Can You Record A Conversation Without Consent?

The short answer: it depends on where everyone is.

In the US, federal law and 38 states allow you to record a conversation you are part of without telling anyone else. 11 states require every participant to consent first.

In the EU, GDPR applies the moment a recording involves an identifiable person, which means a lawful basis and transparent disclosure are required before you hit record, regardless of where the recording device is located.

Get it wrong in either jurisdiction, and you’re looking at civil suits or regulatory fines that scale with company revenue.

Who actually has to consent: You, or everyone on the call?

The US and the EU start from opposite defaults, and you must understand both if you’re on international calls or work with European colleagues.

One-party consent states

The federal baseline is set by the Electronic Communications Privacy Act (18 U.S.C. § 2511): if you are a participant in a conversation, you can record it by consenting on your own behalf. No notice to anyone else is required.

This is one-party consent, and it applies in 38 states plus the District of Columbia.

All-party consent states and states with split rules

11 US states go further. In California, Delaware, Florida, Illinois, Maryland, Massachusetts, Montana, Nevada, New Hampshire, Pennsylvania, and Washington, every participant must know that the recording is happening and agree to it before it starts.

These are all-party consent states, and the penalties are not administrative. Unauthorized recording in Florida is a third-degree felony. Eavesdropping in Illinois, under the Illinois Eavesdropping Act, carries Class 4 felony exposure. Maryland and Massachusetts both sentence for up to five years in prison.

A few states sit outside both categories. Oregon follows one-party consent for phone calls but requires all participants to be specifically informed before recording in-person conversations.

Oregon requires notification, not agreement. Connecticut is one-party for criminal liability on in-person conversations but imposes civil liability for recording phone calls without all-party consent. Michigan's statute reads as all-party, but courts consistently apply a participant exception.

The EU framework: GDPR as the default

Under GDPR, a recording of a conversation involving an EU resident is personal data processing from the moment it begins.

That means you need a lawful basis under Article 6 before starting. Consent under GDPR must be freely given, specific, informed, and unambiguous, which rules out implied or retroactive consent.

EU professionals and employers who routinely record meetings with EU participants are operating under this layer on top of any national wiretapping law that may also apply. They must be able to demonstrate compliance with the processing principles under Article 5.

Researchers conducting interviews face additional requirements on top of this: IRB protocols, data security standards, and in some jurisdictions specific ethics board approvals.

You're in Texas. They're in California. Whose law applies?

Interstate and cross-border calls are where many professionals unknowingly create liability.

There’s no federal rule that definitively resolves which state's law governs a recording when participants are in different states. Courts differ on whether what matters is the recorder's location, the other participant's location, or both.

In practice, the consensus among legal professionals is to apply the strictest law that could plausibly apply. If anyone on a call is in California, Florida, Illinois, Pennsylvania, or another all-party state, treat the entire call as all-party, regardless of where you are sitting.

The practical rule for cross-jurisdiction calls

Announce at the start of every call that it is being recorded. State who is recording and what tool is capturing the audio.

Give participants a genuine opportunity to leave before substantive discussion begins.

Staying on the line after that announcement satisfies implied consent requirements in US states and goes some way toward GDPR's transparency obligation, though for EU participants you will still need a documented lawful basis.

Can you record a conversation at work without telling anyone?

Workplace recording sits at the intersection of three frameworks that rarely align: state wiretap law, federal labor law under the NLRA, and (for EU-based workplaces or remote teams with European employees) GDPR.

If you are the employee

In US one-party states, recording your own workplace conversations is generally lawful if you are a participant in them.

But your employer can still discipline you under a company recording policy even if the recording itself was legal. A lawful recording and a policy-compliant one are not the same thing.

In all-party states, recording a meeting with your manager without their knowledge can be a felony, regardless of your reason for doing it.

In the EU and UK, the bar for an employee secretly recording a workplace conversation is significantly higher. Covert recording without a lawful basis would likely violate GDPR's core transparency principle and potentially breach the implied duty of confidentiality in an employment relationship.

If you are the employer

In US one-party states, employers can record workplace conversations with advance notice: an employee handbook clause, posted signage, or direct notification before the program begins.

In all-party states, employers cannot mandate AI recording of employee meetings without obtaining consent from every participant before each session.

A blanket no-recording policy is permissible, but it cannot sweep up recording that employees are protected to do under NLRA Section 7, which covers concerted activity around wages or union organizing.

In the EU, recording employee meetings requires a documented lawful basis under GDPR and transparent disclosure in the employee privacy notice. It may also need works council consultation in many member states before any recording program is implemented.

Does a meeting bot in the participant list count as consent?

This is the question the legal system is currently working through, and the emerging consensus is no.

Why bot visibility is not the same as consent

When an AI note-taker joins a call and appears in the participant list, you may assume that everyone present is aware that recording is happening. Legal analysts and early court proceedings have rejected this logic.

The clearest test case is In re Otter.AI Privacy Litigation, a consolidated federal class action in the Northern District of California. It bundles four suits filed between August and September 2025, starting with Brewer v. Otter.ai Inc. (No. 5:25-cv-06911).

Plaintiff Justin Brewer was not an Otter user. His sales call was recorded because another participant had OtterPilot running. The complaint alleges violations of ECPA and California's Invasion of Privacy Act (CIPA). A motion-to-dismiss hearing is scheduled for July 15, 2026.

A separate case, Cruz v. Fireflies.AI Corp. (No. 3:25-cv-03399, C.D. Ill., filed December 18, 2025), centers on Illinois' Biometric Information Privacy Act (BIPA): Fireflies allegedly collected voiceprints from non-users who never consented.

Both cases point to the same issue from different legal angles: the default configurations of these AI note taker tools give non-user participants no meaningful route to consent before recording begins.

What proper consent for AI recording looks like

Before the call: notify participants in the meeting invitation that an AI recording tool will be active. Name the tool, state what it captures, and explain how the recording will be used and stored.

At the start of the call: announce verbally, on the record, that recording is underway. In all-party states, get affirmative verbal consent from each participant before substantive discussion begins. In GDPR jurisdictions, that disclosure also needs to cover the data controller's identity, the processing purpose, the legal basis, and the retention period. Document who consented and when.

What happens if you get it wrong?

Federal (US): Up to five years imprisonment under the Wiretap Act (18 U.S.C. § 2511). Civil damages under § 2520 of statutory damages between $10,000 per violation or $100 per day, whichever is greater, plus attorney fees and punitive damages. The recorded party does not need to prove actual harm to collect.

State (US):

• Florida: Third-degree felony, punishable by up to five years imprisonment
• Illinois: Class 4 felony
• Maryland and Massachusetts: Up to five years imprisonment
• California: Civil penalties of $5,000 per violation under CIPA (Cal. Penal Code § 637.2), plus potential misdemeanor charges

Even in one-party states, a lawfully obtained recording used to harass or blackmail someone creates separate civil and criminal liability.

EU/GDPR: Fines up to €20 million or 4% of global annual turnover for serious violations. Data subjects can also claim civil damages for distress and loss of control over personal data. Germany and France impose criminal penalties under national wiretapping law on top of GDPR.

When is it legal to record without telling anyone?

In the US

In US one-party states, recording your own conversations without notifying other participants is legal as long as you are a party to them. You cannot record a private conversation you are not part of. That is illegal under federal law in every state.

Implied consent covers a lot of ground in practice. A "this call may be recorded" announcement at the start of a call satisfies most all-party state requirements if the other party stays on the line. Businesses use this on every customer service call for exactly this reason.

Journalism and public interest recording carry narrow exceptions in some jurisdictions. Recording a public official in a public setting has been upheld as lawful in certain courts, but these exceptions are fact-specific and not a reliable defense to build a workflow around. Law enforcement can record with a court-issued warrant under federal and state wiretap statutes.

In the EU

The legitimate interest basis under GDPR Article 6(1)(f) can theoretically justify recording without explicit consent, but the balancing test is demanding: the legitimate interest must be genuine, necessary, and proportionate, and must not override the data subject's reasonable expectation of privacy.

Covert recording by private individuals almost never passes that test.

The clearest legal position in any jurisdiction is a documented record showing you disclosed the recording and the other party had a genuine opportunity to object before it began. If that record exists, you are in a defensible position on both sides of the Atlantic.

So, what’s the safest way to record conversations?

The safest recording practice in any jurisdiction is the same: disclose before you record, give the other party a genuine opportunity to object, and document that the disclosure happened. In one-party US states that is a choice, not a legal requirement. In all-party states and the EU, it is the baseline minimum.