Configuring Call Recording Consent, Privacy Rules, and PII Redaction in Gong

Deploying conversation intelligence across multi-jurisdictional sales teams introduces immediate regulatory exposure. Revenue Operations (RevOps) leaders want frictionless call capture to coach reps and forecast pipeline, while Legal and Compliance officers must adhere to strict wiretapping statutes, two-party (all-party) consent mandates, GDPR, HIPAA, and PCI DSS payment data security standards.

Gong provides enterprise-grade governance controls to bridge this divide. Instead of relying on manual rep compliance, RevOps and compliance teams can automate multi-region consent collection, enforce granular privacy exclusions, and permanently redact sensitive numerical and personal data before transcripts and audio reach the wider revenue team.

1. Navigating Consent Frameworks: One-Party vs. Two-Party Consent

Wiretapping and call recording laws vary substantially depending on where your reps and prospective customers reside:

• One-Party Consent: In jurisdictions such as the US federal standard and most US states, only one party involved in the conversation needs to consent to the recording. The sales rep can provide that consent.
• Two-Party (All-Party) Consent: In several US states (including California, Florida, Massachusetts, Pennsylvania, Illinois, and Washington) as well as countries like Germany and Canada, all participants on the line must explicitly consent or be notified before recording starts.
• Conflict of Laws: As a rule of thumb, when a sales rep calls across state or international borders, the stricter jurisdiction’s laws apply.

Gong structures consent governance around two primary channels: Web Conferencing (Zoom, Microsoft Teams, Google Meet, Webex) and Telephony / Gong Dialer.

2. Web Conferencing Consent Profiles: Setup & Enforcement

In Gong, consent policies are configured using Consent Profiles (Admin center > Data capture > Recording consent). Rather than imposing a single global policy, administrators can build differentiated profiles assigned to specific teams or regions (e.g., an EMEA profile, an All-Party US profile, and an APAC profile).

Step 1: Configuring the Consent Page

The Gong Consent Page serves as a pre-meeting gatekeeper where external participants acknowledge the recording policy before joining the virtual room.

1. Navigate to Admin center > Data capture > Recording consent and select Add Profile (or edit an existing profile).
2. Toggle Consent page to On and expand Show settings.
3. Choose Between "Enable" vs. "Enforce":
   • Enable consent page: Gong generates consent-redirected meeting links. However, if a participant joins through an alternative direct link, Gong will still attempt to record the meeting.
   • Enforce use of consent page: Gong records the call only if all attendees enter through the consent page and provide explicit agreement. If an attendee bypasses the page or uses a direct meeting link, Gong immediately cancels the recording and drops the call from ingestion.
4. Configure "Join without recording":
   • Check Allow participants to join without giving consent (recording will be canceled). This adds a "Join but don't record" button to the landing page.
   • If an attendee declines recording, the meeting continues unrecorded, preventing lost sales opportunities while preserving compliance.
5. Branding and Policy Linking:
   • Upload your official company logo.
   • Link directly to your corporate privacy policy URL or embed custom legal notice text.
   • Configure language localization so participants see the consent disclaimer in their browser's default language.

Step 2: Meeting Link Architecture (Dynamic vs. Static)

Under the Web conferencing providers section of the consent profile, teams select how meeting links are generated:

Step 3: Configuring the Audio Prompt

The audio prompt announces audibly when recording begins, serving as a backstop for phone dial-in participants or meeting environments where visual consent pages cannot render (e.g., conference room hardware).

1. In the consent profile, switch Audio prompt to On.
2. Select frequency:
   • Play once shortly after the first guest joins with audio on.
   • Play shortly after each guest joins the call with audio on (mandatory for strict all-party compliance when participants drop in late).
3. Check Don't play the audio prompt if the consent page is used: This prevents double notification for attendees who already clicked "I Agree" on the web consent page.
4. Select the prompt language, voice gender, and phrasing (e.g., standard: "We're recording this call for better note-taking, following up, and training purposes").

Step 4: Pre-Call Notification Emails

Send an automated heads-up email 10 to 20 minutes prior to scheduled web conference calls:

• Sent from Gong's email infrastructure to external invitees.
• Contains dynamic tags ({{Sender first name}}, {{Meeting title}}, {{Meeting hour}}).
• Includes a non-removable legal notification informing attendees that the upcoming meeting will be recorded, along with a link to your corporate privacy policy.

3. Telephony and Gong Dialer Consent Configuration

For outbound sales dialing using Gong Dialer (Admin center > Settings > Gong Engage > Dialer setup > Recording), consent cannot rely on web landing pages. RevOps must enforce telephony-specific rules.

Recording Methods

Gong supports four distinct telephony capture behaviors:

• Automatic: Recording starts as soon as the call connects.
• Manual: Recording is disabled by default; the rep must press "Record" after providing verbal disclosure.
• Rep-side only: The dialer captures only the sales rep's voice, leaving the prospect's audio unrecorded (satisfying one-party rules without recording the counterparty).
• Don't allow recording: The dialer suppresses all recording functionality entirely.

Granular Geographic & Area Code Overrides

RevOps teams calling nationally across the United States should never rely on a single blanket telephony rule:

1. In Dialer setup > Recording, establish the corporate default (e.g., Automatic for one-party states).
2. Click + Add customization.
3. Select United States (specific area codes).
4. Input comma-separated area codes corresponding to two-party consent states:
   • California: 209, 213, 310, 415, 510, 619, 650, 714, 818, 858, etc.
   • Florida: 305, 407, 813, 850, 904, etc.
   • Massachusetts: 339, 351, 508, 617, 774, 781, 857, 978.
   • Pennsylvania: 215, 267, 412, 610, 717, 814.
5. Set these area codes to Manual or Rep-side only.
6. When reps dial into these prefixes, Gong displays an on-screen banner: "Please remember to inform the person you're calling that this call is recorded" or "This call is not set to be recorded. Tap 'Record' at any time to start recording."

4. Privacy Rules, Automated Exclusions, and Data Governance

Capturing every conversation by default creates legal risks, including accidental ingestion of HR discussions, board meetings, privileged legal communications, or private employee emails.

Administrators configure exclusions under Admin center > Settings > Data protection & privacy.

Internal Domain Isolation

Specify all corporate domains (e.g., company.com, subsidiary.io). Gong evaluates all participant email addresses:

• If 100% of meeting participants use internal domains, Gong flags the call as internal.
• Internal calls are excluded from recording unless explicitly enabled in recording settings.
• Internal-only emails are completely excluded from capture.

Pre-Capture Exclude Lists

Gong screens meetings and emails against exclusion lists prior to recording or syncing:

• Domain Exclusions: Exclude legal counsel, audit firms, private equity boards, and known competitors (e.g., lw.com, ey.com, sequoiacap.com).
• Email Suffixes: Adding gov automatically suppresses recording and email ingestion for any attendee with a .gov email address.
• Meeting Title Keywords: Filter confidential meeting titles. To avoid false positives (such as matching "three" when searching for "HR"), enclose exact terms in quotation marks: "HR", "1-on-1", "Interview", "Board", "Privileged", "Compensation".

Data Subject Access Requests (DSAR) & Right to Be Forgotten

Under GDPR (Article 17) and CCPA, external individuals can request full data erasure:

1. In Data protection & privacy, scroll to Delete personal data.
2. Enter the individual's email address or international phone number and click Search.
3. Click Delete. Gong purges all call audio, transcripts, emails, and associated CRM contact metadata in the background.
4. Critical RevOps Prerequisite: Always delete the contact record in your CRM (Salesforce / HubSpot) before executing the deletion in Gong; otherwise, CRM sync will re-import the contact during the next synchronization cycle.
5. For programmatic compliance pipelines, leverage Gong's public REST API endpoints:
   • DELETE /v2/data-privacy/erase-data-for-email-address
   • DELETE /v2/data-privacy/erase-data-for-phone-number

5. Automated Sensitive Data Redaction (PII, PCI DSS, PHI)

Once a call is captured, compliance teams must guarantee that financial and personal identifiers are not permanently stored or accessible to unauthorized users.

Gong performs irreversible redaction during call processing (Admin center > Settings > Data protection & privacy > Information redaction). The transcript text is replaced with (REDACTED) and the corresponding audio span is muted to silence.

1. Numeric Redaction (Credit Cards & Financial Account Numbers)

Numeric redaction is designed to protect Payment Card Industry (PCI DSS) cardholder data, social security numbers, and bank account numbers:

• Threshold Configuration: Admins set a minimum sequence length of digits (1, 2, 3, or 4+ digits).
  • 1 Digit: Overly aggressive; mutes all numbers, obscuring deal prices and seat counts.
  • 4 Digits or More (Recommended): Mutes sequences of 4 or more digits. Single numbers, tens, and hundreds are preserved for business context, while 16-digit credit card numbers (read in 4-digit groups), SSNs, and account IDs are permanently masked.
  • Spoken magnitude words like "thousand", "million", or "billion" are preserved (e.g., "fifty thousand" remains audible, whereas "five zero zero zero zero" is redacted).
• Scope of PCI DSS Compliance: Gong's annual PCI DSS validation (SAQ-D and QSA audit) covers call ingestion, temporary processing, and automated redaction from telephony systems. Gong is not intended as a long-term credit card repository.

2. PHI Redaction (Protected Health Information under HIPAA)

For healthcare providers, digital health platforms, and medical device companies, Gong offers specialized Protected Health Information redaction:

• Available for English-language calls and activated upon request via Gong Support.
• Automatically redacts nine specific HIPAA entity classes:
  • AGE: Specific ages and age spans.
  • DATE: Dates of birth, treatment, or admission.
  • NAME: Patient and personal names.
  • PHONE_OR_FAX: Phone, pager, and fax numbers.
  • EMAIL: Personal email addresses.
  • ID: Social security numbers, medical record numbers (MRN), health plan IDs, license numbers.
  • URL & ADDRESS: Personal websites, street addresses, and geographic subdivisions.
  • PROFESSION: Job roles and employer names.
• AI Analytics Trade-off: PHI redaction permanently mutes audio and removes transcript spans. While call metadata (invite participants in headers and next steps) remains visible, transcript-dependent AI trackers, Spotlight summaries, and brief generation will reflect redacted spans.

6. Joint RevOps & Compliance Implementation Checklist

To establish a defensible, revenue-friendly deployment, RevOps and Legal should execute the following phased rollout:

1. Phase 1: Legal Jurisdiction Audit
   • Identify all territories where sales reps operate and prospect.
   • Categorize jurisdictions into One-Party and Two-Party/GDPR zones.
2. Phase 2: Technical Governance Buildout
   • Construct segmented Consent Profiles in Gong Admin Center.
   • Enforce Consent Pages on all external web conference meetings for high-risk regions; enable "Join without recording" fallback.
   • Configure Gong Dialer area-code overrides for US two-party states (Manual or Rep-side recording).
   • Input corporate domains into Internal Domains and populate meeting title/domain Exclude Lists.
   • Enable Numeric Redaction set to a 4-digit threshold.
3. Phase 3: Rep Enablement & Tooling
   • Mandate installation of the Gong Calendar Add-on for Google Workspace or Outlook 365 to ensure dynamic link generation.
   • Coach reps on verbal consent phrasing when using manual recording triggers.
4. Phase 4: Ongoing Compliance Auditing
   • Regularly review the Call Status Report (Admin center > Reports) to monitor the Consent Opt-Out Rate.
   • Audit skip codes on unrecorded meetings to verify that calls were legitimately bypassed rather than unintentionally blocked.

References

• Understanding recording consent
• Create consent profiles
• Information redaction
• Configure dialer recording settings
• Data protection and privacy settings in Gong
• Gong PCI DSS scope and responsibilities
• Exclude calls and emails from Gong
• Delete personal data