AI Tools Security and Privacy Checklist for Local Service Businesses: Customer Data, Call Recording and Text Consent

Federal law requires the consent of only one party to a call. Several states require everyone on the call to agree, and a business serving customers across state lines can hit those rules without ever leaving home.

Published counts of all-party states differ. Viirtue lists 11 (California, Delaware, Florida, Illinois, Maryland, Massachusetts, Montana, Nevada, New Hampshire, Pennsylvania and Washington). CommLaw Group lists the same set plus Connecticut. Frontdesk and AInora count 12, and Dialzara counts 12 all-party states and 38 one-party states. Recordinglaw.com counts 13, adding Connecticut and Oregon, with caveats about whether the rule applies to phone-only or in-person-only recording. The disagreement concerns Connecticut, Michigan, Oregon, Vermont and Delaware. No primary 50-state source was available (Justia returned an access error and the RCFP index did not list details), so the counts here are secondary.

Practical rule: recordinglaw.com says that if either party is in an all-party state, the safest approach is to get everyone's permission. It also says California law applies to calls to or from California regardless of the caller's location. For a service business that takes calls from customers who may be in other states, an announcement at the start of every recorded call, whether from a human or an AI agent, avoids having to guess.

Google Ads call recording is, per Google's help page, enabled by default to allow AI-powered lead qualification. The exceptions are accounts that previously disabled it and healthcare and financial-services advertisers. Callers hear an automated message that the call is recorded 'for quality purposes.' Advertisers must accept the Call Ads Supplemental Terms and acknowledge that they have given notice to agents, employees and others who may be on calls. It applies to US and Canadian numbers. To turn it off, go to Admin > Account settings > Call ads > Call recording > Off. Recordings are available for 30 days.

Search Engine Journal (April 21, 2026) advises advertisers to review whether Google's message satisfies their own legal obligations. A third-party post (ALM Corp) says the default starts July 1, 2026; Google's page shows no date, so check your own account setting rather than relying on a date.

For Local Services Ads, Google's data page says communications through Google may be monitored or recorded. Retention in North America is up to 180 days, or 60 days for legal verticals. Providers may record independently under the provider's company's privacy policies, and Google does not monitor or control how providers use the recordings. Providers are responsible for deleting consumer data stored on their own systems. Older secondary coverage says two years' retention; Google's current page says 180 days.

None of the other published AI-tool checklists reviewed here covers this, even though a local service business is likely to run Google ads.

Under the TCPA, texts count as calls. Marketing texts need prior express written consent. Keep a record of the date and time, the method of consent, and the exact wording the customer saw (ActiveProspect). A sample disclosure many vendors use reads: 'Consent is not a condition of purchase. Message frequency varies. Message and data rates may apply. Reply STOP to cancel,' with links to your terms and privacy policy (SimpleTexting). Treat that as an example of the pattern, not as approved legal text.

The Eleventh Circuit vacated the FCC's 'one-to-one consent' rule on January 24, 2025 in Insurance Marketing Coalition v. FCC.

Revocation of consent (47 CFR § 64.1200(a)(10)), per Hunton's January 12, 2026 summary, has two parts. In effect since April 11, 2025: honor a revocation within a reasonable time not to exceed 10 business days. The words STOP, QUIT, END, REVOKE, OPT OUT, CANCEL and UNSUBSCRIBE are per se reasonable, and any other reasonable method counts as well. Delayed: the 'revoke-all' provision, under which an opt-out to one message type applies to all robocalls and robotexts from that caller. FCC order DA 26-12 of January 6, 2026 moved it from April 11, 2026 to January 31, 2027 (Burr & Forman). The FCC order text itself could not be read; this date comes from law-firm summaries. Plan for revoke-all anyway: if a customer opts out of promotions, assume you may soon need to stop all automated texts to them.

Quiet hours: telephone solicitations to residences are barred before 8 a.m. and after 9 p.m. local time of the recipient, under 47 CFR § 64.1200(c)(1), and this applies to texts (Federalist Society commentary).

AI-generated voices on calls are 'artificial' under the TCPA per the FCC declaratory ruling of February 8, 2024, so they need prior express consent.

Maine (Public Law 2025, ch. 294; 10 M.R.S. § 1500-DD, effective September 24, 2025) requires clear notice that a customer is not talking to a human when a chatbot could mislead them. A violation is an Unfair Trade Practices Act violation. The bill text is LD 1727 on the Maine Legislature site; the effective date and citation come from secondary summaries.

Utah's AI Policy Act (SB 149, amended by SB 226 and SB 452) requires disclosure when a user asks, and in some cases earlier. That description comes from a secondary source only, and the Utah code page could not be loaded, so read the current statute before relying on it.

The same secondary page concludes that only Maine and Utah reach ordinary small-business chatbots. That has not been verified against each state's text. It also mentions California SB 243, which concerns companion chatbots; no claim that a California customer-service-bot law covers only $500M+ companies could be confirmed.

Even where no statute requires it, telling callers and chat users they are dealing with AI is consistent with the transparency Google emphasizes for AI content and with the Dialzara checklist's suggestion to disclose within 30 seconds.

The FTC's Cybersecurity for Small Business page (dated September 2025) does not mention AI, but its advice maps directly onto AI vendors. It says to include provisions for security in your vendor contracts, to limit vendor access to the data points they need, and to establish processes to confirm that vendors follow your rules, adding 'Don't just take their word for it.' It advises requiring multi-factor authentication for network access and for areas holding sensitive data. After a compromise, notify affected people and point them to IdentityTheft.gov.

The FTC's Protecting Personal Information guide for business frames data protection as five steps: take stock, scale down, lock it, pitch it, plan ahead. For AI tools that means knowing which tools hold customer data, keeping only what you need, restricting access, deleting data you no longer need (set retention windows), and having an incident plan.

Consumer versus business AI accounts: several secondary guides (Intellspot, Centre Technologies) say consumer ChatGPT plans (Free, Plus, Pro) may use conversations for training by default, while business plans do not. OpenAI's own enterprise privacy page and data controls FAQ could not be opened to confirm the wording, so verify each vendor's terms yourself and keep customer information out of personal accounts.