Meeting Recording Consent Laws by State and Country

Recording a meeting sounds like a simple act, but the legal ground underneath it shifts depending on where the participants happen to be sitting when the call connects. Federal law sets a permissive floor, one-party consent, but a significant number of states and a growing list of countries build stricter rules on top of it, and the penalty for guessing wrong ranges from a civil judgment to a criminal charge. The mistake almost everyone makes is assuming the law that governs is the law of wherever they happen to be sitting. It isn't. Anyone using an AI notetaker, a call recorder, or a personal voice memo app on a business call needs to know exactly which statute governs that specific conversation, not which one governs the state they live in.

The federal baseline comes from Title III of the Omnibus Crime Control and Safe Streets Act of 1968, later amended by the Electronic Communications Privacy Act of 1986. Title III allows one-party consent: if a person is a party to a conversation, that person's own knowledge that it's being recorded satisfies federal law, full stop. No notice to the other participants is required. But federal law only sets a minimum, and states can raise the bar but never lower it. The penalties for violating the federal statute aren't symbolic either: up to five years in prison and fines as high as $250,000 under the criminal provision, while the civil provision, § 2520, lets a plaintiff recover actual damages or a statutory minimum of $100 per day of violation or $10,000, whichever is greater.

The constitutional scaffolding behind all of this traces to Katz v. United States, a numbered case citation. 347 (1967), where the Supreme Court held that the Fourth Amendment protects a person's reasonable expectation of privacy in a conversation, not just physical spaces. Every state wiretap statute is, in some sense, a legislature's attempt to define where that expectation applies and where it doesn't. The exposure doesn't stop at the moment of recording, either. Bartnicki v. Vopper, a numbered case citation. 514 (2001), addressed whether the First Amendment insulates a media outlet that broadcasts an illegally recorded conversation. That protection is narrow at best and does not extend to the person who did the recording, meaning a bad recording can create liability that ripples outward long after the call ends.

Most AI notetaker users get tripped up on one specific assumption: that federal one-party consent covers them because that's the law in their home state. But the call that creates the problem is rarely the one with a colleague down the hall. It's the video call with a participant dialing in from California, or Florida, or Illinois, none of which recognize one-party consent as sufficient. Remote work didn't create this legal complexity, but it multiplied the number of calls where it actually matters, and most compliance failures trace back to that single wrong assumption.

The 37/9/5 breakdown: how states actually divide

Compiled tallies vary slightly depending on how a given source classifies the trickier states, but the shape of the map is consistent. Thirty-seven jurisdictions, 36 states plus the District of Columbia, follow one-party consent. Nine states require strict all-party consent. Five states are hybrids, where the applicable rule depends on the medium of the conversation or the context in which it happens.

Some sources count 38 one-party jurisdictions instead of 37, or list anywhere from 9 to 12 all-party states. The discrepancy almost always comes down to how Connecticut, Delaware, Hawaii, Maine, and Oregon get classified, since each of those states applies different rules to phone calls, video calls, and in-person meetings. A summary chart is a starting point, not a substitute for reading the actual statute in the state at issue.

For practical compliance purposes, it makes more sense to think in terms of twelve jurisdictions rather than nine: the nine strict all-party states, plus Connecticut, Delaware, and Oregon, whose stricter rule governs the scenario businesses run into constantly, which is a phone or video call. Hawaii and Maine are technically hybrid too, but in most everyday business-call scenarios they lean toward one-party treatment, with specific exceptions worth knowing about (Maine's is detailed below).

One-party consent, defined operationally, means this: a participant in the conversation knows it's being recorded, and that knowledge is enough. There's no legal requirement to announce it out loud. All-party consent flips that. Every person whose voice appears on the recording has to be informed and has to agree, and proof of that agreement generally requires that each party was clearly informed before the recording began. In hybrid states, the rule depends on the medium: an in-person conversation might follow one rule while a phone call follows another.

"All-party" and "two-party" consent get used interchangeably across sources, but "two-party" is a misnomer, and a sloppy one. On a three-person call, all three people need to consent, not just two of them. The term persists despite being technically inaccurate whenever more than two people are on a call.

The 37 one-party consent jurisdictions and what "low risk" actually means

The one-party list includes Alabama, Alaska, Arizona, Arkansas, Colorado, the District of Columbia, Georgia, Idaho, Indiana, Iowa, Kansas, Kentucky, Louisiana, Michigan, Minnesota, Mississippi, Missouri, Nebraska, New Jersey, New Mexico, New York, North Carolina, North Dakota, Ohio, Oklahoma, Rhode Island, South Carolina, South Dakota, Tennessee, Texas, Utah, Vermont, Virginia, West Virginia, Wisconsin, and Wyoming.

Two states deserve a closer look because their statutory history is messier than a simple list suggests. Michigan's eavesdropping statute was ambiguous for years, but courts eventually settled the question: when the person doing the recording is a participant in the conversation, one-party consent applies. Illinois used to be one of the strictest wiretapping states in the country, and courts narrowed the statute over time to cover only "private" conversations and electronic communications specifically. Illinois still requires all-party consent for both oral and electronic communications today, so it belongs in the strict category covered in the next section, not here, but the statute's history is worth knowing given how often older references get it wrong.

Maine sits in an odd spot too. It's classified as one-party, but a state statute adds a further condition. § 710 carries an "unaided hearing" exception: a participant can't record a conversation using a device that lets them hear something they couldn't have heard on their own, a directional microphone picking up a conversation across a room, for instance. That exception matters far more for in-person meetings than for standard video calls.

"Low risk" doesn't mean risk-free, and treating it that way is the second most common mistake after the home-state assumption. The one-party rule only protects a recording if the person doing the recording is a genuine participant in the conversation. Recording a meeting that a person isn't part of, say, a shared office line or an unattended conference room, is not protected by one-party consent rules, since those rules require the person doing the recording to be a genuine participant. There's also a workplace wrinkle: employers in one-party states can generally monitor employee calls if the employee has been made aware of the monitoring policy in advance and that awareness satisfies the consent requirement. That protection doesn't automatically extend to a customer on the other end of that same call, particularly if the customer is calling from an all-party state. Plenty of businesses in one-party states still open every call with "this call may be recorded," and while it's not legally required where they sit, it's a cheap insurance policy against exactly that scenario.

The 9 strict all-party states: what each one actually requires

California, Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Pennsylvania, and Washington make up the strict all-party group. A few reference sources classify these states differently: some list Nevada here instead of treating it as a hybrid, and Illinois's classification sometimes varies depending on the source consulted. Anyone with real exposure in a specific state should read that state's statute directly rather than trusting a summary.

California's rule, under Penal Code § 632, bans recording a "confidential communication," defined as any conversation where the parties have a reasonable expectation of privacy, unless the parties should reasonably expect to be overheard or recorded anyway. Consent has to be express, either verbal or written; implied consent doesn't satisfy the statute. California courts have found that even a whispered exchange in a shared office can count as confidential, which gives some sense of how broadly the law gets read. The risk level here is about as high as it gets: heavy fines, plus real exposure to civil suits, covering both oral and electronic communications.

Florida's statute, § 934.03, requires consent from every party and covers wire, oral, and electronic communications alike. One quirk sets Florida apart from the rest of the group: the statute criminalizes the attempt to record, not just a completed recording. Turning on a recorder and failing to capture any usable audio still violates the law if the intent was there. Criminal liability attaches wherever a reasonable expectation of privacy exists, making Florida one of the more demanding states in the all-party group.

Massachusetts takes a different structural approach. Rather than requiring affirmative, expressed consent from each participant, the statute bans secret recording. As long as participants reasonably know a conversation might be recorded, the law is generally satisfied, but a hidden or unannounced recording made by a participant still violates the statute. The distinction matters mechanically: Massachusetts isn't asking whether everyone agreed, it's asking whether anyone was recorded without knowing it was possible.

Pennsylvania runs one of the strictest wiretap statutes on the books: full all-party consent, high risk. Washington and Maryland both cover in-person and electronic communications with the same all-party requirement, and both carry high risk exposure. Montana requires all-party consent for any conversation where privacy is reasonably expected, sitting at medium-high risk, and New Hampshire requires consent for all private conversations. Delaware requires consent for the interception of communications; some sources classify it as hybrid rather than strict, but in practice it functions as an all-party jurisdiction for electronic communications, carrying high risk.

Across all nine, the safest mechanical habit is the same one: a verbal disclosure at the start of the call, "this call may be recorded," followed by the other participants staying on the line. A verbal disclosure followed by the other participants remaining on the line is widely regarded as a practical baseline for compliance, which makes that one sentence the cheapest compliance measure available. Skipping it to save five seconds of awkwardness is the trade nobody should make.

The five hybrid states where the medium changes the rule

Connecticut, Delaware, Hawaii, Maine, and Oregon each apply different rules depending on how the conversation happens, not just where it happens.

Connecticut requires all-party consent for phone calls under CGS § 52-570d, but its eavesdropping statute is silent on video calls specifically, which leaves that format in a genuine grey area. In-person conversations, by contrast, only need one-party consent. That combination makes any remote or hybrid meeting a medium-risk proposition and any face-to-face meeting a low-risk one, a strange split for a single state to hold, and a strong argument for defaulting to disclosure on every video call regardless of what the statute technically requires.

Nevada runs the opposite pattern: all-party consent for phone and electronic communications, one-party consent for in-person oral conversations. It gets classified as mixed rather than strictly hybrid in some references, but the practical effect on a remote team is the same either way.

Oregon's statute, ORS § 165.540, requires notice to all parties before recording an in-person conversation, but only one-party consent for phone calls. The Ninth Circuit upheld the statute en banc by a 10-2 vote in January 2025, and the Supreme Court denied certiorari on October 6, 2025, so the law is settled as of late 2025. Even so, many reference sites recommend treating Oregon as an all-party state for electronic and phone scenarios as a matter of practical caution, since the in-person notice requirement signals how the state's legislature thinks about privacy generally.

Hawaii's rule may differ depending on whether the conversation happens in person or over the phone, and its classification tends to land in a situational or mixed category. The safest approach, and the one most reference sources recommend, is to default to all-party disclosure regardless of medium.

Maine's hybrid status comes back to that "unaided hearing" exception under the relevant state statute, § 710 and § 709(4): one-party consent applies generally, but not if the recording device lets someone hear something they couldn't have heard unaided. That exception is squarely aimed at in-person meetings recorded with a directional or remote microphone, not standard video calls.

There's a practical wrinkle here for anyone using an AI notetaker. A botless desktop recorder, the kind that captures whatever audio is playing on the device, is a different recording medium than a bot that joins a video call as a visible participant. In a hybrid state, those two mediums can fall under two different consent rules for the exact same meeting. When the applicable rule is unclear in a hybrid state, defaulting to all-party disclosure before recording starts is the only approach that actually avoids the ambiguity, and it should be the default, not the exception considered only after something goes wrong.

Cross-state and cross-border calls: which law applies when participants are in different jurisdictions

Once a call includes participants sitting in different states, the general rule is that the stricter law wins. If even one participant is physically located in an all-party consent state, that state's requirement effectively governs the whole call, regardless of where the recording device sits or where the other participants are located. Anyone running calls across state lines who hasn't internalized this is exposed, full stop.

Kearney v. Salomon Smith Barney, Inc. is the case that made this concrete. California's Supreme Court applied California's dual-consent law to protect California residents even though the other party on the call was calling from Georgia, a one-party state. The ruling means the location of the person being recorded matters just as much as the location of the person doing the recording, a harder standard to satisfy than most people assume going in.

There's a trap hiding in phone numbers, too. A ported number can carry an area code from a state the caller no longer lives in, so a 415 area code doesn't guarantee the person on the other end is sitting in California. Physical location determines which law applies, not the area code stamped on the caller ID, and treating the two as equivalent is exactly how a compliant-seeming call turns into a liability.

The cheapest safe harbor available to any business making calls across state lines is the same verbal disclosure mentioned earlier: announce that the call may be recorded, and treat continued participation as consent. It satisfies all-party requirements everywhere they apply and costs nothing in the one-party states where it isn't strictly required. Take a Zoom call with participants dialing in from New York, California, and Florida at the same time. New York's one-party rule doesn't set the standard for that call. California's and Florida's all-party requirements do, because the most permissive participant's home state never controls the outcome. The strictest one does, every time.

International calls stack another layer of complexity on top of the domestic patchwork, since GDPR, Canadian privacy law, and various country-specific frameworks all impose their own thresholds. That's worth its own separate look.

An AI notetaker that joins a call as a visible, named bot participant gives every person on the call a clear signal, before recording starts, that the conversation is being captured. That visibility is what makes cross-state compliance actually workable in practice, since it replaces a manual announcement that's easy to forget with a consent signal built into the mechanics of the call itself.

International frameworks: GDPR, Canada, and other major jurisdictions

Europe's data privacy framework sets a materially higher bar than any state statute in that country, and treating it as just another all-party rule is a category error. Consent has to be obtained before any personal data, including a recorded voice, gets collected in the first place. GDPR's definition of valid consent is demanding: it has to be freely given, specific, informed, and unambiguous. Simply continuing to talk after someone mentions a recording, the standard that satisfies all-party consent in Massachusetts or California, does not meet GDPR's bar on its own.

Recording under GDPR also needs a valid legal basis, either consent itself or a legitimate interest that survives a balancing test weighing the business's interest against the individual's privacy rights. Whether "legitimate interest" covers routine business call recording is a genuinely contested question across EU member states, with no single settled answer. On top of the consent question, GDPR's data minimization and storage limitation principles mean a recording can't just sit in a company's archive indefinitely. It has to be deleted once it's no longer needed for whatever purpose justified collecting it in the first place.

Canada's federal privacy law, PIPEDA, requires prior consent before recording a conversation that might contain personal information, and it applies to private-sector organizations across the country. Quebec adds another layer on top of that federal baseline: Law 25, in force since 2022 with additional phases rolling out in 2023 and 2024, imposes stricter provincial requirements than PIPEDA alone would require.

None of this is optional detail for a company running meetings across borders. A team recording calls with participants in the EU or in Quebec is operating under a materially different, and stricter, consent standard than the one that governs even California or Florida. Calling GDPR "California's all-party rule, but international" understates the gap by a wide margin. Consent under that framework has to be specific and affirmative in a way that no statute in that country requires. all-party statute demands, and that difference is exactly what separates a compliant recording practice from an expensive mistake.