Can an AI Legally Transcribe Your Conversations Without Consent?

Most states let you record and transcribe a conversation you’re part of without telling the other people. That’s called “one-party consent,” and it covers 36 states plus D.C. If you’re on the call or in the room, you’re the “one party,” so you can hit record and run it through an AI without asking anyone else. The eight states with “all-party consent” are stricter: California, Florida, Illinois, Massachusetts, Maryland, New Hampshire, Pennsylvania, and Washington. In those places, you must get everyone’s okay before you can record or transcribe. Seven more states—Connecticut, Delaware, Georgia, Michigan, Montana, Nevada, and Oregon—have hybrid rules. The details vary: some hinge on whether you’re recording in person or on the phone, others on whether you hide the device. The bottom line is simple: check the state where the conversation happens, not where you live or where the AI servers are.

These rules don’t care whether you use a phone, a digital recorder, or an AI-powered app. If the device captures sound from the conversation, it’s a recording under the wiretap or eavesdropping statute in most states. The one-party consent rule in Alaska, for example, says you can record “any conversation you're part of without telling anyone else.” Similar language appears in many other states, from Arizona to Wyoming, though the exact wording varies by statute. The eight all-party states flip that: in California, “everyone taking part in the conversation must agree before you can record the audio.” The hybrid states split the difference. In Connecticut, you can record an in-person chat with just your own consent, but phone calls may need to notify everyone. These distinctions matter if your AI app is capturing conversations in multiple states at once.

Raw audio itself is usually excluded from biometric data definitions in many states unless it’s processed to identify a specific person. But if you process that audio into a “voiceprint” used to identify a specific person, it can become regulated biometric data. Under Colorado’s law, for example, a voiceprint is explicitly listed as a biometric identifier, and you must inform the person and obtain consent before processing it. The same is true in Connecticut, Delaware, and several other states that fold biometric data into “sensitive data.” The key phrase is “used to identify a specific individual.” If your AI only transcribes the words without turning the voice into an identifier, the biometric rules probably don’t apply. If it creates a voiceprint to recognize the speaker, then you may need consent in those states. The line isn’t always clear, so product teams should design the feature to avoid creating a voiceprint unless they’re ready to meet the consent requirement.

Wiretap and eavesdropping laws started as a way to stop governments and corporations from secretly listening in on private conversations. One-party consent laws balance privacy with the reality that people often record calls for legitimate reasons, like keeping notes of an important meeting. All-party consent states argue that everyone in a conversation should have a say over whether it’s recorded, to prevent hidden surveillance or misuse. Biometric laws add another layer: they’re designed to prevent companies from collecting unique identifiers like fingerprints or voiceprints without people knowing. The statutes explicitly name “voiceprint” as an example because a person’s voice can be a unique identifier. The practical effect is that if your AI turns a voice into a biometric template, you’re stepping into a different legal regime that often requires affirmative consent.

Not every recording is covered. Many states carve out conversations in public places where there’s no reasonable expectation of privacy. Others exempt recordings made to protect yourself or your property, or recordings made with a court order. Some statutes also exclude recordings made by certain professionals, like lawyers or journalists, under specific conditions. For biometric data, the carve-outs are even narrower: raw audio or video isn’t biometric data unless it’s processed to identify a specific person. In Iowa, for instance, the statute explicitly excludes “a video or audio recording or data generated therefrom” from the definition of biometric data, unless that data is generated to identify a specific individual. That means a transcript alone isn’t biometric, but a voiceprint derived from the audio to recognize the speaker is. These nuances matter when your AI app is recording in a public park, a police interaction, or a professional setting.

In all-party states, recording without consent can be a crime and expose you to lawsuits. In California, for example, violating the all-party consent rule can lead to civil damages and injunctions. In Illinois, the Biometric Information Privacy Act allows individuals to sue for collecting biometric data without written notice and consent. In states with comprehensive privacy laws like Colorado or Connecticut, regulators can bring enforcement actions for processing sensitive data without consent. The penalties vary: some are statutory damages per violation, others are fines or injunctions. The key takeaway is that the risk isn’t just theoretical. If your AI app records conversations in California or Illinois, or creates voiceprints in Colorado or Connecticut, you need a consent mechanism that meets the state’s specific requirements.

Imagine a lawyer in Chicago records a client meeting with a client who’s calling from California. The lawyer is in Illinois, which has an all-party consent rule for biometric data collection, but the client is in California, an all-party consent state for recording. The safest approach is to treat the call as if it’s subject to California’s all-party rule, because the client is a party to the conversation and California law applies to the location of the parties. If the lawyer’s AI transcribes the call and then creates a voiceprint to recognize the client’s voice for future meetings, the biometric rules in California kick in. The lawyer would need to inform the client and obtain consent before creating the voiceprint. If the lawyer instead only transcribes the words and doesn’t create a voiceprint, the biometric rules likely don’t apply, but the all-party consent rule for the recording still does. This scenario shows why location matters more than where the lawyer or the AI servers are.