The AI notetaker joined the call: consent, recording laws and what a small business switches off
A third of US workers have had an AI notetaker in a meeting and a quarter of them were never asked. The all-party consent states and their penalties ($5,000 per recording in California), why a vendor's bot is not the same as pressing record, the Otter, Fireflies and Granola lawsuits, what Otter, Fireflies, Zoom, Teams, Meet and Fathom do by default, the exact settings to change, and a six-line rule for a small firm.
In September 2024 an engineer named Alex Bilzerian had a Zoom call with a venture capital firm. He logged off; the investors stayed on and talked among themselves. Their Otter notetaker kept going, and a little later Otter emailed him the transcript, including the part after he'd left, where they discussed what they saw as the company's weak points. He walked away from the deal and posted about it. Otter's answer was that users control their sharing settings.
That is the whole problem in one story. A notetaker joins because someone's calendar told it to, records for its vendor as well as for its user, and sends the result to whoever was on the invite. For a small business it raises three questions: did everyone agree to be recorded, where does the recording go, and what happens to a client's confidential words. This piece covers the US consent rules, the lawsuits that are testing them, what the main tools do by default, and the settings a small firm switches off.
How common it is, and how often people are asked
In a July 2026 survey of 500 employed US adults (Pollfish, for the law firm Kolmogorov Law, margin of error 4.4 points), a third had already had an AI notetaker in their work meetings. Most weren't reliably asked first:
The tools are big. Otter reported more than 35 million users and over a billion meetings in December 2025; Fireflies claims more than 20 million users; Fathom had over 400,000 monthly users when Superhuman bought it in September 2026. Zoom, Microsoft Teams and Google Meet now have their own notetakers built in.
The law: one party or everyone
Federal law is one-party: a person on a call may record it, or let it be recorded, as long as one party consents (18 U.S.C. § 2511(2)(d)). About 38 states and DC follow that rule. The rest require the consent of everyone on the call, and the penalties are not small:
Calls across state lines take the strict rule. In Kearney v. Salomon Smith Barney (2006), the California Supreme Court applied California's law to a Georgia office that recorded calls with clients in California, even though Georgia is one-party. The same decision gives the way out: a business that tells everyone at the start of the call that it is recording does not break the statute. With five people on a call in three states, the practical rule is that all five are told and none objects.
The sums add up quickly in California because damages are per violation. A sales team that records one call a week with two California prospects, without telling them, has 52 × 2 = 104 recordings in a year; at $5,000 each that is a claim of $520,000 before anyone shows harm. In At-Bay's 2026 claims data, lawsuits under the California Invasion of Privacy Act already make up 34% of third-party cyber claims.
Why a notetaker is different from pressing record
Recording laws were written for a person with a recorder. The one-party rule protects a participant who records. A notetaker belongs to its vendor, which isn't on the call, and the cases now in court argue that the vendor is an eavesdropper who needs everyone's consent:
None of this has reached a verdict, and the vendors deny the claims. But the complaints describe default settings, which is useful: the defaults are what put a small business in the picture. Under Illinois' biometric law, damages are $1,000 per negligent violation and $5,000 per intentional one, per person.
What each tool does by default
Prices sit between about $8 and $30 per user per month for the standalone tools (Otter Pro $8.33 a month billed yearly, Fireflies Pro $10, Fathom Premium $16, Read AI Pro $15; third-party price trackers, August 2026). The built-in ones come with Zoom, Microsoft 365 Copilot and Google Workspace plans.
What to switch off, and what to switch on
Otter. Account Settings → Meetings → Notetaker: turn off auto-join. In sharing settings, set the default audience for shared notes to private, so a transcript isn't emailed to everyone on the invite. If you stop using Otter, revoke its calendar access as well; the bot keeps joining until you do.
Fireflies. Settings → Meeting Settings → Auto-join calendar meetings: change "All meetings with web-conf link" to "Only when I invite Fireflies". Check who can see notes (teammates, anyone with the link).
Zoom. Web portal → Settings → AI Companion: untick "Automatically start Meeting Summary" and set "Share summary with" to only the host. As an account admin, add a custom disclaimer that attendees must accept, and set transcript retention as short as you can.
Microsoft Teams. In the meeting policy, turn on "Require participant agreement for recording and transcription": nobody can unmute or share until they agree. Set "Manage external bots and their access to meetings" to block detected bots (the BlockDetectedBots option, rolled out from September 2026) or at least keep the default, which holds them in the lobby as unverified.
Google Meet. As a Workspace admin, require explicit consent for Gemini notes. When you turn on "Take notes for me" from a calendar invite, untick "Also turn it on for future instances" unless you mean it.
Fathom. Opt out of training on de-identified meeting data in account settings. tl;dv: turn on consent collection (Settings → Personal Settings → Preferences → Automations); it's off by default.
For guests' bots. When a client's notetaker turns up in your meeting, you can ask who it belongs to and whether the recording is shared, or leave it in the lobby. On sensitive calls, say at the start that you'd rather it wasn't recorded.
Client confidentiality
For professionals with confidentiality duties, consent to record is only half of it. The other half is what the vendor does with the content.
- Lawyers. ABA Formal Opinion 512 (July 2024) says lawyers need a client's informed consent before putting confidential information into a self-learning AI tool, and boilerplate in an engagement letter isn't enough. The New York City Bar's Opinion 2025-6 (December 2025) applies that to recording and summarising client calls: tell the client, get consent, know where the vendor stores it, whether it trains on it and how to delete it. Its Opinion 2026-2 (August 2026) says the default for calls with non-clients is not to record. In February 2026 a federal judge in New York held that a defendant's chats with a public AI tool were not privileged (United States v. Heppner); no court has yet applied that to a meeting transcript, but nobody wants to be first.
- Therapists, clinics and anyone handling health data. A notetaker that hears patient information needs a business associate agreement. Otter offers one only on Enterprise, Fireflies on Enterprise with private storage, Read AI on Enterprise+, Zoom on eligible paid plans with some AI features excluded. No BAA, no notetaker on those calls.
- Accountants, consultants, agencies. NDAs often forbid sharing client information with third parties without consent. A vendor that keeps and trains on a transcript is a third party.
Outside the US
In the EU and UK a recording or transcript is personal data. The business using the tool is the controller, needs a lawful basis (usually legitimate interests between businesses) and must tell people before recording starts. Spain's data protection authority said in 2026 that transcription is not a low-risk utility and may need a data protection impact assessment where the risk is high. A vendor that trains on the transcripts for its own purposes becomes a controller in its own right, which your privacy notice has to cover.
A notetaker rule for a small firm
Six lines are enough for most businesses with under twenty people:
1. Auto-join is off for everyone. The notetaker joins only meetings you add it to.
2. Announce it twice: a line in the invite, and a sentence at the start with the recording on, so the agreement is on it. If anyone objects, switch it off.
3. Never on these calls: legal advice, health, HR and disciplinary matters, negotiations, or anything under an NDA unless the other side agreed in writing.
4. Summaries go to you, not to the invite list. You send what's needed after reading it.
5. Keep transcripts 90 days unless a project needs them longer, and use a tool that doesn't train on them (or opt out).
6. Check the summary before you act on it. Notetakers mishear names, numbers and who agreed to what.
Put it with the rest of your AI rules; our one-page AI policy for a ten-person company has room for it. If an AI voice agent answers your phone, the same recording rules apply to every caller; our piece on AI receptionists covers the disclosure line.
Say where everyone on the call is and whether a notetaker joins: see whether everyone has to agree, the law and penalty in each place, and the lines to put in the invite and say at the start. Runs in your browser.
Open the recording consent checkSources
Law: 18 U.S.C. § 2511; Cal. Penal Code 632 and 637.2; Fla. Stat. 934.03; 720 ILCS 5/14-4; 18 Pa.C.S. 5703; Digital Media Law Project, recording calls; Layer3Labs, two-party consent states (Sep 2026); RCFP, Delaware; Davis Wright Tremaine on Kearney v. Salomon Smith Barney (Jul 2006).
Cases and incidents: NPR on the Otter lawsuit (15 Aug 2025); Scribbl, Otter lawsuit timeline (Oct 2026); tl;dv, AI meeting recorder lawsuits (Oct 2026); Barnes & Thornburg on the Granola case (Aug 2026); UC Today on Otter and the Bilzerian call (Apr 2026); At-Bay 2026 InsurSec Report.
Tools: Otter privacy policy (Jun 2026); Carleton College on Otter's notetaker (2026); Fireflies auto-join settings, privacy policy and HIPAA; Zoom AI whitepaper: notice, admin controls, data use; Microsoft, Copilot in Teams and transcription, Microsoft 365 Copilot privacy, Office 365 for IT Pros on blocking bots (Aug 2026); Google Meet, take notes for me and Workspace generative AI privacy hub; Fathom privacy policy (Aug 2026); Read AI on privacy; Otter, 35 million users (Dec 2025).
Survey and professional guidance: Kolmogorov Law / Pollfish survey via Stacker (Jul 2026); ABA Formal Opinion 512 summary; NYC Bar Formal Opinion 2025-6; Harvard Law Review blog on United States v. Heppner (Mar 2026); ICO innovation advice; Covington on Spain's AEPD transcription guidance (2026). This is a guide to how the rules work, not legal advice for your situation.