AI notetakers and consent: the bot is not you, and that is the problem

Almost every question worth asking here reduces to two. Is the thing doing the recording a party to the conversation, and did everyone else agree in a way the relevant statute recognises. Neither has an obvious answer once a vendor's bot is in the participant list.

Why "I was in the meeting" is the wrong test

The federal baseline is short. Under 18 U.S.C. § 2511(2)(d) it is not unlawful for a private person to intercept a communication "where such person is a party to the communication or where one of the parties... has given prior consent", unless the purpose is a criminal or tortious act. That is the one-party rule people mean when they say recording is legal.

It settles less than it appears to. It is a floor: states may be stricter, and the stricter state's law is the one that bites. And it assumes the recorder is a party. A notetaker admitted as its own participant, streaming audio to a vendor's servers and storing the transcript there, is not obviously the same thing as you holding a phone.

That second point is being litigated rather than assumed. The consolidated In re Otter.AI Privacy Litigation, No. 5:25-cv-06911 (N.D. Cal., filed 15 August 2025), alleges that the vendor's notetaker joined meetings as a participant, recorded people who were not accountholders, and pushed the job of collecting permissions onto whoever booked the meeting. Those are allegations. Whether wiretap statutes written for telephone lines reach a bot in a video call is open, and nobody should plan on either answer.

Nobody agrees how many all-party states there are

Eleven states appear on essentially every credible list: California, Connecticut, Florida, Illinois, Maryland, Massachusetts, Montana, Nevada, New Hampshire, Pennsylvania and Washington. After that the counts diverge. Kilpatrick's survey names thirteen, adding Delaware and Oregon. Mayer Brown's 2026 note on notetakers names twelve, adding Michigan and leaving out Delaware and Oregon.

The disagreement is real rather than careless. Several of those statutes split by medium, so a state can be one-party for a phone call and all-party in a room, or the reverse. Connecticut's all-party provision, § 52-570d, creates an action for illegal recording of private telephonic communications and reaches nothing else. Delaware carries two statutes that point in opposite directions, and Michigan's position rests on a court's reading of the phrase "the private discourse of others" rather than on the words "all parties".

A footnote in the calendar invite is not consent

This is the near-universal failure mode. The all-party states did not leave consent to be inferred from context — most specify how it is given, and small text under a dial-in link is not among the listed methods.

Washington is the sharpest illustration. RCW 9.73.030(3) does accept an announcement in lieu of individual permission: consent "shall be considered obtained whenever one party has announced to all other parties... in any reasonably effective manner, that such communication or conversation is about to be recorded", with the proviso that if the conversation is recorded, the announcement must also be recorded. The bot must already be capturing when the announcement is made, and the announcement has to survive into the file. Said in the first minute of a call the bot joined at minute four, it is worth nothing.

Connecticut prescribes three routes and no others: written consent from all parties or consent captured at the start of the recording, a verbal notification recorded at the beginning, or an automatic tone repeated roughly every fifteen seconds. California draws its line elsewhere. Penal Code § 632 reaches only a confidential communication — one carried on in circumstances reasonably indicating a party wants it confined to the parties — so a public webinar and a two-person renewal call are not the same problem.

The bot arrives before the humans do

Auto-join is the setting that converts a manageable practice into an unmanaged one. Configured once, the notetaker joins every meeting on a calendar at the scheduled minute, which is reliably earlier than the people. What it captures first is the part nobody would have consented to: two colleagues who dialled in early, or the three minutes after a client drops off when somebody says what they actually think.

The second structural problem is who ever saw a consent screen. The host accepted the vendor's terms; external counsel and the client's finance director did not. They saw a name in a participant list. Relying on the vendor to have handled consent is relying on a step the vendor has expressly handed back.

The transcript outlives the meeting

A recording changes what a meeting is, evidentially. Notes are a summary somebody chose to write. A transcript is electronically stored information: searchable, subject to preservation once litigation is reasonably anticipated, and produced verbatim without the tone that made a sentence a joke. It does that for every routine meeting rather than the ones that mattered.

Privilege deserves its own rule. A third party present at a privileged conversation is the classic waiver scenario, and a vendor that receives, stores and processes the audio is a third party on any ordinary reading. The cheap answer is a flat prohibition: no notetaker in any call with counsel. The same reasoning covers anything you hold under someone else's non-disclosure agreement, because an employee cannot waive a confidentiality promise the company made.

Voiceprints are a second statute, not the same one

Consent to be recorded is not consent to biometric processing. Illinois' Biometric Information Privacy Act requires a written release before a voiceprint is collected, and California requires notice before biometric data is gathered, including where voice is analysed for speaker identity. A notetaker that separates and labels speakers is doing something recognisable as voice identification, whatever the marketing calls it.

That makes it a procurement question. Ask the vendor in writing whether speaker separation produces a stored voice template, how long it is kept, and whether it trains anything. Check the answer against what your privacy policy already tells people, and against data processing agreements.

What a workable rule looks like

Most organisations reach for a ban and end up with the usage they had plus no visibility — the pattern set out in writing an AI use policy for employees. Recording rules fail the same way. What survives contact with a sales team is a short escalation, applied by meeting type rather than by judgement.

Publish it through the handbook and take an acknowledgment, so there is a record of the version in force. Write the client-facing half into new engagement terms rather than negotiating it in the moment — the drafting is covered in AI clauses in client contracts.

This is worth an hour of attention not because of the fine, but because a recording made without clean consent is worth less than no recording at all: unusable where you wanted it, discoverable where you did not, and evidence of the very thing someone will later accuse you of. The tool is fine. The default settings are what need changing.