Is it legal to transcribe a meeting?

The legal position in Germany is clear: anyone who records a private conversation without the consent of all participants — and that includes transcribing it — commits a criminal offense under § 201 StGB. This covers phone calls, video conferences, in-person meetings, and AI transcription tools running in the background.

Key rules:

1. All-party consent. Every participant must be informed before recording or transcription starts and must consent. Silent acceptance isn't enough — active opt-in is required. Tools like Zoom and Teams show "This session is being recorded/transcribed" — anyone who refuses must have the option to leave.

2. GDPR layered on top. Processing personal data means GDPR also applies — legal basis (consent or legitimate interest), notice obligations (Art. 13), DPA with the transcription service (Art. 28).

3. Works council. For employees in Germany, AI transcription falls under § 87(1) No. 6 BetrVG (works-council co-determination for technical systems that can monitor performance or behavior). Without a works-council agreement, you can't roll the tool out company-wide.

4. International calls. If even one participant sits in an all-party-consent state (California, Florida, Illinois, Washington, …), you need everyone's consent there too. German law applies to German participants; US law to US ones — careful when EU and US mix on the same call.

5. Consent wording. Document clearly, e.g. "This meeting will be transcribed with DeepScript. The audio is deleted after processing, the transcript text is retained for 30 days. By joining, you consent to the transcription." Put this in the calendar invite, the meeting description, and at the start of the call.

6. Exceptions. Public talks (conference stages, press conferences) and one-sided recordings for purely personal use may be treated differently — but the moment a second person is involved and the conversation isn't public, protection kicks in.

The practical takeaway: serious AI transcription rollouts build consent into the workflow and choose a provider that handles the GDPR side cleanly. DeepScript provides a ready-to-sign DPA for exactly this purpose.