INVITED PARTICIPANT OR THIRD-PARTY EAVESDROPPER?: Court Holds That Otter.ai Is A Third-Party Eavesdropper Because It Uses The Recordings For Its Own Benefit

Hi CIPAWorld!

Ever wondered how CIPA applies to the AI Notetakers that now show up uninvited in all the meetings on your calendar?

In In Re Otter.AI Priv. Litig., No. 25-CV-06911-EKL, 2026 WL 2351237 (N.D. Cal. Aug.13,2026) United States District Court for the Northern District of California granted in part and denied in part Otter’s motion to dismiss. The CIPA, ECPA BIPA, unjust enrichment, the UCL claims survived in full. The CFAA, CDAFA, and the Washington Privacy Act claims were dismissed, as well as the common law privacy claims of every plaintiff except one. The Court holds that (1) Otter is a third-party eavesdropper under Section 631 because Otter independently collects, retains, and uses communications for its own commercial purposes and that (2) it is not enough to call your communication “private” or “sensitive” without giving additional factual detail regarding the substance of those communications to plausibly allege confidential communications under Section 632.

The situation is familiar to anyone who has ever sat through a Zoom or Microsoft Teams call. Seven plaintiffs from California, Illinois, and Washington allege that Otter’s AI meeting assistant, the “Otter Notetaker,” joins virtual meetings as a “silent participant” and records and transcribes everything said in real time without the consent of all participants. The Plaintiffs allege that Otter then keeps the recordings, including transcripts and voiceprints, and uses that material to train its automatic speech recognition and machine-learning models. The conversations allegedly included communications with a doctor regarding “deeply personal and private medical information”, calls with financial professionals, sensitive business discussions, strategic planning sessions, confidential project meetings, performance reviews, discussions with clients and finally professional opportunities discussions.

On Article III standing the Court distinguishes Popa v. Microsoft Corp., 153 F.4th 784 (9th Cir. 2025) on which Otter principally relies, saying that using sessionreplay technology to record a user’s interactions with a pet supply website, including information such as computer mouse movements, clicks, keystrokes, and pages visited is similar to “a store clerk’s observing shoppers”. Recording the content of the private communications with medical and financial professionals is completely different. The Court said the alleged conduct is closer to concrete injury alleged in Campbell where private Facebook messages were intercepted. So, Plaintiffs do have standing.

Now CIPA claims: Otter’s main defense to the Section 631(a) claim was that the Notetaker is an “invited participant” and functions as the meeting host’s own recording tool, which would make it a party rather than an eavesdropper. That works under Graham v. Noom, Inc., 533 F. Supp. 3d 823 (N.D. Cal. 2021), where a software provider that acts only as an extension of its client is not a third-party interceptor, because a party to a communication may record it. However, Otter does not just participate in meetings, it retains the recordings of the conversations and uses them to improve its own machine-learning models and services. The Court held that Otter is a third-party eavesdropper who collects, retains and uses communications for its own commercial purposes. That is the main difference: Otter is not just a tool that transcribes the conversation and hands it back to the participants, but an independent party who uses the recordings to train its models for its own benefit.

On Section 632 the Court held that Plaintiff Theus plausibly alleged confidential communication because he alleged a call with a medical professional involving “deeply personal medical information”. Plaintiffs Brewer and Ryan, by contrast, alleged only that their conversations were “private” or “sensitive,” saying nothing about the substance. Those labels were held “conclusory and insufficient”. For the same reason Brewer’s and Ryan’s intrusion upon seclusion and California constitutional privacy claims were dismissed. Washington plaintiff’s claims failed as well. As for pen register theory, the plaintiffs withdrew their Section 635 and Section 638.51 claims.

On the ECPA claim, Otter unsuccessfully argued the party exception under 18 U.S.C. § 2511(2)(d). The Plaintiffs invoked the tortious purpose, alleging that Otter used their conversations to train its systems for its own pecuniary gain. Otter’s response was that its purpose was commercial. The Court said that “committing a tort and seeking a profit are not mutually exclusive.”

Otter had no chance with BIPA. Voiceprints are biometric identifiers, and the plaintiffs alleged enough about Otter’s speaker tagging and speaker identification profiles to support an inference that the voiceprints can identify them. Otter’s reading of Zellmer v. Meta Platforms, Inc., 104 F.4th 1117 (9th Cir. 2024), was rejected as too broad. Because a Section 15(b) violation was plausibly alleged, standing followed for the Section 15(a). The extraterritoriality defense was rejected, since the plaintiffs alleged they were Illinois residents and they were physically located in Illinois when Otter collected their data during the meetings.

Despite all, Otter had success with CFAA theories. The allegation that Otter accesses participants’ computers was conclusory under Van Buren v. United States, 593 U.S. 374 (2021), with no facts about how the Notetaker reaches any file, folder, or database. The Section 1030(a)(4) claim failed for want of a cognizable loss, since lost data value and emotional distress fall outside the statute’s narrow definition. See Andrews v. Sirius XM Radio Inc., 932 F.3d 1253 (9th Cir. 2019). The CDAFA claim went the same way under Cottle v. Plaid Inc., 536 F. Supp. 3d 461 (N.D. Cal. 2021).

The important takeaway here is that the party status of an AI tool under Section 631 depends more on what the tool does with the recorded information. Companies using meeting assistants should ask their vendors only one question: does the vendor retain and reuse customer conversation content for model training? If the answer is yes, the “extension theory” will not save them. Big lesson for Plaintiffs is that vague pleading can cost you claims. Conclusory pleadings like “private” and “sensitive” are not enough to allege confidential communications.

We will keep you posted, CIPAWorld!

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.