Colorado AI Meeting Recording Laws (2026)

Colorado is a one-party consent state, so a meeting participant who activates an AI recording tool records lawfully under C.R.S. 18-9-303 without notifying anyone else on the call. The Colorado Privacy Act and, from January 1, 2027, the state's new Automated Decision-Making Technology Act add separate data-handling obligations that go beyond the consent question.

Colorado uses a dual-statute framework to regulate recording. Telephone wiretapping falls under Colo. Rev. Stat. § 18-9-303, while in-person eavesdropping is governed by § 18-9-304. Both statutes follow one-party consent, meaning one participant in a conversation may record without the knowledge of the others. But Colorado's treatment of AI meeting tools is more complex than many one-party consent states, because the state has enacted some of the nation's most significant AI-specific legislation.

The Colorado Privacy Act (CPA) creates an additional compliance layer that affects how AI recording tools collect, process, and store meeting data, and from January 1, 2027 the Automated Decision-Making Technology (ADMT) Act enacted by SB 26-189 adds notice duties in a narrower set of situations. The Colorado Artificial Intelligence Act (SB 24-205) is still sometimes described as Colorado's AI law, but it was repealed before it ever took effect. Understanding Colorado's recording laws requires looking beyond the wiretapping statutes alone.

Colorado's Recording Consent Framework

Telephone Wiretapping: § 18-9-303

Colo. Rev. Stat. § 18-9-303 prohibits wiretapping telephone, telegraph, or electronic communications without the consent of at least one party to the conversation. The statute covers the interception of any communication transmitted via wire or electronic means.

Under § 18-9-303, it is a criminal offense to "knowingly overhear, read, take, copy, or record" a "telephone, telegraph, or electronic communication" without the consent of a party to the communication. The law also prohibits aiding, authorizing, or permitting another person to wiretap.

This statute applies directly to AI meeting recording tools that capture audio from phone calls, VoIP conversations, and virtual meetings conducted over electronic communication platforms.

In-Person Eavesdropping: § 18-9-304

Colo. Rev. Stat. § 18-9-304 separately prohibits eavesdropping on conversations. A person "not visibly present during a conversation or discussion commits eavesdropping" if they "knowingly overhear[] or record[] such conversation or discussion without the consent of at least one of the principal parties thereto."

The key distinction from § 18-9-303 is that eavesdropping under § 18-9-304 turns on the listener not being visibly present in the conversation, not on whether the conversation happened in a private place. For virtual meetings, the participant who activates an AI recording tool is a party to (and visibly present in) the conversation, so courts would likely apply § 18-9-303 (the telephone/electronic wiretapping statute) rather than the in-person eavesdropping provision.

One-Party Consent in Practice

Colorado's one-party consent rule means that any participant in a conversation may legally record it without notifying the other parties. This applies to phone calls, virtual meetings, and in-person discussions (§ 18-9-304's eavesdropping offense reaches only someone not visibly present in the conversation, not a participant who is openly there). The consenting party must be an actual participant in the communication, not a third party who has merely gained access.

Interaction with Federal Law

Federal wiretapping law under 18 U.S.C. § 2511 also follows one-party consent, creating consistency for Colorado-based recordings. For interstate calls involving all-party consent states, the stricter state's law may apply. Colorado users recording calls with California, Florida, or Illinois participants should consider obtaining consent from all parties.

How Colorado Law Applies to AI Meeting Recorders

The Consent Analysis

When a Colorado-based meeting participant activates an AI recording tool like Otter.ai, Fireflies.ai, or Zoom AI Companion, that participant provides the one-party consent required under § 18-9-303. The participant is a party to the communication, and they have consented to the recording. The statute does not require the consenting party to personally operate the recording equipment; it requires only that a party to the communication has consented.

This means the human user's activation of the AI tool satisfies Colorado's wiretapping statute for virtual meetings. The analysis parallels other one-party consent states.

The AI Bot's Legal Status

Colorado's statutes do not define "party" in a way that includes or excludes AI systems. AI meeting bots that appear as named participants in a meeting (such as "Fireflies.ai Notetaker") raise the question of whether they are parties, tools of a party, or unauthorized third parties.

Under prevailing legal analysis, the AI bot functions as a tool or agent of the consenting participant. The bot does not independently participate in the conversation; it records and processes audio on behalf of the human user who authorized it. As long as a human participant consented to the recording, Colorado's one-party consent requirement is met. No Colorado court appears to have ruled directly on this question.

Auto-Join Features and Consent Gaps

The most legally problematic scenario involves AI tools that auto-join meetings from calendar data without explicit per-meeting authorization. If a tool scrapes a user's calendar and joins a meeting autonomously, the question is whether the user's general authorization of the tool constitutes "consent" for each individual recording.

A conservative reading of Colorado law suggests that consent should be specific to each communication. Blanket authorization via account settings or calendar integration may not satisfy the statute if the user is not aware that a specific meeting is being recorded. The ongoing In re Otter.AI Privacy Litigation in California addresses similar auto-join allegations, though under California's stricter all-party consent framework.

Colorado's AI-Specific Legislation

Colorado AI Act (SB 24-205) and Its Replacement (SB 26-189)

Colorado enacted SB 24-205 on May 17, 2024, becoming only the second U.S. state to pass comprehensive AI consumer protection legislation. The law's effective date was delayed from February 1, 2026, to June 30, 2026, during a special legislative session in August 2025, but it never took effect. Governor Polis signed SB 26-189 on May 14, 2026, repealing and reenacting SB 24-205 as a narrower Automated Decision-Making Technology (ADMT) Act, effective January 1, 2027.

As originally enacted, SB 24-205 would have regulated "high-risk AI systems," defined as systems that make or are a substantial factor in making consequential decisions with material legal or similarly significant effects on consumers, and would have imposed risk-management programs, annual impact assessments, and algorithmic-discrimination duties on developers and deployers. None of that framework ever took effect, and none of those duties exist under current Colorado law. SB 26-189 replaced it with a narrower disclosure-and-notice model; while AI meeting recording tools are not the primary target of either version, the current ADMT Act may still create notice obligations for how these tools process and use recorded data in covered decisions.

What the enacted ADMT Act actually requires, beginning January 1, 2027:

• Point-of-interaction notice: Before using a covered automated decision-making technology to materially influence a consequential decision, a deployer must give the consumer clear and conspicuous notice that it used or will use that technology, plus instructions for obtaining further information (C.R.S. 6-1-1704(1))
• Post-adverse-outcome disclosure: If a covered ADMT materially influences a decision that produces an adverse outcome, the deployer has 30 days to provide a plain-language description of the decision and the technology's role in it, a simple process for requesting details about the system and the data it used, and an explanation of the consumer's rights (6-1-1704(3))
• Correction and human review: A consumer who experiences an adverse outcome may request correction of factually incorrect or materially inaccurate personal data, and an opportunity for meaningful human review and reconsideration of the decision, to the extent commercially reasonable (6-1-1705(1))
• Record keeping: Deployers must retain records reasonably necessary to demonstrate compliance for at least three years after a consequential decision (6-1-1703)

These duties attach only where a covered ADMT materially influences a consequential decision. Recording and transcribing a meeting does not by itself trigger them. But if a tool's AI analysis of recorded meetings is used that way, for example to drive an employment or promotion decision, the deployer's obligations under the ADMT Act would apply from January 1, 2027.

Colorado Privacy Act (CPA)

The Colorado Privacy Act, effective July 1, 2023, grants consumers rights over their personal data and imposes obligations on businesses that collect it. The CPA gives Colorado residents the right to access, correct, delete, and opt out of the sale of their personal data, as well as opt out of targeted advertising and certain forms of profiling.

AI meeting tools that record, transcribe, and store conversations involving Colorado residents collect personal data subject to the CPA. Compliance requires providing clear privacy notices, honoring opt-out requests, and limiting data collection to what is reasonably necessary.

Under C.R.S. 6-1-1311(1)(a), the Colorado Attorney General and district attorneys have exclusive authority to enforce the CPA. There is no private right of action, and for purposes of enforcement a violation of the CPA is a deceptive trade practice under Colorado's Consumer Protection Act.

Popular AI Meeting Tools and Colorado Compliance

Under Colorado's recording statutes, all these tools are compliant when activated by a meeting participant. The additional compliance layer comes from the CPA today, which governs how the data is collected, stored, processed, and used after recording. From January 1, 2027, the narrower ADMT Act under SB 26-189 adds notice and disclosure duties, but only where a covered automated decision-making technology materially influences a consequential decision.

Penalties for Violations

Criminal Penalties

Colorado's dual-statute structure creates different penalty levels for telephone wiretapping and in-person eavesdropping.

Colorado wiretapping was previously a Class 6 felony, but House Bill 23-1293 downgraded it to a Class 2 misdemeanor effective October 1, 2023, aligning it with the penalty for in-person eavesdropping. Using or disclosing information obtained through illegal wiretapping, where the person knows or has reason to know the information was illegally obtained, falls under the same statute and is also a Class 2 misdemeanor.

Civil Remedies

Colorado does not have a dedicated state statute creating civil damages for a private unlawful recording. Colo. Rev. Stat. § 13-21-128 addresses a different situation: it lets a person whose recording was destroyed or unlawfully seized by a law enforcement officer file an affidavit with the officer's employing agency, which can lead to a $500 statutory recovery for the recording plus actual damages, and punitive damages of up to $15,000 if the agency denies the claim in bad faith. It does not apply to recordings made by a private individual.

For a genuine wiretapping or eavesdropping violation, meaning an interception made without the consent of any party, the applicable civil remedy is federal: the Wiretap Act, 18 U.S.C. § 2520, lets an aggrieved person sue for actual damages or statutory damages of whichever is greater, $100 per day of violation or $10,000, plus punitive damages in appropriate cases and reasonable attorney's fees. Because Colorado is a one-party consent state, a recording made with one participant's consent, including AI meeting tools activated by a participant, generally would not trigger this remedy.

Colorado AI Act Enforcement

A violation of Colorado's AI law (the ADMT Act under SB 26-189, effective January 1, 2027) is a deceptive trade practice under the Colorado Consumer Protection Act, and the Act's disclosure and consumer-rights requirements are enforceable exclusively by the Colorado Attorney General (C.R.S. 6-1-1706). The enacted Act contains no affirmative defense or safe harbor for companies that follow a published AI risk management framework.

Employer and Workplace Considerations

Recording Policies for Colorado Employers

Colorado employers may use AI meeting recording tools under the one-party consent framework, provided a meeting participant activates the tool. Best practices include establishing written recording policies, notifying employees about the use of AI tools (even though not legally required under the wiretapping statute), and addressing cross-state considerations for remote workers.

Colorado's AI law (the ADMT Act under SB 26-189, effective January 1, 2027) adds a layer of obligation for employers using AI tools in employment decisions. If AI-generated meeting transcripts or analyses are used to evaluate employee performance, make promotion decisions, or inform disciplinary actions, the employer may need to comply with the Act's consumer-notice and disclosure requirements.

CPA Data Minimization

Under the Colorado Privacy Act, employers and AI tool providers should collect only the personal data reasonably necessary for the stated purpose of the recording. Retaining meeting recordings indefinitely, using them for purposes beyond the original intent, or sharing them with unauthorized third parties may violate the CPA.

HIPAA in Colorado Healthcare Settings

Healthcare organizations in Colorado must comply with HIPAA when AI meeting tools capture protected health information. This requires a Business Associate Agreement with the tool provider, encryption of data in transit and at rest, and assurance that recorded PHI is not used for AI model training without proper de-identification.

Colorado's strong healthcare sector, including major hospital systems and research institutions along the Front Range, makes HIPAA compliance a significant consideration for any workplace AI recording deployment.

Multi-State Workforce Considerations

Colorado employers with remote workers in all-party consent states (California, Florida, Illinois, and others) must obtain consent from all participants when those workers join recorded meetings. Colorado's one-party consent rule protects the employer for in-state recordings, but it does not override the recording laws of other states where participants are located.

Cross-State Considerations

Colorado's one-party consent framework applies to communications originating in Colorado. For cross-state communications, the general principle is that the most restrictive applicable law governs. An AI recording activated by a Colorado participant on a call with a California participant may need to comply with California's all-party consent requirements.

Some courts have applied the law of the state where the recording party is located, which would favor Colorado's less restrictive rule. Others have applied the law of the recorded party's state, which could require all-party consent. The uncertainty in this area makes it prudent for Colorado-based users to disclose AI recording when participants from all-party consent states are on the call.

This article provides general legal information about Colorado recording laws as they apply to AI meeting tools. Laws and their interpretations can change; Colorado's AI law (the ADMT Act under SB 26-189) is scheduled to take effect January 1, 2027. Consult an attorney for advice specific to your situation.

More Colorado Laws

• Colorado Data Privacy Laws
• Colorado Deepfake Laws
• Colorado Employee Monitoring Laws
• Colorado Recording Laws