Is Your Meeting Recorder Breaking the Law?

In August 2025, Otter.ai got hit with a federal class-action lawsuit for secretly recording private conversations. Not for a data breach. Not for selling data. For doing exactly what the product was designed to do: join meetings and record them without meaningful consent from every participant.

Four months later, Fireflies.ai caught its own lawsuit. This time under Illinois' Biometric Information Privacy Act. The allegation: their speaker diarization feature was creating voiceprints of meeting participants without consent. At $1,000 to $5,000 per violation per person, the math gets ugly fast.

If you're using an AI meeting recorder right now, these cases should have your full attention.

The legal landscape most people ignore

US recording law splits into two camps: one-party consent and all-party consent.

In one-party consent states, you can legally record a conversation you're part of. You don't need to tell anyone. Most states work this way.

But eleven states require every single person on the call to agree before anyone hits record: California, Delaware, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, New Hampshire, Pennsylvania, and Washington. In these states, recording without consent isn't just rude. It's a crime. Some of these statutes carry criminal penalties, not just civil liability.

Justia maintains a comprehensive 50-state survey if you want the full breakdown. Bookmark it. You'll need it.

The interstate problem nobody talks about

Here's where remote work makes everything worse.

You're in Texas. One-party consent state. You're recording a Zoom call. Your colleague is in California. All-party consent state. Which law applies?

The strictest one.

When participants are in different states, courts generally apply the more protective standard. That means if even one person on your call is in an all-party consent state, you need everyone's permission. And on a typical work call with people scattered across the country, you probably have no idea where everyone is dialing in from.

Now think about your AI meeting bot. It joins the call. It starts recording. Did it ask for consent from the person working from their home office in Pennsylvania? From the contractor in Florida?

This is exactly the scenario that got Otter.ai sued.

Voiceprints and the BIPA problem

Recording consent is just the first layer. Illinois' Biometric Information Privacy Act adds another one entirely.

BIPA treats biometric identifiers (fingerprints, facial geometry, voiceprints) as sensitive data that requires explicit written consent before collection. It's one of the few US privacy laws with a private right of action, meaning individuals can sue directly. They don't need to wait for a state attorney general to act.

The penalties are severe. $1,000 per negligent violation. $5,000 per intentional or reckless violation. Per person. Per instance. Companies have paid nine-figure settlements under BIPA.

Speaker diarization, the feature that puts names next to who said what, often works by building a voiceprint of each participant. That's biometric data. If your meeting recorder uses AI-based speaker identification and any participant is in Illinois, you could be generating BIPA liability with every single call.

That's the theory behind the Fireflies.ai class action. And it's a theory courts have been receptive to.

Institutions are already reacting

The lawsuits are just the public tip. Behind the scenes, organizations are quietly banning AI meeting recorders altogether.

Harvard, Cornell, Stanford, and Oxford have all prohibited AI meeting bots from campus meetings and lectures. These aren't knee-jerk reactions from technophobes. These are institutions with sophisticated legal counsel making a calculated risk decision.

Research backs them up. A widely cited study found that 84% of people change how they speak when they know an AI notetaker is present. People self-censor. They hedge. They avoid saying what they actually think. The tool that's supposed to capture authentic conversation is destroying it.

What this means for you

If you're using a cloud-based meeting recorder that joins calls as a bot, stores audio on remote servers, or uses AI speaker identification, you're carrying legal risk in at least three areas:

• Wiretapping statutes in all-party consent states
• Biometric privacy laws if the tool creates voiceprints
• Organizational policy violations as more employers and institutions ban these tools

This isn't a hypothetical. Real companies are facing real lawsuits right now. The legal landscape around AI meeting tools is getting more restrictive, not less.

Worth noting: I'm a product builder, not your attorney. The specifics of your situation depend on your jurisdiction, your company's policies, and the tools you're using. If you're in a regulated industry, talk to someone who passed the bar.

A different architecture for a different legal reality

We built MeetingVault after watching these lawsuits unfold and thinking: the problem isn't meeting notes. The problem is how these tools capture them.

MeetingVault draws a hard line between recording and note-taking.

Audio is captured temporarily, transcribed on your Mac using on-device AI, and then the audio is deleted. Automatically. What remains is text. Notes. There are no audio files sitting on your hard drive, no recordings stored on anyone's server, and no audio that could be subpoenaed, leaked, or discovered in litigation.

Speaker separation uses audio channels: microphone input is "Me," system audio is "Them." No voice analysis. No voiceprints. No speaker diarization. No biometric data of any kind. Zero BIPA exposure.

Nothing leaves your machine. No cloud servers. No accounts. No bot joining your call that announces itself to the room (or worse, doesn't). MeetingVault runs from your menu bar, captures audio locally, converts it to text, and deletes the source material.

It's closer to typing notes during a meeting than to deploying a surveillance tool. That distinction matters more every day.