Compliance Consent And Governance

California outbound campaign. firstMessage does not disclose recording. California is two-party consent.

Bake the recording disclosure into firstMessage (or a forced opening turn) for jurisdictions that require it — California, Florida, Pennsylvania, et al. two-party-consent states. Capture the disclosure timestamp in artifact.messages[]. Customer audible 'no' should disable recording for the call.

GDPR data-subject erasure request for a EU customer. Operator deletes the row from CRM but the Vapi recording persists.

Implement erasure end-to-end: delete from CRM, delete the operator-mirrored recording in the object store, and call the documented Vapi delete-call / delete-recording endpoint to remove the platform-side copy. Log all three deletions with timestamps.

California AB 1019 / similar regulations require disclosing AI when asked. Customer asks 'are you a robot?' Assistant deflects.

System prompt must instruct the assistant to disclose AI identity truthfully when asked. Test with prompts like 'are you a person?', 'are you AI?', 'is this a recording?' Capture the disclosure event for audit. Do not configure the assistant to claim to be human.