AI products need data to improve, and the easiest data to obtain is what’s already flowing through a product — things like customer calls, chat logs, or meeting transcripts. But collecting and training on that data implicates both privacy and consumer protection laws, as a consolidated class action in the Northern District of California, In re Otter.AI Privacy Litigation, demonstrates. The case is about AI notetaking software, but its theories could map onto other consumer-facing products that collect and train its AI on user data. Otter’s motion to dismiss is fully briefed, and oral argument is set for August 2026.
A company reading the complaint will naturally look on at the various privacy statutes it invokes, including the federal Wiretap Act, California’s Invasion of Privacy Act, Illinois’s biometric privacy law, and others. But the harder claims to defeat could be the state-law unfair trade practices and invasion of privacy claims. And privacy policies aren’t bulletproof defenses; they can become liabilities if they are confusing or used to shift informed consent obligations from companies to their customers.
The Allegations
Plaintiffs allege that Otter’s AI meeting assistant automatically joins Zoom, Microsoft Teams, and Google Meet meetings, records conversations, generates transcripts, captures screenshots, creates identifying voiceprints, and transmits meeting data to Otter’s servers, without notifying participants or obtaining their consent. According to the consolidated complaint, voiceprints are used to identify speakers across meetings, and the recordings and transcripts are used to train Otter’s automatic speech recognition and AI models.
Plaintiffs devote significant attention to Otter’s privacy policy, which places the burden on Otter’s customers (i.e. the entities using the video meeting platform) to obtain consent from the “co-workers, friends or other third parties” whose communications Otter allegedly collects and uses. Plaintiffs argue this is insufficient because the obligation is neither intuitive nor prominent but instead buried in a policy that few participants ever see.
The Claims
The claims fall into four buckets:
- Privacy claims, under the Wiretap Act and CIPA, that allege that Otter intercepted and recorded confidential conversations without the consent of every party, and that Otter is a third-party eavesdropper rather than a passive tool the customer controls because Otter receives the audio on its own servers and uses it to train its systems and build speaker profiles;
- CFAA and CDAFA claims that recast the same conduct as unauthorized access to participants’ computers;
- BIPA claims that allege that Otter collected and stored voiceprints without the notice, written release, or retention policy Illinois requires; and
- A set of California claims —Unfair Competition Law, common-law intrusion, conversion, unjust enrichment, and state constitutional right to privacy — calling the same conduct unfair, deceptive, or privacy-invading.
Practical Takeaways
Although the case is only at the pleading stage, the complaint already surfaces three lessons for any company building or deploying software that trains on user data:
First, be clear about what your product does. Privacy statutes all have technical elements a defendant can attack, such as whether an interception happened “in transit,” whether the vendor was a “party” to the call, and whether a voiceprint is a biometric “identifier.” Win those arguments and the claims can be dismissed early.
Unfair competition laws or invasion of privacy torts, on the other hand, often ask what a reasonable consumer or person would expect and whether the company’s conduct and disclosures matched. Accordingly, these types of claims can be harder to defeat at the pleading stage as they go to more abstract questions about knowledge, intent, and expectations. To mitigate this risk, say plainly what you collect, what you do with it, and who receives it, and make sure your marketing matches your practice.
Second, privacy policies are not cure-alls. Otter had a privacy policy, but Plaintiffs say it was insufficient. In order to learn that conversations were kept indefinitely, a user had to connect one clause saying data is retained “as long as necessary to fulfill the purposes set out in this Policy” to a separate passage revealing that one of those purposes was training Otter’s AI — a purpose with no real end date. This suggests avoiding language that requires people to read discrete sections and connect disclosures across those sections.
Plaintiffs also allege that Otter impermissibly delegated the obligation to obtain informed consent to its customers. This suggests that if your product depends on third-party consent, you should either obtain it yourself or build the product so that no one can use it without obtaining it.
Third, technical details matter. Many elements of the Wiretap Act and CIPA claims turn on how the product actually works — when an interception occurred, whether Otter was a participant, whether its software is a “device,” and whether it captured the “content” of a communication. Companies should assume these facts will be litigated and build, configure, and document their products accordingly.