Licensing call-centre and customer-call recordings to AI

The consent you have may not be the consent you need

“This call may be recorded for quality and training purposes” covers the call centre’s own use. It rarely mentions AI, external buyers, or model training. Reading that old notice as an AI-training licence is the mistake that undoes a deal in diligence.

Treat the original notice as a recording consent, not a training grant. What a buyer needs is an explicit right to train on the audio, and, where callers are identifiable, consent that reaches their voice. If the paperwork does not say it, do not imply it.

Recording consent varies by jurisdiction

Whether a call could lawfully be recorded at all depends on where the parties were. Many US states follow one-party consent. Others require all parties to agree, often called two-party consent. Calls that cross borders can engage more than one rule at once.

This matters before AI ever enters the picture. A recording made without the consent its jurisdiction required stands on weak footing, however useful it is. Because these rules differ and change, confirm the position for your recordings with a qualified adviser rather than assume.

Personal data and redaction

Customer calls carry personal data by the bucket. Names, addresses, card numbers, account details, health and financial facts. Some of it is sensitive on its own. A buyer usually does not want it, and cannot lawfully hold much of it without a basis.

De-identification is the answer. Redact spoken personal data, remove identifiers, and strip the metadata that points back to a person. Cleaner input for the buyer, lower risk for you. Where full de-identification is not possible, that material may simply not be listable.

Redaction is not only about the audio. Account numbers in file names, agent notes and call metadata leak just as easily. Clean the wrapper as well as the recording.

Voice can be biometric data

Two regimes sit over voice specifically. In Illinois, the Biometric Information Privacy Act treats a voiceprint as a biometric identifier, and requires informed, written consent before one is collected, plus a published retention and destruction policy. A plain recording is not automatically a voiceprint, but building voice models from it can bring the law into play.

Under the GDPR, a voice recording is personal data, and becomes special-category biometric data when it is processed to identify a person uniquely. Special-category processing needs a condition under Article 9, most cleanly explicit consent. Both regimes point the same way: where identifiable voices are involved, get consent that is specific and documented.

Consent at source, captured properly

The durable fix is to capture the right consent at the point of the call, or to go back and obtain it. Consent that names AI training, states that voice and audio are included, and is logged against the recording. On fiund, that consent is held separate from the asset licence, so the caller’s permission and your grant are two distinct records.

Fresh recordings are easier than legacy ones. If call-centre audio is an ongoing source for you, add clear AI-training consent to the call flow now. It turns tomorrow’s recordings into listable material by default.

A realistic path to listing

Start with recordings you can stand behind: lawfully recorded, de-identified, and covered by consent that reaches AI training. Set aside anything you cannot document.

Keep provenance, because a buyer will check it in diligence. Slow and clean beats fast and challenged.

Keep the two things a buyer checks in view: the recording was made lawfully, and the people in it are covered. The rest follows from those two.