Research
Is it legal to record a meeting? Consent rules explained
Dylan de Heer
You are about to hit record on a client call, and a small doubt lands: is it legal to record a meeting, or am I about to break a law I have never read? It is the right doubt to have. Recording laws are old, they vary by state and country, and the fines and lawsuits for getting them wrong are real.
The rules are also simpler than they look once you sort them into two questions: who has to agree before you record, and what you are allowed to do with the recording afterwards. The first is wiretapping and consent law. The second, in Europe, is data protection law.
This guide explains both in plain language: the one-party and all-party consent rules in the US, what GDPR adds in the EU and UK, and what changes when the thing doing the recording is an AI notetaker. It is general information, not legal advice; for a specific situation, ask a lawyer in your jurisdiction.
The short answer
Recording a meeting is legal in most places, provided the right people consent. In most US states, one participant's consent is enough, and that participant can be you. Around a dozen US states require every participant to agree. In the EU and UK, recording is legal but regulated: you need a lawful basis under GDPR, you have to tell people, and you cannot keep the recording longer than you need it. The safe rule everywhere is the same one: announce the recording and get agreement before you start.
Recording laws in the US: one-party vs all-party consent
US federal law sets the floor. Under the federal wiretap statute (18 U.S.C. 2510-2511), recording a conversation is legal with the consent of at least one party. If you are in the meeting, you are a party, so recording your own meetings is legal under federal law without asking anyone.
States can set a higher bar, and a group of them do. Per the Reporters Committee for Freedom of the Press recording guide, roughly eleven states require the consent of everyone in the conversation, including California, Delaware, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, New Hampshire, Pennsylvania, and Washington.
Rule | What it means | Where |
|---|---|---|
One-party consent | One participant agreeing is enough, and it can be the person recording | Federal law and most states |
All-party consent | Everyone in the conversation must agree before recording | Around 11 states, including California, Florida, Illinois, Maryland, Massachusetts, and Washington |
Mixed rules | The rule differs for phone calls vs in-person conversations | A handful of states, including Connecticut, Nevada, Missouri, and Oregon |
Three nuances matter in practice.
The rule can differ by medium. Missouri and Oregon require all-party consent for in-person conversations but not phone calls; Connecticut and Nevada run the other way. Do not assume the phone rule covers the conference room.
Expectation of privacy matters. Consent requirements generally attach where people reasonably expect privacy. A client call is exactly that setting.
Cross-state calls follow the strictest participant. A video call routinely spans states. If anyone on the call might be in an all-party state, the practical rule is to treat the whole call as all-party and ask everyone.
Getting it wrong is not a slap on the wrist. Illegal recording can carry criminal penalties, and most states also allow the recorded person to sue, in some states with multiplied damages and legal fees.
Does GDPR make it illegal to record meetings in the EU and UK?
No, but it changes the question. In the EU and UK, a meeting recording that captures people's voices is personal data, so GDPR governs it whenever the recording is for work rather than purely personal use. That adds obligations that US consent law does not have.
You need a lawful basis. For business recordings this is usually either consent or legitimate interest. UK ICO guidance treats legitimate interest as workable for routine business records, but it requires a three-part test: a genuine purpose, necessity, and a balance against the rights of the people recorded.
Consent has a high bar. If you rely on consent, it must be freely given, specific, informed, and as easy to withdraw as to give. A banner saying "by joining you agree" does not clear that bar on its own.
You must tell people either way. Whatever the basis, GDPR's transparency rules mean participants should know they are being recorded, why, and where the recording goes.
You cannot keep it forever. Retention has to match the purpose. A recording kept "just in case" with no deletion point is a finding waiting to happen.
Where the recording is processed matters here too. A recording uploaded to a cloud service adds a processor relationship, a data processing agreement, and often a transfer outside the EU to the compliance file. A recording that never leaves your own machine keeps that file short, which is the architectural argument behind why Weeve is GDPR-compliant by default.
Do the same rules apply to AI notetakers?
Yes. Legally, an AI notetaker recording a meeting is you recording the meeting; the tool acts on your behalf. Consent law does not care whether the recorder is a phone in your pocket or an AI assistant, and GDPR applies to the audio and the transcript alike, because both contain personal data.
Two things do change in practice.
Disclosure gets easier to forget. A visible recording light or a bot named "Meeting Assistant" in the participant list at least hints that something is recording. A notetaker that captures audio quietly, with no bot in the call, puts the duty to announce entirely on you. That is not a reason to avoid botless tools, it is a reason to say the sentence out loud before you start: "I would like to record this so I can be present instead of typing, is that okay with everyone?"
The follow-up question got sharper. Once people know AI is involved, the question they actually ask is where the recording goes. With a cloud notetaker the honest answer involves a vendor's servers, subprocessors, and a retention policy. With a fully local tool like Weeve, the answer is one sentence: the recording, the transcript, and the summary stay on this Mac and are never uploaded. That answer does not replace consent, but it makes consent much easier to get, especially from a nervous client. The design behind it is described in how Weeve stays private by default.
How to stay on the right side of the rules
Five habits cover almost every situation.
Ask first, everywhere. Announce the recording and get a yes before you start, even in one-party states. It is the only rule that works across every jurisdiction, and it protects trust, which is worth more than the legal minimum.
Apply the strictest rule in the room. On multi-state or international calls, assume the most protective law applies. If anyone might be in California or in the EU, behave as if everyone is.
Be ready to answer "where does this go?" Know your tool's honest answer before someone asks. If the answer involves a cloud you cannot explain, that is worth fixing before the next confidential call.
Keep recordings only as long as you need them. Set a deletion habit. Under GDPR this is an obligation; everywhere else it is simply good practice.
Write the consent down. A line in the meeting notes ("recording agreed by all participants") costs nothing and settles arguments later.
Platform tools have their own switches: Zoom, Google Meet, and Teams each show recording indicators when their built-in recording runs. The walkthroughs for doing this locally instead are in how to record and transcribe a Google Meet call, how to transcribe Zoom meetings automatically, and how to record a Microsoft Teams meeting locally. The indicators help with disclosure, but they do not replace asking.
What this means for you
Recording meetings is legal almost everywhere, with consent. The question is never whether you can record, it is who has to agree first.
One-party states are the exception you should not rely on. The moment a call crosses state or national borders, the strictest rule in the room is the one that matters.
In the EU and UK, consent is only half the job. You also need a lawful basis, a retention limit, and an answer to where the recording is processed.
AI notetakers follow the same law as a tape recorder. Botless capture does not remove the duty to ask; it removes the visual reminder, so build the announcement into your meeting habit.
Where the recording lives decides how hard the compliance is. A recording that never leaves your device has no processor, no transfer, and no cloud copy to explain.
Recording client conversations is worth doing well: the notes are better and nobody has to type through the meeting. If your work makes people nervous about where recordings end up, the reassuring answer is a recording that never leaves your Mac. Ask for consent, then let Weeve's free Starter plan do the rest on-device: download Weeve for Mac.
FAQ
Is it legal to record a meeting without telling anyone?
In most US states, yes in the narrow legal sense: one-party consent means your own agreement is enough. In all-party consent states such as California, Florida, and Illinois it is illegal, and in the EU and UK secret workplace recording will usually fail GDPR's transparency rules. Professionally, secret recording is a bad idea everywhere: if the recording surfaces, the legal defence will not repair the trust.
Do I need consent to record meetings with an AI notetaker?
Yes, the same consent you would need for any other recording method. The notetaker records on your behalf, so one-party states need at least your own consent, all-party states need everyone's, and the EU and UK require a lawful basis and transparency under GDPR. Tools differ only in how visible the recording is: a botless notetaker leaves the announcement entirely to you, so make asking part of how you start the meeting.
Which US states require all-party consent?
Per the Reporters Committee for Freedom of the Press, roughly eleven states require everyone's consent, including California, Delaware, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, New Hampshire, Pennsylvania, and Washington. A few states split the rule between phone and in-person conversations, so check the specific state's law before relying on a list.
Does GDPR ban recording work meetings?
No. GDPR permits recording with a lawful basis, usually consent or legitimate interest, plus transparency and a retention limit. What it effectively bans is casual recording: no stated purpose, no announcement, no deletion date. It also makes the processing location part of the compliance picture, which is why a recording that stays on your own device is the simplest case.
Is it legal to record a Zoom, Google Meet, or Teams call?
Yes, under the same consent rules as any other meeting. The platforms' built-in recording shows participants an indicator, which helps disclosure, but platform indicators do not replace consent where all parties must agree. If you record locally with a notetaker instead of the platform's cloud recording, announce it yourself, because there is no indicator to do it for you.
What is the penalty for recording a meeting illegally?
It depends on the jurisdiction, and it can be serious: illegal recording can be a criminal offence with fines or jail time, and most US states also let the recorded person sue, in some cases with multiplied damages and legal fees. Under GDPR, unlawful processing of a recording can draw regulatory fines on top. The cost of asking first is one sentence; the cost of not asking can be a case.
If no bot joins the call, do people still have to be told?
Legally, the consent rules are identical with or without a visible bot; ethically, the quieter the tool, the more the telling matters. Botless notetakers exist so a robot does not sit in your participant list unsettling clients, not so recording can happen in secret. Ask before you start, and if the client asks where the recording goes, a local tool lets you answer: it stays on this Mac.
