An AI phone agent, a website chatbot or a texting tool does more than save time. It listens to your customers, stores what they say, and often sends it to a third-party vendor. That makes you responsible for three things at once: how the vendor handles the data, whether callers and texters agreed to be recorded or contacted, and whether you can prove it later.
Most published checklists are written for call centers or enterprise IT teams. This guide is written for an owner who has a phone, a Google Business Profile, maybe Google Ads or Local Services Ads, and a handful of software subscriptions. It covers the rules that matter most in practice: call-recording consent by state, text-message consent under the TCPA, the 10DLC registration that business texting requires, the data-use clause in your AI vendor's contract, and the call recording that Google Ads can switch on for you by default.
Two cautions apply throughout. First, this is a practical checklist, not legal advice. Several figures below come from law-firm and trade summaries rather than the statute or court text, and each place where that matters is flagged. Second, where published counts disagree (for example, the number of all-party-consent states), the disagreement is stated rather than smoothed over. Information is current as of October 1, 2026.
