Is It Legal to Record a Meeting? One-Party vs All-Party Consent for Zoom, Teams and AI Notetakers (2026)

Recording a meeting used to mean pressing a button in Zoom. Now it often means an AI notetaker joins the call, records it, transcribes every word and sends the text to an AI model for a summary. That is useful, and it is also the moment people start asking whether any of it is legal. Recording is lawful in most places when the people on the call know about it and agree, and risky when they do not. The details depend on where everyone is sitting, what kind of conversation it is and whether you are recording as an individual or as a business. This guide sets out the rules for the United States (federal and state by state), the EU, the UK, Canada and Australia, then gives you consent scripts, a team checklist and a plan for when someone says no.

Quick answer: In the US, federal law and most states let you record a call you are on with only your own consent, but about a dozen states, including California, Florida, Illinois, Maryland, Massachusetts, Pennsylvania and Washington, require every participant's consent, and calls across state lines should follow the strictest state involved. In the EU, UK, Canada and Australia, businesses also need a lawful reason and clear notice. The safe rule everywhere: announce the recording, get agreement and stop if anyone objects.

This is general information, not legal advice. Recording and privacy laws change, courts read them differently, and the right answer depends on your facts. We checked the sources linked in this article in October 2026. If you record for a business in a regulated industry, record employees, record across borders or plan to rely on a recording as evidence, talk to a lawyer licensed where you and your participants are.

Key takeaways

• One-party consent means you can record a conversation you are part of without asking anyone else. US federal law and most states work this way.
• All-party consent (often called two-party consent) means everyone in the conversation must agree. California, Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Pennsylvania and Washington are the clearest examples, and several more states have partial or disputed rules.
• An AI notetaker is a recording device. "The host turned it on" is not the same as "everyone agreed", and recent lawsuits turn on exactly that gap.
• Outside the US, consent is only half the picture. GDPR, UK GDPR, Canada's PIPEDA and Australia's Privacy Act also expect a lawful reason, a clear notice, limited retention and care with vendors.
• One standard satisfies almost every regime: tell people before the meeting, say it again at the start, capture the announcement on the recording, and have a plan for anyone who says no.

What do one-party and all-party consent mean?

One-party consent is a rule that lets a participant record a conversation without telling the others, because the recorder's own consent is enough. It also covers someone outside the conversation who records with the permission of one participant.

All-party consent is a rule that requires every participant to consent before a conversation is recorded. It is often called "two-party consent", which is misleading: on a six-person call, all six count.

Three ideas change how these rules work in practice:

• Private versus public. Most state laws protect conversations where people reasonably expect privacy. California's law covers "confidential communications" and Illinois's covers "private conversations". A public webinar or a speech is treated differently from a two-person sales call.
• Consent versus notice. Some laws are satisfied when people simply know they are being recorded. Massachusetts prohibits secret recording, and Washington treats a recorded announcement as consent. Others expect a clearer yes.
• Who is recording. A bot that joins your call records on your behalf. The host's consent is one party's consent, not everyone's.

What does US federal law say about recording calls?

The federal Wiretap Act sets the floor for the whole country. Under 18 U.S.C. § 2511(2)(d), it is not unlawful for a private person to intercept a wire, oral or electronic communication when they are a party to it or one of the parties has given prior consent, unless the interception is carried out to commit a crime or a tort. Unlawful interception is a federal crime punishable by up to five years in prison.

So federal law is one-party consent. Two qualifications matter for businesses. First, states may be stricter, and many are. Second, the "criminal or tortious purpose" exception means a one-party recording is not automatically safe. The 2025 class action against an AI notetaker vendor, covered below, pleads federal wiretap claims alongside California ones.

Which US states require all-party consent?

It depends on how you count, which is itself a warning. The Reporters Committee for Freedom of the Press, whose Reporter's Recording Guide is the most widely cited state-by-state survey, lists 11 states that primarily require all-party consent, four that require it for either phone calls or in-person conversations, and two that require it only for recordings in particularly private places. A 2024 overview by the law firm Kilpatrick Townsend puts the core list at 13, adding Connecticut, Nevada and Oregon and leaving out Michigan. Both lists are defensible. The differences come from the nuances in this table.

Oregon deserves a closer look because it is the clearest example of a state writing video calls into its recording law. ORS chapter 165 says a conversation "includes a communication occurring through a video conferencing program", and makes it an offense to record one unless all participants are specifically informed. A 2023 panel of the Ninth Circuit struck that requirement down, but the full court reversed in January 2025 and upheld the law, and the US Supreme Court declined to hear the case in October 2025. Older summaries that describe Oregon's rule as struck down are out of date.

Is a Zoom, Teams or Google Meet call covered by these laws?

Assume it is. Most recording statutes were written for telephones and rooms, and the RCFP notes that because many of these laws are decades old, it is sometimes unclear how they apply to newer forms of communication. A video call carries a live conversation, it runs over the kind of networks these laws were written to protect, and in a business meeting the participants usually expect the conversation to stay among them.

A few specifics:

• Oregon is explicit. Video conferencing is a "conversation", so everyone must be specifically informed, or must at least know or reasonably be expected to know, before you record.
• California covers "other devices". Section 632 applies to confidential communications carried by telephone or "other device", and the live audio of a small business meeting is the kind of conversation people expect to stay private.
• Phone-only rules are open questions. Connecticut's civil statute and Nevada's all-party rule are written for phone calls, and courts have not settled how they treat video calls. Behave as if they apply.
• Dial-in participants cannot see the screen. Someone who joins a Zoom or Teams meeting by phone never sees the participant list, so an on-screen bot or banner tells them nothing. Say the notice out loud.
• Large public events are different, but not entirely. A public webinar carries less expectation of privacy, while breakout rooms and small-group Q&A sessions carry more.

The built-in recorders in Zoom, Teams and Google Meet notify participants when recording starts, and Zoom has an account setting that asks participants to consent when a recording begins. A third-party notetaker joins as a participant instead, so the notice people actually get depends on how visible the bot is and on what you tell them. PepoSmart's notetaker, for example, joins Zoom, Google Meet and Microsoft Teams calls as a visible participant that everyone in the meeting can see.

Which state's law applies when people are in different states?

There is no single answer, which is why the cautious answer wins. The RCFP's guidance is to assume the stricter state's law applies. Some courts apply the law of the state where the recording device is; others apply the law of the state where the person being recorded is, so a person who was recorded may be able to choose the friendlier forum. The RCFP's own example: a reporter in Virginia (one-party) who records a call with someone in Maryland (all-party) without consent does not break Virginia law but could be liable under Maryland's.

California has been particularly willing to protect its residents. In Kearney v. Salomon Smith Barney (2006), the California Supreme Court applied California's all-party rule to a brokerage that recorded calls from Georgia with clients in California.

For remote teams the practical problem is that you rarely know where anyone is sitting today. A prospect with a New York phone number may be working from California this week, and a colleague may be travelling. That is why the sensible default is all-party consent on every call. It costs one sentence per meeting and removes the guesswork. The same logic applies to international participants: follow the strictest rule involved.

Do you have to tell people an AI notetaker is recording?

In practice, yes. An AI notetaker is software that joins an online meeting as a participant, records the audio (and often the video), transcribes it and produces notes from the transcript. Legally, it is a recording device you brought into the meeting. In a one-party state your own consent may technically cover it. Everywhere else, and in any meeting that includes someone from an all-party state, the other people need to know and agree.

The AI layer adds two questions the old laws never anticipated:

1. Who else receives the conversation? Transcripts are commonly sent to third-party AI providers to produce summaries. Under GDPR and Canadian privacy law, that is a disclosure your notice should mention.
2. What happens to it afterwards? Some vendors use recordings to improve their models. Your participants did not agree to that just because you did.

These questions are no longer theoretical. In August 2025 a proposed class action was filed in federal court in Northern California against Otter.ai. NPR reported that the complaint alleges the company's notetaker typically asked the meeting host for permission to record but by default did not ask the other participants, and that conversations were used to train its AI. The case, now consolidated as In re Otter.AI Privacy Litigation, raises California and federal wiretap claims. Those are allegations, not findings. The lesson for everyone else is the legal theory: consent from the account holder is not consent from the people they talk to.

So what counts as enough notice for a notetaker? The same four things that satisfy the strictest state rules:

• Advance notice in the invite or booking page, so nobody is surprised.
• A visible bot with a name that makes clear what it is.
• A spoken announcement at the start, captured on the recording. That covers Washington's recorded-announcement rule, Connecticut's recorded-notice option and Montana's warning rule, and it makes the recording obviously not secret for Massachusetts and Oregon.
• A real chance to object, with a plan for what happens if someone does.

For a wider look at how these tools work and what they produce, see the AI meeting notetaker guide, and for a side-by-side of the tools themselves, the best AI meeting notetakers comparison.

What does GDPR require when you record a meeting?

Under GDPR, a recording of identifiable people is personal data, and so are the transcript and the AI summary. Recording therefore has to meet the regulation's rules even where no wiretap law applies. Purely personal or household activity falls outside GDPR; business meetings do not.

Choose a lawful basis

A lawful basis is the legal reason, under Article 6 of GDPR, that permits you to process personal data. The European Commission's summary lists six: consent, contract, legal obligation, vital interests, public interest and legitimate interests.

• Legitimate interests is the basis most businesses use for meeting notes. Legitimate interests is a lawful basis that applies when you have a genuine need, the processing is necessary for it, and it does not override the participants' rights. You have to carry out and document that balancing test, tell people what the interest is, and respect their right to object.
• Consent must be freely given, specific, informed and as easy to withdraw as to give. That makes it awkward for meetings: if one participant withdraws halfway through, you have to stop. It is also rarely valid between employer and employee because of the power imbalance.
• Legal obligation applies where a law requires you to record, as some financial-services rules do.

Tell people clearly, at the start

Articles 13 and 14 require you to tell people, at the time you collect their data, who is recording, why, on what lawful basis, who receives the data (including your notetaker vendor and its AI providers), how long you keep it, what rights they have, and whether it leaves the EU. A two-line notice in the invite with a link to your full privacy notice usually does the job.

Keep it proportionate

Record only the meetings where a recording serves the stated purpose, set a retention period and stick to it, and limit who inside your company can open the recordings.

Check your vendor

Your notetaker vendor is normally a processor, so you need a data processing agreement under Article 28, a list of its subprocessors (including AI model providers), a lawful mechanism for any transfer outside the EU, and a clear answer on whether your recordings are used for training. If a tool builds voiceprints to identify speakers, that is biometric data, a special category under Article 9 that needs extra justification.

Consider a data protection impact assessment

A data protection impact assessment (DPIA) is a documented risk review that Article 35 requires before processing likely to result in a high risk. Systematic recording and scoring of employees' calls, or recording conversations that routinely touch on health or other sensitive topics, are the cases to assess first.

Check national criminal law too

GDPR is not the only rule in Europe. Some countries also criminalize unauthorized recording of private speech. Germany's Criminal Code (§ 201) makes it an offense, punishable by up to three years in prison or a fine, to record the non-public spoken words of another person without authorization. Being GDPR-compliant does not override rules like that.

What are the rules in the UK, Canada and Australia?

United Kingdom

UK GDPR and the Data Protection Act 2018 mirror the EU approach: a lawful basis, clear information, limited retention and proper vendor contracts. For workplaces, the Information Commissioner's Office guidance on monitoring workers says consent is not usually appropriate in the employment context, that you must tell workers about monitoring in a way that is accessible and easy to understand, that a DPIA is required before high-risk processing, and that covert monitoring should be reserved for very exceptional circumstances with senior sign-off. The ICO notes the guidance is under review following the Data (Use and Access) Act.

Canada

Section 184 of the Criminal Code makes intercepting a private communication an offense unless you have the express or implied consent of the person who made it or the person it was meant for, which in practice is one-party consent. Businesses also answer to privacy law: PIPEDA, or the provincial private-sector laws in Alberta, British Columbia and Quebec. The Office of the Privacy Commissioner's guidance on recording customer calls, updated on 8 October 2026, says organizations must tell people they are recording and why, keep the stated purpose narrow and cover every use, treat consent as generally implied when the person continues the call after being told, offer an alternative where recording is not integral to the service, and make sure contractors follow the same rules. It also flags voiceprints as sensitive biometric information that may need express consent. The guidance is written for phone calls, but its principles carry straight over to video meetings.

Australia

Recording is governed mainly by each state and territory's surveillance devices or listening devices law, and the laws differ. The Australian Law Reform Commission's review of surveillance laws found that only Queensland, Victoria and the Northern Territory had a general exception letting a participant record a private conversation; the other jurisdictions did not. That review dates from 2014, so check the current Act where your participants are. At federal level, the Telecommunications (Interception and Access) Act 1979 targets listening to or recording a communication passing over a telecommunications system without the knowledge of the person making it. Organisations covered by the Privacy Act 1988 must also notify people at or before collection under Australian Privacy Principle 5. Many small businesses with annual turnover of $3 million or less are outside the Act, but not all; health service providers, for example, are covered regardless.

Can employers record meetings with employees?

Generally yes, with notice, but not without limits.

In the US, employers can usually record work meetings, but the state consent laws above protect employees just as they protect customers, so an all-party state means all-party for staff too. New York's Civil Rights Law § 52-c requires employers that monitor employees' phone, email or internet use to give written notice on hiring, get it acknowledged and post it where staff can see it, and Connecticut and Delaware have their own electronic-monitoring notice laws. A clear written policy that says which meetings are recorded, why and for how long is the baseline. Union agreements may add terms.

In the UK and EU, employers normally rely on legitimate interests rather than consent, must explain the recording clearly before it happens, and should run a DPIA for systematic recording or scoring. In some countries, such as Germany, the works council has a say before tools that can monitor employees are introduced.

Coaching and performance. Call scores and talk-ratio metrics are a form of monitoring. Use them as coaching prompts alongside the call itself, not as a verdict on a person. PepoSmart's coaching scorecards follow a published methodology that says the score measures conversational mechanics, not whether the call was useful.

Interviews. Candidates are outside your company, so treat them like customers: notice in the invite, a spoken check at the start and a real option to decline without penalty. The interview scheduling guide covers where that notice fits in the scheduling flow.

Meetings to keep off the record. HR investigations, grievances, medical conversations and anything involving legal advice deserve a default of no notetaker. Sensitive data, privilege and trust are all at stake, and handwritten meeting minutes do the job.

How do you ask for consent? Scripts you can copy

The wording below is designed to work under the strictest rules in this guide. Replace the brackets and keep it short; long legal notices get skipped.

Calendar invite or booking page

Recording notice: with your agreement, this call will be recorded and transcribed by an AI notetaker ([tool name]) so we have accurate notes and can send a follow-up. The recording is used only for [purpose] and kept for [period]. If you'd rather not be recorded, reply to this invite or tell us at the start of the call and we'll take notes by hand instead. Privacy notice: [link].

Booking form question

Use a checkbox question as an acknowledgment, or a two-option question if recording is genuinely optional:

• Checkbox (acknowledgment): "I understand this meeting may be recorded and transcribed for note-taking. I can still ask for it not to be recorded at the start of the call."
• Two options (preference): "Can we record this call for our notes?" with "Yes, that's fine" and "Please don't record".

A tick box at booking is a notice and an acknowledgment, not blanket consent for everyone on the call. The person booking may forward the invite to colleagues who never saw the form.

Verbal opener at the start of the call

Before we start: I'd like to record and transcribe this call with [notetaker name], which you can see in the participant list, so I can focus on our conversation instead of typing. It's used only for our notes and follow-up, and it's kept for [period]. Is everyone okay with that?

Wait for each person to answer, then close the loop: "Thanks, [names] have all agreed." Saying this after the recording has started puts the announcement and the answers on the record, which is exactly what Washington and Connecticut look for.

Naming the notetaker

If your tool lets you choose the bot's display name, make it say what it does and whose it is, for example "[Your name]'s notetaker (recording)". A bot called "Assistant" or a random string reads as something to hide.

When someone joins late

[Name], welcome. Quick note before you jump in: we're recording this call for our notes. Are you okay with that?

Internal meeting policy line

Team meetings on [list] are recorded and transcribed for notes and action items. Recordings are kept for [period] and only [roles] can open them. Anyone can ask for a meeting, or part of one, not to be recorded, and the host will turn the notetaker off without needing a reason.

Short privacy notice for EU and UK participants

[Company] records this meeting to keep accurate notes and follow up (our legitimate interests). Audio, video, the transcript and an AI-generated summary are processed by our notetaker provider and its AI subprocessors and kept for [period]. You can object, ask for a copy or ask us to delete it at [email]. Full notice: [link].

What should you do if someone says no?

An objection is the system working, not a problem to manage. Handle it the same way every time:

1. Stop, without debate. Don't ask the person to justify themselves. If the notetaker is already in the call, remove it with the meeting platform's participant controls.
2. Delete anything already captured. If the first few minutes were recorded before the objection, delete that recording and transcript, and tell the person you have.
3. Take notes by hand. Nominate a note-taker and use a simple minutes structure; the guide to writing meeting minutes has a template.
4. Don't bring the bot back quietly. If your tool can re-invite a notetaker partway through a meeting, only do it after everyone has agreed again.
5. Offer a substitute. Send your written notes afterwards and invite corrections. Most people who object to a recording are happy with a summary they can check.
6. Remember the preference. Note it against the contact or in your CRM so the next meeting starts without the bot. The guide to syncing meeting notes to your CRM shows where those notes usually live.
7. Escalate rather than override. If recording is company policy and a colleague objects, take it to whoever owns the policy. The host should not decide alone.

If someone asks you to stop for one part of a meeting, such as a sensitive pricing discussion, remove the notetaker for that part and restart it only when everyone agrees.

A recording-consent checklist for teams

To roll this out across a team:

1. Map where your participants are. List the states and countries your customers, candidates and colleagues usually join from.
2. Pick the strictest standard as your default. For most teams that means all-party consent plus GDPR-style notice.
3. Write a one-page policy. Cover which meetings are recorded, why, retention, access and how objections are handled.
4. Update every template. Calendar invites, booking pages, confirmation emails and internal meeting descriptions.
5. Configure the tool. Decide which meeting types use the notetaker, who can see the notes and how deletion will work.
6. Train every host. Practise the opener and the objection routine until they are automatic.
7. Review every quarter. Delete recordings past their retention date and re-check the laws, which do change.

How to set this up in PepoSmart

PepoSmart is an AI scheduling and meeting-intelligence platform: booking pages and availability rules on one side, and an AI notetaker on the other that joins Zoom, Google Meet and Microsoft Teams calls as a visible participant and produces a recording, a speaker-labelled transcript, a summary, action items and a follow-up draft for review. The notetaker makes the recording obvious. It does not make it lawful. As the product facts page puts it, meeting hosts remain responsible for any notice or consent their jurisdiction or organisation requires. Here is how to build the checklist above into the product:

1. Choose which event types use AI notes. The notetaker only joins events where AI meeting notes are enabled, so keep a separate event type with notes switched off for conversations that should never be recorded.
2. Put the notice in the event description. Add the recording notice to the event's description so it carries through to the booking confirmation. Descriptions are easy to skim past, so pair it with the next step.
3. Add an intake question. Intake questions on your booking page can be single line, multi-line, radio, checkbox, dropdown or phone number, each required or optional. A required checkbox works as an acknowledgment; a radio question with "Yes, that's fine" and "Please don't record" captures a preference you can act on.
4. Say the opener anyway. The bot is visible in the participant list, but dial-in participants and people on small screens may miss it.
5. Handle objections cleanly. Remove the notetaker from the call. If it is removed, PepoSmart can re-invite it with "Rejoin notetaker" and stitch the parts into one transcript, so only use that when everyone has agreed. Recordings, transcripts and meeting records can be deleted from the meeting record at any time.
6. Limit who can see notes. On team plans, the owner or an admin controls whether each member can view meeting notes.
7. Set your retention routine. Free plan recordings are kept for 7 days and then deleted automatically. Paid plans keep recordings for the life of the account with no scheduled expiry, so if your policy says 90 days, someone needs to delete older recordings from the meeting record.
8. Disclose the AI processing. Transcripts are processed by third-party large-language-model providers to produce summaries, action items and drafts. Say so in your privacy notice and your invite wording.

Every plan, including Free, includes 2 AI recordings for the lifetime of the account so you can see how the notetaker behaves in your own meetings before deciding. Paid plans start at $6 per user per month, begin with a 12-month free trial, and can add AI recording credit packs for more recordings. The pricing page has the current details.

What PepoSmart does not do, and when you need a lawyer

Being clear about the limits matters more on a legal topic than anywhere else.

• PepoSmart does not obtain or verify consent for you. It cannot know which state or country each participant is in, whether someone forwarded the invite, or whether a dial-in caller heard your announcement.
• A visible bot is not consent. It is good notice. In all-party states and under GDPR you still need the steps in this guide.
• The notetaker cannot record phone calls or in-person meetings. It only joins supported online meetings. If you record in-person meetings with another device, the in-person rules above (Oregon's and Michigan's in particular) apply to you directly.
• Deletion on paid plans is manual. There is no scheduled expiry, which suits teams that want permanent records and means extra work for teams with a short retention policy.
• Regulated industries have extra rules. Financial services, healthcare and legal teams may be required to record and retain some conversations and forbidden from recording others. Our financial services page shows how teams there use PepoSmart, but your compliance team has the final word.

Get specific legal advice before you record covertly for any reason, record conversations you expect to use as evidence, record minors, record employees in the EU or UK at scale, or record health, legal or financial-advice conversations. In those cases a handwritten note, or no record at all, is sometimes the better choice.

Summary

Recording a meeting is legal in most places when everyone knows and agrees, and risky when they do not. US federal law and most states require only one party's consent, but about a dozen states require everyone's, Oregon writes video calls into its rule, and calls that cross state lines should follow the strictest state involved. Outside the US, GDPR, UK GDPR, PIPEDA and Australia's laws add a lawful basis, clear notice, limited retention and vendor checks. The workable standard everywhere is notice before the meeting, an announcement at the start that is captured on the recording, and a clean way to say no. If you want a notetaker that joins as a visible participant and fits that workflow, create a free PepoSmart account and try it on two meetings, then see the pricing page for paid plans.