Rules
Part of What a customer interview can measure, and what it never will
Customer Interviews: Consent, Recording, and Privacy Law
A customer interviews guide to recording consent and privacy law: California's all-party consent rule, the federal wiretap statute, and CCPA scope and rights.
Customer interviews leave records behind — audio files, transcripts, and notes — and the rules that govern those records depend on where you and the person you are talking to are located. This guide covers the consent law that applies before you press record, including California's all-party consent rule and the federal wiretap statute, the privacy law that can attach to the files afterward, notably the California Consumer Privacy Act (CCPA), and the handling choices that keep a transcript usable. It is a planning checklist for founders, not a legal opinion about your business.
Consent law decides whether the recording is legal
The federal Wiretap Act, at 18 U.S.C. § 2511, generally allows a party to a conversation to record it. Many states follow that one-party standard in their own statutes. A minority require every party's consent, and California is the best-known example: the California Invasion of Privacy Act, at Penal Code § 632, makes it an offense to record a confidential communication without the consent of all parties, and a related provision covers calls made on cellular or cordless phones. Washington and Illinois also require all-party consent.
Where an all-party rule applies, a person who was recorded without consent can sue, and a court may refuse to admit the recording. Two habits follow from that. Find the rule for the state where the other person is sitting, not only your own, because calls cross state lines more often than founders assume. And when you cannot be sure, ask anyway: consent given before the recording starts satisfies both standards, and a refusal costs you one conversation instead of a legal problem.
Outside the United States, recording a call is processing personal data. If the person you interview is in the EU or the EEA, the General Data Protection Regulation applies to that processing, which means you need a lawful basis for it and a plain-language explanation of what happens to the file.
A pre-interview checklist for consent, purpose, and handling
Work through these items before you invite anyone to a call. If you cannot explain one of them out loud, settle it first.
- Write the purpose.One or two sentences on what you are trying to learn and what you will do with the notes or audio. A narrow purpose makes it easy to leave out details you do not need.
- Decide whether to record at all.A short or sensitive conversation may be better served by notes. A recording is worth creating only when the exact wording matters to the decision.
- Ask for consent explicitly, and keep the proof.Say on the recording that it has started, and ask whether the person agrees to it. The audible yes belongs in the same file as the interview, not in a separate email you later have to find.
- Explain what happens to the file.Whether you will make a transcript, whether a service processes the audio, who reads it, how long you keep it, and how the person can ask you to delete it. Do not promise a deletion you have not arranged.
- Offer the unrecorded option.If someone declines, ask whether notes are acceptable. If notes will not do, thank them and stop.
- Collect only what the test needs.Interview notes and audio should not become a storage place for payment details, health information, or login credentials.
- Fix storage and access.Decide where the audio lives, who can open it, and whether the processing service keeps its own copy. Ask whether the service encrypts files and whether it will sign a data processing agreement.
- Prepare for the second question."Will anything else process this?" is a reasonable thing for a participant to ask. Have an answer ready.
Three questions for any trend
Does it change who you can reach?
change your sample frame
Does it change what a signal costs?
Compare capture options before you commit
There is no single best way to capture a conversation. Compare what each option creates and where your own hours go, rather than assuming a service removes work.
| Approach | What to check | Where your effort goes |
|---|---|---|
| Notes only | Whether notes will hold the wording the decision needs | Listening, writing, and keeping your own reading apart from what was said |
| Recording you review yourself | Where the file is stored, who can open it, when it is deleted | Re-listening and locating the passages that matter |
| Recording processed by a transcription service | What audio and text the service receives, how long it keeps them, and its terms | Checking the transcript against the audio on the passages you will quote |
A transcript is a working document, not a verified account. When you quote someone in a decision memo or a deck, check the sentence against the audio while you still have it, and mark summaries and generated themes as your reading rather than their words. The interview mistakes that cost the most are usually the ones that survive that check because nobody ran it.
Capture vs retrieval effort
Then
- Transcription
- Expensive part
- Effort goes to
- Capture
- Tag for
- Nothing
- Tag for
- Nothing
Now
- Transcription
- Cheap part
- Effort goes to
- Retrieval
- Tag for
- How you reached them
- Tag for
- What surprised you
When California's privacy law reaches your interview files
The California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act — approved by voters as Proposition 24, with new protections that began on January 1, 2023 — gives consumers more control over the personal information businesses collect about them. It applies to for-profit businesses that do business in California and meet any of the criteria the statute lists; one criterion is gross annual revenue of over $25 million. Audio, transcripts, and contact details are personal information when they identify a person, so a covered business should expect the law to reach the files an interview round creates. The California Department of Justice's CCPA overview sets out that scope and notes that the Attorney General and the California Privacy Protection Agency are the authorities that may take legal action for violations other than a data breach.
Covered businesses also owe California consumers specific rights over that information: to know what is collected, to request deletion, to opt out of the sale or sharing of personal information, and to be treated without discrimination for using those rights. A business that is covered has to tell people what it collects and why at or before the point of collection. Interview notes are a small part of that picture, but they are not outside it.
For a test round, two points matter. Where you are based does not decide coverage on its own; the test is whether the business does business in California and meets the listed criteria. And interviewing one person who lives in California does not tell you whether your business is covered. If you need that answer for your own company, get it from a qualified professional rather than from a checklist.
Note also that privacy coverage and recording consent are separate questions. A lawful recording can still create personal information you have to handle properly, and a well-handled file does not cure a recording that the consent rule did not allow.
After the call: retention, access, and the chain to a decision
Decide a retention window when you decide to record, and say what it is. "Until the pricing decision is made" is clear enough for most test rounds; a date is clearer still. When the window closes, check every copy: the original file, the transcript, the copy sitting with the processing service, and any backup. Deleting one file is not deletion.
Keep raw material and interpretation in separate places so that three weeks later you can still tell which is which. The round design keeps those columns apart, and the tooling questions cover the software decisions behind them.
Then use the record for what it can support. An account of what someone did last month is evidence about their past, not a promise about what they will buy. Keep that line visible when notes turn into a decision, and test the money questions in market validation.
Common questions
Do I need consent to record a customer interview?
It depends on the law that applies. The federal Wiretap Act allows a participant to record, and many states follow that standard; California, Washington, Illinois, and other all-party states require everyone's consent. Asking first satisfies both.
Is a verbal yes at the start of the call enough?
It is the practical minimum when the law requires consent: state on the recording that it has begun, ask whether the person agrees, and keep the answer in the same file. If your own process needs a signed consent form, send it before the call.
Does the CCPA apply because I interviewed someone in California?
That fact alone does not decide it. Coverage turns on the business — doing business in California and meeting the criteria the statute lists — not on where a single participant sits.
How long may I keep a recording?
There is no single retention period for interview recordings. Keep them no longer than the purpose you stated requires, honor any deletion promise you made, and check every copy when you delete.
What if the person I want to interview is in the EU?
Recording and storing the call is processing personal data, so the General Data Protection Regulation applies to it. You need a lawful basis, and you should say in plain language what you do with the file.
