California AI Meeting Recording Laws (2026)

California requires the consent of every participant before an AI meeting recorder captures a confidential conversation. Cal. Penal Code 632 requires all-party consent for confidential conversations, and that requirement applies fully to AI transcription bots. California law does not require a particular form of consent, and a clear announcement at the start can mean a conversation is no longer confidential under Penal Code 632. For calls involving a cell or cordless phone, though, Penal Code 632.7 requires every party's consent with no confidentiality element, so explicit consent remains the safest practice. Recording without that consent exposes users and companies to criminal penalties and civil damages of at least $5,000 per violation, or three times actual damages, whichever is greater.

California's privacy laws place significant limits on AI meeting recording tools. Under the California Invasion of Privacy Act (CIPA), codified in Cal. Penal Code §§ 631 and 632, recording a confidential conversation requires the consent of every participant. This all-party consent requirement has made California a frequent forum for litigation against AI transcription services, with multiple class action lawsuits filed against Otter.ai, Google, and other providers.

The stakes are substantial. CIPA violations carry both criminal penalties (up to $2,500 and one year in jail for a first offense) and civil liability (the greater of $5,000 per violation or three times actual damages). For companies deploying AI meeting tools across California-based workforces, compliance is not optional.

California's Recording Consent Framework

CIPA: The Two Key Sections

California's wiretapping and eavesdropping protections rest primarily on two sections of the Penal Code.

Section 631 prohibits wiretapping and interception of communications in transit. The statute makes it illegal to tap or make unauthorized connections with telegraph or telephone wires, or to "willfully and without the consent of all parties to the communication" read, attempt to read, or learn the contents of any communication while it is in transit. Section 631 also prohibits using information obtained through illegal wiretapping.

Section 632 prohibits eavesdropping on or recording confidential communications. A "confidential communication" is defined as one carried on in circumstances that reasonably indicate any party to the communication desires it to be confined to the parties present. This includes most business meetings, private phone calls, and virtual meetings where participants have a reasonable expectation that the conversation will remain between those present.

Section 632.7 separately makes it a crime to intercept or intentionally record, without the consent of all parties, a call in which at least one phone is a cell phone or cordless phone. It has no confidentiality element, and in Smith v. LoanMe (2021) the California Supreme Court held that it applies to the parties to a call, not just outsiders. Whether it reaches internet-based calls, such as app-based video meetings, has not been decided by a California appellate court.

Together, these sections require the consent of all parties before any recording or interception of confidential communications. This all-party consent standard is significantly more restrictive than the one-party consent rule followed by the majority of states and by federal law under 18 U.S.C. § 2511.

The Ribas v. Clark Precedent

The California Supreme Court's 1985 decision in Ribas v. Clark (38 Cal.3d 355) established a foundational precedent: even listening to a conversation without the consent of all parties can constitute a CIPA violation. In Ribas, the court held that a complaint alleging that someone secretly listened to a phone call on an extension, at one party's request but without the other's knowledge, stated a claim under Section 631.

The court reasoned that "secret monitoring denies the speaker an important aspect of privacy of communication, the right to control the nature and extent of the firsthand dissemination of his statements." This principle has direct implications for AI meeting tools. Under Ribas, an AI system that listens to and processes a conversation without all-party consent may violate CIPA even if it never produces a traditional "recording." The act of listening and learning the contents is itself sufficient.

What Constitutes "Consent" Under CIPA

CIPA does not specify a particular form of consent (written, verbal, or implied), and no California statute says that a recording notice plus staying in the meeting counts as consent. The California Supreme Court said in Kearney v. Salomon Smith Barney (2006) that a business that clearly tells every party at the start of a call that it is being recorded would not violate Penal Code 632, because the call is then not confidential. But for calls involving a cell or cordless phone, Penal Code 632.7 requires the consent of all parties, and in Smith v. LoanMe (2021) the court left open whether a beep tone or notice followed by staying on the call counts as consent.

However, relying on implied consent is risky. The safest approach under California law is to obtain explicit verbal or written consent from all participants before activating any recording or AI transcription tool. Simply having a bot join a meeting with a visible name like "Otter.ai Notetaker" may not constitute adequate notice to establish consent, particularly if participants do not understand what the bot is doing.

The Otter.ai Litigation in California

Case Overview

In August 2025, a class action complaint was filed against Otter.ai in the U.S. District Court for the Northern District of California. The lead case, originally captioned Brewer v. Otter.ai Inc., alleges that Otter's AI notetaker products (OtterPilot and Otter Notetaker) joined virtual meetings, recorded participants, and used the captured audio to train machine learning models without securing the consent required under CIPA and federal law.

Several related cases were subsequently consolidated into In re Otter.AI Privacy Litigation (No. 5:25-cv-06911), including Case Nos. 25-cv-7187, 25-cv-7462, and 25-cv-7712.

Key Allegations

The consolidated complaints allege that Otter.ai engaged in a pattern of privacy violations:

• Otter's AI bots joined meetings as silent or near-silent participants, recording audio without obtaining consent from non-host attendees
• The auto-join feature, enabled by default, scraped calendar invitations and joined meetings autonomously
• Under default settings, consent was sought only from the meeting host, not from other attendees
• Otter's most expensive "Enterprise" plan was the only tier that offered the option to notify non-user attendees
• Recorded content was used to train AI models without disclosure or consent
• Names, emails, and metadata were collected from calendar integrations

Legal Claims

The lawsuits assert violations of multiple California and federal statutes:

• CIPA §§ 631 and 632: Unlawful interception and eavesdropping on confidential communications
• Electronic Communications Privacy Act (ECPA): Federal wiretapping violations under 18 U.S.C. § 2511
• Computer Fraud and Abuse Act (CFAA): Unauthorized access to computer systems
• California Comprehensive Computer Data Access and Fraud Act: State computer fraud claims
• Illinois Biometric Information Privacy Act (BIPA): Collection of voiceprints without written consent
• Unfair Competition Law (UCL): Unfair and deceptive business practices
• Common law and equitable claims: Intrusion upon seclusion and unjust enrichment (a conversion claim was later withdrawn)

Current Status

On August 13, 2026, Judge Eumi K. Lee granted in part and denied in part Otter.ai's motion to dismiss the consolidated complaint. The CIPA claim survived. The court held that plaintiffs plausibly alleged Otter acts as a third-party eavesdropper under Section 631(a), because Otter is alleged to retain conversation data and use it to improve its own machine learning models rather than acting solely as the meeting host's recording tool.

The court wrote that "because Plaintiffs plausibly allege a violation of section 631(a), Count 8 survives regardless of whether Plaintiffs alternatively state a claim under section 632." On the Section 632 theory specifically, only the plaintiff who alleged a call with a medical professional pleaded a "confidential communication" with enough factual detail; allegations that a conversation was merely "private" or "sensitive" were held to be conclusory.

The federal ECPA claim also survived: even if Otter counted as a party to the meetings, the court held that plaintiffs plausibly alleged it intercepted conversations for a tortious purpose (training its own models for its own gain), which removes the federal one-party consent defense under 18 U.S.C. 2511(2)(d). Both Illinois BIPA claims, the Unfair Competition Law claim, the unjust enrichment claim and the declaratory relief claim survived as well. The court dismissed the CFAA claim, the California Comprehensive Computer Data Access and Fraud Act claim, the Washington Privacy Act claim, and several plaintiffs' intrusion upon seclusion and California constitutional privacy claims, all with leave to amend. Plaintiffs were given 14 days to file an amended complaint. No amended complaint appears on the docket; Otter answered the consolidated complaint on September 17, 2026, and filed an amended answer on October 29, 2026.

The case is now in discovery, and the court entered a stipulated protective order on August 20, 2026. The court has not ruled on the merits or on class certification; under the current schedule, the class certification motion is due May 13, 2027.

The Ambriz v. Google "Capability Test"

Case Background

In Ambriz et al. v. Google LLC, plaintiffs alleged that Google Cloud Contact Center AI (GCCCAI), an AI-powered customer service system used by companies like Verizon, Hulu, GoDaddy, and Home Depot, violated CIPA by listening to and transcribing customer service calls without the callers' consent. Callers spoke with virtual agents and human representatives but were not informed that Google's AI was intercepting and processing their conversations.

The Ruling

On February 10, 2025, the Northern District of California denied Google's motion to dismiss. The court's analysis turned on a distinction that matters for AI meeting recording tools operating in California.

Courts within the Ninth Circuit have used two tests for determining whether a software service violates Section 631(a): the "extension test" and the "capability test."

The extension test asks whether the third party acts merely as an extension of one of the parties to the communication (like a person listening on an extension phone). Under this test, if the AI tool functions purely as a recording device for one of the parties and does not use the data independently, it may not violate CIPA.

The capability test is broader. It asks whether the third-party vendor has the capability to use intercepted data for its own purposes, regardless of whether it actually does so. The court applied this test in Ambriz and found that plaintiffs plausibly alleged Google had the "capability" to use wiretapped data to improve its AI and machine learning models. That capability alone was enough to survive a motion to dismiss. The court took the capability test from an earlier decision, Javier v. Assurance IQ (N.D. Cal. 2023), and acknowledged that other courts use the extension test instead.

The case, now called In re Google Cloud Contact Center AI Privacy Litigation, later narrowed. On October 22, 2026, the same judge sent some plaintiffs to individual arbitration and dismissed the remaining Home Depot callers' claims, with leave to amend by November 12, 2026. The two Home Depot accountholders had agreed to a privacy statement disclosing that call recordings could go to service providers, which the court read to include Google; the third caller plausibly alleged he did not consent, but none of the three alleged facts showing Google intended to record without consent. The court also said that the common practice of recording customer-service calls did not, by itself, show that the third caller impliedly consented to having his call shared with an unannounced third party such as Google.

Impact on AI Meeting Tools

Where courts apply it, the capability test creates significant exposure for AI meeting recording companies in California. Virtually every AI transcription service has the theoretical capability to use recorded conversations for model training, product improvement, or data analytics, so under that approach a no-training privacy policy may not be enough to avoid a claim.

But federal courts in California remain split: some ask only whether a vendor could use the data for its own purposes, and others look at whether it actually does. The court in the Otter.ai case found third-party status on allegations of actual use without adopting the capability test. Ambriz is a pleading-stage trial-court ruling that binds no other court.

Given that uncertainty, securing all-party consent before recording any conversation involving California participants is the safest course for AI meeting tool providers.

California AG Advisory on AI and Privacy (January 2025)

On January 13, 2025, California Attorney General Rob Bonta issued two legal advisories addressing how existing California law applies to artificial intelligence systems. These advisories have direct implications for AI meeting recording tools.

Advisory 1: Existing Law Application

The first advisory gave guidance to entities that develop, sell, and use AI about their obligations under California's existing legal framework, including CIPA, the California Consumer Privacy Act (CCPA), civil rights laws, competition laws, and election misinformation statutes. On CIPA, the advisory said the law "may also impact AI training data, inputs, or outputs," noted that it restricts recording communications without the consent of all parties, and said developers and users "should ensure that their AI systems, or any data used by the system, do not violate CIPA."

Advisory 2: Healthcare AI

The second advisory specifically addressed AI in healthcare settings, reinforcing that privacy protections apply when AI tools process medical conversations or patient data.

Practical Effect

The AG's advisories are not new law but carry significant weight. They signal that the California Attorney General's office views CIPA and other existing privacy statutes as relevant to AI systems, which include AI meeting recorders. Businesses deploying AI recording tools in California should treat the advisories as a compliance roadmap.

California's Evolving AI Legislation

SB 942: California AI Transparency Act

California enacted SB 942, the California AI Transparency Act, which requires "covered providers" (those with AI systems having over 1 million monthly users accessible in California) to provide free, publicly available tools that allow users to detect whether content was created or altered by their AI systems. The law's effective date was originally January 1, 2026, but Assembly Bill 853 delayed implementation to August 2, 2026, and it has been in effect since then.

While SB 942 primarily targets AI-generated content detection rather than recording consent, it reflects California's broader commitment to AI transparency and may influence how courts evaluate AI meeting tools' disclosure obligations.

SB 243: Companion Chatbots Act

Effective January 1, 2026, SB 243 establishes safety requirements for "companion chatbots," including mandatory AI disclosure and heightened protections for minors. Though focused on chatbot interactions, the law's disclosure requirements reinforce the principle that California expects transparency when consumers interact with AI systems.

The Broader Trend

The AG's January 2025 advisories, combined with SB 942, SB 243, and the active CIPA litigation against AI recording companies, create a legal environment where AI meeting tools face extensive compliance obligations. Companies that record California participants' confidential conversations without all-party consent risk criminal prosecution, civil damages, and regulatory enforcement.

Popular AI Meeting Tools and California Compliance

California does not require a particular form of consent. The California Supreme Court has said, in Kearney v. Salomon Smith Barney (2006), that clearly telling all parties at the start of a call that it is being recorded means the recording does not violate section 632, because the conversation is then not confidential; a party who does not want to be recorded may decline to continue. For calls involving a cell or cordless phone, though, Penal Code 632.7 requires the consent of all parties, and the court left open in Smith v. LoanMe (2021) whether a notice followed by staying on the call counts as consent.

A bot name alone may not be adequate notice, and notice from the host does not settle whether an AI vendor that keeps the data is a third-party eavesdropper under section 631, so explicit consent remains the safest practice. Best practice is to verbally confirm consent at the start of every recorded meeting or obtain written consent in advance.

Penalties for CIPA Violations

Criminal Penalties

CIPA violations are "wobblers" in California, meaning prosecutors can charge them as either misdemeanors or felonies depending on the circumstances.

Civil Damages

Under Cal. Penal Code § 637.2, any person injured by a CIPA violation may bring a civil action and recover the greater of $5,000 per violation or three times actual damages. In cases involving multiple recorded conversations, courts may award $5,000 for each individual recording, making class action exposure for AI meeting tool companies potentially enormous.

For example, if an AI bot recorded 1,000 meetings involving California participants without proper consent, the company could face civil damages of $5 million or more, plus attorney's fees and injunctive relief.

Exclusionary Rule

Penal Code 632(d) makes evidence obtained by illegally recording a confidential conversation inadmissible in judicial, administrative, legislative and other proceedings, except as proof in a case about the violation itself. In criminal cases, however, the California Supreme Court held in People v. Guzman (2019) that Proposition 8's Truth-in-Evidence provision abrogated that exclusion, so a relevant recording can be used in a criminal prosecution.

The exclusion still applies in civil, administrative and other non-criminal proceedings, including to AI-generated transcripts and summaries of an unlawfully recorded conversation. The person who made the recording can still face criminal charges and a civil lawsuit for it.

Employer and Workplace Considerations

Mandatory All-Party Consent in the Workplace

California employers cannot rely on one-party consent to record workplace meetings. Every employee, client, vendor, or other participant in a recorded confidential meeting must consent. A clear announcement at the outset can mean a conversation is no longer confidential under section 632. For calls involving a cell or cordless phone, though, Penal Code 632.7 requires the consent of all parties with no confidentiality element, and Smith v. LoanMe (2021) held that it applies to the parties themselves. That court left open whether a notice followed by staying on the call counts as consent, and no California appellate court has decided whether 632.7 reaches app-based meetings. Documented consent is the safer course. Employers should implement clear, documented consent procedures before deploying any AI meeting recording tool.

A practical approach includes adding recording consent language to meeting invitations, verbally confirming consent at the start of each meeting, and allowing participants to leave without penalty if they do not wish to be recorded.

Remote and Hybrid Work Complications

Courts have not settled which state's law governs a meeting that spans states. In Kearney v. Salomon Smith Barney (2006), the California Supreme Court held that California law generally applies when a business in a one-party state records calls with California clients, but it applied that rule only going forward and used Georgia law for damages from the past recordings. An employer headquartered in a one-party consent state like Texas should therefore assume that if a California employee is on the call, California law may apply.

This creates significant compliance challenges for companies with distributed workforces. AI meeting recording policies must account for the locations of all participants, not just the meeting organizer.

HIPAA Considerations

Healthcare employers in California face overlapping obligations under both CIPA and HIPAA. AI meeting tools that capture protected health information (PHI) during clinical discussions, case conferences, or patient consultations must comply with HIPAA's security and privacy requirements in addition to CIPA's all-party consent mandate.

A Business Associate Agreement (BAA) with the AI tool provider is required. HIPAA's Security Rule treats encryption as an addressable safeguard, so the tool should encrypt data in transit and at rest, and the provider may use PHI only as the agreement permits. Otter.ai's Enterprise tier and Microsoft's HIPAA-eligible Copilot plans offer BAA coverage, but default consumer plans do not.

Employee Training Requirements

Given the severity of CIPA penalties (both criminal and civil), California employers should train all employees who participate in or organize virtual meetings on the legal requirements for AI recording consent. Training should cover how to activate notification features, how to obtain verbal consent, and what to do if a participant declines to be recorded.

Cross-State Implications

California's all-party consent law can reach recordings made outside the state. When a California resident participates in a meeting recorded by someone in a one-party consent state, the California participant may have a CIPA claim. Courts have not settled which state's law governs, however: Kearney applied California law to an out-of-state business only going forward, and other courts, such as the Nevada Supreme Court in Ditech Financial v. Buckles (2017), look to the place where the recording was made.

This means that any company using AI meeting tools must consider California law if any meeting participant is based in California. Given California's large population and concentration of technology workers, this effectively makes CIPA compliance a nationwide concern for companies with remote workforces.

This article provides general legal information about California recording laws as they apply to AI meeting tools. Laws and their interpretations can change, and several active cases may produce new precedent. Consult an attorney for advice specific to your situation.

Related news

• Otter.ai Wiretap Lawsuit Explained: AI Notetakers and All-Party Consent (2026)

More California Laws

• California Data Privacy Laws
• California Deepfake Laws
• California Employee Monitoring Laws
• California Recording Laws

Frequently Asked Questions

Is it legal to use Otter.ai or Fireflies in California meetings?

Recording a confidential conversation with an AI meeting recorder in California requires the consent of all participants under Cal. Penal Code §§ 631 and 632 (CIPA). The law does not require a particular form of consent, and a clear announcement at the start can mean a conversation is not confidential under section 632, but for calls involving a cell or cordless phone, section 632.7 requires every party's consent, so explicit consent is the safest practice. Simply having a bot join the meeting with a visible name is unlikely to constitute adequate consent. You should verbally confirm that all participants agree to be recorded before activating any AI tool. Otter.ai is currently facing class action litigation in California for allegedly recording without all-party consent.

What are the penalties for recording a meeting without consent in California?

CIPA violations are wobblers. A first offense charged as a misdemeanor carries up to one year in jail and a $2,500 fine. Charged as a felony, penalties include up to three years in state prison. Repeat offenders face fines up to $10,000. Civil damages under Cal. Penal Code § 637.2 are $5,000 per violation or three times actual damages, whichever is greater.

Does the Ambriz v. Google ruling affect all AI meeting tools in California?

Not directly. Ambriz v. Google (N.D. Cal. 2025) applied the 'capability test' from Javier v. Assurance IQ (2023), holding at the pleading stage that a vendor's capability to use intercepted data for its own purposes, such as model training, can make it a third-party eavesdropper under CIPA. Other federal courts in California look at whether the vendor actually uses the data; the court in the Otter.ai case found third-party status on allegations of actual use without adopting the capability test, and no appellate court has settled the question. The ruling binds no other court, and in October 2026 the same judge dismissed the remaining plaintiffs' claims on consent and intent grounds, with leave to amend. Where courts use the capability test, AI meeting tools operating without all-party consent in California face more exposure.

Can my employer record meetings with AI tools in California without my consent?

Generally no. California's all-party consent requirement under CIPA applies in the workplace, so your employer needs your consent before recording a confidential conversation, including a virtual meeting. A clear announcement at the start that a meeting is being recorded can mean the conversation is no longer confidential under section 632. For calls involving a cell or cordless phone, though, section 632.7 requires every party's consent with no confidentiality element, it applies to the parties themselves (Smith v. LoanMe, 2021), and whether staying on after a notice counts as consent is unsettled. CIPA itself does not say what happens to an employee who declines to be recorded; whether an employer may take action against an employee who refuses depends on other employment laws, so talk to an employment attorney. Employers who record without consent face both criminal penalties and civil liability of $5,000 per violation or three times actual damages.

What did the California AG's January 2025 advisory say about AI recording?

Attorney General Rob Bonta's January 13, 2025 advisories explained how California's existing laws apply to AI. The general advisory says CIPA may impact AI training data, inputs, or outputs and that developers and users should ensure their AI systems do not violate it. The advisories are not new legislation but signal that the AG's office views existing privacy statutes as relevant to AI tools that record conversations. Businesses deploying AI recording tools should treat these advisories as a compliance baseline.