Consent for call recording and AI notetakers

The federal Wiretap Act follows the one-party rule, and so do most states. A smaller group of states require everyone on the call to agree. Kilpatrick's chart of US wiretap laws is one of several published lists, and the lists do not match each other. California, Florida, Illinois, Maryland, Montana, Pennsylvania and Washington appear on all of them. Other states are counted in or out depending on whether the recording is of a phone call or an in-person conversation, which is why published totals range from 11 to 14.

California is where most of the money risk sits. The California Invasion of Privacy Act (CIPA) allows $5,000 per violation or three times actual damages, whichever is greater, according to the same Kilpatrick chart. That figure applies per violation, so a business that records many calls can face a large number on paper even when no one was harmed in any ordinary sense.

A business usually cannot tell which state each participant is in. That is why many companies apply the all-party rule to every conversation. Which state's law governs a particular call is a question for counsel.

The older question was simple: did the people on the call know it was being recorded. With AI tools there is a second listener. A notetaker bot, a contact-center analysis service or an ordering assistant receives the conversation and may keep it or use it to improve its own product.

Holland & Knight's May 2026 review of these cases describes two lines of reasoning. One asks whether the vendor used the conversation for its own purposes. The other asks only whether the vendor was capable of doing so. The firm's view is that no bright-line rule has been established. It also warns that a standard notice that the call may be recorded may not be enough where the complaint is that a third party was analyzing the call at the same time without being announced.

For a business, the practical point is that the notice should say what is really happening. If an AI service transcribes or analyzes the conversation, say so, and say it before recording starts.

The case most people watch is In re Otter.AI Privacy Litigation in the Northern District of California. On 13 August 2026 the court granted Otter's motion to dismiss in part and denied it in part. Federal Wiretap Act, CIPA and Illinois biometric claims go forward. Baird Holm's summary of the order says the court found the complaint plausibly alleged that Otter kept and used conversation data for its own commercial purposes, which let the plaintiffs argue it acted as a third-party eavesdropper. That is a ruling on the pleadings. It does not decide whether Otter did anything unlawful.

The defense wins matter just as much. In Lisota v. Heartland Dental, a federal court in Illinois dismissed a federal Wiretap Act claim over an AI call service under the ordinary-course-of-business exception, as reported by Covington. In Guerra v. Papa John's, a California federal court granted summary judgment because the statute at issue covers landline, cordless and cellular phones and the call centers used internet calling, as reported by Loeb & Loeb. In the Google contact-center AI litigation, a 22 October 2026 order dismissed one group of callers with leave to amend and sent three other groups to arbitration, as reported by OpenClassActions. That report says the court treated lack of consent as something the plaintiff has to plead.

The picture is narrow. The research behind this guide found roughly a dozen named cases. Most name the AI vendor as the defendant. The businesses sued as customers were mainly health systems and companies running contact centers. No case was found against an ordinary employer whose staff used a notetaker in meetings.

The Illinois Biometric Information Privacy Act (BIPA) covers voiceprints. The American Bar Association's litigation section describes voiceprint claims against AI tools as a new trend. It lists Cruz v. Fireflies.AI, filed in December 2025, and Basich v. Microsoft, filed on 5 February 2026 over speaker attribution in Teams. The biometric claim against Otter also survived the August 2026 ruling.

These cases are at an early stage. No ruling was found in the Fireflies case, and none of the voiceprint suits has decided whether ordinary speaker labeling in a transcript counts as a biometric identifier.

If a tool identifies speakers by voice and any participant may be in Illinois, treat speaker identification as its own consent question. Ask the vendor whether the feature can be turned off, and record whether it was on for each meeting.

PYMNTS reported in November 2026 that HIPAA has no specific patient-notice rule for AI scribes, so the obligation depends on the state. Louisiana's Act 649 requires a licensed professional to verbally disclose before recording any part of a visit for AI transcription, with licensing-board discipline as the sanction. Rhode Island's S2570A requires providers who use AI to document visits to notify the patient and review the note. California's AB 3030 covers AI-generated messages about clinical information. It does not cover recordings. These descriptions come from one news report, so check the statute for your state.

Lawsuits have gone further than the statutes. Holland & Knight describes Saucedo v. Sharp HealthCare and Stewart v. Kurien, both in California Superior Court. The complaints allege that visits were recorded with ambient AI tools without consent, and that the notes the tool produced stated that patients had been told and had agreed when they had not. No rulings were reported in either case.

That second allegation is the useful lesson. A line in an AI-written note saying the patient consented is weak evidence if the tool writes that line by default. The consent record should be created separately from the scribe's own output.

UC Today reported that Microsoft introduced detection of external meeting bots in Teams in 2026. Detected bots are labeled as unverified in the lobby, the setting is on by default, and administrators can set a policy to block them for the whole organization. The same report says Zoom's AI Companion and Google Meet's note-taking feature have to be started by a host and show an indicator, and administrators can restrict them.

These controls answer whether a bot is in the meeting. They do not record who saw the indicator, when each person joined, or whether anyone objected. Baird Holm also notes that some notetakers capture audio on the person's own device without joining as a bot, which meeting-platform controls cannot see.

A banner is a notice to the room. Proof that a named participant received that notice before recording began has to be kept by the business that relies on it.

Lack of consent is the point these cases turn on, so the record that matters is the one that shows consent was asked for and given. Baird Holm's advice after the Otter ruling is that the questions a business will be asked are whether every participant got notice before recording started and what the vendor does with the data.

The list below is a practical checklist drawn from those questions. It is not a legal standard. Consentra's Recording Consent keeps this kind of record per participant and per jurisdiction. A spreadsheet or a field in a call system can hold the same facts if it is filled in every time.

• Who the participant was, and how they were identified (name, phone number or meeting login).
• The exact wording of the notice, including whether it said an AI service would transcribe or analyze the conversation.
• How the notice was delivered: spoken by a person, played by a phone menu, shown on screen, or sent in the invitation.
• The time the notice was given and the time recording started, so the order is clear.
• The response: agreed, declined, or continued without objecting, and how that was captured.
• What happened for anyone who joined late or declined, such as pausing the recording.
• Which vendor processed the audio, whether speaker identification was on, and whether the vendor may use the data for its own purposes.
• The state or country the participant gave, if known, and the rule the business applied.