Is It Legal to Record Someone Without Their Consent?

This article is general information, not legal advice. Laws change and vary by jurisdiction — talk to qualified counsel about your specific situation.

A few years ago, recording a conversation took deliberate effort: a dictaphone on the table, a clear “do you mind if I record this?” Today an AI notetaker can join a call by default, and a transcript lands in your inbox before you’ve said goodbye. The convenience is real. So is the legal exposure — and most people pressing “record” have never thought about it.

The good news: the rules are more navigable than they look, and almost all of them come down to a single idea — consent. Here’s what professionals using meeting tools and AI notetakers actually need to know.

The short answer: it depends on consent — and on where everyone is

Recording a conversation you’re part of is legal in much of the world if you have the right kind of consent. The catch is that “the right kind” shifts with geography, with whether the talk is private, and — increasingly — with who or what is doing the recording.

So the honest answer to “is it illegal to record someone without their permission?” is: sometimes, and the safest assumption is that you need their permission. Let’s break down why.

United States: one-party vs. all-party consent

US recording law has two layers.

The federal baseline is the Wiretap Act (18 U.S.C. § 2511), which is a one-party consent rule. As long as one person in the conversation consents — and if you’re recording your own meeting, that’s you — federal law is generally satisfied.

State law can be stricter, and it controls. Around a dozen states require all-party consent (often called two-party consent): everyone in the conversation has to agree. The clearest examples include California, Florida, Illinois, Maryland, Massachusetts, Pennsylvania, and Washington, with several others in the mix and a few that are genuinely ambiguous.

This creates an obvious trap for remote work. When participants sit in different states, which rule applies? Courts don’t always agree — so the only durable answer is to default to all-party consent. If you record as though every call needs everyone’s agreement, you’re compliant everywhere at once and you never have to run a per-call jurisdiction analysis.

The downside of getting it wrong isn’t theoretical. Illegal recording can carry criminal penalties and civil damages — California, for example, lets a wronged party recover statutory damages for each unlawful recording — and an improperly obtained recording can be thrown out as evidence in the very dispute you made it for.

Practical rule of thumb: ask for everyone’s consent, every time, before you start. It’s the one approach that works in all 50 states.

The AI-notetaker twist: the tool can be on the hook, too

Here’s the part that’s genuinely new. For decades, recording liability landed on the person doing the recording. AI notetakers have started to change that.

When a bot or background service captures and transcribes a call, plaintiffs have begun arguing that the vendor itself “intercepted” the communication — making the software company a defendant under the same wiretap statutes, not just the user. There is active litigation testing this theory against notetaker products right now, and a recurring theme in those cases is that burying a consent clause in the terms of service isn’t enough. Courts are looking at whether the product actually obtained consent from the people being recorded.

The takeaway for you as a user: choose tools that treat consent as a real, built-in step — not a checkbox you clicked at signup that supposedly speaks for everyone you’ll ever talk to. And the takeaway for anyone building these tools (us included): consent has to be a feature, not a disclaimer.

Europe and the UK: a recording is personal data

Cross the Atlantic and the framing changes. Under the GDPR (and the UK’s equivalent), a voice recording of an identifiable person is personal data, full stop. That means you need a lawful basis to capture it — usually consent — plus you have to be transparent about what you’re doing, and you have to honor people’s data-subject rights, including the right to access their data and have it deleted.

In practice, recording someone in the EU/UK without telling them, without a clear purpose, and without a way to delete the recording on request is a compliance problem regardless of what any wiretap statute says.

Canada: PIPEDA and Quebec’s Law 25

Canada’s federal PIPEDA centers on knowledge and consent — people should know their information is being collected and agree to it — and it applies broadly, with no small-business carve-out to hide behind.

Quebec’s Law 25 goes further still, adding requirements like data-residency considerations, French-language notices and consent interfaces, and a designated privacy officer. If you do business with people in Quebec, plan for the stricter regime.

Recording at work is its own game

Workplace recording deserves special caution, because the usual logic breaks down.

The problem is power imbalance: an employee’s “consent” to be recorded by their employer may not count as freely given, so consent alone is a shaky legal foundation. Employers typically have to lean on a documented legitimate interest (coaching, development, record-keeping) plus genuine transparency instead. On top of that:

• Monitoring-notice laws. Several states — including Connecticut, Delaware, New York, and Texas — require employers to give written notice of electronic monitoring. In Canada, Ontario’s Employment Standards Act requires a written electronic-monitoring policy for employers with 25 or more employees.
• Labor law. In the US, the National Labor Relations Act protects “concerted activity.” An employer can’t use recording to surveil or chill protected organizing — and, conversely, an employee recording to document working conditions may themselves be protected.

The short version: at work, you generally need notice, a written policy, and proportionality — not just a quick “okay?” before the call.

What “recording the right way” actually looks like

Strip away the jurisdictions and you’re left with a surprisingly short checklist. Do these things and you’re aligned with the strictest standards almost everywhere:

• Ask first — every time, before capture begins. No retroactive consent.
• Get it from the other person, not just yourself. Your own consent doesn’t speak for them.
• Make it specific and informed: what’s captured, why, how long it’s kept, and who else processes it.
• Make it per person and revocable. People can change their mind, and your tool should let them.
• Minimize what you keep. Hold raw audio only as long as you truly need it, then delete it.
• Don’t repurpose the data. No training AI models on private conversations, no voiceprints or biometric profiling.
• Keep a record. Who consented, to what, and when — so you can prove it later.

That list reads like a product spec — which is exactly how we approached it when we built consent into Tagup.

How Tagup is built for consent-first recording

Tagup is a relationship tool that can record your one-on-ones, transcribe them, and turn them into smart notes you actually keep. The difference is that recording is never the default and never silent — you tap record to start a conversation, and the people in it have a real say.

Here’s how the checklist above maps to the product:

• Consent before capture, fail-closed. You request recording consent from a contact, and until they grant it, recording stays off for that person. No consent, no recording — that’s enforced, not just suggested.
• Consent that reaches non-users. The person you want to record doesn’t need a Tagup account. They get a private link by email and can approve or decline — and change that decision later — from a simple page of their own.
• Per person and revocable. Each contact controls their own permission and can withdraw it at any time.
• Informed by design. Before anyone agrees, we show a clear disclosure: what’s captured, that the audio is deleted after transcription, and what their data rights are.
• Ephemeral audio. Raw audio is discarded right after it’s transcribed — it isn’t kept in storage or backups.
• No surprises with your data. We don’t train AI models on your conversations, and we don’t build voiceprints or other biometric profiles.
• An audit trail. Every grant, change, and revocation is timestamped and logged, so there’s a real record of who agreed to what.
• Isolated and encrypted. Consent records live in their own protected store, encrypted in transit and at rest.

And when the conversation’s over, you’re still in charge of what it becomes. The Conversation Hub drafts your smart notes and surfaces what matters before the next meeting — but the notes that get saved are the ones you confirm. You stay the author. Tagup is the partner.

If you want the specifics on how we handle your data, our Privacy Notice lays it out in plain language.

Recording conversations is more useful than ever — and more regulated than most people realize. But the through-line is simple: get clear, informed consent, keep only what you need, and respect people’s right to change their mind. Do that, and the legal map gets a lot easier to read.

That principle is wired into how Tagup works, so you can capture the conversations that matter without leaving compliance to chance.