Is A CCPA Risk Assessment Required When Recording Customer Calls?

Key Takeaways

• Analyzes whether recording customer service and sales calls triggers the CCPA’s new risk assessment requirements.
• Identifies the specific CCPA triggers most relevant to call recording, particularly when AI analytics are applied to recordings.
• Notes related obligations under state wiretapping laws and other state privacy frameworks.

Recording customer calls is among the most common data collection practices in business. Contact centers, healthcare providers, financial services firms, and countless other industries record customer interactions for quality assurance, training, compliance, and dispute resolution. The familiar “this call may be recorded for quality and training purposes” disclosure has become almost reflexive. But with the CCPA’s new risk assessment requirements now in effect, businesses subject to the CCPA should revisit this practice—particularly where call recordings are analyzed using AI or used in ways that go beyond simple storage and retrieval.