AI Notetaker Recording Consent: What Utah Businesses Owe

The assumption that just broke

Most people running an AI notetaker believe something like this: I am in the meeting, I am allowed to record the meeting, the bot is just my recorder. Under that story the bot has no independent legal status. It is a pen.

On August 13, 2026, a federal judge in the Northern District of California said that story does not automatically hold. In In re Otter.AI Privacy Litigation, No. 25-cv-06911-EKL, the court granted part of the defendant's motion to dismiss and denied the rest. The claims that survived are the ones that matter here: the California wiretap claim, the federal Electronic Communications Privacy Act claim, the Illinois biometric claim, unjust enrichment, and unfair competition.

The reasoning is the part worth reading twice. A vendor that only transcribes a call and hands the transcript back to you can be treated as an extension of you, which means one-party consent covers it. The court held that this particular notetaker went past that, because it retained the recordings and used them to train its own speech and machine learning models. Once a vendor is doing something with your customer's voice for its own commercial benefit, the "it is just my pen" defense stops working.

Nothing has been proven yet. Surviving a motion to dismiss means the claims are plausible enough to go forward, not that anyone lost. But the legal test the court applied is now on the record, and it is a test you can apply to your own vendor in about five minutes.

Why the Utah answer is not simply "we are a one-party state"

Utah is a one-party consent state. That much is true and it is easy to verify. Utah Code 77-23a-4(7)(b) says a person not acting under color of law may intercept a communication "if that person is a party to the communication or one of the parties to the communication has given prior consent to the interception."

Read the rest of that sentence. The permission runs "unless the communication is intercepted for the purpose of committing any criminal or tortious act in violation of state or federal laws."

That clause is not decoration. The federal statute has the identical carve-out at 18 U.S.C. 2511(2)(d), and the tortious purpose exception is exactly where the Otter defense failed. The vendor argued its purpose was commercial. The court's answer, in substance, was that committing a tort and seeking a profit are not mutually exclusive.

So the Utah shortcut has a hole in it. Your consent as a participant covers your own recording. It does not obviously cover a third party that is sitting on the same call harvesting the audio for its own purposes. Utah's one-party rule and the federal one-party rule both stop at the same line.

The other half of the problem is who else is on the call

Even if your vendor is clean, you have a geography problem, and it is worse for a Utah business than for a business that only sells locally.

You are in a one-party state. Your prospect on the other end of the Zoom call may not be. California Penal Code 631 is the statute that just survived dismissal in the Otter case, and California requires all parties to consent. Illinois adds a separate biometric statute, which is why voiceprints showed up in that lawsuit at all.

For a Salt Lake City company, the practical reading is this. Internal standups with your own team in Utah are the easy case. A discovery call with a prospect in San Francisco is the hard case, and you do not get to pick which law applies by picking where you sit. Everyone on the call brings their own.

The gap in the tools most small businesses actually have

Here is a specific thing that surprised me when I went looking, and it is the reason this post exists.

Zoom does have a recording consent disclaimer. It prompts participants when a recording starts and lets them consent or leave, and admins can pull a report of who consented. But read Zoom's own documentation on customizing it: the feature requires account owner or admin privileges on a Business, Education, API, or Enterprise account with 100 or more licenses.

A six-person shop in Sugar House is not on a 100 license plan. So the compliance feature that would solve this cleanly is, in practice, gated away from the businesses most likely to be running a notetaker on a credit card subscription with nobody watching.

That is the actual state of play. The tool is cheap and instant. The guardrail is enterprise-priced.

What to do this week

None of this requires a lawyer to start. Four steps, in order.

Find out what is actually running. Notetakers spread sideways. One person installs a calendar integration and it starts auto-joining every meeting on the account, including meetings that person did not book. Open your calendar for the last month and look for a bot participant in the attendee list. Check the recordings folder in your meeting platform. Ask each person on the team what they installed.

Second, read the vendor's data terms for the training question above. If the answer is that your conversations train their model, either turn that off if there is a switch, or replace the tool.

Third, announce the recording out loud, every time, in the first thirty seconds. This is unglamorous and it works. It converts a legal argument about implied consent into a documented moment where everyone heard it and stayed. If your platform can also display a banner, turn that on, but say it anyway, because the person dialing in from a car does not see banners.

Fourth, decide what the notetaker is not allowed to attend. Performance reviews. Anything with a client's health, finances, or legal exposure in it. Anything under an NDA that names permitted recipients, because a training-hungry vendor is not on that list.

Where this actually bites in a workflow

I care about this because of how these tools get wired in, not because of how they get used in isolation.

The whole point of a notetaker is that it does not stop at the transcript. The transcript goes to a summarizer, the summary goes to a CRM, the CRM triggers a follow-up email. That is the kind of chain we build, and it is genuinely useful. We are building intake automation for a residential treatment provider right now, and the reason we do not put a general purpose notetaker anywhere near that pipeline is simple: the content of those conversations is the most sensitive category there is, and the answer to "where does this audio go" has to be a short, provable sentence.

Most business conversations are not that sensitive. But the design rule scales down cleanly. Every automated step should have a named destination for the data. If you cannot say where a recording lands and who else can read it, the automation is not finished, it is just fast.

That is the same discipline that applies to consent rules for automated text messages and to deciding what an AI agent may do without a human. The technology is not the risky part. The unexamined default is.

If you are in Utah, this also stacks with the disclosure duties covered in our post on the Utah AI disclosure law and the data handling questions in Utah privacy law for small business. Those are separate obligations, and a notetaker can touch all three at once.

The honest summary

An AI notetaker is not automatically your property just because you invited it. A federal court has now said, at least plausibly, that a vendor which keeps and reuses the audio is its own party to the conversation. Utah's one-party consent rule does not cure that, because Utah's statute carries the same tortious purpose exception the federal statute does.

The fix is not to stop recording meetings. It is to know which vendor you are using, know what it does with the audio, and say the words out loud at the start of the call.

If you want help mapping where recordings and transcripts actually travel inside your systems, that is the sort of thing we untangle when we build workflow automation that has to hold up under scrutiny.

Talk through your automation stack