AI Notetakers and Recording Consent in 2026: What to Configure Before the Next Call

Meeting assistants became normal faster than meeting policy did. The tool joins, the transcript appears, the action items route themselves, and nobody in the call asked the question that two decades of wiretap case law turns on: did everyone agree to the recording.

The answer varies by where the participants sit, not by where your company sits, and the gap between federal and state standards decides what you have to configure.

The Two Standards That Collide

Federal law permits recording by a participant. 18 U.S.C. 2511(2)(d) makes it lawful for a person not acting under color of law “to intercept a wire, oral, or electronic communication where such person is a party to the communication or where one of the parties to the communication has given prior consent to such interception,” unless the purpose runs to a criminal or tortious act. One party suffices, and that party can be you.

California sets the opposite default. Penal Code 632 reaches a person who, “intentionally and without the consent of all parties to a confidential communication, uses an electronic amplifying or recording device to eavesdrop upon or record the confidential communication.” Every party has to agree. A confidential communication means one carried on in circumstances indicating that a party wants it confined to the parties, which describes most internal calls and nearly every customer call. The penalty reaches $2,500 per violation, and $10,000 per violation after a prior conviction under the related sections.

California is not alone in requiring all-party consent, and the list changes as legislatures move. The operational conclusion holds regardless: on any call with a participant in an all-party state, consent of one participant protects nobody, and the recording that a notetaker makes automatically is the recording a statute describes.

Why AI Notetakers Sharpen the Problem

Three properties of this tool category create exposure that a phone recorder never did.

Recording starts by default. Calendar integration means the assistant joins without a human deciding, call by call, whether this particular conversation should produce a transcript. Default-on is the feature people buy, and it removes the moment where a person would have asked for agreement.

The artifact outlives the call. A transcript, a summary, and a set of routed action items persist in a searchable system, which makes a recording discoverable in litigation long after everybody forgot it existed.

Bot-free capture removes the visible signal. The bot that announces itself in a participant list is, accidentally, a disclosure mechanism. Capture that runs on the host’s own machine produces no such signal. Granola states plainly that “it does not add a bot to your video call,” that it “doesn’t store the audio from meetings,” and that it “only stores the transcript and any notes you provide from a call.” Its security page says nothing about notifying other participants, which is accurate rather than evasive: the design moves that duty to the host. Teams in healthcare, finance, and government adopt bot-free tools precisely because policy blocks bots, and they inherit the disclosure obligation along with the capability. Our Granola review and Granola versus Fathom comparison cover the tool itself.

The Settings That Carry a Disclosure

Vendors differ in how much of the consent workflow they automate. Fireflies documents the fullest set I have found, which makes it a useful reference even for buyers who choose something else. Its recording consent and compliance controls include an email to participants an hour before the meeting with a link that declines and keeps the assistant out, and an in-meeting compliance message pinned in the chat when the bot joins. On the desktop app, which records without a bot, consent and notification behavior adds an audio announcement that plays through the meeting roughly ten seconds after capture starts, plus a chat message and a watermark. Fireflies recommends treating two-party consent as the standing policy and enabling the compliance feature so the tool notifies everyone automatically.

Four configuration decisions matter more than the brand on the invoice.

Announcement at capture, in a channel participants actually see. Audio beats chat, and chat beats a calendar invitation nobody reopened. Anything that requires the participant to go looking for the notice fails as a disclosure.

A decline path that stops capture. A notice that cannot be refused records objections rather than honoring them.

Admin enforcement rather than per-user choice. Consent settings that each employee can toggle will drift within a quarter. Set them at the workspace level and remove the toggle.

Retention that matches a policy somebody wrote. Transcripts accumulate silently. Decide the retention window deliberately, apply it to summaries and action items as well as to the transcript, and expect to defend the number.

External calls deserve one more step. Put a sentence in the invitation and say it out loud at the start: this call gets recorded and transcribed for notes, and anybody who prefers otherwise can say so now. Sales and support teams already open calls with a disclosure for quality monitoring, which is the same move.

Where Editing Enters the Picture

Teams that reuse meeting audio, for internal enablement or for marketing clips, add a second question: what happens to the asset after capture. Editors like Descript make a recording into a publishable artifact, which raises the consent bar from “may we transcribe this” to “may we publish your voice.” Treat republication as a separate permission, asked for separately, because the original agreement covered note-taking.

Our best AI meeting assistants guide ranks the category on accuracy and integration depth. This piece covers what every one of them obligates the host to do.

A Policy Short Enough to Follow

Write five lines and put them where the calendar invitation template lives.

Announce recording in audio at the start of every external call. Enable automatic participant notification at the workspace level and remove the per-user override. Treat all-party consent as the default policy rather than deciding per jurisdiction, because nobody checks participant residency before a call. Set a retention window for transcripts, summaries, and action items alike. Ask separately before any recording becomes a published asset.

A policy that takes thirty seconds to read gets followed. A matrix of state consent rules in a wiki does not.

Frequently Asked Questions

Does one participant’s consent cover the call? Under federal law, yes. In an all-party consent state, no, and the statute reaches the person doing the recording.

Do we check where every participant sits? Few teams can, which argues for adopting the stricter standard everywhere rather than running a jurisdiction lookup per meeting.

Does bot-free capture reduce exposure? It reduces the vendor’s data footprint and increases your disclosure duty, because nothing in the meeting signals that recording started.

Does an internal-only call escape the question? Employees are parties to a confidential communication like anybody else, and California’s definition turns on the circumstances rather than on the employment relationship.

Is a calendar-invitation notice enough? It helps and rarely stands alone. Pair it with an announcement at the moment capture begins.

Statutory language above comes from the linked federal code and California code sections, and vendor behavior comes from each vendor’s own documentation, linked in place. Consent law varies by state and gets litigated continuously, so treat this as engineering guidance and take the jurisdictional call to counsel. Some vendor links here earn a commission, which never changes what the statutes say.