In the digital age, online meetings have become the new normal — not just in home offices, but also in international collaboration. At the same time, we're seeing a boom in AI technologies that automatically record, transcribe, and even summarize meetings.

The problem: while these tools keep getting smarter, many data protection questions remain unanswered. When is a recording legally permitted? What does this mean for the confidentiality of the spoken word? And how can companies build trust instead of fueling fears of surveillance?

AI-Powered Recordings in Everyday Life — A New Standard?

Digital assistants that "listen in" on meetings are no longer the exception. AI note-takers and the AI features of video conferencing tools can automatically generate:

  • Verbatim records and transcripts
  • Summaries with action points
  • Emotional tone analyses
  • Automatic follow-up e-mails

A real-world example:
A SaaS sales team uses an AI tool to automatically transcribe all customer calls and turn them into structured CRM notes. This saves time — but often the customer has no idea. And even internally, it's unclear where this data is stored and who can access it.

Bottom line: what looks productive can quickly become a breach of trust if communication isn't clear.

What Are the Legal Requirements for Recording Online Meetings?

Two principles apply in this legal context:

  1. Legal basis: Recording and transcribing meetings involves personal data and therefore needs a legal basis under Art. 6(1) GDPR. Depending on the case, this can be consent (point a), necessity for the performance of a contract or for pre-contractual steps (point b) or legitimate interests after a balancing test (point f). Consent has to relate to one or more specific purposes. Which basis applies depends on the individual case; this article does not replace legal advice.
  2. Information requirement: Participants must be clearly informed in advance about,
    1. why the recording is taking place,
    2. how the data will be processed,
    3. where it will be stored,
    4. and how long the data will be retained.

→ Important: If you rely on consent, an automatic notice like "This meeting is being recorded" is not enough without active consent (e.g., via a click, written consent, or a verbal confirmation at the start of the call).

Common mistakes to avoid:

  • Recording without a notice in the calendar invite
  • Verbal notices without documented consent
  • Transcription tools running in the background — without other participants knowing

Section 201 of the German Criminal Code: Violating the Confidentiality of the Spoken Word — What Does This Mean in Practice?

Many forget: it's not just the GDPR that matters here. In Germany, the unauthorized recording of a non-publicly spoken word can be a criminal offense — regulated under Section 201 of the German Criminal Code (StGB).

In practice, this means:

  • Anyone who, without authorization ("unbefugt"), records another person's non-publicly spoken word on a sound carrier is liable to imprisonment of up to three years or a fine (Section 201(1) no. 1 StGB). The same applies to anyone who uses such a recording or makes it accessible to a third party (Section 201(1) no. 2 StGB). An attempt is also punishable (Section 201(4) StGB).
  • Non-public generally means: the conversation is not intended for the public but only for a closed group (e.g., a team meeting, a customer call, a job interview).
  • Whether a recording is unauthorized has to be assessed case by case, including in online meetings.

A case example:
An HR team records a candidate interview with an AI tool for later internal review — but forgets to obtain consent. Result: depending on the individual case, this can constitute an offense under Section 201 StGB and a violation of the GDPR.

Challenges and Risks of Using AI in Online Meetings

Integrating AI systems brings efficiency gains, but also serious risks — especially when handling sensitive data:

  • Data storage in insecure cloud environments, e.g., outside the EU (US, India, etc.)
  • Lack of control over further processing by third parties, for example for AI training purposes
  • Automatic extraction of personal characteristics such as voice pitch, mood, or reaction time (profiling)

Concrete risks:

  • A faulty summary can distort statements and lead to misunderstandings.
  • If the transcript is sent to team members who weren't part of the call, this can constitute a breach of data confidentiality.

A Particular Risk: Automatic Transcription and Analysis by AI

Automatic transcription is convenient — but also tricky. Because:

  • It creates a permanent written record of a spoken conversation.
  • This can be forwarded, copied, or misused within seconds.
  • The text often ends up in systems that many people can access — e.g., internal collaboration tools or CRM systems.

What companies should do:

  • Only grant access to transcripts based on user roles
  • Define automated deletion periods (e.g., 30 days)
  • Ensure that no AI post-processing to "optimize" content takes place without consent

To put it in perspective:
A transcript is like a screenshot — but of the entire conversation. One wrong click, and it lands with the wrong person or an external stakeholder. That can be disastrous, not just from a data protection standpoint, but for the business too.

Best Practices for GDPR-Compliant Online Meetings

To make online meetings legally secure and trustworthy, the following measures are recommended:

Before the meeting:

  • Clear notice in the calendar invite: "Recording planned — consent required"
  • Choose GDPR-compliant tools (EU servers, clear policies, certified)
  • Obtain consent in advance or document it verbally at the start

During the meeting:

  • Create transparency: Who is recording? Why? Where does the data go?
  • Add visual cues (e.g., keep the recording icon visible in the video call)
  • Offer the option to decline or join anonymously

After the meeting:

  • Access restricted to authorized persons
  • Limit the storage period
  • Implement deletion routines and audit logs
  • Optional: store summaries instead of full transcripts

Technology Solutions for Secure Online Meetings

Not every platform is the same. Look for tools with:

  • End-to-end encryption
  • Granular access controls
  • GDPR-compliant storage (e.g., EU data centers)
  • Configurable recording features (only activatable with consent)

Recommendation: check every tool individually against these criteria, regardless of the provider, and ask the provider for its documentation (e.g., data processing agreement, hosting location, sub-processors, use of data for AI training). With US providers, also pay attention to the basis for the third-country transfer (e.g., Standard Contractual Clauses, SCCs).

Future Outlook: How AI Can Improve Security in Online Meetings

AI isn't just a risk — it can also be part of the solution when used correctly. Future systems could:

  • Trigger real-time alerts for data protection violations (e.g., detecting unauthorized recording)
  • Enable data-minimized processing (capturing only metadata, not content)
  • Automatically provide transparency reports (who saw what, and when?)

Instead of tightening control, AI systems could help strengthen accountability and trust in digital collaboration — provided they're designed ethically and lawfully.

Conclusion: Building a Privacy-Safe Meeting Culture Through Clear Rules and Communication

AI-powered online meetings are here to stay. But only those who create transparency can build lasting trust with their employees, customers, and partners.

  • Clear consent processes
  • Deliberate tool selection
  • Technical security measures
  • Ethical handling of data

Companies that follow these principles can benefit from modern technology — without putting data protection or company culture at risk.