The short answer
Recording consent is the operational practice that satisfies the legal requirement. It covers the disclosure the caller hears, the evidence that it was made, what happens if someone objects, and how long the audio is kept. For voice AI it also has to cover secondary uses, because a recording retained for QA is not automatically available for model training.
In detail
A usable disclosure is delivered before substantive conversation begins, states plainly that the call is being recorded, and — where all-party consent applies — gives the recipient a real opportunity to object. Burying it in a fast preamble that the caller talks over defeats the purpose and is unlikely to be defensible.
The evidence is as important as the disclosure. Storing when the disclosure was played, what it said, and how the recipient responded turns an assertion into a record. The version of the disclosure text matters too, because wording changes over time and a dispute concerns what was actually said on that call.
Retention and purpose deserve separate decisions. Audio kept indefinitely is a growing liability, particularly where it contains payment details or health information, so a defined retention period with automatic deletion is the norm. Secondary use for model training is a distinct purpose that most consent language does not cover, and treating it as included because the recording exists is a common and avoidable error.
How Rexa handles it
Recordings on Rexa are not served from a public URL: the recording endpoint redirects to a short-lived pre-signed link, and custom-storage recordings live in a private bucket. A session.recording_completed webhook delivers the recording reference when the audio is ready. Mid-call opt-out is wired into recording too — a workspace can configure an opt-out to stop recording, and can elect to purge the full recording rather than keep the pre-opt-out portion.
SecurityRelated terms
Two-party consent
Two-party consent is the requirement in certain jurisdictions that every participant in a conversation agree before it may lawfully be recorded.
Consent capture
Consent capture is the process of obtaining, recording and retaining evidence that a person agreed to be contacted.
Opt-out keyword
An opt-out keyword is a word or phrase that, when spoken or sent by a recipient, is treated as a request to stop being contacted.
GDPR
The GDPR is the European Union regulation governing the processing of personal data relating to people in the EU and EEA.