Do You Need Consent for an AI Note Taker? State Rules (2026)

What Counts as “Consent” for an AI Note Taker, Legally

For years the standard advice was that an AI note taker is just a recording device, like a tape recorder. Courts have generally applied recording laws to these tools that way, and the transcription and summarizing don’t change the consent analysis.

That framing is now being tested in court, though. The vendor behind the tool may be treated as its own party, not just an extension of you. I cover that in its own section below.

The federal floor

The Wiretap Act (18 U.S.C. § 2511), part of the Electronic Communications Privacy Act, sets a one-party consent baseline. If you’re a participant, federal law alone doesn’t require anyone else’s permission.

There’s an exception. One-party consent doesn’t protect a recording made to commit a crime or a tort (§ 2511(2)(d)). And federal law is a floor, not a ceiling: states can require more, and a dozen or so do.

One-party vs. all-party, in plain terms

Under one-party consent, a recording is legal as long as one person involved knows about it and agrees. Under all-party consent, everyone on the call has to know and agree before recording starts. Each state picks one, though the details vary (see the table).

The “reasonable expectation of privacy” test

Some of these laws only apply to private or confidential conversations. California’s § 632, for example, turns on whether participants reasonably expected the conversation wasn’t being recorded (Flanagan v. Flanagan, Cal. 2002). A public webinar with 500 attendees is treated differently than a confidential one-on-one HR conversation. Most work meetings (status updates, client calls, internal syncs) can carry that expectation, so don’t assume you’re exempt because it’s “just a work call.”

All-Party Consent States: The List, With Statutes

Here’s something most articles skip: the “two-party consent states” lists I found while researching this, including on sites that rank for this query, disagree with each other. Counts range from about 9 to 13. The disagreements cluster around Delaware, Michigan, and Nevada, and that matters when the answer determines whether your recording is legal.

My approach: 10 states clearly require all-party consent, 3 are genuinely disputed, and I treat all 13 as all-party because the cost of over-complying is a 15-second announcement.

Oregon note: Oregon (ORS 165.540) is one-party for phone calls but requires everyone to be informed for in-person conversations. How it applies to video meetings isn’t clear, so I’d treat Oregon participants as all-party too.

One-Party Consent States: The Full List

Everywhere not listed above follows one-party consent: 37 states plus Washington, D.C. In these states, a participant can record a conversation they are part of without asking the others. That is the legal floor, not a best practice. If even one person on your call sits in an all-party state, the stricter rule wins (see the next section).

Plus Washington, D.C. (one-party).

Three footnotes before you rely on this list:

• Oregon is one-party for phone calls but all-party for in-person conversations (see the note above), so it appears in both places.
• Hawaii is one-party, except that hiding a recording device in a private place is a separate offense.
• Vermont has no general recording statute. Courts treat it as one-party, but a recording can still create privacy-tort exposure.

What this means for AI note takers: one-party consent covers you recording a call you are on. It is less clear that it covers a third-party AI vendor’s bot capturing and storing the audio on its own servers, which is exactly what the 2025-2026 lawsuits argue. Even in a one-party state, announcing the bot is the safer habit.

My practical take: don’t memorize which side of a disputed state you land on. If a meeting touches any state above (or Oregon), treat it as all-party consent required and move on.

What If Meeting Participants Are in Different States?

This scenario rarely gets a real example, and it trips up remote teams constantly.

The safe rule is: assume the strictest applicable law controls. If any participant is in an all-party state, get all-party consent for the whole call, even if you personally are in a one-party state.

Worked example: You’re in Texas (one-party). A client on the call is in California (all-party). Under Texas law alone, you wouldn’t need their permission. But the California Supreme Court held in Kearney v. Salomon Smith Barney (2006) that California’s all-party rule can apply when an out-of-state business records calls with California residents. How a court would treat your specific call depends on the facts, but you shouldn’t count on Texas law protecting you. Get explicit consent from everyone.

On most client calls you don’t know every participant’s location with certainty. In that case, default to all-party consent. It’s the safest default.

Can the AI Vendor Be Liable Too? The “Third-Party Eavesdropper” Question

This is where the law is moving fastest, and it’s the biggest gap in most consent guides.

The old assumption is that an AI note taker is a tool in the hands of the person who turned it on, so that person’s consent covers it. Plaintiffs are now arguing something different: the vendor is a separate party that captures the audio, stores it on its own servers, and sometimes uses it to train its models. Wiretap laws like the federal Wiretap Act and California’s § 631 target third-party eavesdroppers, and one participant’s consent may not cover a third party listening in. The vendors’ response is that they act at the direction of the meeting host, like a recorder.

What’s happened so far (all allegations, no liability findings)

• Otter.ai. In August 2025, Justin Brewer sued in the Northern District of California. He alleged he was recorded on a call by an Otter bot he didn’t know about and had no Otter account. Related suits were consolidated as In re Otter.AI Privacy Litigation, No. 5:25-cv-06911-EKL. On August 13, 2026, the court ruled on Otter’s motion to dismiss. Core claims under the federal Wiretap Act, California’s privacy law, and Illinois’s biometric privacy law survived, on the theory that Otter plausibly acted as a third-party eavesdropper. Other claims, including the computer-intrusion claims, were dismissed, mostly with leave to amend. This is a ruling on the pleadings, not a finding that Otter broke the law, and the case continues. Otter denies wrongdoing.
• Fireflies.ai. A class action filed in Illinois in December 2025 alleges the tool creates voiceprints of participants without the consent Illinois’s BIPA requires.
• Granola. Chamberlain v. Granola, Inc. (N.D. Cal., filed July 30, 2026) targets the no-bot model, alleging that silent, invisible capture and training on transcripts by default violate wiretap law.

What this means for you

1. Your consent may not be the only one that matters. If the vendor is treated as a separate party, “I agreed” is a weaker defense than it used to be.
2. Check whether the tool trains on your recordings, and what the default is. Non-users on your call never agreed to the vendor’s terms. Business plans often let you turn training off, so check yours.
3. Name the vendor when you disclose. “This call is being recorded” doesn’t tell people that a third-party company is receiving the audio.
4. Expect this area to keep changing. Recheck it before you rely on any summary of it, including this one.

Is Adding an AI Bot to a Calendar Invite Enough to Count as Consent?

Usually not. This is the most common mistake I see teams make.

Adding “Otter.ai Notetaker” or a similar bot to a calendar invite tells people a bot might join. It doesn’t clearly tell them the call is being recorded, transcribed, and possibly stored indefinitely by a third-party vendor, which is what informed consent requires. Legal commentary generally treats a passive calendar notification as weak evidence of consent in an all-party state. A verbal confirmation at the start of the call is the safer bar.

Does a Zoom, Teams, or Google Meet notice count?

This is a separate question that people often conflate with AI note taker consent.

The built-in recording banner in Zoom, Teams, or Google Meet covers that platform’s recording. The same goes for their own AI features (Zoom AI Companion, Teams Copilot, Gemini in Meet). None of these automatically covers a third-party note taker that joins separately, captures audio, and sends it to another company’s servers. If you run Fireflies or Fathom on top of a Zoom call, the Zoom banner alone doesn’t disclose what that tool is doing with the data. Treat them as two separate disclosures.

What about implied consent?

Some courts recognize implied consent: the participants were clearly told about the recording and stayed on the call anyway. You’ll see this argument in legal commentary, and it’s why some people say silence is enough.

I wouldn’t rely on it. It depends on the facts (was the notice clear, did people have a real chance to object?). Courts differ on it, and California’s stricter approach makes it a risky thing to build a workflow on. Silence is weak evidence, and an explicit yes is strong evidence.

What actually counts as valid consent

• A verbal announcement at the start of the meeting, stated clearly enough that it’s captured on the recording itself
• An explicit opt-in, not silence and not “no objections raised”
• Written notice that names the specific AI tool, not just “this call may be recorded”

Do You Need Consent to Use an AI Note Taker at Work?

Yes. “The company approved this tool” doesn’t change the underlying consent law. Company policy can require employees to use an AI note taker. It can’t override state wiretapping statutes that require the other participants’ consent, including participants outside the company.

Employer wiretapping exposure

If your organization records meetings via AI note taker without proper consent in an all-party state, the legal exposure can sit with the company, not just the employee who clicked “record.” I’d treat this as a policy problem, not an individual-judgment problem. Leaving disclosure up to each employee is how companies end up with inconsistent, non-compliant behavior across teams.

High-stakes meetings: legal, HR, medical

A few contexts deserve extra caution, because the consent question stacks on top of separate confidentiality rules:

• Legal meetings: running an AI note taker in a conversation with counsel risks waiving attorney-client privilege. If a third-party vendor has access to the transcript, the confidentiality that privilege depends on gets harder to argue.
• Litigation-adjacent meetings: recordings and AI-generated summaries prepared in anticipation of litigation may or may not keep work-product protection. That protection is fact-specific, not automatic.
• Medical or health-related meetings: HIPAA requires vetting whether the AI vendor will sign a business associate agreement before it goes near protected health information.
• Education contexts: FERPA creates similar constraints around meetings involving student records.

If a meeting falls into one of these categories, don’t use a general-purpose AI note taker by default. Use one vetted for that compliance context, or don’t record at all.

Sample internal policy line

“Any AI note taker or transcription tool must be verbally disclosed to all meeting participants before recording begins, regardless of the participants’ location. Passive calendar notifications do not satisfy this requirement.”

Does GDPR Require Consent for AI Meeting Transcription?

For meetings involving anyone in the EU, in practice yes, though the legal mechanics differ from US wiretapping law.

GDPR requires a lawful basis for processing personal data. Consent is one of several, and it isn’t automatically the only one available. But most legal teams treat explicit consent as the cleanest, lowest-risk path for meeting recordings, because the alternatives (legitimate interest, contract necessity) are harder to justify for something as sensitive as a recorded conversation. GDPR also requires you to tell people what you’re doing with their data, including who receives it, so a vendor-named disclosure does double duty.

On top of GDPR, individual EU member states have their own criminal codes. Germany’s § 201 StGB, for example, criminalizes recording a non-public conversation without consent, which is a separate exposure from GDPR.

Outside the EU and US:

• UK: UK GDPR and the Data Protection Act 2018 work similarly.
• Canada: the federal Criminal Code generally allows one-party consent, but privacy laws add notice and consent duties.
• Australia: surveillance laws vary by state, and several require the consent of all parties.

My recommendation: if any participant is in the EU or another non-US jurisdiction, get explicit, disclosed consent every time, and ask counsel about the specifics.

How Popular AI Note Takers Actually Handle Consent

If you’re choosing a tool, this is the part that matters most. I’ve used or tested most of these directly. Details are current as of September 2026, and consent defaults and admin settings change often, so recheck yours.

The practical takeaway: the tool you pick changes your consent burden. A bot-joining tool at least gives participants a visual cue. A locally recording tool gives them nothing, which puts 100% of the disclosure responsibility on you, verbally, every time. If your team is in a heavier-compliance context, that’s a real factor in tool selection, not just a UX preference. The lawsuits above make the same point from the other direction.

Comparing note takers on price and features too? See our Otter vs Fireflies comparison.

How to Actually Ask for Consent

1. Add disclosure to the calendar invite. Name the specific tool, not just “this meeting may be recorded.”
2. Announce it verbally when the meeting starts, before any substantive discussion.
3. Pause and wait for acknowledgment. A few seconds of silence isn’t agreement.
4. Offer a real opt-out. Leaving the call, or asking you to pause the tool, should be genuinely available.
5. Log consent for high-stakes meetings. For legal, medical, or HR contexts, note in writing that consent was obtained.

Calendar invite template

“This meeting will be recorded and transcribed using [Tool Name] for note-taking purposes. The recording may be shared with [team/stored for X days]. Let me know before the call if you’d prefer it not be used.”

Verbal script for the start of a meeting

“Quick note before we start: I’m using [Tool Name] to record and transcribe this call so I don’t have to take notes manually. Is everyone okay with that?”

That takes about fifteen seconds, and it puts you on the safest footing in every US state. It doesn’t replace separate duties under GDPR, BIPA, HIPAA, or privilege rules, but it’s the habit that covers the wiretap question.

If someone declines

Turn the tool off for that call. There’s no workaround. Proceeding anyway in an all-party state is exactly the scenario that creates liability.

What Happens If You Skip Consent

• Wiretapping liability. In states like Illinois, Florida, and Massachusetts, unauthorized recording can carry felony charges, not just civil exposure. California adds civil damages of $5,000 per violation or three times actual damages.
• Vendor liability, and yours. As covered above, vendors are being sued as alleged third-party eavesdroppers. That doesn’t automatically shield the people who turned the tool on.
• Vendor data access and retention. Many AI note taker vendors retain transcripts on their own servers, and some default settings keep them indefinitely. Agreeing to be recorded doesn’t mean anyone agreed to that data sitting with a third party or being used for model training. Check your retention and training settings.
• Transcript discoverability. AI meeting transcripts are increasingly treated as discoverable in litigation. A sloppy, unreviewed AI summary can become evidence, with all the accuracy problems that implies.
• Biometric data (BIPA). Some note takers process voiceprints for speaker identification. Illinois’s Biometric Information Privacy Act (740 ILCS 14) requires written notice and a written release before collecting biometric identifiers. That’s a separate requirement from the recording question, and BIPA claims are part of the lawsuits above.
• Hallucination and inaccuracy risk. I’ve had AI note takers attribute a comment to the wrong speaker and, once, invent a numeric figure that was never said in the meeting. If that transcript gets treated as an authoritative record in a dispute, an HR complaint, or litigation, an uncorrected error is a real problem. Have someone check the transcript against their memory before treating it as ground truth.

The Takeaway

The legal answer to “do I need consent for an AI note taker” depends on your state, and the law is still shifting as courts decide whether the vendor counts as a separate eavesdropper. The practical answer doesn’t have to be complicated. Disclose the tool by name before you record, get a clear yes from everyone, and default to all-party consent whenever you’re not certain who’s in the room.

That one habit, a 15-second announcement at the start of every call, makes the state-by-state patchwork mostly irrelevant to your day-to-day.

Sources

• 18 U.S.C. § 2511 (federal Wiretap Act)
• Cal. Penal Code §§ 631, 632, 632.7, 637.2; Flanagan v. Flanagan, 27 Cal. 4th 766 (2002); Kearney v. Salomon Smith Barney, Inc., 39 Cal. 4th 95 (2006)
• 720 ILCS 5/14-2; 740 ILCS 14 (Illinois Biometric Information Privacy Act)
• 18 Pa. Cons. Stat. §§ 5703–5704
• Fla. Stat. § 934.03
• Mass. Gen. Laws ch. 272, § 99
• Md. Code, Cts. & Jud. Proc. § 10-402
• Mont. Code Ann. § 45-8-213
• N.H. Rev. Stat. § 570-A:2
• Wash. Rev. Code § 9.73.030
• Conn. Gen. Stat. § 52-570d
• Mich. Comp. Laws § 750.539c; Sullivan v. Gray, 117 Mich. App. 476 (1982)
• Nev. Rev. Stat. §§ 200.620, 200.650; Lane v. Allstate Ins. Co., 114 Nev. 1176 (1998)
• 11 Del. C. §§ 1335, 2402
• ORS 165.540
• In re Otter.AI Privacy Litigation, No. 5:25-cv-06911-EKL (N.D. Cal.)
• Chamberlain v. Granola, Inc., No. 3:26-cv-07926 (N.D. Cal.)
• Cruz v. Fireflies.AI Corp. (Ill.)
• Germany, StGB § 201; GDPR (Regulation (EU) 2016/679)

Frequently Asked Questions

Do I need consent to use an AI note taker at work? Yes. Company approval to use a tool does not override the consent laws that protect the other people on the call, including outside clients or partners.

Is adding an AI bot to a calendar invite enough to count as consent? Generally not, especially in all-party states. A calendar entry is passive notice, and legal guidance favors active, verbal confirmation at the start of the meeting.

What states require all-party consent for recording? California, Connecticut (telephone and electronic), Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Pennsylvania, and Washington clearly require it. Delaware, Michigan, and Nevada are disputed, so treat them as all-party to be safe. Oregon splits by conversation type.

Which states are one-party consent states? Thirty-seven states plus Washington, D.C., including Texas, New York, New Jersey, Georgia, Ohio, Virginia, Arizona, Colorado, and North Carolina. Oregon is one-party for phone calls but all-party for in-person conversations. See the full list above.

Does a Zoom or Teams recording notice count as consent for a third-party AI note taker? No, not automatically. The platform banner discloses the platform’s own recording. A separate third-party tool capturing and storing audio elsewhere needs its own disclosure.

What happens if meeting participants are in different states? Assume the strictest applicable state law controls the whole call. If anyone is in an all-party state, treat the entire meeting as requiring all-party consent.

Can an AI note taker company be sued for recording my meeting? Plaintiffs are trying. Otter.ai, Fireflies, and Granola face proposed class actions. In the Otter case, a federal court let core wiretap and privacy claims proceed in August 2026. That is a ruling on the pleadings, not a finding of liability.

Does GDPR require consent for AI meeting transcription? Consent is one lawful basis under GDPR, and it is the one most legal teams rely on for recordings involving EU participants. Get it explicitly, and tell people who will receive the data.

Can I get in legal trouble for using an AI note taker without consent? Yes. In all-party states, unauthorized recording can carry criminal penalties, including felony charges in states like Illinois and Florida, plus civil liability.