB's data rules still will.

When it does apply, recordings play a major role. An audio file that contains identifiable health data is PHI, and the transcript you make from it is PHI too.

This is where your transcription tool becomes a compliance decision. Under HIPAA, any third-party service that processes PHI on a covered entity's behalf is a business associate, and the covered entity must have a signed Business Associate Agreement (BAA) with that service before any PHI changes hands. No BAA, no upload.

For instance, HappyScribe is not currently HIPAA compliant, which means it can't serve as a business associate or sign a BAA for protected health data. If your research requires HIPAA compliance, verify that your transcription platform can sign a BAA before you upload a single recording.

Plenty of academic teams run siloed workflows for exactly this reason: a HIPAA-compliant service for anything that contains PHI, and broader tools like HappyScribe for non-PHI material.

Recording across state lines: Compliance for remote interviews

Remote interviews are a different beast because suddenly you’re not only talking about recordings across the state, but also across the Atlantic.

Whose law wins on an interstate call

Federal law doesn't settle it at one go. The Wiretap Act gives a one-party baseline but doesn't preempt stricter state law, and courts haven't agreed on which state governs a cross-border call.

The trend favors the state where the recorded person sits. In Kearney v. Salomon Smith Barney, California's Supreme Court applied its all-party rule to a Georgia firm that recorded calls with California clients. So follow the strictest law that could apply, and get consent from everyone.

Where this still backfires for researchers

For most studies, this barely changes your day, because your IRB already makes all-party consent your default. State law only re-enters when you don't yet have that signed consent:

• Recruitment or screening calls you make before formal consent is in place
• Studies that run under an IRB waiver of documented consent

Crossing into the EU or UK

When recordings cross borders, a new regime can take over. If your participant is physically in the EU or UK, GDPR or UK GDPR can apply to you because it depends on where they are, not their citizenship.

The consent bar sits higher than US norms: it has to be explicit and fully informed, and health data is a special category that requires its own explicit consent. Storage is part of it as well, because moving EU data onto US servers triggers transfer rules, which is why many transcription tools keep recordings on EU infrastructure.

I cover the UK side in our guide to UK recording consent for researchers.

What to include in your consent form about recording and transcription

Your consent form is where you put all this info to practice. State law, your IRB, GDPR, the tools you choose, all of it lands in the one document a participant actually reads and signs. Spell out the recording and transcription plainly, and cover these points:

• Whether the interview will be recorded, and whether that's audio or video
• Why you're recording it, for example, transcription and analysis rather than publication of the audio
• Whether recording is required to take part or is optional
• How the recording will be transcribed: AI, human, or both
• Whether a third-party service will process the recording
• Where recordings and transcripts will be stored, and for how long
• Who will have access to them
• When and how recordings will be destroyed
• How and when you'll de-identify the data
• The participant's right to refuse recording or withdraw later

If you use AI transcription, you have to name it. Explain to participants that the audio will be processed by automated speech recognition, and describe how the platform handles their data: encryption, where the data sits, and how long it's kept.

That last part deserves more attention than it usually gets. Before you upload a single interview, get clear answers to three things about your provider: whether it uses your recordings to train its models, how long it keeps your files, and who can see them.

Keep your research recordings compliant with HappyScribe

Every layer we've covered ends up asking the same thing of your transcription tool: can it prove how it handles participant data? HappyScribe publishes its standards on its security and privacy pages, so you can cite them directly in an IRB application or consent form.

Here's how HappyScribe helps you record conversations for research:

GDPR and SOC 2 Type II compliance for added security

Remember the GDPR parallel to the HIPAA point from earlier? If your participant's data falls under GDPR, your transcription provider acts as your processor, and Article 28 expects a data processing agreement (DPA) between you. HappyScribe provides that DPA, lists its subprocessors with standard contractual clauses in its trust center.

It backs the claims with SOC 2 Type II certification, which means an independent audit firm has reviewed HappyScribe’s security processes. These are the parameters an ethics review wants to see.

EU-only data residency for simpler data handling

All files are processed and stored in EU data centers, in a Tier IV, PCI DSS, ISO 27001-compliant facility. For interviews with EU or UK participants, this keeps the data within its jurisdiction of origin, so you sidestep the cross-border transfer rules we covered in the remote-interview section.

For US-only studies, it still gives your consent form a clean, one-line answer to "where will my recording be stored?"

AI plus human transcription for reliability

You get to choose the workflow depending on your project scope. HappyScribe’s AI transcription generates 95% accurate drafts in 150+ languages and dialects, so multilingual projects can run smoothly.

When you need to be absolutely sure about accuracy, the human proofreading service brings in a vetted professional to review and fix your transcripts with 99% accuracy in 60+ languages. It’s ideal for qualitative coding and verbatim analysis.

One disclosure note from your consent checklist: human review means a linguist accesses the recording under confidentiality, so mention that in your form when you use it.

AI training controls you decide on

"Will my voice train an AI?" is a question participants now ask, and most platforms give a vague answer. HappyScribe is upfront about it. Model training is a setting you control from your dashboard, and for Enterprise accounts, it’s off by default.

Your files are deleted from HappyScribe when you remove them from your account. That gives you something concrete to put in front of a participant.

Stay compliant when you record research interviews

Recording consent for US researchers comes down to a hierarchy. State law is the floor, and your IRB sits above it and demands informed consent from everyone. HIPAA adds its own rules when health data enters the picture, and GDPR takes over when your participant sits across the EU.

The good news is that most of the work happens in one document. A consent form that names the recording, the transcription method, and the data handling behind it satisfies your ethics board and your participants at the same time. The only thing left is a transcription provider whose paperwork backs you up.

HappyScribe gives you that paper trail for research transcription. EU data residency, SOC 2 Type II, GDPR compliance, and AI training controls you can cite in your IRB application word for word.

You can talk to the team about the research and security setup your committee needs to see.