Massachusetts call recording laws make secret recording a crime, and section 99 of chapter 272 lets each person secretly recorded sue for actual damages, with a floor of $1,000 or $100 a day, whichever is higher. What that means for AI notetakers, AI receptionists and the transcripts they keep.
Massachusetts call recording laws forbid secret recording: under M.G.L. c. 272, section 99, a call or meeting may be recorded only when every party knows it is happening. The statute's definition of a recording device is broad enough to reach AI notetakers, call transcription and AI voice receptionists, just as it covers a tape recorder, and a willful secret recording carries a fine of up to $10,000 and up to five years in state prison.
This is the recording layer under Massachusetts WISP requirements under 201 CMR 17.00. The wiretap statute decides whether a recording may exist at all. The data security regulation decides how a business protects the transcript once it does, which matters most on the day a customer reads a card number to a bot.
I am not a lawyer, and this is not legal advice. It explains what the law and the courts say; your own attorney applies it to your business.
Secret recording. The statute text on malegislature.gov defines an interception as "to secretly hear, secretly record, or aid another to secretly hear or secretly record the contents of any wire or oral communication through the use of any intercepting device by any person other than a person given prior authority by all parties to such communication." Massachusetts is usually called a two-party or all-party consent state for that reason.
The definition reaches further than phone calls. An "oral communication" is simply speech, so a laptop or phone recording an in-person meeting in a conference room falls under the same rule as a recorded call. An "intercepting device" is any device "capable of transmitting, receiving, amplifying, or recording" a communication, which describes any AI notetaker.
The Supreme Judicial Court has read the word "secretly" as the center of the statute. In Commonwealth v. Jackson, decided in 1976, the court held that the person recorded must have actual knowledge of the recording, and that knowledge is proved by "clear and unequivocal objective manifestations of knowledge." That means knowledge can be shown by what someone visibly understood, without a signed form.
In Commonwealth v. Hyde (2001), the court held that section 99 "strictly prohibits the secret electronic recording by a private individual of any oral communication," and upheld a motorist's conviction for secretly taping police officers during a traffic stop. The argument that the officers had no privacy interest in what they said did not save him. The court added that he could have avoided the problem by telling the officers he was recording "or even held the tape recorder in plain sight." The First Circuit later held in Project Veritas Action Fund v. Rollins (2020) that the statute cannot be enforced against secret audio recording of police officers doing their jobs in public, a limit that does not reach private meetings or business calls.
It can, when anyone on the call does not know it is running. A notetaker that joins a video meeting as a named participant, announces itself and appears in the attendee list is far easier to defend as a recording people knew about, though no Massachusetts court has ruled on an AI notetaker. The same tool running quietly from one attendee's account, or a phone app transcribing a meeting from a pocket, is the secret recording the statute was written to stop.
The court has been clear that the honesty of the person recording is a separate question. In Curtatone v. Barstool Sports, decided June 14, 2021, the mayor of Somerville sued over a recorded call with a caller using a false identity. The court affirmed the dismissal of the claim because the mayor "knew throughout the call that his words were being heard and recorded," and called the truthfulness of the caller's identity "irrelevant." Knowledge of the recording is the test.
The 2026 case law points the same way. In Commonwealth v. Grimaldi, decided June 2, 2026, the court held that a willful violation "requires not merely an intent to record, but rather an intent to secretly record," and found none where State Police troopers used visible body cameras beside a posted recording sign. The court expressly left open whether that recording was secret, so a sign alone is not a safe harbor.
The statute's definition of a device does exclude telephone equipment furnished by a carrier and used "in the ordinary course of its business." The Appeals Court read that exception beyond telephone companies in Dillon v. MBTA (2000), covering recorders a business bought from an equipment maker and wired into its phone system. Whether a cloud AI service fits it has not been decided, and it is a question for counsel before anyone relies on it.
Three tiers, written into section 99 itself. A person who willfully commits or attempts an interception "shall be fined not more than ten thousand dollars, or imprisoned in the state prison for not more than five years, or imprisoned in a jail or house of correction for not more than two and one half years, or both so fined and given one such imprisonment."
Using the recording carries its own penalty. Section 99 C 3 makes it a misdemeanor to willfully disclose or use the contents of a communication "knowing that the information was obtained through interception," punishable by up to two years in a jail or house of correction, a fine of up to $5,000, or both. A transcript passed around after the fact inherits the problem with the recording it came from.
The civil remedy in section 99 Q gives any aggrieved person a claim for "actual damages but not less than liquidated damages computed at the rate of $100 per day for each day of violation or $1000, whichever is higher," plus "punitive damages" and "a reasonable attorney's fee and other litigation disbursements reasonably incurred." The Reporters Committee for Freedom of the Press summarizes the same three parts in its Massachusetts recording guide.
Consider an insurance agency in Shrewsbury whose AI receptionist answers 300 calls in a month without saying it records them. If each of those callers brought and won a claim, the liquidated floor alone would be $1,000 per caller, $300,000 before punitive damages and fees. The arithmetic is why a missing disclosure is a business decision and not a technicality.
Lawsuits over AI notetakers are already moving elsewhere. In re Otter.AI Privacy Litigation, filed in the Northern District of California on August 15, 2025, alleges that the notetaker recorded people who never agreed to it. On August 13, 2026 the judge granted Otter's motion to dismiss only in part, letting the federal wiretap, California privacy, Illinois biometric and consumer protection claims proceed. That is a ruling on the pleadings under federal law and other states' laws, not a finding of liability.
Before the recording starts, in words the caller hears. Jackson and Hyde both turn on what the other person knew, so the safest design makes knowledge unavoidable: an opening line on every inbound call that says the call is answered by an automated assistant and is recorded and transcribed, spoken before the caller says anything substantive.
Four habits make that disclosure hold up when someone later asks what a caller knew.
Lawyers writing on this have reached the same practical answer. McLane Middleton, writing in October 2024, recommends getting consent when a meeting invitation is accepted or orally at the start, and Mac Murray & Shuster, in June 2026, advises applying the strictest state rule whenever participants' locations are unknown. Wording for customers is covered in how to use AI for customer communication without sounding like a robot.
The same protection as any other record. 201 CMR 17.02 defines a record as "any material upon which written, drawn, spoken, visual, or electromagnetic information or images are recorded or preserved, regardless of physical form or characteristics." A call recording is a record, and so is the transcript and the summary the AI writes from it.
Personal information under the same section is a resident's name with a Social Security number, a driver's license or state ID number, or a financial account or card number. Callers recite exactly those things to a receptionist, and employees recite them in benefits and payroll meetings. The moment one of them is spoken into a recorded line, the recording and every copy of its text are in scope.
The AI vendor is then a service provider: 17.02 covers "any person that receives, stores, maintains, processes, or otherwise is permitted access to personal information" through services it provides. Section 17.03(2)(f) requires taking reasonable steps to select providers capable of protecting it and "requiring such third-party service providers by contract" to do so. Section 17.04 adds access limited to people who need it for their jobs, and encryption of personal information that travels across public networks or sits on laptops.
The Attorney General has said this applies to AI by name. Her advisory of April 16, 2024 states that Chapter 93H and 201 CMR 17.00 reach AI systems, and that developers, suppliers and users must safeguard personal data those systems use and follow the breach notification rules. If a transcript store is ever exposed, the steps in Massachusetts data breach notification requirements apply to it like any other file. The vendor side is the subject of the sub-processor problem.
Chat sits next to voice in most of these products. In Vita v. New England Baptist Hospital, decided October 24, 2024, the court held that the wiretap statute does not clearly cover tracking of web browsing. It also wrote that the plain meaning of communication includes messages between people by "e-mail, text message, chat, instant message, or the equivalent," so a chat transcript deserves the same care as a call.
Who may switch a recorder on, and where it is never allowed. AI notetakers often arrive through one employee's free account, which is the pattern described in shadow AI: govern it by enabling it. Approving one tool with the disclosure built in is easier to enforce than a ban that people route around, whether the office is in Worcester or the team is spread across three states.
Then a short list of decisions, written into the policy covered in how to build an AI policy for your team. Meetings that never get a bot: legal advice, disciplinary and medical conversations, and anything under a confidentiality agreement. A retention period for recordings and transcripts, with automatic deletion, because the cheapest way to protect data is to not keep it. A contract term on whether the vendor may train models on your calls, and what it must delete when you leave.
Finally, a test. Before launch, call the AI receptionist from an outside line, listen to what a stranger hears in the first ten seconds, and read the transcript it produces to see what personal information it captured. A disclosure that exists in a settings page but not in a caller's ear is unlikely to give a caller the actual knowledge Jackson requires. Repeat the test after every vendor update, because a changed greeting script can drop the notice without anyone on staff hearing the difference.
Kief Studio builds and runs the software and systems a business depends on, and when one of them records a call or a meeting, we treat the notice that plays before audio is kept, transcripts that expire on schedule, and access limited to the people who need it as properties of the build rather than a policy added later. MyRHC's index of official compliance sources links many state and federal regulations directly. We work across Worcester and Shrewsbury, mostly remotely.
Not legal advice. This article is general information about Massachusetts law as of October 2026. I am not a lawyer, Kief Studio is not a law firm, and reading this does not create an attorney-client relationship. Laws and court decisions change, and the right answer depends on your facts, so talk to a Massachusetts attorney before you record calls or deploy an AI notetaker or receptionist.
If your team already records calls or runs a notetaker, we can review how notice, retention and access work today and what to change in the build. Start on the consulting page or contact Kief Studio directly.
All-party, in practice. Section 99 of chapter 272 bars recording unless every party has given prior authority, and the Supreme Judicial Court reads it as banning recordings made without the other person's knowledge.
Not reliably. Section 99 contains no beep-tone provision, and the court asks whether the caller had actual knowledge of the recording. A spoken announcement at the start of the call is far easier to prove than a tone.
It can. Which state's law applies is decided case by case, and lawyers advising on AI notetakers recommend meeting the strictest rule of any participant's state. A Massachusetts caller on the line is reason enough to disclose.
No. Commonwealth v. Hyde held that section 99 bars secret recording by any private individual, with no exception based on a privacy expectation. Recording openly, with the manager aware, is a different matter.
Using it is its own risk. Section 99 C 3 makes willfully disclosing or using intercepted contents, knowing they came from an interception, a misdemeanor punishable by up to two years in jail, a $5,000 fine, or both, separate from the recording itself.
Both. Section 99 protects wire communications and oral communications, and it defines an oral communication as "speech, except such speech as is transmitted over the public air waves by radio or other similar device."
Your contract with them must cover it when they handle personal information. 201 CMR 17.03(2)(f) requires a business to bind service providers by contract to implement and maintain appropriate security measures for that information.
GDPR for Massachusetts companies applies when they offer goods or services to, or monitor, people in the EU. Fines reach EUR 20 million or 4% of worldwide turnover, whichever is higher. Here is how it overlaps with 201 CMR 17.00.
Phishing training cost runs from free federal material to $19.56 to $45 per seat a year on KnowBe4's published list prices. What the free options leave out, what platforms, managed programs and in-person sessions add, and what to ask before buying.
Custom software cost starts with labor: the Bureau of Labor Statistics puts the 2025 Massachusetts median software developer wage at $165,210. How to turn that into a project estimate, what a build costs to run after launch, and when it beats SaaS or low-code.
Work With Us
Kief Studio builds, protects, automates, and supports full-stack systems for businesses up to $50M ARR.
Newsletter
Strategy, psychology, AI adoption, and the patterns that actually compound. No spam, easy to leave.
Subscribe
