AI Notetaker Wiretap Lawsuits Spread From Otter to Granola

The lawsuits are no longer about one company

AI meeting notetakers have been sold as a simple productivity upgrade: something joins or listens to a call, and you get a transcript and summary. That picture is now being tested in federal court. Otter.ai, Fireflies, and Granola are all facing class action lawsuits over whether the way they capture meetings is legal. 1 The newest suit, against Granola, was filed on July 30, 2026. 1

The Granola case is the most telling. Granola is widely seen as an alternative to bot-based notetakers, the kind that appear as a visible participant in a meeting. If the same legal theory can reach it, then the important question is not whether a bot shows up on the call. It is what the vendor does with the audio after it is captured.

The Otter ruling that set the template

The leading case is In re Otter.AI Privacy Litigation, a consolidated federal class action in the Northern District of California. It alleges that Otter's Notetaker recorded and transcribed meetings without the consent of everyone on the call, and that the company used that content to help train its models. 1 The claims rely on the California Invasion of Privacy Act (CIPA) and the federal Wiretap Act. 1 Biometric privacy claims are also part of the case. 4

In August, Judge Eumi K. Lee denied Otter's motion to dismiss the core wiretap and biometric claims, so the case moves forward. 4 Otter's defense was straightforward. It argued that Notetaker joins only when invited and acts as the host's own recording tool, essentially an extension of the customer. 4 The court did not accept that. Because the plaintiffs allege Otter also keeps the conversations and voiceprints and trains its models on them, the judge found they had plausibly alleged that Otter acted as a third-party eavesdropper. 4

That reasoning matters more than the procedural win. Older wiretap laws were written for tape recorders and phone taps. Courts are now deciding whether an AI tool invited by one participant counts as an unlawful interceptor. 2 Judge Lee's answer suggests that a vendor which keeps and reuses meeting data for its own benefit may no longer be a neutral tool. That logic does not depend on interface design, which is why a bot-free product offers limited protection if its maker also stores and learns from user audio.

Why the dollar figures get large

A separate case, Cruz v. Fireflies, brings claims under the Illinois Biometric Information Privacy Act (BIPA). 2 The penalties add up quickly. CIPA allows $5,000 per violation, BIPA allows $5,000 per intentional violation, and Florida's felony statute carries up to five years in prison. 2 Across many meetings and many attendees, statutory damages can grow far beyond what any one recording seems worth.

Consent rules also differ by law. Under wiretap statutes, an audible announcement at the start of a call is usually enough, because courts generally treat staying on the line as implied consent. 2 Under biometric laws like BIPA, a spoken disclaimer is not sufficient. 2 Calls that cross state lines add another complication, with Kearney v. Salomon Smith Barney often cited as the guiding rule for which state's law applies. 2 Mayer Brown published its own analysis of how these statutes apply to AI notetakers in June 2026. 2

The discovery problem nobody budgeted for

Privacy liability is only part of the exposure. Transcripts and summaries stored by cloud vendors such as Otter, Fireflies, and Zoom AI Companion are almost certainly discoverable in litigation and regulatory investigations. 3 They are permanent, time-stamped, searchable business records. Because a third party holds them, they can be subpoenaed, may undermine privilege, and can surface years later. 3 Patrick E. Zeller, general counsel of JetStream Security, argues that the organizations most likely to suffer are the ones that never thought about this risk. 4

Several of the compliance guides recommend on-device transcription, such as Apple's iOS 26 SpeechAnalyzer, as a fix. Their reasoning is that if no audio leaves the device, there is no interception, no vendor server, and no third-party custodian to subpoena. 23 The architectural point holds up, but these recommendations come from a company that sells on-device tools, so readers should weigh them with that in mind.

What to take from it

The legal risk follows data retention and reuse, not whether a bot is visible. The Otter ruling ties third-party eavesdropper status to keeping and training on recordings. 4 By that standard, any cloud notetaker with similar practices is a plausible target, whatever its marketing. Companies using these tools should review vendor retention and training terms, handle biometric consent separately from recording notices, and assume that anything a vendor stores could end up in discovery. The cases are still early, but the direction is clear enough to act on now.