Meeting Recording Consent Laws by Jurisdiction
Every participant's home state law controls whether the recording is legal, not the host's location.
A host in New York schedules a call. Three participants join from California, Florida, and Illinois, and an AI notetaker joins with them to record and transcribe. The host's own state law is close to irrelevant to whether that recording is legal, because recording consent law runs on the location of every participant, not the location of the organizer, and at least two of the three guest states in this scenario demand that everyone on the call agree to being recorded before a single word is captured. Whether the host feels compliant because New York is a one-party consent state has no bearing on the exposure sitting with the other three participants' home states.
The U.S. consent framework: federal baseline, all-party states, and hybrid states
Under 18 U.S.C. § 2511(2)(d), it is not unlawful for a person to record a wire, oral, or electronic communication as long as that person is a party to the conversation, or has the consent of at least one party, provided the recording isn't made to commit a crime or a tort, and this one-party standard is the default rule across most U.S. states and the equivalent all-party jurisdictions. If a user's state follows the federal baseline and every other participant's state does too, a single participant's consent (often just the host's own presence on the call) is legally enough.
That default breaks the moment a state opts for stricter protection, and nine states have done exactly that: California, Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Pennsylvania, and Washington require all-party consent, so every single person on the call has to agree to being recorded. You need to ask, for every call, whether any participant sits in one of those nine states. If so, the one-party federal floor no longer governs that conversation; the stricter state law does.
The third branch is where most confusion lives: a set of hybrid states that apply one-party rules to some kinds of conversations and all-party rules to others, usually splitting along in-person versus telephone or electronic lines. Connecticut treats in-person conversations under one-party consent, but it shifts to all-party consent (with specific notice requirements) for telephone and electronic voice communications under Conn. Gen. Stat. § 52-570d. Nevada looks like the opposite pattern on its face, one-party in person under NRS § 200.650, but state courts have applied all-party treatment to telephone calls under NRS § 200.620. Oregon flips the medium the other way: all-party consent governs in-person conversations, while telephone and video-conference calls fall under one-party consent per ORS 165.540. Hawaii and Maine keep one-party rules for phone calls but add separate restrictions covering surveillance in private spaces, a different legal question from call recording but distinct from the clean one-party read.
This is precisely why hybrid states are the hardest category for video calls specifically: a video meeting isn't cleanly "in person" or "telephone" under statutes written decades before videoconferencing existed, and courts in these states have had to decide, case by case, which bucket a video call falls into. For planning purposes, the safest approach treats the strict all-party states together with the hybrid states whose stricter rule tends to dominate in practice (Connecticut, Delaware, Nevada, and Oregon) as a combined group where all-party treatment should be the default assumption. Michigan complicates even that: the statute reads as an all-party requirement on its face, but state court decisions have recognized participant-recording carve-outs, so the practical rule is murkier than the text alone suggests. Anyone deploying an AI meeting tool across a distributed team needs to know, for each state involved, which of these three tiers applies before assuming a single consent setting covers everyone.
The all-party states with felony penalties: what the statutes say
The gap between a one-party state and an all-party state isn't a paperwork distinction. Eight of the thirteen all-party and hybrid states treat violations as felonies, and the statutes carry real prison exposure, not civil fines a company can absorb as a cost of doing business.
Laws ch. 272, § 99, makes illegal interception a felony with substantial criminal penalties attached, while disclosing or using an illegally obtained recording is treated as a separate, lesser misdemeanor. The Massachusetts statute reaches further than most: it prohibits secret recording even at public gatherings, so the "no reasonable expectation of privacy in public" argument that works in other states doesn't apply the same way here. Pennsylvania's statute, 18 Pa. C.S. § 5703, makes intentional interception, disclosure, or use of a communication a third-degree felony, and it carries significant prison time and fines. New Hampshire's RSA 570-A:2 splits the offense by intent: willful interception is a Class B felony, while knowing interception by someone who is themselves a party to the conversation drops to a misdemeanor, a structure that makes New Hampshire among the harshest penalty regimes in the country for the willful category. Maryland's statute, Md. Code § 10-402, sets a felony with a maximum of five years in prison and a $10,000 fine. Illinois treats unauthorized recording as a Class 4 felony on a first offense, rising to a Class 3 felony for a second or later offense, each carrying several years of possible imprisonment and substantial fines, and Illinois stacks a second, independent law (its biometric privacy statute) on top of that wiretap exposure, addressed below. Washington's statute, RCW 9.73.030, treats violations as a gross misdemeanor carrying up to nearly a year in jail plus civil damages, and it builds in one practical workaround: an announcement that a call is being recorded counts as valid consent under the statute, as long as that announcement itself is captured on the recording. Another all-party state's law, under its criminal code, Code § 45-8-213, keeps recording violations at the misdemeanor level without escalation; the statute's escalating penalties, up to five years, apply only to separate harassment or extortion conduct under other subsections, not to the act of recording itself, and Montana additionally requires notifying all participants.
None of these statutes were drafted with an AI bot in mind. They were written to govern a person holding a tape recorder or tapping a phone line, and none of the nine all-party states have rewritten their wiretap language to specifically address automated transcription tools, speaker diarization, or cloud-based meeting assistants. That silence hasn't stopped liability from attaching. Courts are now doing the work of deciding how these older statutes apply to bots, and that litigation is the subject of the next section.
The third-party eavesdropper question: how courts are treating AI meeting bots
The one-party consent defense depends entirely on the recorder being a party to the conversation. Courts are now actively deciding whether an AI meeting bot counts as a party at all, or whether it functions instead as a third-party interceptor sitting outside the conversation and listening in, and that classification changes the entire legal analysis.
The clearest signal so far comes from Ambriz v. The court applied what amounts to a capability test: if a vendor has the technical capability to use intercepted call data for its own purposes, separate from the purpose the host had in mind, that capability alone was enough at the pleading stage to support a claim that the vendor operated as a third party to the call rather than as an extension of the host's own participation. That reasoning, if it holds up and spreads to other courts, has a direct consequence for every AI meeting tool that does more than transcribe audio for the host's immediate benefit: a tool that stores, processes, or repurposes meeting data for its own separate uses risks being treated as a third-party interceptor, regardless of whether the host consented to its presence on the call.
That distinction matters because the one-party consent defense only protects someone who is a party to the conversation, recording it, or giving consent as a party. A third party intercepting the call from outside that relationship can't borrow the host's consent. If courts settle on treating AI bots as third-party interceptors as a general matter, hosting the bot and consenting to its presence stops functioning as a defense, even in states that otherwise only require one party to agree. The litigation is still unfolding, but Ambriz establishes that the question is live, and that outcome runs against the assumption many teams currently operate on.
Illinois BIPA and the voiceprint problem that wiretap law doesn't cover
Wiretap statutes govern whether a recording itself was lawfully made. They say nothing about what happens to a voiceprint extracted from that recording, and that gap is where a state biometric privacy statute creates a second and entirely independent layer of exposure.
AI meeting tools that perform speaker identification, distinguishing which voice belongs to which participant through diarization, generate a voiceprint in the process, and a voiceprint counts as a biometric identifier under Illinois law. Capturing and processing that identifier triggers its own consent and notice requirements under BIPA, separate from whatever the wiretap analysis concludes about the recording itself. A tool could clear every wiretap hurdle in a given state and still violate BIPA if it extracts and stores voiceprints without the specific consent BIPA requires. Illinois isn't the only state with this kind of requirement: Colorado's HB24-1130, effective July 1, 2025, requires consent before collecting biometric identifiers; Texas's biometric privacy statute (CUBI) bars capturing biometric identifiers for commercial purposes without prior notice and consent; and Washington's RCW 19.375 prohibits enrolling a biometric identifier in a database for commercial purposes without notice, consent, or an opt-out mechanism. Illinois simply has the most developed litigation record of the group.
That litigation record is already producing class actions, with the sharpest fact pattern involving people who never used the tool. A participant joins a call hosted by someone else, never having agreed to that tool's terms of service, with no idea that a bot on the call is extracting a voiceprint from their speech for speaker identification. That non-user participant problem sits at the center of the active BIPA class action wave, because BIPA's consent requirement runs to the person whose biometric data is collected. A 2024 amendment to BIPA, applied retroactively by the Seventh Circuit as of April 1, 2026 in Clay v. Union Pacific, caps recovery to a single statutory-damages award per person per method of collection of the same biometric identifier, regardless of how many times that identifier was collected. That amendment narrows the aggregate damages a company might face across repeated collections of the same person's voiceprint, but it does not eliminate the underlying per-person, per-identifier liability. Each non-consenting participant whose voiceprint gets captured remains a separate claim.
The interstate call rule: how one participant's location sets the standard for everyone
Picture a product team's weekly standup: one engineer in California, one in Illinois, one in New York, and the manager running the call from Texas. The company is incorporated in Delaware and headquartered in New York, and the instinct is to assume New York law, or Texas law, governs the call. Neither does. The call is governed by the strictest law any participant's physical location imposes at the moment of the call, and here that means both California's and Illinois's all-party consent requirements apply to the entire conversation, binding every participant on it, not just the two who happen to be sitting in those states.
The location that matters is physical presence during the call, not a billing address, not an area code, and not where an employer is registered. A participant physically present in a given all-party state during a call counts as a participant in that state under its wiretap statute even if that participant is dialing in on a phone number with an out-of-state area code. The same logic extends to AI meeting tools directly: deploying the tool from a server in one state, or configuring it from a company headquartered in another, does nothing to change which law applies. The law follows the participants' physical locations at the time of the call, full stop on where the software happens to run.
The operational fix isn't complicated, even if it's easy to overlook. Teams need an accurate picture of where their participants physically are for any given call, not where the company sits on paper, and that picture has to be checked meeting by meeting, since remote and hybrid teams move between states and countries more than fixed organizational charts suggest. A single participant logging in from an all-party state is enough to pull an otherwise simple one-party call under a stricter standard, and that's true whether the team realizes it or not.
Key international jurisdictions: GDPR, Germany, Canada, Australia, Switzerland, and the EU AI Act
Everything addressed so far operates inside the wiretap framework used domestically, which asks a narrow question: was the recording itself lawfully intercepted. International regimes ask a broader and structurally different question about lawful processing of personal data generally, with recording consent as just one piece of a larger compliance obligation.
One major international data protection framework treats a voice recording, a transcript, and a speaker-identified voiceprint all as personal data subject to its processing rules, so a company needs a valid legal basis, such as consent or legitimate interest, before an AI meeting tool can lawfully record, transcribe, or analyze a call involving anyone within its scope, independent of whatever domestic one-party or all-party rules say about the same recording. One country within that framework applies its own data protection law on top of the regional rules, and it has historically taken an even stricter approach to employee monitoring and workplace recording, reflecting a broader regional tradition of treating workplace surveillance with particular caution. Another country's federal and provincial privacy statutes similarly treat call recordings and derived biometric data as personal information requiring a lawful basis for collection and use, following a processing-based model closer to that international approach than to the domestic interception-based one. Australia's privacy law likewise centers on the collection and use of personal information rather than on the narrower act of interception, so an AI meeting tool that complies with U.S. wiretap law isn't automatically compliant with that other country's privacy obligations covering the same recorded data. Switzerland, outside the EU but closely aligned with it on data protection, applies its own federal data protection law to the same categories of recorded voice and biometric data, with its own enforcement body distinct from the EU's.
Layered on top of all of it, the EU AI Act adds a further obligation specific to AI systems rather than to recording or data processing generally, and it places transparency and risk-based requirements on tools that perform the kind of automated analysis AI meeting assistants increasingly handle, from speaker identification to sentiment inference. A tool built to satisfy domestic wiretap consent rules addresses only one narrow slice of what a global compliance posture actually requires. Teams operating across the U.S. and the EU, Canada, Australia, or Switzerland are working under two fundamentally different legal architectures at once: one asking whether a recording was intercepted lawfully, and the other asking whether personal data was processed lawfully, and satisfying one of those frameworks carries no guarantee of satisfying the other.
