AI Notetaker Lawsuits: Otter Ruling Raises Compliance Stakes

A ruling that changes the math

AI meeting assistants were sold as a convenience: invite a bot to the call, get a transcript with speaker labels, and move on. Over the past year, that convenience has turned into a legal liability. The clearest signal came in August, when Judge Eumi K. Lee of the Northern District of California declined to dismiss the core wiretap and biometric privacy claims in In re Otter.ai Privacy Litigation. The class action against the maker of the Notetaker assistant can now proceed. 3

Otter.ai's defense was intuitive. It argued that Notetaker joins a meeting only when invited and acts as the host's recording tool, an extension of the customer who deployed it. 3 The court was not persuaded. Plaintiffs allege that Otter.ai keeps the conversations and voiceprints it captures and uses them to train its models. On that basis, the judge found they had plausibly alleged the company was acting as a third-party eavesdropper rather than a neutral instrument. 3

That distinction is the heart of the case. A tool that simply records for the host looks like a dictaphone. A vendor that keeps the audio and learns from it looks like a separate party listening in. Under wiretap law, that is exactly the kind of party whose presence requires consent.

Not one lawsuit but a pattern

Otter.ai is not alone. Class actions also target Fireflies.ai, with plaintiffs alleging that both companies harvested voiceprints from meeting participants who never agreed to it. 1 Most recently, Chamberlain v. Granola, Inc. was filed in the Northern District of California on July 30, 2026. Its claims include wiretapping under Section 631 of the California Invasion of Privacy Act. 2

The suits rest on two overlapping legal theories:

• Biometric privacy. Speaker identification can depend on building a mathematical model of a person's voice. The biometric-privacy complaints, including those invoking Illinois's BIPA, argue that this kind of identifier is uniquely sensitive. A leaked password can be reset, but a voiceprint cannot. 1
• Eavesdropping and wiretap statutes. California's CIPA is the leading example. These laws focus less on what is extracted from the audio and more on who is listening and whether everyone on the call agreed. 23

One analysis traces the start of the litigation wave to late 2025 and says it accelerated through 2026. 1 Another says the cases have matured. Early disputes asked whether AI recording was allowed at all. The current round, covering Granola, Otter.ai, and Fireflies.ai, has moved past that question to the harder issues of notice and consent. 2 That same analysis expects these class actions to be only the beginning. 2

Why compliance teams should care

The practical burden falls on more than the vendors. Patrick E. Zeller, general counsel of JetStream Security, warns that the organizations most exposed are the ones that never assessed the risk at all. 3 His commentary also points to discovery problems. Meeting assistants produce large archives of recorded and transcribed conversations, and those archives can become evidence in later disputes. 3

The Granola commentary makes a related point. Companies that build these tools, deploy them, or simply allow employees to use them all need to proceed carefully. 2 In practice, a bot that an individual employee connects to a calendar can bind the employer to a vendor's data practices that nobody in legal or IT ever reviewed.

The sources differ in perspective. The legal and compliance commentators focus on governance: consent flows, vendor terms, and records management. 23 Source 1 comes from a transcription vendor, and it argues that on-device processing is the only safe alternative. 1 That reflects a commercial interest. Still, the underlying logic matches the Otter.ai ruling, since the court's reasoning turned on the vendor keeping the data and training on it. 3

The bigger picture

The direction of the US litigation seems clear. Courts appear willing to look past the "we're just the host's tool" framing when a vendor's business model depends on keeping and reusing what it hears. Multinational companies also face regulation abroad, including the EU AI Act, which adds another set of compliance questions on top of this US exposure.

The working lesson is fairly simple. Before an AI notetaker joins a call, organizations should know three things: who gets notified, how consent is captured from every participant, and what the vendor does with the audio afterward. Any company that cannot answer those questions now is in a similar position to the defendants in these cases.