Who owns call recordings at a contact center or BPO, and what can it license?

The short answer: the client usually controls the recordings

At an outsourced contact center or BPO, recordings of calls handled for a client are usually owned or controlled by that client under the master services agreement. Many agreements define client data broadly enough to cover recordings, transcripts, chat logs and anything derived from them, and allow the BPO to use them only to deliver the service. Without the client's written consent, those recordings are not the BPO's to license.

That does not end the conversation for a sponsor who owns a contact center platform. The BPO's own operating records, built with its own people and methods, may be licensable.

What a BPO usually controls

Sort records by who created them and under which contract.

An in-house contact center is different. A company recording calls with its own customers usually controls those recordings, although privacy notices and consent rules still limit what it can do with them. The case for why business call recordings are valuable for AI applies most directly there.

Consent rules apply even when ownership is clear

Ownership and consent are separate questions. The federal Wiretap Act, 18 U.S.C. 2511, generally permits a party to a call to record it, or anyone to record it with one party's prior consent, unless the purpose is criminal or tortious. Some states require more: California's Penal Code section 632 prohibits recording a confidential communication without the consent of all parties. A contact center taking calls from many states therefore has to show how consent was obtained, and what callers were told the recording was for, before any recording is licensed.

Calls that consist mainly of protected health information are a red flag unless there is HIPAA authorization or proper de-identification. This is general information, not legal, tax or financial advice. Confirm with your own counsel before acting.

How a sponsor can check a contact center platform

1. Pull the services agreements for the largest clients and read the data ownership, use restriction, confidentiality and return-or-destroy clauses.
2. Check where recordings are stored: in the BPO's own contact center platform tenant or in the client's.
3. List the materials the BPO built itself: curricula, QA frameworks, workforce models and playbooks.
4. Confirm retention schedules and whether departed clients' data has already been destroyed as the contracts required.
5. Confirm the company had 50+ full-time employees at peak, contractors excluded, and several years of documented operations; the who qualifies page covers the remaining criteria.
6. If it passes, introduce the company to SourceX and let its own team build a metadata-only inventory with the data inventory builder.

The business process outsourcing industry page lists other BPO record types worth checking. The same service-provider question comes up in professional firms; who owns audit workpapers covers the accounting version.

What to say to the contact center CEO

When the concern is valid

• Nearly all the platform's useful records are client recordings, and clients will not consent.
• Contracts required destruction of client data at termination, and it has been destroyed.
• The center mainly handles healthcare calls full of protected health information.
• Headcount never reached 50+ full-time employees at peak, contractors excluded.
• The same records were already licensed for AI training.

Next step

If a contact center in your portfolio holds substantial self-built records, register as a partner and connect its CEO or CFO with SourceX, or have the company apply at sourcex.si/apply. Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company, and rewards become payable only after the buyer pays and SourceX receives its fee. The operating partner overview explains the rest of the program for sponsors.