Granola's bot-free design does not remove the need for consent. The safest operating rule is straightforward: tell everyone that a third-party AI note-taking service will transcribe the meeting, explain how the notes will be used, and obtain affirmative consent before you start.
This page is general operational guidance, not legal advice. Recording and transcription rules depend on where participants are located, what they reasonably expect to remain private, the type of information discussed, and the policies that govern your organization. Ask qualified counsel to approve your workflow.
What Granola actually captures
On desktop, Granola captures microphone and system audio through the local app. It passes that audio to cloud transcription providers in real time, then uses cloud AI providers to produce enhanced notes. Granola says it does not retain the meeting audio after transcription, but it stores transcripts and notes in encrypted AWS infrastructure in the United States.
That distinction matters. A bot-free meeting can feel less disruptive, but the conversation is still being processed by an external service. Participants should understand that before the meeting is transcribed.
Granola starts transcription after you interact with a meeting note: clicking its notification, opening a meeting after its scheduled start, or creating a Quick Note. If you open an upcoming meeting note before the scheduled start, transcription can begin at the scheduled time. Treat the active transcription indicator as the source of truth and end the session when the meeting is over.
Use all-participant consent as the default United States law contains both federal and state rules, and participants can join from several jurisdictions. International privacy and communications laws add more variation. Trying to decide which single rule applies while a call is starting creates unnecessary risk.
A conservative business policy is easier to operate:
- Disclose the transcription tool before capture begins.
- Name the purpose: personal notes, a shared recap, CRM follow-up, or another defined use.
- Ask every participant for affirmative consent.
- Record how consent was obtained when your policy requires evidence.
- Stop transcription if anyone declines.
- Ask again when a late participant joins.
A plain-language script is enough for many ordinary meetings:
I use Granola to transcribe this call and draft my notes. The transcript is processed by third-party cloud services. Is everyone comfortable with me turning it on?
Your legal team may require different wording, a written notice, or a formal consent record. Use their approved language.
Granola's consent helper has limits
Granola offers an automated consent message for Zoom on macOS. When enabled, the app opens Zoom chat and sends a customizable notice after transcription has detected another person. The Zoom window must be focused, and the chat composer must be empty.
That helper is useful as a disclosure prompt. It does not establish that every participant saw, understood, or accepted the notice. Granola also places responsibility for obtaining consent on the user. If your organization needs a durable consent log, build that requirement into the meeting process instead of assuming the product created one.
Decide what the notes may contain
Consent to transcription does not automatically authorize every later use. Before adopting Granola, document:
- which meeting categories may be transcribed;
- which categories are prohibited;
- whether personal, customer, employee, financial, legal, or health information may appear;
- who can access transcripts and enhanced notes;
- where notes may be shared or exported;
- how long transcripts and notes are retained;
- who responds to deletion, access, or legal-hold requests.
Granola notes are private by default, but users can share them with specific people, company members, or anyone with a link. Enterprise administrators can restrict sharing, and transcript auto-deletion settings are available. A sound policy still needs to cover exports to Slack, Notion, CRM systems, Zapier, and the Granola API.
Treat regulated conversations separately
General business-meeting approval does not cover every industry workflow.
Granola states that it is not currently HIPAA compliant and cannot sign a Business Associate Agreement. Do not use it to process protected health information unless Granola's status changes and your compliance team approves a suitable agreement.
Financial services, legal practices, education, employment, and government work can carry their own retention, supervision, confidentiality, or procurement requirements. Ask counsel and the relevant security owner to review the exact meeting type and data flow. A SOC 2 report answers useful security-control questions; it does not decide whether a particular recording is lawful.
A meeting-by-meeting operating checklist
Before the call:
- Confirm that the meeting category is approved.
- Check the attendee list and likely jurisdictions.
- Remove prohibited material from the agenda.
- Decide where the final notes will be stored.
- Prepare the approved disclosure language.
At the start:
- Disclose Granola before transcription.
- Explain the purpose and intended audience.
- Obtain consent from every participant.
- Start only after consent is clear.
After the call:
- End transcription promptly.
- Correct names, dates, decisions, and sensitive details.
- Share the minimum necessary information.
- Delete the transcript on the approved schedule.
- Escalate accidental capture through your incident process.
My recommendation
Use Granola only after your organization has approved the meeting categories, consent language, data handling, and retention period. For mixed-state or international calls, all-participant consent is a sensible default, but counsel should make the final determination.