Blog · Law

Recording a conversation with AI: consent rules in the US, the EU and India

Eleven US states need everyone's consent to record. The EU's AI transparency rules apply from August 2026. India's DPDP Rules phase in by May 2027. A plain summary for teams that record meetings, calls or counter conversations.

10 October 2026 · 3 min read · Soham Mitra

The United States: one party or all parties

Federal law lets a conversation be recorded if one party to it consents. States can be stricter. The Reporters Committee for Freedom of the Press lists about eleven that require consent from everyone: California, Delaware, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, New Hampshire, Pennsylvania and Washington.

California's Penal Code §632 bars recording a confidential communication “without the consent of all parties”. Under §637.2 a person recorded that way can sue for the greater of $5,000 or three times their actual damages. Calls cross state lines, so the stricter rule is the safer default.

Lawyers have extra rules

The New York City Bar's Formal Opinion 2025-6 says a lawyer who uses AI to record a client call must tell the client and get consent, even though New York only needs one party's consent. It also says to check how the vendor stores and trains on data, and to check AI summaries. ABA Formal Opinion 512 says a client's informed consent is needed before their information goes into a self-learning AI tool, and that boilerplate in an engagement letter is not enough. Our law-firm case study shows a client call filed into a matter log on the firm's own laptop.

The European Union: tell people they are dealing with AI

Article 50 of the AI Act applies from 2 August 2026, with one grace period for machine-readable marking by systems already on the market. Its main duties:

• Providers must tell people they are interacting with an AI system, unless that is obvious.
• Providers of systems that generate audio, images, video or text must mark the output as machine-generated.
• Deployers of emotion-recognition or biometric-categorisation systems must inform the people exposed to them.
• The information must be given at the first interaction at the latest.

A meeting notetaker that only transcribes and summarises is not an emotion-recognition system. Recording consent in the EU still comes from data protection law and national law, which the AI Act does not replace.

India: DPDP consent is specific and withdrawable

The Digital Personal Data Protection Rules were notified in November 2025 with an eighteen-month phase-in. According to MirvoLegal's timeline, the duties on notice, consent, security, breach reporting and data-principal rights apply from about May 2027. A proposal to shorten the phase-in to twelve months had not been notified as of September 2026.

Consent under the Act must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and as easy to withdraw as to give. Each data fiduciary must give a clear notice stating the specific purpose. A shop that records counter conversations to fill customer records is that fiduciary, whichever tool it uses.

A short checklist

Vlocalhost keeps recordings, transcripts and notes on the user's own computer, so deleting them is deleting files the user controls. That makes the last two rows easier. It does not make the first three unnecessary.

This is a summary for orientation, as of 10 October 2026. It is not legal advice; laws differ by place and change.