A caller with a 415 number orders forty sandwiches for a Thursday office lunch. The order is recorded, as every call on that line has been since your phone system was installed. Six weeks later there is a dispute about what was promised on delivery timing, someone plays the recording back, and the customer's first question is not about sandwiches. It is why you have a recording of them at all.
In California, that question has more weight behind it than it does in most places. This is general education rather than legal advice, and anything you actually do should be reviewed by an attorney licensed in California, but the shape of the issue is worth understanding before you have that conversation.
The framework, in general terms
California is generally described as an all-party consent jurisdiction. The relevant body of law is the California Invasion of Privacy Act, part of the state's Penal Code, usually shortened to CIPA.
The core concept is that recording a confidential communication without the consent of every party to it is prohibited. There are additional provisions addressing calls carried over cellular and cordless phones, which is worth knowing because a large share of restaurant calls now arrive that way.
"All parties" means what it says, and it includes people who join partway through. If a manager picks up to handle an escalation, that manager is now a party. The broader concept is described in all-party consent states and what restaurants get wrong.
"Confidential" carries most of the weight
The framework does not reach every recorded conversation. It reaches confidential ones, and what counts as confidential has been argued about for a long time.
The general idea is whether a participant reasonably expected the conversation would not be recorded or overheard. That is a fact-specific inquiry, which is a polite way of saying it is decided case by case and you should not decide it yourself. Some of the considerations that come up:
- Whether the caller was told anything at the start of the call, since a person who has been told the line is recorded is in a different position than one who has not.
- Whether the conversation was a routine commercial transaction or something a caller would reasonably treat as private, which is not always obvious on a restaurant line where people discuss allergies and medical restrictions.
- Whether the recording captured a participant who never interacted with your business, such as someone talking in the background or a second person handed the phone.
That third item is more common in a restaurant than operators expect. Large orders get placed by committee, with a phone passed around an office.
The practical response is not to reason your way to a conclusion about confidentiality. It is to obtain consent from everyone, so the question does not have to be answered.
The disclosure most businesses use
The mechanism is a notice at the very beginning of the call, before your greeting and before the caller says anything substantive, followed by the caller continuing to speak. Some businesses also use a periodic tone.
Getting the placement right matters more than most operators realize. A notice delivered after a caller has recited their name, their phone number, and a dietary restriction has not given them a meaningful choice about any of it.
Keep the wording short and have a lawyer look at it. This is one of the narrow situations where the exact phrasing does work, and where copying another restaurant's script is a poor idea because you do not know whether theirs was reviewed either.
Give objecting callers a path. If a caller says they would rather not be recorded and your only response is to end the call, you have not built a consent process. Someone should be able to continue on a line that is not being recorded.
An automated phone agent has a real advantage here, and it is worth being precise about what the advantage is. Software delivers the identical notice on call four hundred that it delivered on call one, in the same words, at the same position, without shortening it during a rush. That is consistency, and consistency is what a disclosure practice lives or dies on. It is not the same thing as compliance, and no vendor should tell you otherwise. The general vendor questions are in call recording and consent for restaurants.
Why the exposure is shaped differently here
In many regulatory areas, a small business's practical risk is a function of whether a regulator ever notices. California's recording framework works differently, because it provides a private right of action. Individuals can bring claims directly.
That changes the calculation in a way worth stating plainly: your exposure does not depend on attracting an agency's attention. It depends on whether any individual caller decides to pursue something.
It is also worth knowing that plaintiffs have applied this statute to technologies well beyond the tape recorders it was originally written around. The boundaries of that are actively contested and well outside what an article like this can resolve. The reason to mention it at all is that "our phone vendor said it's fine" is not a durable position in California, and a written answer from an attorney is worth what it costs.
What to actually do this month
Five things, in order, and none of them require a lawyer until the last one:
- Inventory every phone path into your business, including the catering line, any forwarding rule, any number a marketing agency issued, and the overflow that rings a manager's cell. Note which ones record.
- Ask your phone vendor in writing what is captured on each path, whether transcripts are stored separately from audio, where it all lives, and who at their company can access it.
- Find out what your current disclosure says and exactly where in the call it plays, by calling your own restaurant from an outside line and listening.
- Write down a retention period and confirm something actually deletes on it, using the approach in call recording retention policy.
- Take all four answers to a California attorney in a single hour-long conversation, which is far cheaper than four separate ones.
Then handle the second question, which is not about consent at all. California's consumer privacy statutes govern what you do with the information after you have it, including what you disclose to consumers and what rights they have over it. Voice recordings and transcripts of your customers are personal information, and the obligations attached to them are covered in CCPA and voice data for restaurants and in voice AI data ownership and privacy.
One last thing to consider seriously: whether you need audio at all. Most of what operators want recordings for is settled faster by a timestamped order record showing exactly what was entered. If the order data does the job, keeping the audio buys you a modest convenience and a permanent obligation, and in California that trade deserves a deliberate answer rather than a default setting.