The era of 'move fast and break things' for AI meeting assistants is hitting a legal wall. In August, a federal judge in the Northern District of California rejected Otter.ai’s motion to dismiss core wiretap and biometric privacy claims in In re Otter.ai Privacy Litigation. The ruling allows class-action plaintiffs to proceed against the vendor, challenging the assumption that joining a meeting as an invited participant grants implicit consent for data capture and model training.

The Eavesdropper Argument Holds Up

Otter.ai argued that its Notetaker functions merely as an extension of the customer, a recording tool invited into the space. Judge Eumi K. Lee disagreed, finding that because plaintiffs alleged Otter.ai retains conversations and voiceprints to train its models, the company acted as a third-party eavesdropper. This distinction is critical for infrastructure builders: if your tool processes data outside the customer’s control for model improvement, you are not just a utility—you are a potential violator of the federal Electronic Communications Privacy Act (ECPA).

Silent Tools Pose Greater Risks

While Otter.ai’s visible presence in the attendee list was insufficient to satisfy consent requirements, newer tools like Granola are raising even higher stakes. A proposed class action, Chamberlain v. Granola, Inc., alleges that Granola captures audio directly from a participant’s computer while remaining invisible to other attendees. Unlike traditional bots, these silent capture tools rely on customer-enabled transparency features. If an organization fails to configure these settings, they may face liability as active 'procurers' of the interception, particularly in states like California that require all-participant consent rather than just one-party consent.

Discovery and Privilege in the Cloud

For legal and compliance teams, the technical architecture of these tools creates a discovery minefield. Transcripts and biometric data often reside in the vendor’s cloud, subject to the vendor’s retention policies rather than the customer’s. This complicates legal holds and privilege protection. If an AI vendor uses privileged conversations for model training, opposing counsel can challenge privilege designations. The burden falls on the organization to prove that sensitive data was never exposed to vendor employees or used for commercial training—a difficult task without robust, auditable controls.

Key Takeaways

  • Visible bots do not equal consent: Courts are rejecting the idea that appearing in an attendee list satisfies state privacy laws.
  • Model training is a liability: Retaining audio for AI training transforms vendors into third-party eavesdroppers under federal and state wiretap laws.
  • Silent capture is dangerous: Tools that record without visible presence expose deploying organizations to significant legal risk if consent features are not enforced.
  • Cloud data complicates discovery: Transcripts stored in vendor environments may not adhere to customer retention schedules, creating compliance gaps.

The Bottom Line

Developers and enterprises must treat AI meeting assistants as high-risk infrastructure, not convenience tools. Implement strict consent frameworks, audit vendor data retention, and prohibit silent capture to avoid becoming the next defendant in wiretap litigation.