The modern workplace has been transformed by the rapid integration of AI-powered meeting assistants—tools like Otter.ai, Granola, and others that promise to boost productivity by transcribing conversations, summarizing key takeaways, and automating follow-up tasks. However, as these bots become ubiquitous fixtures in virtual boardrooms, a wave of litigation is surfacing, challenging the legality of their presence and the data-handling practices of the companies that deploy them.
For legal and compliance departments, the honeymoon phase with AI notetakers is over. A landmark class-action lawsuit against Otter.ai has served as a wake-up call, suggesting that the convenience of automated minutes may come at the cost of profound regulatory and civil liability. Patrick E. Zeller, General Counsel of JetStream Security, warns that the organizations most at risk are those that have bypassed rigorous risk assessments in favor of seamless adoption.
Main Facts: The In re Otter.ai Litigation
In August, a federal judge in the Northern District of California denied Otter.ai’s motion to dismiss core claims in the class-action lawsuit In re Otter.ai Privacy Litigation. The plaintiffs allege that the company’s AI notetaker effectively acts as an unauthorized, third-party eavesdropper, capturing sensitive audio and biometric voiceprints without the informed consent of all meeting participants.
Otter.ai’s defense centered on the premise that its tool is a passive, user-controlled recording instrument—essentially an extension of the host. However, U.S. District Judge Eumi K. Lee rejected this framing, noting that because the platform retains audio data and uses it to train its proprietary machine learning models, it crosses the line into active data collection. By allowing the suit to proceed, the court has signaled that the mere act of "joining" a meeting does not shield an AI vendor from wiretap and biometric privacy claims.
A Chronology of Escalating Privacy Concerns
The legal landscape regarding AI surveillance is evolving rapidly as these tools move from novelty to necessity:
- Pre-2023: Organizations adopt AI meeting assistants with minimal friction, often treating them as standard software-as-a-service (SaaS) tools without vetting data retention or training policies.
- July 2024: A new class action, Chamberlain v. Granola, Inc., is filed in the Northern District of California. This case highlights a more insidious evolution: "silent" bots that operate without appearing in the participant list, raising the stakes for surreptitious recording.
- August 2024: The federal court ruling in In re Otter.ai establishes that AI vendors—and by extension, the companies deploying them—cannot rely on simple "attendee list" visibility to satisfy privacy laws.
- Present Day: Legal departments are now forced to confront the reality that AI meeting transcripts are not just "notes"—they are potentially discoverable evidence in state and federal litigation.
Supporting Data: The Anatomy of the Risk
The risks associated with AI meeting assistants are multifaceted, stemming from how these tools handle data once it leaves the corporate firewall.
The "Procurer" Liability
Many organizations operate under the mistaken belief that liability rests solely with the vendor. Under the federal Electronic Communications Privacy Act (ECPA), however, a company that "procurs" or mandates the use of these tools can be held liable as an active participant in an illegal interception. If an employee launches a bot in a meeting with external clients or regulators without explicit consent, the organization is the one facilitating the breach.
The Myth of One-Party Consent
While the federal Wiretap Act may offer a "one-party consent" defense, this is a dangerous baseline for global or even multi-state organizations. Over a dozen states, including California, have "all-party" consent laws. In an era of remote work, where a meeting participant might be dialing in from a restrictive jurisdiction, relying on one-party consent is a recipe for litigation. The courts have made it clear: the residency of the participant matters, and organizations should default to the strictest legal standard to avoid liability.
Official Responses and Judicial Interpretation
The courts are increasingly skeptical of the "bot as a participant" defense. Judge Lee’s decision in the Otter.ai case emphasizes that transparency is not synonymous with consent. Even if an AI bot is visible on the screen, if it is capturing voiceprints and ingesting conversation data for the purpose of training a large language model (LLM), that activity must be disclosed and affirmatively agreed to by all parties involved.
Furthermore, the emergence of "invisible" tools like Granola poses a direct challenge to the concept of consent. If a customer has the ability to enable or disable consent features but chooses not to, they are arguably complicit in an unauthorized recording. Legal experts argue that failure to implement strict "opt-in" controls will likely be viewed by regulators as a willful violation of privacy, rather than an accidental oversight.
Implications for Corporate Governance
The widespread adoption of AI notetakers has created a new, largely ungoverned category of "confidential corporate records." These transcripts are now part of the corporate digital footprint, subject to discovery in the event of litigation or regulatory investigation.
Discovery and Legal Holds
Legal teams are struggling with the "possession, custody, and control" dilemma. If an AI vendor holds a transcript in their own cloud environment, can the organization actually produce it when a legal hold is issued? Most current retention schedules are designed for email and local files, not for data processed in a vendor’s proprietary machine learning environment. Organizations risk "spoliation of evidence" claims if they cannot preserve or retrieve these AI-generated transcripts upon demand.
The Erosion of Attorney-Client Privilege
Perhaps the most alarming implication is the potential for waiver of attorney-client privilege. Privilege is predicated on the confidentiality of the communication. By piping sensitive legal or strategy discussions through an AI assistant that uses that data to train its models, organizations may inadvertently be sharing privileged information with a third party. If a court determines that the vendor has "access" to the data, the privilege may be deemed waived, exposing the organization’s most sensitive legal strategy to opposing counsel.
Recommendations for Risk Mitigation
To avoid the pitfalls facing the defendants in Otter.ai and Granola, legal and compliance officers must pivot from a "wait and see" approach to active governance.
- Conduct a Rigorous Risk Assessment: Before deploying any AI meeting tool, assess where the data is stored, who has access to it, and—crucially—whether it is being used to train the vendor’s models. If the answer is yes, ensure that the data is partitioned or that the training features are disabled.
- Standardize Consent Protocols: Move away from passive notices. Implement a "mandatory consent" flow where the bot is blocked from recording until every participant has clicked an "Accept" button.
- Update Retention Schedules: Treat AI transcripts with the same rigor as sensitive emails. Ensure that your vendor contract allows for the deletion of data upon request and that you have a mechanism to implement legal holds on vendor-held transcripts.
- Audit Vendor Agreements: Demand contractual assurances that the vendor will not use your organization’s meeting data for model training. If a vendor cannot provide this, the legal risk of using their tool may outweigh the productivity benefits.
Conclusion: The Cost of Ignorance
The history of technology regulation is filled with companies that adopted "disruptive" tools without considering the legal, ethical, and discovery implications until they were served with a complaint. As Patrick E. Zeller notes, the organizations that suffer the most are rarely those that weighed the risk and built controls; they are the ones that treated innovation as an excuse to ignore the law.
The AI notetaker is a powerful tool, but it is not a neutral one. In the current legal climate, failing to implement strict governance over these assistants is no longer a minor operational oversight—it is a significant, and potentially costly, failure of corporate risk management. As these tools continue to evolve, the burden remains on the organization to ensure that in the pursuit of a perfect meeting record, they are not inadvertently recording their own path to the courtroom.
