What are the AI transcription consent laws in 2026 and how do they affect recording meetings, calls, and medical visits?

The Direct Answer: Consent Is the Default, But the Details Vary by Jurisdiction and Context

As of August 2026, there is no single federal law in the United States that governs AI transcription consent. Instead, the legal framework is a patchwork of state wiretapping statutes, federal and state privacy laws, sector-specific regulations (especially in healthcare), and a growing number of state AI-specific laws that directly address automated recording and transcription. The general rule across all 50 states is that at least one party to a conversation must consent to being recorded. However, 11 states—California, Connecticut, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, and Washington—require what is known as "two-party" or "all-party" consent, meaning every participant must be notified and agree before any recording, including AI-powered transcription, can take place. This applies whether the transcription is done by a human or an AI tool, because the underlying act is the same: capturing audio. The key difference in 2026 is that AI transcription tools often run continuously in the background, are embedded in meeting platforms, and may process audio in the cloud, which raises additional consent questions beyond the initial recording. For example, if you use an AI notetaker in a meeting with participants in both California and Texas, the stricter California law applies to the California participant, and you must obtain consent from that person even if the meeting is hosted on a platform that only requires one-party consent. The practical answer is simple: if you are using AI to transcribe any conversation, you should obtain explicit, informed consent from all participants before the recording begins, and you should document that consent in writing or through an audio announcement. This is not just a legal recommendation; it is also a best practice for building trust and avoiding the reputational damage that comes from being accused of secretly recording someone.

Also worth reading: How can efficient audio transcription powered by AI transform my recording experience? · What is the best AI transcription tool for meetings in 2026? · What is a secure AI transcription workflow and why does it matter for sensitive meetings?

The legal landscape is further complicated by the fact that AI transcription is not just about the audio capture. The subsequent processing, storage, and use of the transcript may trigger additional obligations under privacy laws like the California Consumer Privacy Act (CCPA) and the European Union's General Data Protection Regulation (GDPR). For instance, if the transcript contains personal information, you may need to provide a privacy notice, allow individuals to access or delete their data, and ensure that the AI vendor has appropriate data processing agreements in place. In healthcare, the Health Insurance Portability and Accountability Act (HIPAA) imposes strict rules on the use of AI transcription tools, and the U.S. Department of Health and Human Services has issued guidance stating that covered entities must have business associate agreements with AI vendors that handle protected health information. The bottom line is that consent is the foundation, but it is not the only legal requirement. You must also consider data security, data retention, and the potential for the AI model to be trained on your conversations, which may require additional consent under state AI laws. As of 2026, at least 20 states have enacted or proposed AI-specific laws that address automated decision-making and data processing, and many of these laws include provisions that directly affect AI transcription. For example, Colorado's AI Act, which took effect in 2025, requires companies to conduct impact assessments for high-risk AI systems, and an AI transcription tool used in employment or healthcare could be considered high-risk. Therefore, the direct answer to the question is that you must obtain consent from all parties in all-party consent states, and you must also comply with a broader set of privacy and AI-specific regulations that govern the entire lifecycle of the transcription data.

Why Consent Laws Matter More in 2026 Than Ever Before

The proliferation of AI transcription tools has fundamentally changed the risk profile of recording conversations. In the past, recording required a physical device, and the act of recording was often obvious. Today, AI notetakers are embedded in smartphones, smart glasses, and meeting platforms, and they can operate silently and automatically. This has led to a surge in "shadow AI" usage, where employees use unauthorized AI tools to record and transcribe meetings without their employer's knowledge or consent. According to a 2025 survey by Foley & Lardner, nearly 40% of employees admitted to using AI transcription tools at work without formal approval, and 25% of those said they had recorded a conversation without telling the other participants. This creates significant legal exposure for both the employee and the employer. If an employee in a two-party consent state records a meeting without consent, the employer could be held liable for the employee's actions under the doctrine of vicarious liability. Moreover, the transcripts themselves may contain trade secrets, attorney-client privileged information, or personal data, and if those transcripts are stored on an unsecured cloud server or used to train an AI model, the consequences can be severe. The legal risks are not just theoretical. In 2024, a class-action lawsuit was filed against a major tech company after it was discovered that its AI transcription tool had been recording and analyzing customer service calls without proper consent, resulting in a $45 million settlement. This case highlighted the fact that consent is not just a checkbox; it must be meaningful and informed.

Another reason consent laws matter more in 2026 is the rise of audio deepfakes. AI transcription tools are often paired with voice cloning technology, and if a malicious actor gains access to a transcript, they could use it to create a convincing fake audio recording. This has led to new state laws that specifically address the use of AI to impersonate individuals. For example, Tennessee's ELVIS Act, which took effect in 2024, prohibits the use of AI to replicate a person's voice without consent, and it applies to transcription tools that also generate audio. This means that even if you have consent to transcribe a conversation, you may not have consent to use that transcript to create a voice clone. The legal landscape is evolving rapidly, and courts are increasingly treating AI transcription as a distinct activity that requires its own consent, separate from the underlying recording. In a 2025 ruling in California, a court held that using an AI tool to transcribe a conversation and then sharing the transcript with a third party constituted a separate invasion of privacy, even though the original recording was lawful. This ruling underscores the importance of obtaining consent not just for the recording, but also for the transcription, storage, and any potential sharing of the transcript.

State-by-State Comparison: One-Party vs. All-Party Consent

The most critical distinction in AI transcription consent laws is between one-party and all-party consent states. In one-party consent states, only one participant needs to know about and agree to the recording. This means that if you are a participant in the conversation, you can legally record it without telling the other person. However, this does not mean you can use an AI transcription tool without any restrictions. Even in one-party consent states, you may still be required to provide notice if the conversation is considered "private" or if there is a reasonable expectation of privacy. For example, recording a conversation in a public park is generally allowed, but recording a conversation in a hospital room or a lawyer's office may be prohibited. In all-party consent states, the rules are much stricter. You must obtain the consent of every participant before the recording begins, and this consent must be explicit and informed. This means that you cannot simply rely on a general notice in a meeting invitation; you must actively confirm that each participant agrees to be recorded. The table below provides a comparison of the key features of one-party and all-party consent laws as they apply to AI transcription.

It is important to note that the classification of states can change, and some states have nuanced exceptions. For example, Massachusetts requires all-party consent, but it has an exception for conversations that occur in public places where there is no reasonable expectation of privacy. Similarly, Illinois has a strict all-party consent law, but it also has a separate law that specifically addresses the use of AI to record conversations in the workplace, requiring employers to provide advance notice and obtain written consent from employees. As of 2026, at least five states have introduced legislation that would update their wiretapping laws to explicitly address AI transcription, and it is likely that more states will follow. This means that the legal landscape is not static, and you must regularly review the laws in your jurisdiction and in the jurisdictions of the people you are recording.

How to Obtain Valid Consent for AI Transcription: Practical Steps

Obtaining valid consent for AI transcription is not as simple as asking "Is it okay if I record this?" The consent must be informed, voluntary, and specific. Informed consent means that the person understands exactly what will happen to the recording and the transcript. You must disclose that you are using an AI tool, that the AI may process the audio in the cloud, that the transcript will be stored (and for how long), and that the transcript may be shared with third parties. Voluntary consent means that the person has a genuine choice to say no without facing negative consequences. In an employment context, this is particularly tricky, because an employee may feel pressured to consent to recording if their boss asks. To ensure voluntariness, you should provide an alternative to recording, such as taking manual notes, and you should not penalize someone for refusing to consent. Specific consent means that the consent is limited to the particular conversation and purpose. You cannot obtain consent to transcribe a meeting and then use the transcript for a different purpose, such as training an AI model, without obtaining separate consent. This is a common mistake, and it has led to legal action in several cases. For example, in 2025, a patient sued a healthcare provider after discovering that their medical visit was transcribed by an AI tool and the transcript was used to train the AI model without their consent. The provider argued that the patient had consented to the transcription for clinical documentation, but the court ruled that this did not extend to AI training.

To implement a robust consent process, you should follow these steps. First, before any meeting or call, send a clear notice to all participants stating that the conversation will be recorded and transcribed using AI. The notice should include the name of the AI tool, the purpose of the transcription, the data retention period, and the contact information of the person responsible for data protection. Second, at the start of the meeting, verbally announce that the meeting is being recorded and transcribed, and ask each participant to confirm their consent. If any participant does not consent, you must either stop the recording or exclude that participant from the conversation. Third, document the consent in a written log, including the date, time, names of participants, and the method of consent (e.g., verbal confirmation, email, or signed form). This log should be stored securely and retained for at least as long as the transcript is retained. Fourth, ensure that the AI transcription tool you are using has a consent management feature. Many enterprise tools, such as Microsoft Dynamics 365 Contact Center, now include built-in consent-based recording features that allow you to automatically pause recording if a participant does not consent. Finally, regularly review your consent practices to ensure they comply with new laws and regulations. As of 2026, at least 10 states have enacted laws that require businesses to conduct regular audits of their AI systems, including transcription tools, to ensure they are not violating consent requirements.

AI Transcription in Healthcare: The Highest-Risk Area

Healthcare is the sector where AI transcription consent laws are most stringent and most complex. The use of AI medical scribes has exploded in recent years, with tools like Freed and Nuance's Dragon Medical One becoming standard in many clinics. These tools automatically transcribe patient visits, generate clinical notes, and even suggest diagnoses. However, the legal requirements for using these tools are far more demanding than for general business meetings. Under HIPAA, covered entities must obtain written authorization from patients before using AI transcription tools that involve the disclosure of protected health information (PHI) to a third party. This authorization must be separate from the general consent to treatment, and it must specifically state that AI may be used to transcribe the visit. In addition, the AI vendor must sign a business associate agreement (BAA) that guarantees the protection of PHI. The U.S. Department of Health and Human Services has issued guidance stating that using an AI transcription tool that does not have a BAA in place is a violation of HIPAA, regardless of whether the patient consents. This has led to a wave of enforcement actions. In 2025, the Office for Civil Rights (OCR) fined a hospital $1.2 million for using an AI scribe without a BAA, and the hospital was also required to provide free credit monitoring to affected patients.

Beyond HIPAA, there are state-specific laws that impose additional consent requirements. For example, California's Confidentiality of Medical Information Act (CMIA) requires that patients be notified of any use of AI in their care, and it provides for civil penalties of up to $250,000 for violations. In 2026, several states, including New York and Massachusetts, have introduced bills that would require healthcare providers to obtain explicit opt-in consent from patients before using AI transcription, rather than relying on implied consent. This is a significant shift, as many providers currently include AI transcription in their general consent forms, which patients often sign without reading. The legal risk is not limited to the provider. AI transcription vendors can also be held liable if they fail to obtain proper consent. In a 2025 class-action lawsuit, patients sued an AI scribe company for using their de-identified transcripts to train its models without authorization. The company argued that de-identification removed the legal obligation, but the court disagreed, ruling that the patients had a reasonable expectation that their conversations would not be used for any purpose other than their own care. This case is currently on appeal, but it highlights the need for AI vendors to implement robust consent mechanisms.

For healthcare providers, the practical steps to ensure compliance include: (1) obtaining written, specific consent from patients before using AI transcription, (2) ensuring that the AI vendor has a BAA and is HIPAA-compliant, (3) providing patients with a clear opt-out mechanism, and (4) conducting regular risk assessments to identify any unauthorized use of AI. Providers should also be aware that open-source AI transcription programs, which run locally on a device, may not require a BAA because they do not transmit data to a third party. However, these programs may still be subject to state privacy laws, and they may not have the same accuracy or security features as commercial tools. As of 2026, the American Medical Association has recommended that physicians use AI transcription tools that are certified by the ONC (Office of the National Coordinator for Health Information Technology), as these tools are more likely to meet legal standards.

AI Transcription in the Workplace: Employer Obligations and Employee Rights

The workplace is another high-risk area for AI transcription consent. Employers often use AI notetakers to record meetings, performance reviews, and training sessions, but they must navigate a complex web of laws, including state wiretapping laws, the National Labor Relations Act (NLRA), and various state AI laws. Under the NLRA, employers are prohibited from recording conversations with employees if the purpose is to interfere with their right to engage in protected concerted activity, such as discussing wages or working conditions. This means that even in one-party consent states, an employer cannot use AI transcription to monitor employees' union organizing efforts. In addition, several states, including California and New York, have enacted laws that require employers to provide advance notice and obtain consent before using AI to monitor employees. For example, California's Workplace Technology Accountability Act, which took effect in 2025, requires employers to disclose the specific AI tools they use, the data they collect, and the purpose of the collection. It also prohibits employers from using AI transcription to create performance profiles without the employee's consent.

Employees also have rights under the common law tort of invasion of privacy. In a 2025 case, a court in Illinois ruled that an employer violated an employee's privacy by using an AI notetaker to record a one-on-one meeting without telling the employee, even though Illinois is an all-party consent state. The court awarded the employee $75,000 in damages. This case underscores the importance of obtaining consent even in situations where the employer might argue that the employee has no reasonable expectation of privacy. To avoid liability, employers should implement a clear policy on AI transcription that includes: (1) a list of approved AI tools, (2) a requirement that all meetings be announced as recorded, (3) a process for employees to opt out, and (4) a data retention schedule. Employers should also train managers on how to obtain consent and how to handle situations where an employee refuses to consent. It is important to note that an employee's refusal to consent cannot be used as a basis for disciplinary action, as this would violate public policy and potentially the NLRA.

The use of AI transcription in the workplace also raises issues of attorney-client privilege. If a meeting includes in-house counsel, the transcript may be protected by privilege, but only if the recording and transcription are done in a way that maintains confidentiality. If the AI tool is not secure or if the transcript is shared with unauthorized parties, the privilege may be waived. This is a particular concern with consumer-grade AI notetakers, which may store data on unsecured servers. A 2025 report by Duane Morris LLP highlighted a case where a company inadvertently waived attorney-client privilege because an AI transcription tool automatically shared the transcript with the vendor's support team. To protect privilege, employers should use enterprise-grade AI tools that offer end-to-end encryption and have strict data access controls. They should also ensure that the AI vendor does not use the transcripts for any purpose other than providing the transcription service.

Common Mistakes and How to Avoid Them

One of the most common mistakes in AI transcription consent is relying on a general notice in a meeting invitation or a privacy policy. This is insufficient for all-party consent states, and even in one-party consent states, it may not be enough if the conversation is private. Another mistake is assuming that consent to record is the same as consent to transcribe. As mentioned earlier, a court in California ruled that these are separate acts, and you need consent for both. A third mistake is failing to consider the location of the participants. If you are in a one-party consent state but you are recording a conversation with someone in a two-party consent state, you must comply with the stricter law. This is particularly relevant for remote meetings, where participants may be in different states or countries. A fourth mistake is using an AI transcription tool that does not have a consent management feature. Many free or low-cost tools do not provide a way to pause recording when a participant does not consent, which can lead to accidental violations. A fifth mistake is not having a data retention policy. If you keep transcripts indefinitely, you increase the risk of a data breach and the potential for legal liability. Finally, a sixth mistake is ignoring the AI training issue. Many AI transcription tools use customer data to improve their models, and this may require separate consent under state AI laws. For example, OpenAI has stated that it may use data from its API to train models, but it has also advocated for federal laws that would preempt state AI laws, which could change the consent requirements. To avoid these mistakes, you should consult with legal counsel who specializes in privacy and AI law, and you should regularly review your consent practices to ensure they are up to date.

When to Act: Immediate Steps for Compliance in 2026

Given the rapid evolution of AI transcription consent laws, it is not enough to wait for a lawsuit or a regulatory enforcement action. You should take immediate steps to ensure compliance. First, conduct an audit of all AI transcription tools currently in use in your organization. Identify who is using them, what data they are collecting, and whether consent is being obtained. Second, review your consent forms and notices to ensure they are specific and informed. If you are using a general consent form, update it to include a separate section for AI transcription. Third, implement a consent management system, either through your AI tool or through a manual process. Fourth, train your employees on the legal requirements and the consequences of non-compliance. Fifth, review your data retention and security policies to ensure that transcripts are protected and deleted when no longer needed. Sixth, monitor legislative developments in your state and in the states where you operate. As of August 2026, at least 15 states have pending bills that would affect AI transcription, and the federal government is considering a national privacy law that could preempt state laws. By taking these steps, you can reduce your legal risk and build a culture of transparency and trust.

The Cost of Non-Compliance: Penalties and Lawsuits

The cost of non-compliance with AI transcription consent laws can be substantial. In all-party consent states, criminal penalties can include fines of up to $10,000 per violation and imprisonment for up to one year. Civil penalties can be even higher, with some states allowing statutory damages of $5,000 per violation, plus attorney's fees. In a class-action lawsuit, these damages can quickly add up. For example, in 2025, a class-action lawsuit against a tech company for using AI transcription without consent resulted in a $45 million settlement, which included $25 million in damages and $20 million in attorney's fees. In healthcare, the penalties are even more severe. HIPAA violations can result in fines of up to $1.5 million per calendar year, and the OCR has been increasingly aggressive in enforcing AI-related violations. In addition to financial penalties, non-compliance can lead to reputational damage, loss of customer trust, and a competitive disadvantage. A 2026 survey by Mayer Brown found that 70% of consumers would stop doing business with a company that was found to have secretly recorded their conversations. Therefore, the cost of compliance is far lower than the cost of non-compliance.

Alternatives to AI Transcription: When to Avoid It

While AI transcription is convenient, there are situations where it is better to avoid it altogether. If you are in a highly sensitive conversation, such as a legal consultation or a therapy session, and you cannot obtain explicit consent from all parties, you should use manual note-taking instead. Manual notes are not subject to wiretapping laws, and they do not raise the same privacy concerns. Another alternative is to use an AI transcription tool that runs entirely on-device, such as an open-source program that does not transmit data to the cloud. This can reduce the legal burden, but it may not be as accurate or feature-rich as cloud-based tools. A third alternative is to use a human transcription service, which may be subject to different legal requirements. However, human transcription is more expensive and slower than AI transcription. Ultimately, the decision to use AI transcription should be based on a risk-benefit analysis. If the conversation is routine and you can easily obtain consent, AI transcription is a valuable tool. If the conversation is sensitive or the consent process is burdensome, you should consider alternatives.

Conclusion: The Future of AI Transcription Consent Laws

The legal landscape for AI transcription consent is likely to become more complex in the coming years. As of 2026, there is a growing movement toward federal legislation that would create a uniform standard for AI recording and transcription. OpenAI and other tech companies have advocated for federal preemption of state AI laws, arguing that a patchwork of state regulations is burdensome and stifles innovation. However, consumer advocacy groups have pushed back, arguing that federal laws may be weaker than state laws. In the absence of federal legislation, states will continue to enact their own laws, and we can expect to see more states adopt all-party consent requirements and specific rules for AI transcription. The trend is clearly toward greater transparency and stricter consent requirements. Therefore, the best strategy is to adopt a conservative approach: always obtain explicit, informed consent from all parties before using AI transcription, and stay informed about legal developments in your jurisdiction. By doing so, you can protect yourself, your organization, and the people you interact with.