Are AI note takers legal? Consent rules, a court order and what 5 vendors publish (October 2026)

The strictest participant's rule decides, and three states ask everyone

Federal law needs the consent of one participant. Under 18 U.S.C. § 2511(2)(d) it is not unlawful to record a call when you are a party to it or one party has agreed beforehand, unless the purpose is a crime or a tort. A note taker you start yourself in your own meeting meets that test.

State law can be stricter. California Penal Code § 632 punishes anyone who records a confidential communication without the consent of all parties. The penalty is a fine up to $2,500 per violation, jail up to one year, or both. A communication is confidential when circumstances reasonably show that a party wants it kept among the participants. Section 637.2 lets an injured person sue for the greater of $5,000 per violation or three times actual damages, and it says no actual damage is needed. Washington's RCW 9.73.030 requires the consent of all participants in a private conversation and treats consent as obtained when one party announces, in a reasonably effective way, that the recording is about to start, with the announcement itself recorded. Florida's § 934.03(2)(d) makes interception lawful when all parties gave prior consent.

What this means for you: if even one participant may sit in California, Washington or Florida, treat the meeting as all-party. I read the statutes of these three states only, so a state missing here is not automatically one-party.

Sources: [1][2][3][4][5]

A federal judge let the Otter.ai case go ahead because of what the vendor keeps

The case is In re Otter.AI Privacy Litigation, No. 5:25-cv-06911, in the Northern District of California. Seven plaintiffs from California, Illinois and Washington say the Otter Notetaker joined their meetings as a "silent participant", recorded and transcribed them without the consent of all participants, and kept the content to train Otter's speech models.

On August 13, 2026 Judge Eumi K. Lee granted the motion of Otter.ai to dismiss in part. The federal wiretap claim, the California Invasion of Privacy Act claim and two Illinois voiceprint claims survived. For buyers the reasoning matters. A vendor that only acts as its customer's tool is not a third-party eavesdropper, but the plaintiffs allege Otter also keeps the conversations and uses them to improve its own models. In the judge's words, "Software providers may qualify as third-party interceptors under these circumstances."

Several claims failed. Two California plaintiffs described their meetings only as private or sensitive, so their privacy-tort claims were dismissed with leave to amend, as was the Washington claim. The § 632 claim stayed alive only for the plaintiff who alleged a call with a medical professional. The computer-fraud and computer-data claims were dismissed as well.

On September 17, 2026 Otter filed its answer. It denies the core allegations and lists defenses, among them that the conduct happened with the plaintiffs' knowledge, authorization or consent. Nothing has been decided on the merits. I read the order and the answer as copies of the court record on CourtListener.

What this means for you: the dispute is whether a vendor is only your tool or also a listener. The more a vendor reuses transcripts for itself, the weaker the "tool" argument gets, so read the training line before you read the feature list.

Sources: [6][7][8]

All five vendors put the consent duty on the person who records

Otter's terms of September 19, 2025 say you are "solely responsible for providing any notices to, and obtaining consent from, individuals" in connection with recordings. tl;dv's terms of May 18, 2026 make you responsible for collecting consent from all participants before recording starts. Notta's terms of September 2, 2026 and Tactiq's terms, last updated June 6, 2019, both say it is your responsibility to follow the law, including informing participants. jamie's privacy policy of September 15, 2026 says the same. You are responsible for informing the other participants, as the laws that apply to you require.

What this means for you: no vendor takes the legal duty off you. A notice setting can make the job easier, but none of the terms says the tool does the job for you. The table shows the other columns I compared.

Sources: [9][10][11][12][13]

Notice features differ far more than the terms do

tl;dv offers a consent page. When it is on, tl;dv replaces the meeting link in your calendar with a consent link, participants choose whether to allow recording, and a decline stops the recording for that meeting for good. It works only for calendar meetings that record automatically, and the organizer is not asked.

Tactiq sends a message to the meeting chat when transcription starts. Its help center shows how a user switches that message off, and how an Enterprise admin makes it mandatory for the team (article of February 19, 2026).

jamie records on your device. Its security page says no bot joins, no participant sees a third party in the meeting, and no calendar invite goes out. That protects the host's privacy but leaves the notice to you, because nothing tells the other people.

For Otter and Notta I found notice settings mentioned in search results, but both help centers showed me a security check when I opened them. I did not go around it, so I rate none of their notice features.

Sources: [14][15][16][17]

Training: Otter says yes, three say no, Notta does not say

Otter's privacy policy, effective June 16, 2026, lists as a purpose "training our proprietary AI technology on de-identified audio recordings and on transcriptions". Its security page adds that the training is automatic, that humans do not review the data, and that its AI service providers may not train on customer data.

tl;dv states in its policy of September 9, 2026 that it does not use customer content to train or fine-tune models, for itself or anyone else. jamie says the same in its policy of September 15, 2026, and extends it to its model providers. Tactiq's help article of July 24, 2026 says its model provider does not train on submitted data. Notta's privacy policy excludes data from Google Workspace APIs from training and says nothing about audio and transcripts from calls.

I found two corrections to our own profiles. Tactiq's privacy center names "OpenAI's enterprise API" as its AI provider, our profile followed that, and the later help article names Microsoft Azure OpenAI, so I corrected our entry. Our tl;dv profile said all data centers are in Europe; the policy says data is primarily hosted in the EU, and limited transcript portions can be processed in the United States if the user picks that AI hosting location.

What this means for you: before you buy, ask each vendor one question in writing: do you train on audio and transcripts, and does your model provider? If the policy is silent, treat the answer as unknown.

Sources: [18][19][20][13][21][22][23]

Retention runs from three months to until you delete it

tl;dv keeps recordings and transcripts of free users for 3 months and of paying users until the account is deleted. It also stores the email addresses of non-user participants for 5 years or until a deletion request. jamie deletes the audio once the transcript is done and keeps text until you delete it, and its security page lists retention rules you can set.

Otter moves deleted conversations to the trash and empties it after 30 days. Tactiq archives a deleted meeting for 30 days, and Business and Enterprise admins can set automatic deletion between 6 and 60 months. For Notta I found no period on the terms, privacy or security page.

What this means for you: a short retention period is the cheapest way to cut risk. If EU or UK participants are covered, the vendor and you also have to say how long data is stored, because GDPR Article 13(2)(a) requires the storage period or the criteria for it.

Sources: [20][17][19][24][25]

If anyone is in the EU or UK, GDPR adds a second layer

GDPR does not demand consent for every recording. Article 6(1) lists several legal bases, among them consent in point (a) and legitimate interests in point (f). What it does demand is information about purpose, legal basis and storage period (Article 13) and a binding contract with the vendor as processor (Article 28(3)). The German version of this article covers the works council and § 201 of the German criminal code.

Voiceprints raise a separate issue. Article 9(1) bans processing of biometric data used to identify a person, unless an exception applies. jamie's policy treats its speaker memory as biometric and relies on explicit consent, and Otter's policy lists speaker identification and biometric information among the data it handles. The data protection authority of Baden-Württemberg wrote in June 2026, for municipal councils, that AI transcription is not biometric processing as long as voice only becomes text and speaker separation stays temporary, without profiles tied to names.

Sources: [26][27][28][29][13][18]

What I would do before switching one on

Put a notice in the invite, say it again when the call starts, and ask for a clear yes from outside guests and whenever the topic is health, money or HR. Then set the training switch and the retention period before the first recording, not after.

The self-test and the checklist below turn this into steps. For regulated settings such as medical, financial or HR calls, ask counsel in the state or country your participants sit in.

Sources: [6][4]