Do You Need Participant Consent to Use an AI Notetaker in User Research Interviews When No Bot Joins?

Short answer: yes, in almost every situation you should get clear participant consent before an AI notetaker captures a user research interview — even when no bot joins the call and even when the transcription happens entirely on your own device. The absence of a visible bot does not change the underlying legal duties: you are still recording a conversation, you are still processing personal data, and in many jurisdictions one or more of the participants must affirmatively agree before you press record.

The confusing part, for product teams and the lawyers advising them, is that the rules sit at the intersection of three different regimes: state and federal wiretap statutes, data-protection law (GDPR, CCPA/CPRA, and sector rules), and the ethical duties that apply when any of the content touches legal advice or client confidences. A quiet, local AI notetaker avoids some risks that cloud notetakers create, but it does not avoid the consent question.

This article walks through the analysis the way a careful general counsel would: what "recording" means when an AI is listening, when one-party versus two-party consent applies, what GDPR and CCPA add on top, how to write a consent script that actually works, and where on-device processing genuinely changes the risk calculus. If your research touches regulated users, enterprise customers under NDA, or anything privileged, read all the way to the end.

Why "No Bot Joined" Is Not a Legal Safe Harbor

A lot of product teams have internalized a shortcut: "if the notetaker is not a visible participant in the Zoom call, I don't have to disclose it." That intuition is wrong, and it is worth unpacking why.

Recording laws, in both the US and Europe, do not care whether the recording device is a dedicated bot, a laptop microphone, a phone on the table, or a background process on your Mac. They care whether a conversation is being captured, by whom, and with whose knowledge. The Reporters Committee for Freedom of the Press maintains a widely cited state-by-state recording guide that frames the question in exactly these terms: is the conversation being recorded, and does state law require consent from one party, all parties, or (in a few places) something in between.

The "no bot" design pattern — where capture happens on the host's device rather than via a cloud attendee — reduces some risks (fewer third parties touch the audio, no automatic email with a recording link), but it does nothing to change the recording analysis itself. If your laptop is turning speech into a transcript and storing it, you are recording.

There is also a reputational dimension. The 2025 proposed class action in Brewer v. Otter.ai drew attention precisely because meeting participants argued they had not meaningfully consented to how a popular AI notetaker captured and used their conversations. The suit is ongoing and its outcome is not the point here; the lesson for product teams is that "the other side didn't know" is a bad posture, legally and reputationally, regardless of the technology used.

One-Party vs. All-Party Consent: The US Wiretap Baseline

In the United States, federal law (18 U.S.C. § 2511) permits recording of a conversation if at least one party consents. That is the floor. States are free to require more, and about a dozen do, under what are commonly called "two-party" or "all-party" consent rules. California, Florida, Illinois, Maryland, Massachusetts, Pennsylvania, and Washington are the names that come up most often, though the exact contours vary — Massachusetts, for example, focuses on "secret" recording; Illinois has a distinct Eavesdropping Act with its own history.

For a user research interview, the practical implications are:

• If any participant is in an all-party state, you need affirmative consent from every participant before capture begins. Remote interviews are frequently cross-jurisdictional, so the safe default is to assume the stricter rule applies.
• Even in one-party states, your own consent as the researcher technically satisfies the wiretap statute — but it does nothing for GDPR, CCPA, platform terms of service, IRB rules, or basic research ethics. One-party consent is a floor, not a program.
• Enterprise participants under NDA may have contractual obligations that forbid them from being recorded without their employer's sign-off. That is not a wiretap question; it is a contracts question, and it still blocks you.

A reasonable operating rule for a US-based research team: always obtain explicit, on-the-record verbal or written consent at the start of the session, regardless of state. It costs ten seconds and resolves the ambiguity.

What GDPR and CCPA Add on Top

Wiretap laws ask "can you press record?" Data-protection laws ask the broader question: "what are you doing with the data, on what legal basis, and have you told the data subject?"

Under the GDPR, a voice recording and its transcript are personal data. If the participant is identifiable — and in a one-on-one interview they are — Articles 5, 6, and 13 apply. You need a lawful basis (consent is the usual choice for user research), a clear purpose, a retention period, and a transparent notice. The European Data Protection Board's transparency guidance gives the practical shape of what that notice needs to cover.

Under the CCPA/CPRA, audio recordings are explicitly called out as personal information, and voice data can be "sensitive personal information" in some configurations. The California Privacy Protection Agency's current regulations set out notice-at-collection and purpose-limitation duties that apply whether the AI is local or remote.

Crucially, both regimes care about who else touches the data. A cloud notetaker that sends audio to a vendor's servers introduces a processor (GDPR) or service provider / third party (CCPA) that must be disclosed, contracted with, and bounded in what it can do. An on-device notetaker that never transmits audio to the vendor removes that specific disclosure obligation — but only for that specific vendor. If the same tool syncs data to your own cloud account (for example, your iCloud), that storage still needs to be covered in your notice.

When User Research Edges Into Privileged Territory

Most user research interviews are not privileged. But some are, or sit adjacent to privilege in ways product teams routinely underestimate:

• In-house counsel conducting discovery interviews with employees about a product issue.
• Legal-ops research into attorney workflows where real matters come up.
• Compliance interviews that could later be used in regulatory proceedings.
• Researcher interviews with outside counsel evaluating a legal-tech product.

In each of these, introducing an AI notetaker creates an additional analysis under ABA Model Rule 1.6 on confidentiality and under ABA Formal Opinion 512 (July 2024) on generative AI. Opinion 512 is explicit that lawyers must understand what happens to information fed into an AI tool, obtain informed client consent where appropriate, and consider whether the tool's data handling is consistent with the duty of confidentiality.

The NYC Bar Formal Opinion 2025-6 (December 2025) builds on this by addressing confidentiality in AI-assisted workflows more concretely. And courts are beginning to ask similar questions: in US v. Heppner (S.D.N.Y. Feb 2026), Judge Rakoff held that a litigant's chats with a public AI platform were not privileged, reasoning by analogy to the third-party doctrine. The implication for research interviews is that any time privileged or confidential content might arise, the architecture of the capture tool — who else sees the data — becomes a central question, not a background detail.

Separately, decisions like West Technology Group v. Sundstrom (D. Conn. 2024) illustrate how courts scrutinize electronic evidence capture and chain-of-custody arguments. The more third parties involved in the pipeline, the more questions you invite.

A Practical Consent Script for AI-Assisted Research Interviews

Consent works best when it is specific, short, and audibly captured at the start of the recording. A workable template, adaptable to your context:

"Before we start, I want to let you know that I'll be using an AI notetaker to transcribe and summarize our conversation so I don't have to type while we talk. The transcription runs on my laptop and the audio is not sent to the notetaker's vendor. The transcript and audio will be stored in my company's account and retained for [X] days / until the research is complete. You can ask me to stop at any time, skip any question, or ask me to delete the recording afterward. Is that okay with you?"

Then wait for an affirmative answer, on the recording. If any participant declines, turn the tool off. Document the consent in your research log or consent register alongside participant metadata.

Comparing Capture Architectures

Not all AI notetakers are architecturally equivalent, and the differences matter for both your consent script and your data-protection analysis. The table below compares three common patterns.

The headline insight: on-device capture meaningfully reduces the number of third parties in the pipeline, which reduces disclosure and contracting burdens and reduces privilege-adjacent risk. It does not remove the consent obligation — nothing does.

Platform Terms and "No Bot" Capture

A quieter issue, often missed, is that meeting platforms have their own rules about recording. Zoom, Microsoft Teams, and Google Meet each expose a native recording indicator when their built-in recording is used, and each has terms that address recording generally. Capturing audio via a separate on-device tool does not trigger those indicators, which is a feature for the host but another reason to be explicit about consent: participants cannot infer from the UI that recording is happening.

For reference, Zoom's recording and consent documentation outlines the platform's own notification behavior. Your consent script should not rely on the platform to disclose on your behalf.

IRB, Research Ethics, and Enterprise Contracts

If your research is run through or alongside an IRB (common in healthcare, academic partnerships, or regulated industries), the IRB's consent form controls and typically requires explicit language about recording, storage, retention, and the identity of any AI processors. "No bot joined" is not an answer to an IRB; the question they will ask is what tools processed the audio and where the data went.

For B2B research with enterprise participants, check the participant's NDA with you, and check your own master agreements. Many enterprise NDAs forbid recording by default; a verbal "yes" from the individual participant may not be sufficient if their employer has pre-committed them otherwise.

A Short Checklist Before Your Next Interview

1. Decide whether your capture tool sends audio to a vendor. If yes, confirm you have a DPA.
2. Default to all-party consent, verbally captured at the start of the session.
3. Disclose: who is recording, what tool, where it stores data, how long, and how to delete.
4. Check whether any participant is likely to be in a two-party state or in the EU/UK.
5. If the content could be privileged, align your tool choice with ABA Opinion 512 and your jurisdiction's analog.
6. Log the consent alongside the research artifact.

For teams whose research touches legal workflows specifically, our notes on Basil for Law go deeper on the architectural choices that matter when privilege is in play.

How Basil Approaches This

Basil is designed so that transcription and summarization run on the device, using the Apple Neural Engine. Basil has no server and no subprocessors, and Basil never receives your recordings, transcripts, or summaries. iCloud Sync is on by default, which means your library — audio included — is stored in your own iCloud account (Apple, not Basil); you can turn sync off in Settings › iCloud if you prefer purely local storage. For in-person meetings and virtual calls on Zoom, Teams, or Meet, Basil captures on your Mac in Computer mode — no bot joins the call, which is why the consent script above still matters: participants cannot see a bot, so you need to tell them.

Basil signs DPAs and NDAs on request. The Basil for Law edition (privilege attestation, consent log, matter organization, Privileged & Confidential labeling) is $19.99/month or $199.99/year, with a 3-day free trial on monthly and 7-day on annual, one trial per Apple Account. The general Basil app is available today with a 60-minute free tier.

This article is for information only and is not legal advice.

Keep client conversations on your device

Basil makes transcripts and summaries on your device. No bot joins the call, and Basil never receives your client conversations. See Basil for Law → · Legal-tool reviews →

This article is for information only and is not legal advice.