AI Notetakers and Recording Tools in the Enterprise: Wiretapping, Consent, Privilege, and Retention

AI meeting recorders have become standard equipment in the modern workplace. Tools like Otter.ai, Fireflies, Fathom, and integrated meeting assistants in Zoom and Microsoft Teams are recording, transcribing, and summarizing business conversations at an unprecedented scale. The convenience is real. So are the legal risks — and they are more serious than most businesses using these tools understand.

This post covers the full legal landscape: federal and state wiretapping obligations, attorney-client privilege exposure, trade secret risks, and what your corporate policies must address to manage these tools responsibly.

The Federal Framework: ECPA and the One-Party Consent Default

The foundational federal law governing electronic recording of conversations is the Electronic Communications Privacy Act of 1986, specifically Title I, known as the federal Wiretap Act. Under ECPA, it is generally unlawful to intentionally intercept an electronic communication — but there is an important consent exception. The interception is permissible when one of the parties to the communication has consented to it.

This one-party consent rule means that, under federal law, a meeting host who has enabled an AI notetaker has arguably consented to the interception on behalf of the one-party consent standard — at least as to their own communication. That framework applies to the host’s participation. Whether it extends cleanly to the recording of all other participants is a more complicated question, and it is the question at the heart of the litigation now working through federal courts.

The “crime-tort” exception is where things get legally interesting. ECPA’s one-party consent exception has a carve-out: it does not apply when the recording is made for the purpose of committing a criminal or tortious act. In the major AI notetaker litigation pending as of 2026, plaintiffs have argued that the AI vendors’ use of recorded meeting content to train their speech recognition and language models — without the consent of non-user participants — constitutes a tortious act (specifically, intrusion upon seclusion and conversion). If that argument holds, the one-party consent defense evaporates, and the recording would be an unlawful interception under federal law.

The implications of this theory, if courts adopt it, extend well beyond the specific vendors named in the lawsuits. Any enterprise that uses an AI meeting tool that the vendor trains on meeting content could face exposure under the same logic.

State Wiretapping Laws: The All-Party Consent Problem

Federal law is the floor, not the ceiling. At least 13 states require all-party consent — meaning every participant in a recorded conversation must consent to the recording. California, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Oregon, Pennsylvania, Washington, and Connecticut all have all-party consent requirements, with varying specifics.

The penalties in these states are serious. Violation of California’s Invasion of Privacy Act (CIPA) is a criminal offense — a fine of up to $2,500 per violation or imprisonment. Illinois, Pennsylvania, and Florida have similar criminal exposure. Beyond criminal liability, these statutes create private rights of action with statutory damages that are attractive targets for class action plaintiffs.

In the context of AI meeting recorders, the all-party consent requirement creates a practical problem: the meeting host’s consent does not satisfy the obligation for participants who are in all-party consent states. If you are hosting a meeting with participants in California, Massachusetts, or Washington, and an AI notetaker joins the call, every participant must have consented — not just you as the host.

This is not a theoretical concern. In re Otter.AI Privacy Litigation, filed in the Northern District of California in December 2025 and consolidating four class actions filed between August and September 2025, is pending before Judge Eumi K. Lee. The plaintiffs allege that Otter recorded and transcribed meeting participants’ communications in violation of both ECPA and CIPA without obtaining consent from non-user attendees. Otter’s motion to dismiss is scheduled for hearing in May 2026.

Additional active litigation includes Cruz v. Fireflies.AI in Illinois (filed December 2025, asserting claims under the Illinois Biometric Information Privacy Act) and multiple CIPA suits targeting AI tools used in customer-facing contexts. The litigation wave is real and expanding.

Consent: What Actually Satisfies the Legal Standard

Given the wiretapping exposure, what does adequate consent look like for AI meeting recorders?

For one-party consent states, the host’s use of an AI recording tool generally satisfies the federal and state consent standards — provided the host (a party to the conversation) has authorized the recording and the recording is not being made for a tortious purpose. The key vulnerability is the “crime-tort” exception argument.

For all-party consent states, adequate consent requires that every participant affirmatively consents before recording begins. This cannot be satisfied by a generic terms-of-service provision the vendor wrote. It requires that each meeting participant knows they are being recorded by an AI tool and agrees before the recording starts.

Best practice in all-party consent states:

1. At the start of any meeting, verbally disclose that an AI recording tool is active and identify the tool.
2. Give participants the ability to opt out by leaving before the recording begins or muting themselves.
3. For recorded meetings with external participants — customers, vendors, partners, opposing parties — obtain written consent where practical, particularly for sensitive or legally significant meetings.
4. Configure your AI meeting tools to announce themselves when joining a call, rather than joining silently. Several enterprise tools offer this setting; confirm it is enabled.

The silent join problem. One of the specific allegations in the Otter.ai litigation is that Otter’s default configuration did not notify non-user attendees that they were being recorded, and that the option to configure automatic notifications was only available on the most expensive enterprise tier. For companies using these tools in states with all-party consent requirements, this default creates unacceptable legal risk. Verify your tool’s default notification settings immediately.

Attorney-Client Privilege: The Third-Party Disclosure Risk

Recording conversations that include legal discussions creates a distinct and serious risk: disclosure to a third-party AI system — the recording vendor — may waive attorney-client privilege.

The attorney-client privilege protects communications between an attorney and client made in confidence for the purpose of obtaining or providing legal advice. The “in confidence” element is critical. When a privileged communication is shared with a third party who is not part of the attorney-client relationship, privilege is typically waived.

When an AI notetaker records, transcribes, and stores a legal strategy discussion, the vendor becomes a third party in possession of that content. The question is whether the disclosure to the vendor destroys privilege. Courts have not yet uniformly answered this question in the AI meeting recorder context, but the risk is real and the trend in case law is concerning.

One federal court has already addressed the related issue in the context of public AI tools: a judge ruled that using a public AI service to process client communications without adequate confidentiality controls waived privilege over the information processed. The same logic extends to AI meeting recorders storing transcripts in vendor cloud systems.

Factors that affect the privilege analysis:

• Whether the vendor has access to transcript content or only processes encrypted data
• Whether the vendor’s terms permit use of content for model training or other purposes
• Whether the vendor has a data processing agreement with adequate confidentiality protections
• Whether the enterprise version of the tool prevents content from being used to train general models
• Whether transcripts are stored on vendor servers or only locally

Practical guidance: Do not use AI notetakers in meetings that include privileged legal discussions unless you have verified that the specific tool and configuration you are using provides adequate protections. If your general counsel or outside counsel is on the call and discussing litigation strategy, risk assessments, or legal advice, disable the AI recording tool for that meeting — or exclude it at the start. This is a policy question, not just a technology settings question.

New York Bar Formal Opinion 2025-6 addressed a related question, concluding that secretly activating a recording tool during a client conversation violated professional responsibility rules even in a one-party consent state. Lawyers using AI meeting tools have additional professional responsibility obligations that exceed what the law requires of non-lawyer users.

Trade Secret Exposure from AI Meeting Recorders

Beyond privilege, AI meeting recorders create trade secret exposure for enterprises that discuss confidential business information in recorded meetings.

Trade secret protection requires that the owner maintain reasonable measures to keep the information secret. When confidential business information — pricing strategies, product roadmaps, M&A discussions, customer relationships — is captured by an AI tool whose data handling practices are not fully controlled, the question arises whether that disclosure undermines the reasonable secrecy measures required to maintain trade secret status.

The risk compounds when the vendor’s terms of service permit use of meeting content to train or improve AI models. If your proprietary business strategy is captured in a transcript that is subsequently used to train a language model, that information effectively becomes part of the model’s knowledge — potentially accessible to other users.

The enterprise version issue. Several major AI meeting tool vendors distinguish between their consumer and enterprise tiers on this point. Enterprise tiers often include contractual commitments that customer content will not be used to train general models, that data is stored in isolated environments, and that transcripts are not retained beyond defined periods. These protections are typically absent from free or standard-tier plans.

For any enterprise deployment of AI meeting tools, verify:

1. The vendor’s data processing agreement and what it commits to regarding content use
2. Whether the enterprise tier includes commitments against using your meeting content for model training
3. The data retention period and deletion practices for transcripts
4. The vendor’s security controls for stored transcript data

Corporate Policy Requirements

The combination of wiretapping exposure, privilege risk, and trade secret concerns means that AI meeting recorders cannot be treated as unmanaged personal tools in an enterprise context. Every company deploying these tools needs a formal policy that addresses the following.

Approved tools list. Not all AI meeting tools carry the same legal risk profile. The enterprise tiers of major platforms — with data processing agreements, content isolation, and no-training commitments — are substantially different from free consumer tools. Your policy should define which tools are approved for which contexts.

Consent procedures. Your policy must define consent requirements for internal and external meetings, including specific procedures for meetings with participants in all-party consent states. This should include a requirement to verbally announce the AI tool at the start of any meeting with external participants.

Prohibited uses. The policy should identify meeting contexts where AI recording tools are prohibited or restricted: meetings with legal counsel discussing privileged matters, meetings with potential litigation counterparties, meetings discussing trade secret information that has been designated as such, and any meetings where participants are known to be in all-party consent jurisdictions without documented consent.

Data retention limits. Define how long AI-generated transcripts and recordings are retained, where they are stored, and who has access. Long-term retention of detailed meeting transcripts in vendor cloud environments is an unnecessary risk. Set reasonable retention limits and enforce them.

Vendor management. Any vendor whose AI tool is approved for enterprise use should be subject to a data processing agreement that includes commitments consistent with your obligations under applicable privacy and data protection law, content isolation commitments, and contractual restrictions on using your meeting content for model training.

Employee training. Employees need to understand the policy, not just receive it. The number of employees who will join a customer call with an AI notetaker bot without disclosing it — or who will record a meeting with an attorney present without understanding the privilege implications — is not zero. Policy training matters.

What to Do Right Now

If your organization uses AI meeting recording tools and you have not already done the following, these are immediate action items.

Audit which AI meeting tools are in use across your organization. In most enterprises, the official enterprise deployment is not the only one — individual employees are using consumer-tier tools without IT approval. Shadow AI use in meeting recorders is common and creates the highest-risk profile.

Review the default settings of your approved tools. Are they configured to announce themselves when joining? Is content being used for model training? Are transcripts stored in vendor cloud systems with no retention limits?

Update your meeting policies to address all-party consent state requirements and privileged communication protections.

Negotiate adequate data processing agreements with any AI meeting tool vendors whose tools are approved for enterprise use.

The Stakes Are Real

The litigation wave against AI notetaker vendors is in its early stages. The legal theories are being tested, but the exposure is well within established frameworks — ECPA and CIPA have been successfully used in technology privacy class actions for years. The crime-tort exception theory, if adopted, significantly expands the potential liability surface.

For enterprises using these tools: the convenience of AI meeting recorders is genuine. But convenience without governance is a liability strategy. The legal risks are manageable with proper policies and vendor contracts. They are not manageable by ignoring them.

This post is for general informational purposes only and does not constitute legal advice. Reading this post does not create an attorney-client relationship. If you have questions about your specific situation, consult a qualified attorney.