On TikTok, Instagram, and other platforms, there is currently an increasing trend of individuals filming themselves calling other people in order to subsequently publish their spontaneous reactions as content. What may seem authentic and entertaining from the content creator’s perspective raises complex criminal and data protection law questions.
One thing is clear: In the cases mentioned, the voice of a conversation partner constitutes personal data, and the recording of a phone call regularly represents processing of personal data within the meaning of the GDPR. Furthermore, § 201(1) No. 1 of the German Criminal Code (StGB) protects the non-publicly spoken word and criminalizes its unauthorized recording.
Less clear, however, is the question of whether consent from the conversation partner is mandatory for every call recording, or whether other legal grounds may be considered under certain circumstances.
For professional content creators, influencers, agencies, or media companies, the scope of application of the GDPR will regularly be triggered, as the recordings typically do not serve exclusively personal or family purposes, but rather serve to increase reach, marketing, or monetization. In such cases, data protection requirements must be fully observed.
Particular attention should be paid to the fact that the voice (or the content of the conversation) may also constitute special categories of personal data within the meaning of Art. 9(1) GDPR. If such information is recorded, processed, or published, a legal basis under Art. 6(1) GDPR alone is not sufficient. Rather, an additional legal basis under Art. 9(2) GDPR is required. In practice, only explicit consent from the data subject pursuant to Art. 9(2)(a) GDPR will frequently be available for this purpose.
Data protection supervisory authorities regularly take a restrictive view in this regard. According to this view, the recording of a phone call generally requires prior, informed, and voluntary consent from all parties involved. This applies all the more when the recording is to be published or used for social media purposes. From a criminal law perspective as well, it is widely assumed that the required “authorization” within the meaning of § 201 StGB can regularly only be established through the consent of the conversation partners.
However, the discussion is not concluded with this. In legal literature and practice, it is sometimes argued that not every call recording must necessarily be based on consent. From a data protection law perspective, it is argued that in individual cases, a legitimate interest pursuant to Art. 6(1)(f) GDPR could also be considered as a legal basis, provided that the interests and fundamental rights of the data subject do not prevail. Furthermore, the view is sometimes held that processing that is permissible under data protection law could simultaneously provide the authorization required for § 201 StGB.
However, it is objected to this view that § 201 StGB guarantees independent criminal law protection of the spoken word and is not automatically superseded by every data protection law justification. Moreover, the statements published to date and the administrative practice of the data protection supervisory authorities tend to argue against a generous application of Art. 6(1)(f) GDPR in cases of secret or surprise call recordings.
The legal situation is therefore not yet definitively clarified. Established supreme court case law on the question of whether legitimate interests can establish both data protection law and criminal law permissibility in individual cases does not currently exist.
This discussion is equally relevant in the recording and transcription context, as in many cases a recording of the spoken word is also assumed here. Particularly in this context, it should be added that in the employment context, consent does not regularly constitute a viable legal basis, or obtaining it is subject to high hurdles.
Practical Tip: Anyone recording phone calls for social media content should not only think about increasing their own reach. The criminal law protection of the spoken fleeting word as well as the protection of personal data present content creators with significant legal risks that should be carefully weighed.
From a data protection law perspective, the following points are particularly important:
- If consent is chosen, particular attention should be paid to ensuring sufficient transparency and information, voluntariness, unambiguity, and revocability.
- If a balancing of interests is chosen, this must be carried out in a documented manner, and according to supreme court case law, the data subject must also be informed about the legitimate interest of the controller before data processing takes place.
- In both cases, the information obligations and data subject rights must be observed (see Art. 13 GDPR et seq.)
As of July 22, 2026
