State privacy and call-recording laws for AI notetakers

Why AI notetakers raise recording-law questions

An AI notetaker is a recording device. Most of them capture the audio of a meeting, turn it into a transcript and then summarize it. So before you think about AI at all, the old question applies: are you allowed to record this conversation, and whose consent do you need?

This page covers that question and the related one of state privacy laws. It's the area where our other guides say the least ("ask counsel whether any state privacy or recording laws apply"), and it's the area most likely to change. We name only states whose statutes we read on their own legislature's website. Everything here is a starting point for a conversation with your compliance team or counsel, not an answer for your firm.

The federal baseline: one-party consent

The federal wiretap statute, 18 U.S.C. § 2511, says it isn't unlawful for a person not acting under color of law to intercept a communication "where such person is a party to the communication or where one of the parties to the communication has given prior consent," unless the purpose is to commit a criminal or tortious act. That's usually called one-party consent: if you're in the meeting, you can consent for yourself.

Federal law isn't the end of it. States can and do set stricter rules, and an advisor in a one-party state talking to a client in an all-party state can be subject to the stricter law. Which state's law applies to a call that crosses state lines isn't something we can settle for you, and that uncertainty is the main reason to ask everyone.

States whose statutes call for everyone's consent

The table lists seven states whose recording statutes, read on the state's own official website on October 23, 2026, require the consent or knowledge of all parties in at least some situations. The wording differs: some apply only to "confidential" communications, some only to secret or hidden recording. Read the statute, and ask counsel how it applies to your meetings.

This isn't a complete list. Other states are often described as all-party consent states, and some have different rules for phone calls and in-person conversations. We've left them out because we haven't confirmed them from the statute. Laws change; confirm the rule for every state your clients are in.

The practical default: get everyone's consent, every time

The simplest approach that works in every state is the one our recordkeeping guide already recommends: ask everyone at the start of every recorded meeting, and keep a record that you did. That covers the client, a spouse or adult child who joins, a CPA or attorney on the call, and anyone else in the room.

A good consent process has three parts. Tell people before the recording starts, in plain words, that the meeting will be recorded and transcribed by an AI tool. Give them a real choice, including the option to turn it off for part of the meeting. And write it down, either in the calendar invite and the meeting notes or in the tool itself if it logs consent. Many notetakers announce themselves when they join, but an automated banner may not be enough on its own for every state or every client, so most firms add a spoken request too.

Also think about who isn't a client. If a prospect, a family member or another professional objects, the meeting goes ahead without the recorder. Build that into your process so advisors don't feel they have to argue for it.

• Add a recording notice to meeting invitations for any meeting the notetaker may join.
• Ask for verbal consent at the start of the meeting, after everyone has joined, and again if someone joins late.
• Record the consent in the meeting notes or CRM.
• Turn the recorder off when anyone declines, and make that easy to do.
• Check that your notetaker's settings match your policy (auto-join, announcement, who receives the recording).

State comprehensive privacy laws and financial firms

Recording laws are about whether you may record. State comprehensive privacy laws are about what you then do with personal information. Several states now have them, and they don't all treat financial firms the same way. Two examples show the range:

California. The California Consumer Privacy Act exempts personal information "collected, processed, sold, or disclosed subject to" the federal Gramm-Leach-Bliley Act, but that exemption is for the data, not the whole firm, and the statute says it doesn't apply to the section creating a private right of action for certain data breaches (Civil Code § 1798.145(e)). So a California-connected firm may still have CCPA duties for data outside GLBA, and breach exposure for data inside it.

Virginia. The Virginia Consumer Data Protection Act says it doesn't apply to any "financial institution or data subject to Title V" of the Gramm-Leach-Bliley Act (Va. Code § 59.1-576). That reads as a broader, entity-level exemption.

Regulation S-P is the SEC's privacy rule for the firms it covers, which is part of why GLBA exemptions come up for advisers and broker-dealers. But whether a particular state's exemption reaches your firm, and which of your data it covers (clients, prospects, website visitors, employees, meeting recordings), varies by state and isn't something we can answer here. That's a question for counsel, and it's worth asking before you roll out a notetaker or website chatbot to clients in a new state.

Where notetaker data ends up

Whatever the state law answer, the recording and transcript exist once the meeting ends. That raises the questions covered elsewhere in the hub: the vendor is likely a service provider under Regulation S-P, parts of the output may be required records under the books and records rules, and your vendor due diligence should cover retention, deletion and whether the vendor trains models on your data.

One more practical point: consent to record isn't consent to everything. If the vendor uses recordings to train its models, or if summaries are shared outside the firm, say so to clients or switch it off. Our page on disclosing AI use to clients has example wording to discuss with your compliance team.