# AI notetakers and recording law: 14 states and the Otter ruling

> Federal law needs one party's consent; we read 14 state laws that can ask for more. An August 2026 ruling on Otter shows where a notetaker bot adds risk.

- Published: 2026-10-30
- Author: 28creation Desk
- Format: Analysis
- URL: https://28creation.com/articles/ai-notetaker-recording-consent/

## The short read

**A judge let wiretap claims against Otter.ai proceed in August 2026 over its alleged use of meeting audio for itself.**

- Federal law lets one participant consent. We read 14 state laws that can ask for more, from everyone's consent to a recorded announcement.

### What you can do with this

> Before a bot joins a call with outside people, say in the invite and out loud at the start that the meeting is recorded and transcribed, and turn off auto-join for sensitive meetings.

---

An AI notetaker records a meeting, so recording law applies to it. Federal law lets one participant consent for everyone. We read the statutes of 14 states that can ask for more: the consent of every party, or a notice everyone hears. If one person on your call is in one of them, plan for the stricter rule.

The bot can add a risk of its own. On August 13, 2026, a federal judge in California let wiretap claims against Otter.ai go forward. The [order](https://storage.courtlistener.com/recap/gov.uscourts.cand.454675/gov.uscourts.cand.454675.68.0.pdf) found it plausible that Otter is a third-party eavesdropper, not the host's tool, because it allegedly keeps and uses the recordings for its own purposes.

This piece sets out what each text requires, what the Otter case adds, and a notice you can paste into an invite. It is a reading of the sources on October 25, 2026, not legal advice.

## Federal law asks for one party, with one catch

The federal Wiretap Act makes it lawful for a private person to intercept a communication "where such person is a party to the communication or where one of the parties to the communication has given prior consent." That is [18 U.S.C. § 2511(2)(d)](https://www.law.cornell.edu/uscode/text/18/2511).

The catch is the rest of the sentence. The exception falls away if the communication is intercepted "for the purpose of committing any criminal or tortious act." The plaintiffs suing Otter used exactly that clause, as the order below shows.

## The Otter case turns on who the bot works for

The case is *In re Otter.ai Privacy Litigation*, No. 5:25-cv-06911 in the Northern District of California. Seven plaintiffs from California, Illinois and Washington filed a [consolidated complaint](https://storage.courtlistener.com/recap/gov.uscourts.cand.454675/gov.uscourts.cand.454675.35.0.pdf) on December 5, 2025. Its allegations are claims, not findings.

The complaint says that once an account holder connects a calendar, Otter Notetaker "automatically, joins every meeting and begins recording and transcribing." It says the bot appears under a name such as "Anna's Notetaker (Otter.ai)" and gives other participants "no visual or auditory notice." It quotes Otter's privacy policy, which asks account holders to "make sure [they] have the necessary permissions" from others and says Otter trains its AI "on de-identified audio recordings."

## The judge found the bot may not be the host's tool

Otter argued that its bot is an invited participant and the host's recording tool. Judge Eumi K. Lee agreed that a software vendor acting only as "an extension" of its client is not a third-party interceptor.

But she found that the plaintiffs "plausibly allege that Otter independently collects, retains, and uses communications for its own commercial purposes." That was enough to plead that Otter is a third-party eavesdropper under California Penal Code § 631.

The federal claim also survived. Otter said its purpose was commercial; the order replied that "committing a tort and seeking a profit are not mutually exclusive."

Claims under Illinois's biometric law (BIPA) over voiceprints survived too. Several other claims were dismissed, mostly with leave to amend. This is a ruling on whether the case may proceed, not a finding that Otter broke the law.

Two details matter for everyone else. The California confidential-recording claims of two plaintiffs failed because they called their calls "private" without saying what was discussed; a third plaintiff's medical call was enough. And under Washington law, the judge would not infer that a participant knew he was recorded just because a notetaker showed up in the participant list. The Washington claim still failed, because he did not allege his conversations were private.

## What 14 state statutes say, in their own words

We read each text on October 25, 2026. Nine set an all-party rule for private conversations: the consent, authority or knowledge of everyone. Five more go beyond federal law only in some cases or on some readings, so any count of "all-party consent states" involves judgment.

| State | The text | What triggers it |
|---|---|---|
| California | [Penal Code § 632(a)](https://california.public.law/codes/penal_code_section_632) | "without the consent of all parties to a confidential communication" |
| Florida | [§ 934.03(2)(d)](https://www.flsenate.gov/Laws/Statutes/2024/934.03) | lawful "when all of the parties to the communication have given prior consent" |
| Illinois | [720 ILCS 5/14-2(a)(2)](https://codes.findlaw.com/il/chapter-720-criminal-offenses/il-st-sect-720-5-14-2/) | a party recording "in a surreptitious manner" a "private conversation" without "consent of all other parties" |
| Maryland | [Cts. & Jud. Proc. § 10-402(c)(3)](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcj&section=10-402&enactments=false) | lawful when "all of the parties to the communication have given prior consent" |
| Massachusetts | [Ch. 272 § 99](https://malegislature.gov/Laws/GeneralLaws/PartIV/TitleI/Chapter272/Section99) | to "secretly record" without "prior authority by all parties" |
| Montana | [§ 45-8-213(1)(c)](https://leg.mt.gov/bills/mca/title_0450/chapter_0080/part_0020/section_0130/0450-0080-0020-0130.html) | a "hidden" device, "without the knowledge of all parties" |
| New Hampshire | [RSA 570-A:2](https://gc.nh.gov/rsa/html/LVIII/570-A/570-A-2.htm) | "without the consent of all parties"; a party who records is charged with a misdemeanor (I-a) |
| Pennsylvania | [18 Pa.C.S. § 5704(4)](https://www.palegis.us/statutes/consolidated/view-statute?txtType=HTM&ttl=18&div=0&chapter=57&section=4&subsctn=0) | lawful "where all parties to the communication have given prior consent" |
| Washington | [RCW 9.73.030](https://app.leg.wa.gov/RCW/default.aspx?cite=9.73.030) | "without first obtaining the consent of all the participants" |
| Oregon | [ORS 165.540(1)(c)](https://oregon.public.law/statutes/ors_165.540) | a conversation, unless "all participants ... are specifically informed"; phone calls need one participant |
| Connecticut | [Gen. Stat. § 52-570d](https://codes.findlaw.com/ct/title-52-civil-actions/ct-gen-st-sect-52-570d/) | recording "an oral private telephonic communication" without consent, a recorded notice or a beep tone; a civil claim |
| Delaware | [11 Del. C. § 1335(a)(4)](https://delcode.delaware.gov/title11/c005/sc07/index.html) | "without the consent of all parties"; yet [§ 2402(c)(4)](https://delcode.delaware.gov/title11/c024/sc01/index.html) allows a party to record |
| Michigan | [MCL 750.539c](https://www.legislature.mi.gov/Laws/MCL?objectName=mcl-750-539c) | "without the consent of all parties"; [750.539a](https://www.legislature.mi.gov/Laws/MCL?objectName=mcl-750-539a) defines "eavesdrop" by the "private discourse of others" |
| Nevada | [NRS 200.620](https://www.leg.state.nv.us/nrs/nrs-200.html) | phone calls; the lead opinion in [*Lane v. Allstate*](https://caselaw.findlaw.com/nv-supreme-court/1091302.html) (1998) found that taping one's own calls broke it |

## Five states are where the counts split

Delaware has two statutes that point in opposite directions.

Michigan's definition, "the private discourse of others," reads as aimed at outsiders, so its reach to a participant is open on the text alone. Nevada's statute pairs one party's consent with a court-order route, and the lead opinion of its supreme court found a man who taped his own calls in breach. Connecticut's civil rule covers telephone calls, and the text does not say whether a video call counts.

Oregon is the clearest about meetings. Its definitions, in [ORS 165.535](https://oregon.public.law/statutes/ors_165.535), say a "conversation" "includes a communication occurring through a video conferencing program." So on a video call with someone in Oregon, every participant must be "specifically informed" that the meeting is being captured.

## Most of these laws bite on secrecy, so notice does a lot of work

Read the trigger words again: "confidential" in California, "surreptitious" in Illinois, "secretly" in Massachusetts, "hidden" in Montana, "specifically informed" in Oregon. Several of these laws target recording people who do not know. A clear notice before the recording starts takes away the secrecy.

Two states spell out what a notice must look like. Washington's [RCW 9.73.030(3)](https://app.leg.wa.gov/RCW/default.aspx?cite=9.73.030) treats consent as obtained when one party has "announced to all other parties ... in any reasonably effective manner" that the conversation "is about to be recorded," and "that said announcement shall also be recorded." Connecticut accepts consent given "at the start of" the recording, or a "verbal notification which is recorded at the beginning."

Notice is not the same as consent everywhere. The Florida, Maryland, Pennsylvania and New Hampshire sections we read use the words "consent" or "prior consent," with no notice rule like Washington's. The safe reading there: announce it, and give people a real way to say no, such as asking the host to turn the bot off or leaving.

The penalties are not small. California allows a civil claim for "five thousand dollars ($5,000) per violation" under [Penal Code § 637.2](https://california.public.law/codes/penal_code_section_637.2), and one meeting can include many people. Connecticut lets anyone aggrieved sue for damages, costs and "a reasonable attorney's fee."

## Illinois adds a separate rule for voiceprints

Speaker identification can bring in Illinois's Biometric Information Privacy Act. The court quoted it: a "biometric identifier" includes a "voiceprint," and section 15(b) bars collecting one unless the company first informs the person "in writing" of the purpose and the length of time, and "receives a written release."

A spoken notice does not satisfy that. If your notetaker labels speakers by recognizing their voices across meetings, as the complaint says Otter's does, Illinois participants are a separate question. Ask the vendor in writing whether it builds voiceprints, and if so, how it gets written releases.

## In the EU and UK, the question is a lawful basis and a notice

Under [GDPR Article 6(1)](https://www.legislation.gov.uk/eur/2016/679/article/6/adopted), consent is one of six lawful bases, next to contract, legal obligation and "legitimate interests." For staff meetings we expect most employers to rely on legitimate interests, which needs a balancing test; consent from staff rarely works, as we explained in [employee monitoring and GDPR](/articles/employee-monitoring-gdpr-automation/).

Whatever the basis, [Article 13](https://www.legislation.gov.uk/eur/2016/679/article/13) requires telling people "at the time when personal data are obtained" who is recording, why, on which legal basis and who receives the data. That points to the same fix as the US laws: a notice before the recording starts. Voiceprints used to identify people are "biometric data for the purpose of uniquely identifying a natural person" under [Article 9](https://www.legislation.gov.uk/eur/2016/679/article/9), which are banned unless an exception such as explicit consent applies.

The UK version of [Article 6](https://www.legislation.gov.uk/eur/2016/679/article/6) now adds a seventh basis, "recognised legitimate interest." The notice duty is the same.

## The meeting platforms already announce their own notetakers

The built-in tools tell everyone when they start. In Teams, "all participants see a notification that the meeting is being transcribed" ([Microsoft](https://support.microsoft.com/en-us/office/view-live-transcription-in-microsoft-teams-meetings-dc1a8f23-2e20-4684-885e-2152e06a4a8b)). In Google Meet, "Google Meet informs all meeting participants that notes are being taken" when Gemini takes notes ([Google](https://support.google.com/meet/answer/14754931)).

Zoom admins can go further. The setting "Show a disclaimer to participants when a recording starts" asks each participant to consent or leave, and the host can pull a report of who consented ([Zoom](https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0068402)). A separate setting, "Show a custom message when turning on AI in a meeting," can require participants to agree; until they accept, they cannot unmute or turn on video ([Zoom](https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0082011)).

The trade-off is friction. A consent prompt makes some guests leave or ask to stop the recording, and that is the point. These notices cover the platforms' own features; the Otter complaint alleges that a third-party bot gave no such notice.

## What this means for you

The decision is whether a bot joins a given meeting, and on whose terms. Our view: for internal meetings among staff who have been told, a notetaker carries little of this risk. For calls with outside people, the safe default is the strictest rule any participant might be under.

1. **Announce it twice.** Put a line in the invite, then say it at the start, after the recording begins, so the announcement is on the recording, as Washington and Connecticut describe.
2. **Turn on the platform notice.** In Zoom, enable the recording disclaimer and the AI message; Teams and Meet show theirs automatically.
3. **Turn off auto-join** for interviews, HR, legal, medical and sales calls with people outside the company. Join the bot by hand when everyone has been told.
4. **Read the vendor's data terms.** The Otter order turned on the vendor keeping and using recordings for itself. A vendor that uses your meetings only to serve you is closer to the "extension" of a client that the order said is not an eavesdropper.
5. **Ask about voiceprints** if anyone on your calls is in Illinois, and get the answer in writing.

## A notice to paste into the invite

A notice you can adapt (a template, not legal wording):

> Invite: "This meeting will be recorded and transcribed by [tool] to produce notes for attendees. The recording is kept for [period]. Tell [host] before the meeting if you do not want it recorded."
>
> At the start, once recording runs: "This call is being recorded and transcribed by [tool]. If anyone objects, say so now and we will turn it off."

If someone objects, turn it off and take notes by hand. That one sentence at the start is the cheapest protection under most of the texts above.

## How we made this

On October 25, 2026, we read the recording statutes of the 14 states in the table, from the legislatures' own sites for ten of them and from public copies for the rest: California and Oregon on public.law, Illinois and Connecticut on FindLaw, whose official sites did not load for us. We read the Otter consolidated complaint and the August 13, 2026 order in full from CourtListener, plus GDPR Articles 6, 9 and 13 and the Teams, Meet and Zoom help pages. We did not test any notetaker, did not review court rulings beyond those linked, and did not read the other 36 states' laws or the UK's interception statutes. This is not legal advice.

## Sources

- [18 U.S.C. § 2511](https://www.law.cornell.edu/uscode/text/18/2511), the federal Wiretap Act
- [In re Otter.ai Privacy Litigation, consolidated complaint](https://storage.courtlistener.com/recap/gov.uscourts.cand.454675/gov.uscourts.cand.454675.35.0.pdf), December 5, 2025
- [In re Otter.ai Privacy Litigation, order granting motion to dismiss in part](https://storage.courtlistener.com/recap/gov.uscourts.cand.454675/gov.uscourts.cand.454675.68.0.pdf), August 13, 2026
- [California Penal Code § 632](https://california.public.law/codes/penal_code_section_632) and [§ 637.2](https://california.public.law/codes/penal_code_section_637.2)
- [Florida Statutes § 934.03](https://www.flsenate.gov/Laws/Statutes/2024/934.03)
- [720 ILCS 5/14-2](https://codes.findlaw.com/il/chapter-720-criminal-offenses/il-st-sect-720-5-14-2/) (Illinois)
- [Maryland Courts and Judicial Proceedings § 10-402](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcj&section=10-402&enactments=false)
- [Massachusetts General Laws ch. 272 § 99](https://malegislature.gov/Laws/GeneralLaws/PartIV/TitleI/Chapter272/Section99)
- [Montana Code § 45-8-213](https://leg.mt.gov/bills/mca/title_0450/chapter_0080/part_0020/section_0130/0450-0080-0020-0130.html)
- [New Hampshire RSA 570-A:2](https://gc.nh.gov/rsa/html/LVIII/570-A/570-A-2.htm)
- [18 Pa.C.S. § 5704](https://www.palegis.us/statutes/consolidated/view-statute?txtType=HTM&ttl=18&div=0&chapter=57&section=4&subsctn=0) (Pennsylvania)
- [RCW 9.73.030](https://app.leg.wa.gov/RCW/default.aspx?cite=9.73.030) (Washington)
- [ORS 165.540](https://oregon.public.law/statutes/ors_165.540) and [ORS 165.535](https://oregon.public.law/statutes/ors_165.535) (Oregon)
- [Connecticut General Statutes § 52-570d](https://codes.findlaw.com/ct/title-52-civil-actions/ct-gen-st-sect-52-570d/)
- [11 Del. C. § 1335](https://delcode.delaware.gov/title11/c005/sc07/index.html) and [§ 2402](https://delcode.delaware.gov/title11/c024/sc01/index.html) (Delaware)
- [MCL 750.539c](https://www.legislature.mi.gov/Laws/MCL?objectName=mcl-750-539c) and [750.539a](https://www.legislature.mi.gov/Laws/MCL?objectName=mcl-750-539a) (Michigan)
- [NRS 200.620](https://www.leg.state.nv.us/nrs/nrs-200.html) and [Lane v. Allstate Insurance Co.](https://caselaw.findlaw.com/nv-supreme-court/1091302.html), Nevada Supreme Court, December 8, 1998
- [GDPR Article 6 (as adopted)](https://www.legislation.gov.uk/eur/2016/679/article/6/adopted), [Article 9](https://www.legislation.gov.uk/eur/2016/679/article/9), [Article 13](https://www.legislation.gov.uk/eur/2016/679/article/13), and the [UK GDPR Article 6](https://www.legislation.gov.uk/eur/2016/679/article/6)
- Microsoft: [View live transcription in Teams meetings](https://support.microsoft.com/en-us/office/view-live-transcription-in-microsoft-teams-meetings-dc1a8f23-2e20-4684-885e-2152e06a4a8b)
- Google: ["Take notes for me" in Google Meet](https://support.google.com/meet/answer/14754931)
- Zoom: [Customizing the recording consent disclaimer](https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0068402) and [Configuring the custom message for AI](https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0082011)