California AI Meeting Recording Laws (2026)

AI meeting recorders are lawful in California only when every participant consents before recording begins. Cal. Penal Code 632 requires all-party consent for confidential conversations, and that requirement applies fully to AI transcription bots. Recording without that consent exposes users and companies to criminal penalties and civil damages of at least $5,000 per violation, or three times actual damages, whichever is greater.

California's privacy laws create the most restrictive legal environment in the United States for AI meeting recording tools. Under the California Invasion of Privacy Act (CIPA), codified in Cal. Penal Code §§ 631 and 632, recording a confidential conversation requires the consent of every participant. This all-party consent requirement has made California the primary jurisdiction for litigation against AI transcription services, with multiple class action lawsuits filed against Otter.ai, Google, and other providers.

The stakes are substantial. CIPA violations carry both criminal penalties (up to $2,500 and one year in jail for a first offense) and civil liability (the greater of $5,000 per violation or three times actual damages). For companies deploying AI meeting tools across California-based workforces, compliance is not optional.

California's Recording Consent Framework

CIPA: The Two Key Sections

California's wiretapping and eavesdropping protections rest primarily on two sections of the Penal Code.

Section 631 prohibits wiretapping and interception of communications in transit. The statute makes it illegal to tap or make unauthorized connections with telegraph or telephone wires, or to "willfully and without the consent of all parties to the communication" read, attempt to read, or learn the contents of any communication while it is in transit. Section 631 also prohibits using information obtained through illegal wiretapping.

Section 632 prohibits eavesdropping on or recording confidential communications. A "confidential communication" is defined as one carried on in circumstances that reasonably indicate any party to the communication desires it to be confined to the parties present. This includes most business meetings, private phone calls, and virtual meetings where participants have a reasonable expectation that the conversation will remain between those present.

Together, these sections require the consent of all parties before any recording or interception of confidential communications. This all-party consent standard is significantly more restrictive than the one-party consent rule followed by the majority of states and by federal law under 18 U.S.C. § 2511.

The Ribas v. Clark Precedent

The California Supreme Court's 1985 decision in Ribas v. Clark (38 Cal.3d 355) established a foundational precedent: even listening to a conversation without the consent of all parties can constitute a CIPA violation. In Ribas, the court held that a person who listened in on a phone call via an extension telephone, at the request of one party but without the knowledge of the other, violated Section 631.

The court reasoned that "secret monitoring denies the speaker an important aspect of privacy of communication, the right to control the nature and extent of the firsthand dissemination of his statements." This principle has direct implications for AI meeting tools. Under Ribas, an AI system that listens to and processes a conversation without all-party consent may violate CIPA even if it never produces a traditional "recording." The act of listening and learning the contents is itself sufficient.

What Constitutes "Consent" Under CIPA

CIPA does not specify a particular form of consent (written, verbal, or implied). California courts have recognized that consent can be inferred from the circumstances. For example, when a meeting platform displays a clear notification that recording is in progress and participants choose to remain in the meeting, courts may find implied consent.

However, relying on implied consent is risky. The safest approach under California law is to obtain explicit verbal or written consent from all participants before activating any recording or AI transcription tool. Simply having a bot join a meeting with a visible name like "Otter.ai Notetaker" may not constitute adequate notice to establish consent, particularly if participants do not understand what the bot is doing.

The Otter.ai Litigation: California's Landmark AI Recording Case

Case Overview

In August 2025, a class action complaint was filed against Otter.ai in the U.S. District Court for the Northern District of California. The lead case, Brewer v. Otter.ai Inc., alleges that Otter's AI notetaker products (OtterPilot and Otter Notetaker) joined virtual meetings, recorded participants, and used the captured audio to train machine learning models without securing the consent required under CIPA and federal law.

Several related cases were subsequently consolidated into In re Otter.AI Privacy Litigation (No. 5:25-cv-06911), including Case Nos. 25-cv-7187, 25-cv-7462, and 25-cv-7712.

Key Allegations

The consolidated complaints allege that Otter.ai engaged in a pattern of privacy violations:

• Otter's AI bots joined meetings as silent or near-silent participants, recording audio without obtaining consent from non-host attendees
• The auto-join feature, enabled by default, scraped calendar invitations and joined meetings autonomously
• Under default settings, consent was sought only from the meeting host, not from other attendees
• Otter's most expensive "Enterprise" plan was the only tier that offered the option to notify non-user attendees
• Recorded content was used to train AI models without disclosure or consent
• Names, emails, and metadata were collected from calendar integrations

Legal Claims

The lawsuits assert violations of multiple California and federal statutes:

• CIPA §§ 631 and 632: Unlawful interception and eavesdropping on confidential communications
• Electronic Communications Privacy Act (ECPA): Federal wiretapping violations under 18 U.S.C. § 2511
• Computer Fraud and Abuse Act (CFAA): Unauthorized access to computer systems
• California Comprehensive Computer Data and Fraud Access Act: State computer fraud claims
• Unfair Competition Law (UCL): Unfair and deceptive business practices
• Common law claims: Intrusion upon seclusion and conversion

Current Status

On August 13, 2026, Judge Eumi K. Lee granted in part and denied in part Otter.ai's motion to dismiss the consolidated complaint. The CIPA claim survived. The court held that plaintiffs plausibly alleged Otter acts as a third-party eavesdropper under Section 631(a), because Otter is alleged to retain conversation data and use it to improve its own machine learning models rather than acting solely as the meeting host's recording tool.

The court wrote that "because Plaintiffs plausibly allege a violation of section 631(a), Count 8 survives regardless of whether Plaintiffs alternatively state a claim under section 632." On the Section 632 theory specifically, only the plaintiff who alleged a call with a medical professional pleaded a "confidential communication" with enough factual detail; allegations that a conversation was merely "private" or "sensitive" were held to be conclusory.

The federal ECPA claim, the Unfair Competition Law claim, and the unjust enrichment claim also survived. The court dismissed the CFAA claim, the California Comprehensive Computer Data and Access Fraud Act claim, the Washington Privacy Act claim, and several plaintiffs' intrusion upon seclusion and California constitutional privacy claims, all with leave to amend. Plaintiffs were given 14 days to file an amended complaint, with Otter's responsive pleading due 21 days after that.

The case is now in discovery, and the court entered a stipulated protective order on August 20, 2026. The court has not ruled on the merits or on class certification. The outcome will likely set significant precedent for the entire AI meeting recording industry.

The Ambriz v. Google "Capability Test"

Case Background

In Ambriz et al. v. Google LLC, plaintiffs alleged that Google Cloud Contact Center AI (GCCCAI), an AI-powered customer service system used by companies like Verizon, Hulu, GoDaddy, and Home Depot, violated CIPA by listening to and transcribing customer service calls without the callers' consent. Callers spoke with virtual agents and human representatives but were not informed that Google's AI was intercepting and processing their conversations.

The Ruling

On February 10, 2025, the Northern District of California denied Google's motion to dismiss. The court's analysis introduced a critical distinction that affects all AI meeting recording tools operating in California.

Courts within the Ninth Circuit have used two tests for determining whether a software service violates Section 631(a): the "extension test" and the "capability test."

The extension test asks whether the third party acts merely as an extension of one of the parties to the communication (like a person listening on an extension phone). Under this test, if the AI tool functions purely as a recording device for one of the parties and does not use the data independently, it may not violate CIPA.

The capability test is broader. It asks whether the third-party vendor has the capability to use intercepted data for its own purposes, regardless of whether it actually does so. The court applied this test in Ambriz and found that plaintiffs plausibly alleged Google had the "capability" to use wiretapped data to improve its AI and machine learning models. That capability alone was enough to survive a motion to dismiss.

Impact on AI Meeting Tools

The Ambriz capability test creates significant exposure for AI meeting recording companies in California. Virtually every AI transcription service has the theoretical capability to use recorded conversations for model training, product improvement, or data analytics. Under the capability test, this creates potential CIPA liability even if the company's privacy policy states that recordings are not used for training purposes. The question is capability, not actual use.

This precedent makes it essential for AI meeting tool providers to secure all-party consent before recording any conversation involving California participants.

California AG Advisory on AI and Privacy (January 2025)

On January 13, 2025, California Attorney General Rob Bonta issued two legal advisories addressing how existing California law applies to artificial intelligence systems. These advisories have direct implications for AI meeting recording tools.

Advisory 1: Existing Law Application

The first advisory reminded businesses that California's existing legal framework, including CIPA, the California Consumer Privacy Act (CCPA), civil rights laws, competition laws, and election misinformation statutes, applies fully to AI developers, sellers, and deployers. The advisory emphasized that CIPA's restrictions on recording and listening to private communications extend to AI systems that intercept, record, or analyze conversations.

Advisory 2: Healthcare AI

The second advisory specifically addressed AI in healthcare settings, reinforcing that privacy protections apply when AI tools process medical conversations or patient data.

Practical Effect

The AG's advisories are not new law but carry significant weight. They signal that the California Attorney General's office views AI meeting recorders as subject to CIPA and intends to enforce existing privacy statutes against AI companies. Businesses deploying AI recording tools in California should treat the advisories as a compliance roadmap.

California's Evolving AI Legislation

SB 942: California AI Transparency Act

California enacted SB 942, the California AI Transparency Act, which requires "covered providers" (those with AI systems having over 1 million monthly users accessible in California) to provide free, publicly available tools that allow users to detect whether content was created or altered by their AI systems. The law's effective date was originally January 1, 2026, but Assembly Bill 853 delayed implementation to August 2, 2026.

While SB 942 primarily targets AI-generated content detection rather than recording consent, it reflects California's broader commitment to AI transparency and may influence how courts evaluate AI meeting tools' disclosure obligations.

SB 243: Companion Chatbots Act

Effective January 1, 2026, SB 243 establishes safety requirements for "companion chatbots," including mandatory AI disclosure and heightened protections for minors. Though focused on chatbot interactions, the law's disclosure requirements reinforce the principle that California expects transparency when consumers interact with AI systems.

The Broader Trend

California continues to lead in AI regulation. The AG's January 2025 advisories, combined with SB 942, SB 243, and the active CIPA litigation against AI recording companies, create a legal environment where AI meeting tools face extensive compliance obligations. Companies that fail to secure explicit all-party consent before recording in California face criminal prosecution, civil damages, and regulatory enforcement.

Popular AI Meeting Tools and California Compliance

In California, no AI meeting recording tool is compliant by default. Every tool requires explicit consent from all participants before recording begins. The notification banners and bot names that major platforms display may provide notice, but notice alone does not constitute consent. Best practice is to verbally confirm consent at the start of every recorded meeting or obtain written consent in advance.

Penalties for CIPA Violations

Criminal Penalties

CIPA violations are "wobblers" in California, meaning prosecutors can charge them as either misdemeanors or felonies depending on the circumstances.

Civil Damages

Under Cal. Penal Code § 637.2, any person injured by a CIPA violation may bring a civil action and recover the greater of $5,000 per violation or three times actual damages. In cases involving multiple recorded conversations, courts may award $5,000 for each individual recording, making class action exposure for AI meeting tool companies potentially enormous.

For example, if an AI bot recorded 1,000 meetings involving California participants without proper consent, the company could face civil damages of $5 million or more, plus attorney's fees and injunctive relief.

Exclusionary Rule

Evidence obtained in violation of CIPA is generally inadmissible in any judicial, administrative, legislative, or other proceeding. This applies to AI-generated transcripts, summaries, and any derivative work product based on unlawfully recorded conversations.

Employer and Workplace Considerations

Mandatory All-Party Consent in the Workplace

California employers cannot rely on one-party consent to record workplace meetings. Every employee, client, vendor, or other participant in a recorded meeting must consent. Employers should implement clear, documented consent procedures before deploying any AI meeting recording tool.

A practical approach includes adding recording consent language to meeting invitations, verbally confirming consent at the start of each meeting, and allowing participants to leave without penalty if they do not wish to be recorded.

Remote and Hybrid Work Complications

California's all-party consent requirement applies to any conversation involving a California-based participant, regardless of where the other participants are located. An employer headquartered in a one-party consent state like Texas cannot bypass CIPA by arguing that the recording occurred outside California. If a California employee is on the call, California law may apply.

This creates significant compliance challenges for companies with distributed workforces. AI meeting recording policies must account for the locations of all participants, not just the meeting organizer.

HIPAA Considerations

Healthcare employers in California face overlapping obligations under both CIPA and HIPAA. AI meeting tools that capture protected health information (PHI) during clinical discussions, case conferences, or patient consultations must comply with HIPAA's security and privacy requirements in addition to CIPA's all-party consent mandate.

A Business Associate Agreement (BAA) with the AI tool provider is required. The tool must encrypt data in transit and at rest, and the provider must not use PHI for model training. Otter.ai's Enterprise tier and Microsoft's HIPAA-eligible Copilot plans offer BAA coverage, but default consumer plans do not.

Employee Training Requirements

Given the severity of CIPA penalties (both criminal and civil), California employers should train all employees who participate in or organize virtual meetings on the legal requirements for AI recording consent. Training should cover how to activate notification features, how to obtain verbal consent, and what to do if a participant declines to be recorded.

Cross-State Implications

California's all-party consent law has extraterritorial reach. When a California resident participates in a meeting recorded by someone in a one-party consent state, the California participant may have a CIPA claim regardless of where the recording party is located. Courts have generally held that CIPA protects California residents' privacy rights in their communications.

This means that any company using AI meeting tools must consider California law if any meeting participant is based in California. Given California's large population and concentration of technology workers, this effectively makes CIPA compliance a nationwide concern for companies with remote workforces.

This article provides general legal information about California recording laws as they apply to AI meeting tools. Laws and their interpretations can change, and several active cases may produce new precedent. Consult an attorney for advice specific to your situation.

Related news

• Otter.ai Wiretap Lawsuit Explained: AI Notetakers and All-Party Consent (2026)

More California Laws

• California Data Privacy Laws
• California Deepfake Laws
• California Employee Monitoring Laws
• California Recording Laws