The Lawsuits That Set the Rules for Recording Meetings

TL;DR

The rules for recording a business conversation were not written by legislatures in any useful detail. They were written by a handful of court decisions that answered the questions the statutes left open, and those answers are what a plaintiff's lawyer will actually cite.
Four of them decide almost every practical question: Flanagan (what counts as a private conversation), Kearney (whose state law applies when the call crosses a border), Smith v. LoanMe (being on the call is not a defence), and Javier (consent has to come before the recording, not after).
The most useful case for anyone who does not want to open every call with a consent speech is Commonwealth v. Hyde, because Massachusetts — the strictest state in the country — punishes secret recording, not unconsented recording. Knowledge is the test. That distinction is the entire basis for a workable process.
Two 2025–26 cases moved the target from the customer to the vendor: In re Otter.AI held an AI notetaker can be a third-party eavesdropper in its own right, and Cruz v. Fireflies.AI claims that telling speakers apart is biometric collection.
California's SB 690 is not the rescue it is being sold as. It is narrow, it is about website tracking, and it does nothing for meeting recording.

Most guidance on recording consent is a map of the United States with states coloured in two shades. It is a reasonable starting point and it answers almost none of the questions that actually come up: whether a note-taking tool "records," whose law applies when a rep in Texas calls a buyer in California, whether a disclosure in a calendar invite counts, whether being a participant is a defence.

Statutes do not answer those. Cases do. Here are the decisions that did, what each one actually held, and what each one changes about how you should run a call.

This is a summary of publicly reported decisions for operational planning, not legal advice. The facts of your business, and the states your people and customers sit in, change the answer. Take it to counsel.

Flanagan v. Flanagan (California, 2002) — what makes a conversation private

California's Penal Code § 632 does not prohibit recording conversations. It prohibits recording confidential conversations, and for years the courts disagreed about what that meant. One line of cases said a conversation was confidential if the parties expected it would not be repeated to anyone else. Another said it was confidential if the parties expected it was not being recorded.

In Flanagan, the California Supreme Court settled it: a conversation is confidential if a party to it has an objectively reasonable expectation that the conversation is not being overheard or recorded.

That is a much lower bar than secrecy. The buyer on your discovery call does not have to believe the contents are confidential in any commercial sense. They only have to reasonably believe nobody is running a recorder. On an ordinary video call with no notice and no indicator, that expectation is entirely reasonable — which is what puts a routine sales call inside the statute.

The damages history in Flanagan is worth following, because it is usually reported badly. There were 27 calls. The jury found 24 of them confidential and awarded $5,000 each — $120,000, plus $1.2 million in punitive damages, out of a family dispute. The trial court then cut the statutory award to $5,000, reasoning that multiple conversations about the same subject were a single violation, and struck the punitive award. The Court of Appeal rejected that reasoning but cut the count a different way, finding only 2 of the 27 confidential under the standard the Supreme Court went on to reject. The Supreme Court reversed and sent it back.

So Flanagan is not authority for "$120,000 per family dispute." What matters more is what the legislature did afterwards: § 637.2 was amended by AB 1671, effective January 2017, and now provides for the greater of "$5,000 per violation" or three times actual damages — and subdivision (c) states that the plaintiff need not have suffered any actual damages at all. The trial court's collapse-it-into-one-violation move is a harder argument to run against that text than it was in 2002.

What it changes for you: stop asking whether the conversation was sensitive. Ask whether the other side had reason to think nobody was recording. If you have not told them, they did.

Kearney v. Salomon Smith Barney (California, 2006) — your state's law is not the one that matters

This is the case that catches distributed teams, and it is the one most often missed.

Salomon Smith Barney's brokers sat in Atlanta. Georgia is a one-party-consent state, so recording a call you are on is lawful there. The brokers recorded calls with clients in California, where § 632 requires everyone's consent. Everything the firm did was legal where it was done.

The California Supreme Court held that § 632 reaches the out-of-state recording of calls into California anyway. Applying Georgia's rule would impair California's interest in protecting its residents more than applying California's rule would impair Georgia's. The court enjoined the practice going forward. It declined to award damages for the past conduct only because the statute's reach had genuinely been unclear until that moment — and it said plainly that damages would be available for the same conduct in future.

What it changes for you: the question is never "what state is my rep in." A rep in Austin calling a buyer in Los Angeles is subject to California's rule. In practice, once your prospect list is national, you are running the strictest applicable standard whether you planned to or not. Build one process for everyone rather than a per-state matrix your reps will not follow. Our state-by-state primer covers which states those are.

Smith v. LoanMe (California, 2021) — being on the call is not a defence

The intuition that trips people up: I'm a participant, I'm not wiretapping anyone, I'm just keeping a record of my own conversation.

LoanMe called a borrower's home. Her husband answered, said she was unavailable, and hung up. The call lasted eighteen seconds. There was a beep three seconds in. LoanMe argued that § 632.7 — which covers calls to or from cellular and cordless phones — was aimed at eavesdroppers, and that a party to the call could record it freely.

The Court of Appeal agreed. The California Supreme Court reversed, holding that § 632.7 applies to parties as well as nonparties.

What it changes for you: "I was on the call" is not an exemption, and neither is a beep the other person may not have registered or understood. Note also how short the call was. There is no de minimis carve-out that makes a brief call safe.

Javier v. Assurance IQ (Ninth Circuit, 2022) — consent has to come first

Javier filled in an insurance quote questionnaire. His interactions with the page were captured by third-party session-replay software. After completing the questionnaire, he reached a screen telling him that clicking "View My Quote" meant agreeing to the privacy policy. He clicked. He then sued under § 631(a).

The district court dismissed, reasoning that his later agreement retroactively authorised the earlier capture. The Ninth Circuit reversed: § 631(a) requires the prior consent of all parties, and retroactive consent does not cure a recording that has already happened.

One caveat worth stating honestly, because plenty of summaries do not: Javier was an unpublished memorandum disposition, so it is not binding precedent in the formal sense. It has nonetheless been enormously influential, and district courts have followed its logic consistently.

What it changes for you: the timing is the whole thing. A consent line that lands after capture begins is worth nothing — and that covers most of the comfortable options. A privacy policy the buyer never opened. A disclosure in the recap email. A notice that appears once the tool has already started. If the sequence is capture, then notice, you do not have consent.

This case is usually read as bad news. It is actually the opening for the process most teams want, because it says nothing about consent needing to be spoken or on the call. It has to be earlier. Earlier is easy.

Commonwealth v. Hyde (Massachusetts, 2001) — secret is the trigger, not unconsented

Massachusetts has the strictest recording statute in the country, and its structure is different from California's in a way that matters enormously.

Michael Hyde was stopped by police, secretly recorded the stop on a handheld recorder, and later brought the tape to the authorities to complain about how he had been treated. He was prosecuted — for the recording. The Supreme Judicial Court affirmed his conviction, holding that Mass. Gen. Laws ch. 272 § 99 "strictly prohibits the secret electronic recording by a private individual of any oral communication" with no exception for a motorist recording his own traffic stop. Unlike most wiretap statutes, § 99 has no exception for situations where nobody had a reasonable expectation of privacy. Hyde was recording police doing public work on a public road, and it did not matter.

That sounds like the harshest possible result, and for Hyde it was. But read the statutory definition the court was applying, quoted in the opinion itself:

"The term 'interception' means to secretly hear, secretly record, or aid another to secretly hear or secretly record the contents of any wire or oral communication through the use of any intercepting device by any person other than a person given prior authority by all parties to such communication." — G. L. c. 272, § 99 B 4

Two things follow, and both help you. The prohibited act is secret recording — secrecy is an element of the offence, not an aggravating factor. And the statute's own carve-out is for a person given prior authority by all parties. The court's holding tracks it exactly: § 99 prohibits secret recordings made "without their permission or knowledge."

What it changes for you: in the strictest state in the country, the statute is aimed at recording people who do not know. Knowledge and prior authority are alternatives in the text. It does not require a consent ritual at the top of the meeting — it requires that the recording not be secret, before it starts.

Combine that with Javier — consent must be prior — and you have the shape of a process that is both lawful and bearable: put unmistakable notice in front of people before the call, and you do not need a negotiation at the start of it. We cover how to build that in recording consent without asking on every call.

Two honest caveats. Massachusetts's structure is not universal — other all-party states are written around consent rather than secrecy, so notice alone is not everywhere sufficient, and the safest posture treats clear notice plus an easy objection path as the floor. And whether a recording was "secret" is a question a court answers after the fact, on the facts, not a box you tick in advance. Notice buried where nobody saw it will not persuade anyone that the recording was open.

Rosenbach, Cothron, and the 2024 correction — biometrics, and why the numbers got smaller

Illinois's Biometric Information Privacy Act is the other statute in this area with real teeth, and it applies to voiceprints.

Rosenbach v. Six Flags (Ill. 2019) held that a person is "aggrieved" under BIPA based solely on a company's failure to meet the statute's notice-and-consent requirements — no actual injury required. Cothron v. White Castle (Ill. 2023) then held that claims accrue per scan or transmission, which produced damages arithmetic that reached genuinely ruinous numbers for high-frequency collection.

Then the legislature corrected it. Illinois amended BIPA in SB 2979, signed 2 August 2024 and effective immediately, so that obtaining the same biometric identifier from the same person by the same method of collection is a single violation — each aggrieved person recovers at most once for it. That provision was written to overturn Cothron, and the Seventh Circuit has since held it applies retroactively, so it reaches pending claims too. The same amendment confirmed that the required written release can be given by electronic signature.

Anyone quoting you Cothron-era per-scan arithmetic without mentioning that amendment is quoting stale law.

BIPA's actual requirements remain strict, and they are procedural rather than vibes-based: written notice that biometric data is being collected, written notice of the specific purpose and duration, a written release before collection, and a published retention-and-destruction schedule. Damages are $1,000 per negligent violation and $5,000 per reckless or intentional one.

What it changes for you: if any tool in your stack builds voiceprints, that is a separate compliance regime from wiretap law with its own paperwork, and "we got verbal consent to record" does not satisfy it.

In re Otter.AI Privacy Litigation (N.D. Cal., 2026) — the vendor becomes the defendant

Four 2025 class actions — Brewer, Walker, Theus and Winston — were consolidated before Judge Eumi K. Lee in the Northern District of California as No. 25-cv-06911. The allegations: that Otter joined meetings as a silent participant, recorded, retained, sent transcripts to attendees who had not agreed to anything, and used recorded content to train its models, without adequate disclosure.

On 13 August 2026 the court ruled on the motion to dismiss. The CIPA, ECPA, BIPA, unjust-enrichment and UCL claims survived.

The reasoning is the part worth internalising. The court held that Otter could be a third-party eavesdropper under § 631 — not merely a tool in the hands of a participant — because it independently collects, retains and uses the communications for its own commercial purposes.

That is a line with a clear principle behind it. A recorder operated by a participant is an instrument. A vendor that takes the same audio and uses it to build its own product is, on this reasoning, a separate listener who needed its own consent. The case is ongoing and a motion-to-dismiss ruling decides only that the claims may proceed, not that they win. But the framing is now in a published order and it will be cited.

What it changes for you: your consent posture is no longer just about you and your customer. It is about whether your vendor is a third party in the conversation. The diligence question is narrow and answerable: does this vendor use our meeting content for anything other than delivering our own notes back to us — model training included? Get it in the contract, not the marketing page.

Cruz v. Fireflies.AI (N.D. Ill., 2025) — telling speakers apart may be biometric

Filed 18 December 2025, this one alleges that an AI meeting assistant violated BIPA by recording virtual meetings and using speaker-recognition technology to distinguish between participants.

The theory is worth understanding even though the case is early: a product does not have to be marketed as biometric to be treated as biometric. If the functionality distinguishes people by their vocal characteristics, the claim is that it collects voiceprints and owes the full BIPA notice-and-written-release process to every participant.

Almost every meeting AI labels speakers. If that labelling is done by voice rather than by platform metadata, this theory reaches it.

What it changes for you: ask your vendor how speaker labels are derived. "From the platform's participant list" and "from the audio" are the same feature to a user and very different questions under Illinois law.

What is not coming to save you: California SB 690

SB 690 is widely described as CIPA reform, and vendors have started gesturing at it as though the problem is about to go away. Read the actual bill.

As introduced in 2025 it would have created a broad "commercial business purpose" exception across CIPA's wiretapping, eavesdropping and pen-register provisions. That version passed the Senate unanimously. It did not survive. The July 2026 amendment removed the broad commercial exemption entirely.

What passed both houses on 28 August 2026 is much narrower: it removes the private right of action for pen register and trap-and-trace claims under § 638.51, and only for conduct on websites and mobile applications, leaving the Attorney General as the sole enforcer of that provision. As of this writing it is on the Governor's desk with a 30 September 2026 deadline, and would take effect 1 January 2027.

What it changes for meeting recording: nothing. It is aimed at the website-tracking pixel litigation wave. The §§ 631, 632 and 632.7 provisions that govern recording a conversation are untouched, and so is the private right of action under them.

The through-line

Eight cases, four operating rules:

Assume the conversation is protected. Flanagan sets the bar at whether the other party reasonably thought nobody was recording, not at whether the content was sensitive.
Run the strictest standard everywhere. Kearney means your rep's location does not determine the rule. A per-state matrix is a process your team will get wrong.
Participating is not permission. Smith v. LoanMe forecloses the most common intuition, and eighteen seconds was enough.
Notice goes before capture, and it has to actually reach them. Javier kills retroactive consent; Hyde shows that in the strictest state the requirement is knowledge rather than ceremony.

The fourth is the one that makes a workable process possible. The law is asking you to make sure people know. It is not asking you to open every call by requesting permission — and the teams that do that anyway are usually complying with a rule nobody wrote, at the cost of the first two minutes of every meeting.

Frequently asked questions

Does a tool that does not join the call as a bot avoid all of this? No. Every statute discussed here is about capturing a communication, not about whether a participant icon appears in the meeting. Whether a bot joins is a question about how visible the capture is, and visibility is the thing these cases are asking you to increase. See what to do when a customer says no recording.

Is a disclosure in the calendar invite enough? It is a strong component and, under a Hyde-style knowledge standard, it is doing exactly the right work: it puts the fact in front of everyone before the meeting starts. Whether it is sufficient on its own depends on the state and on whether the person actually received it — a forwarded invite, a dial-in guest, or someone who joined from a colleague's link may never have seen it. Treat it as the default layer, not the only one.

Does one recorded call really expose us to $5,000? Penal Code § 637.2 gives an injured person the greater of $5,000 per violation or three times actual damages, and expressly does not require any actual damages. Whether a given call is a violation depends on the statute invoked, the states involved and the facts — and how violations are counted has been litigated, as Flanagan's own history shows. The useful planning number is not one call. It is a team recording every call for a year before anyone checks.

We are not in California or Illinois. Does any of this reach us? Kearney is the answer to that question and the answer is yes, if you call into those states. Your customers' locations determine your exposure.