AI note-takers have made it routine to transcribe meetings and calls, and easy to forget that a transcript is a recording of other people’s words. This note sets out, from primary legal texts and official guidance, when the law in France and Morocco requires the consent of the people being recorded, how this compares with the United States federal rule and with the GDPR’s duty to inform, and how meeting software and a pending lawsuit treat the question. It ends with what AISir, a HisnLabs planner for the Mac that can take call notes, does before it transcribes anything, and what it leaves to the user. This is a description of texts, not legal advice; the rules depend on the country, the setting and the facts.
Background
Three different legal questions arise when a call is transcribed. The first is criminal: is it an offence to capture or record words spoken in private without the speaker’s consent? The second is data protection: a recording and its transcript are personal data, and whoever decides to make them must inform the people concerned. The third is contractual or professional: an employer, a client or a professional code may impose rules of its own. A transcription made by software, even if no audio file is kept, is still a capture of the words spoken, and the transcript is usually the more useful, and the more revealing, of the two artefacts.
Findings
France: consent of the speaker, presumed only when the recording is open
Article 226-1 of the French Code pénal, in the version in force since 23 March 2024, punishes “d’un an d’emprisonnement et de 45 000 euros d’amende” (one year’s imprisonment and a fine of 45,000 euros) the act of deliberately infringing another person’s privacy “En captant, enregistrant ou transmettant, sans le consentement de leur auteur, des paroles prononcées à titre privé ou confidentiel” (by capturing, recording or transmitting, without the consent of their author, words spoken in a private or confidential capacity). Consent can be presumed, but only in one situation: “Lorsque les actes mentionnés aux 1° et 2° du présent article ont été accomplis au vu et au su des intéressés sans qu’ils s’y soient opposés, alors qu’ils étaient en mesure de le faire, le consentement de ceux-ci est présumé” (when the acts were done in full view and knowledge of the persons concerned, without their objecting although they were able to, their consent is presumed) [1]. Openness is therefore the condition: a recording the other party does not know about cannot rely on the presumption.
For calls recorded at work, the CNIL’s guidance lists what must be disclosed: “Les salariés ainsi que les interlocuteurs (clients, par exemple) doivent être notamment informés” (employees and the people they speak to, clients for example, must in particular be informed) of the existence of the system, the identity of the controller, the purposes, the legal basis, the recipients, the retention period and “de leur droit d’opposition pour motif légitime” (their right to object on legitimate grounds) [2].
Morocco: prior approval, and a duty to inform
Law 103-13 of 2018 added article 447-1 to the Moroccan Penal Code. In the unofficial English translation by Mobilising for Rights Associates, published by Morocco World News on 17 April 2018, it reads: “Shall be sentenced to imprisonment from six months to three years and a fine ranging from 2,000 to 20,000 MAD, any person who intentionally, by any means whatsoever including computer systems, captures, records, broadcasts or disseminates someone’s private or confidential information or statements without their prior approval” [3]. Morocco’s personal data law, Law 09-08, separately requires, in its article 5, that any person asked directly for personal data “doit être préalablement informée de manière expresse, précise et non équivoque” (must be informed beforehand, expressly, precisely and unambiguously) of, among other things, “l’identité du responsable du traitement” and “les finalités du traitement” [4].
The United States federal rule: one party’s consent
The federal Wiretap Act takes a different approach. Under 18 U.S.C. § 2511(2)(d), it is not unlawful for a private person to intercept a communication “where such person is a party to the communication or where one of the parties to the communication has given prior consent to such interception”, unless the purpose is to commit a criminal or tortious act [5]. State laws can be stricter; this note did not open them and does not describe them.
The GDPR: inform at the time of collection
Where the GDPR applies, Article 13 requires that “Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information”, starting with “the identity and the contact details of the controller” and “the purposes of the processing for which the personal data are intended as well as the legal basis for the processing” [6]. Whether a private individual transcribing a call is acting in a purely personal capacity, outside the GDPR, or as a controller, for example as a freelancer, is a question of fact.
How meeting tools and a lawsuit treat consent
Microsoft documents an explicit-consent mode for Teams: “When the explicit recording and transcription policy is enabled, all participants are muted once the meeting recording or transcription starts. Once a participant decides to un-mute, they’re prompted to provide consent” [7]. Third-party note-takers do not always ask. The Register reported on 18 August 2025 on a proposed class action against Otter.ai, whose complaint, according to the report, notes that “Otter records all utterances in a meeting – those made by accountholders and those made by meeting participants who do not have an Otter account”, and claims that “Otter’s services never ask those guests for consent to have their voices recorded or fed into a machine learning model” [8]. These are allegations; the report does not describe a ruling.
| Framework | Whose consent | Penalty or duty stated | Source |
|---|---|---|---|
| France, Code pénal art. 226-1 | The speaker; presumed only if done openly and not opposed | One year and 45,000 euros | [1] |
| France, CNIL (calls at work) | Employees and callers must be informed, with a right to object | Duty to inform | [2] |
| Morocco, Penal Code art. 447-1 | Prior approval of the person (unofficial translation) | Six months to three years, 2,000 to 20,000 MAD | [3] |
| Morocco, Law 09-08 art. 5 | Prior, express information of the person | Duty to inform | [4] |
| United States, 18 U.S.C. § 2511(2)(d) | One party to the communication | Federal rule; states may differ | [5] |
| EU, GDPR art. 13 | Information at the time of collection | Identity, purposes, legal basis | [6] |
Implications for people who transcribe calls
In France and Morocco, the texts quoted above make consent, not participation, the decisive factor: being on the call does not by itself authorise recording it. The French presumption of consent rewards openness, which in practice means announcing the transcription at the start, so that others can object. The one-party rule familiar from US discussions does not carry over to these two countries. A local transcription does not change the legal analysis, since words are captured either way, but it does change who else receives them: a cloud note-taker adds a provider that holds the audio or the transcript, and possibly uses it, which is precisely what the Otter complaint is about.
Recommendations
- Announce at the start of the call that you will transcribe it, say why, and give people the chance to object; note that you did so.
- If anyone objects, do not transcribe, and do not record “just in case”.
- Prefer meeting settings that ask each participant for consent, and check whether a third-party note-taker announces itself.
- Keep transcripts only as long as their purpose requires, and tell participants how to get a copy or ask for deletion.
- For calls across borders, assume the stricter rule applies, and seek legal advice where the stakes are high.
Relevance to AISir
AISir 1.0.1 notices when Microsoft Teams, Zoom, FaceTime, Slack, Webex, Discord or a call in a browser uses the microphone, and asks “Take notes for this call?”. According to its Help, “It never starts on its own.” If the user accepts, a sheet asks the user to tell the other participants: “Start taking notes stays disabled until you turn on ‘I’ve told the other participants’. Cancel leaves the call alone.” While notes are taken, a red “AISir is taking notes” badge stays on screen until the user clicks Stop. Whisper writes a live transcript of both sides on the Mac; afterwards Gemma, also on the Mac, writes a summary, the decisions and proposed tasks, which wait for Accept, Edit or Dismiss. Call audio “stays in memory and is never saved; only the transcript and the notes of calls are kept”, in AISir’s database on the Mac. AISir’s roadmap gives the reason for the reminder: recording or transcribing a call without the participants’ consent is illegal in many countries, including France and Morocco. Details are on the AISir page.
AISir does not obtain consent, verify it or record it: the switch records only the user’s own statement that they told the others. It does not notify participants itself, and they see no indicator from AISir on their side. It is not legal advice and does not know which law applies to a given call. Its transcripts can contain errors, especially in Arabic, where support is weaker than in French and English in places; the small model’s summaries can be wrong; and AISir runs only on Apple silicon with macOS 15.
Limitations
This note quotes texts; it does not interpret case law, which can narrow or widen them, and it is not legal advice. The official Arabic text of Moroccan article 447-1 could not be retrieved, so it is quoted from an unofficial English translation; later amendments, if any, are not reflected. Law 09-08 was read from a PDF copy, not from the official portal. US state laws, including those that require the consent of all parties, were not opened and are not described. The Otter case is described from a press report of the complaint, not from a court decision. AISir’s behaviour is described from its own Help and roadmap, and HisnLabs makes AISir, which readers should weigh. Related reading: camera and microphone permissions on the Mac.
How FireAI and HisnLabs fit in
A note-taker that sends a call’s audio to a server opens a connection while the call runs. FireAI shows, per app, which connections your Mac opens during a call, so you can see which tools listen with a server and block the ones you did not expect.
FireAI is HisnLabs’ own product: an on-device AI firewall for Mac. It shows every connection your apps make, in plain language, and lets you decide what leaves your Mac — its AI runs locally, so your traffic is never sent to us or anyone else. HisnLabs’ security research team is the group that keeps that decision-making accurate: cataloguing which domains are ordinary telemetry versus a real product, tracking the country and network behind a connection, and training the on-device model (its FireAI Pilot feature) on real traffic patterns, all without any of it leaving your Mac.
You can read the technical decisions behind it, or try FireAI for 17 days, at FireAI, by HisnLabs.