Is it legal to use an AI notetaker on calls? Consent and confidentiality

Do I need everyone’s consent to record a call?

It depends where the participants are. Recording laws come in two broad types. “One-party consent” means you can record a conversation you are part of without asking anyone else. “All-party consent” (sometimes called two-party consent) means everyone in the conversation must agree.

US federal law is one-party. The Wiretap Act, part of the Electronic Communications Privacy Act (ECPA), lets a participant record unless the recording is made to commit a crime or a tort, meaning a civil wrong. Most US states follow the same approach. Canada’s Criminal Code also allows a participant to record their own conversation.

But a notetaker is not quite the same as you pressing record. A bot run by a vendor may be treated as a separate listener, and the vendor may use the audio for its own purposes. That is the argument at the centre of the Otter.ai case, and it is why “I consented, so it is fine” is no longer a complete answer.

What happens when people join from different states or countries?

This is the interstate call problem. If you are in Texas (one-party) and your client is in California (all-party), which rule applies? Courts have often applied the stricter law where the person recorded is located, especially in California. With remote teams, a single video call can easily include people in five jurisdictions.

The practical answer is to stop working out the minimum. Follow the strictest rule that could apply, which in most cases means telling everyone at the start and recording only if nobody objects. That one habit covers almost every market.

What is the Otter.ai lawsuit about?

Brewer v. Otter.ai was filed on 15 August 2025 in the federal court for the Northern District of California. The plaintiff, who did not have an Otter account, says the Otter Notetaker joined a meeting and recorded him without his consent. The complaint argues that the default settings asked only the host for permission, not the other attendees, and that Otter used the recordings to improve its speech recognition and AI models.

The claims include the federal Wiretap Act and California’s Invasion of Privacy Act (CIPA). The key argument is that one-party consent does not help when the recording is used for the vendor’s own commercial purposes, such as training AI. The case was later consolidated with similar suits as In re Otter.AI Privacy Litigation.

As of October 2026, it has been reported that the court allowed some of the core privacy claims to proceed in August 2026 and dismissed others. No class has been certified and Otter has not been found liable. Even so, the case has changed how vendors and buyers think about bots that join meetings automatically.

What is happening in the market right now?

AI meeting assistants have moved from early adopters to standard kit. Zoom, Microsoft and Google now build notetaking into their platforms, and specialist tools compete on accuracy, integrations and price. In healthcare, ambient AI scribes are being rolled out across hospital systems and GP practices in several countries.

Litigation has followed. Beyond the Otter cases, class actions filed from December 2025 under Illinois’ Biometric Information Privacy Act (BIPA) target speaker-recognition features that allegedly create “voiceprints”, a type of biometric identifier, without the written consent BIPA requires. Fireflies is among the companies sued. None of these claims had produced a final judgment as of October 2026.

Regulators are also issuing guidance. NHS England published guidance on AI-enabled ambient scribing products in April 2025 and has since updated it, and the UK medicines regulator, the MHRA, has published its own guidance on when these tools count as medical devices. Data protection authorities in Europe increasingly treat AI meeting tools as something employers must assess before rollout.

UK and EU: recording is the easy part, data protection is the work

In the UK, recording a call you are part of, for your own use, is generally lawful. Once a business records or transcribes calls, though, it is processing personal data under the UK GDPR. It needs a lawful basis, must tell people what it is doing and why, and must keep the data secure and no longer than necessary. The ICO’s guidance on monitoring workers expects employers to be open about monitoring and to assess its impact first.

The EU GDPR works the same way. Transparency means telling participants about the recording, the vendor and the retention period. If the call involves health, union membership or other “special category” data, stricter conditions apply. A data protection impact assessment (DPIA), a structured risk review, is often expected for workplace rollouts and is very likely for health settings.

Two further points matter in Europe. In Germany, introducing a tool capable of monitoring employees’ behaviour or performance usually needs the agreement of the works council, the elected employee body, under section 87 of the Works Constitution Act. And the EU AI Act has banned emotion recognition in the workplace since February 2025, with narrow medical and safety exceptions, so features that score participants’ sentiment or engagement deserve a careful look before you switch them on.

India, Canada and Australia

India has no specific statute on recording calls between private parties. The Supreme Court recognised privacy as a fundamental right in Puttaswamy (2017), and recordings made without knowledge can raise privacy and evidence questions. The Digital Personal Data Protection Act, 2023 will require clear notice and, usually, consent for processing personal data. Its core duties are scheduled to apply from 13 May 2027 under the DPDP Rules, 2025.

Canada lets a participant record under criminal law, but businesses covered by federal or provincial privacy laws must tell people they are being recorded and why. A short notice at the start of the call is the norm.

Australia is a patchwork. Each state and territory has its own surveillance or listening devices law. New South Wales, Western Australia, South Australia and Tasmania generally require the consent of all parties to record a private conversation, subject to limited exceptions. Other states are more permissive for participants, but the national Privacy Act still applies to most businesses.

Can a notetaker break client confidentiality or legal privilege?

It can. Lawyers, accountants, therapists and doctors owe duties of confidentiality, and sending a client conversation to a third-party AI vendor is a disclosure. Whether that is acceptable depends on the vendor’s terms, security and use of data. The American Bar Association’s Formal Opinion 512 says lawyers must understand how an AI tool uses client information and often need informed client consent before using self-learning tools.

Legal privilege, which protects lawyer-client communications from being disclosed in litigation, can be weakened if confidentiality is lost. In United States v. Heppner (February 2026), a federal judge in New York held that documents a defendant created with a consumer AI chatbot were not privileged, partly because the tool’s terms allowed the provider to use and disclose the data. That case was not about notetakers, but the reasoning applies: vendor terms that allow training or broad sharing make confidentiality harder to argue.

In healthcare, a US AI scribe vendor handling patient information is usually a “business associate” under HIPAA, so a signed business associate agreement (BAA) is needed before use. In England, NHS guidance expects a DPIA, clinical safety documentation, clear information for patients and clinician review of every note before it is saved to the record.

Which notetaker settings should I change?

Most of the risk sits in default settings, not in the idea of a notetaker itself. Spend ten minutes in the admin panel and you remove a large part of it. If you manage a team, set these centrally rather than leaving them to each user.

Are AI meeting summaries discoverable, and can I trust them?

Usually yes, they are discoverable. In litigation, “discovery” or “disclosure” means handing over relevant documents to the other side. Transcripts and AI summaries are documents. If a dispute is likely, a legal hold, an instruction to preserve relevant records, can apply to them, and deleting them afterwards can cause real problems.

Accuracy is the second issue. AI summaries can misattribute who said what, invent action items or turn a passing idea into a firm commitment. In a clinical note that can affect patient care. In a sales call it can become an alleged promise.

Treat every summary as a draft. Someone who was on the call should check it before it is shared, filed or relied on, and corrections should be made in the source record rather than in a side note.