AI Notetaker Lawsuits 2026: Otter, Fireflies, Granola and Consent

AI notetakers moved from convenience to courtroom in under a year. Suits against Otter.ai, Fireflies.ai, Granola and Microsoft now test whether recording a call with AI is lawful when only one person on the call agreed to it. This guide from the BuildBetter team explains what each case claims, what the August 2026 Otter ruling means, and which three laws drive almost every complaint. It also gives you an 8-step consent checklist your team can adopt this week and shows how to choose a recorder, including our own BB Recorder, without taking on more risk than you need.

What Is an AI Notetaker Lawsuit? (Definition in 150 Words)

An AI notetaker lawsuit is a privacy claim that a meeting-recording or transcription tool captured, stored or used people’s conversations or voices without the consent the law requires. The plaintiffs are usually not the people who signed up for the tool. They are the other participants on the call: the customer, the candidate, the vendor rep. They never accepted the vendor’s terms, so the account holder’s click-through does not bind them, and they are generally not subject to the vendor’s arbitration clause. That structural fact is why these cases can proceed as federal class actions.

Nearly every case rests on three statutes:

• The federal Wiretap Act (Title I of the Electronic Communications Privacy Act, or ECPA, 18 U.S.C. § 2510 et seq.)
• The California Invasion of Privacy Act (CIPA, Cal. Penal Code §§ 631, 632, 637.2)
• The Illinois Biometric Information Privacy Act (BIPA, 740 ILCS 14)

Status as of October 15, 2026: suits are pending against Otter.ai, Fireflies.ai, Granola and Microsoft (Teams live transcription). In Otter’s case, a federal judge let the core wiretap and biometric claims proceed.

This page explains public filings and general consent practice. It is not legal advice. Talk to counsel about your specific situation.

Below you’ll find dated case summaries, a plain-language read of the Otter ruling, the three legal theories, a consent method, a worked example, common mistakes, a capture-mode comparison and guidance on choosing a recorder.

What Happened: The AI Notetaker Cases, Dated

Four vendors face pending privacy suits, and none has reached a finding of liability. Everything below describes allegations unless a court has ruled on them.

Otter.ai: In re Otter.AI Privacy Litigation

The consolidated case is In re Otter.AI Privacy Litigation, N.D. Cal., No. 5:25-cv-06911-EKL, before Judge Eumi K. Lee. The lead suit, Brewer v. Otter.ai, was filed in August 2025. Walker, Theus and Winston followed in August and September, and the court consolidated them on October 22, 2025.

Plaintiffs allege that OtterPilot, Otter’s notetaker, auto-joins calls through calendar integration, asks the account holder for permission but not the other participants, records people who never had an account, builds speaker voiceprints, uses “de-identified” recordings to train its models, and emails transcripts and sign-up prompts to participants. On August 13, 2026, the court partly denied Otter’s motion to dismiss. The ECPA, CIPA and BIPA claims survived. The computer-intrusion counts were dismissed (per The Little Binger).

Fireflies.ai: two BIPA suits

Cruz v. Fireflies.AI Corp. (C.D. Ill., filed December 18, 2025) and Fricker v. Fireflies.AI Corp. (N.D. Ill., March 2026) are both BIPA claims. They allege the “Speaker Recognition” feature creates voiceprints without written notice, without a written release and without a publicly available retention and destruction policy (per tl;dv’s litigation overview).

Granola: Chamberlain v. Granola, Inc.

Chamberlain v. Granola, Inc. is a proposed class action filed July 30, 2026 in N.D. Cal. under CIPA and ECPA. It alleges Granola was designed to record without disclosure to all participants, because it captures audio from the user’s computer rather than joining as a visible participant. It also alleges transcription data is used commercially, including for AI training by default. To be fair to Granola, its own documentation describes optional chat alerts and video watermarks (per Computerworld). Whether optional, user-triggered notice is legally enough is one of the central questions. For policy-level detail, see our Granola privacy policy review.

Microsoft Teams live transcription

A BIPA suit over voiceprints generated by Teams live transcription and speaker attribution was filed February 5, 2026 in W.D. Wash. The motion to dismiss was pending as of October 15, 2026.

Timeline

• Aug 2025: Brewer v. Otter.ai filed; three more Otter suits follow by September.
• Oct 22, 2025: Otter cases consolidated in N.D. Cal.
• Dec 18, 2025: Cruz v. Fireflies.AI filed (BIPA).
• Feb 5, 2026: Microsoft Teams BIPA suit filed in W.D. Wash.
• Mar 2026: Fricker v. Fireflies.AI filed (BIPA).
• Jul 30, 2026: Chamberlain v. Granola filed (CIPA, ECPA).
• Aug 13, 2026: Otter motion to dismiss partly denied; ECPA, CIPA and BIPA claims proceed.

What the Otter Ruling Means in Plain Words

The Otter ruling means the plaintiffs’ claims are legally plausible enough to go to evidence-gathering. It does not mean Otter broke the law. A motion to dismiss asks a judge to assume the complaint’s facts are true and decide whether they describe a legal violation. Judge Lee said they do for interception and biometrics, so the case moves into discovery.

The key line: the court found Otter “independently collects, retains, and uses communications for its own commercial purposes.” That framing treats the vendor as a third-party eavesdropper rather than a neutral tool the user operates.

The framing matters because wiretap laws often protect a party to the conversation. Federal law (18 U.S.C. § 2511(2)(d)) lets a participant record, or authorize recording. If the vendor is just the participant’s pen and paper, it shares that protection. If the vendor listens for its own reasons, such as model training, product improvement or growth marketing, a court may treat it as a separate listener who needed everyone’s consent. A similar line of reasoning let CIPA claims proceed in Ambriz v. Google, where a call-transcription AI was capable of using call data to improve its models.

The practical takeaway for product and customer teams:

• Your consent may not cover your vendor’s uses. When you invite a notetaker, you speak for yourself, not for what the vendor does with the file afterward.
• Vendor data terms are now part of your risk. Training defaults, retention and marketing emails all count.
• The case now turns on interception and biometrics. The computer-hacking counts were cut.

To see what Otter’s policy says about data use, read our Otter privacy policy review.

Why Recording Breaks: The Three Legal Theories

AI notetaker claims fall into three theories: unlawful interception, biometric collection and commercial reuse. A single call can trigger all three.

Theory 1: Wiretapping and eavesdropping (ECPA and CIPA)

Recording or intercepting a conversation without the required consent is the core claim. Federal law is one-party consent, with an exception for interceptions made to commit a crime or tort. California is all-party: CIPA § 632 bars recording a confidential communication without everyone’s consent, and § 631 reaches third parties who learn contents in transit and anyone who helps them. Small private video calls usually carry a reasonable expectation of not being recorded.

Typical failure modes:

• A bot auto-joins a call the user didn’t actively start.
• A bot-free recorder captures participants who never see a notice.
• A notice appears only after recording has already started.

Theory 2: Biometric voiceprints (BIPA)

Speaker identification that creates a voiceprint can count as biometric data under Illinois law. BIPA requires written notice, a written release and a public retention and destruction policy before collection. Failure mode: the tool learns that “Speaker 2” is a named customer and tags her across calls, and nobody signed anything.

Theory 3: AI training and commercial reuse

When a vendor uses transcripts to train models or drive marketing, plaintiffs argue it acts as an independent party. This reasoning kept the Otter claims alive, and the Granola suit relies on it. Failure mode: a default-on “improve our models” setting nobody on the team ever reviewed.

Statutory damages

• ECPA: the greater of $100 per day or $10,000, or actual damages plus profits, with punitive damages and fees possible. Courts have discretion.
• CIPA: $5,000 per violation or three times actual damages. No proof of harm required.
• BIPA: $1,000 per negligent violation, $5,000 per intentional or reckless one. Since the August 2024 amendment, repeated collection from the same person by the same method counts once.

Damages scale because they are counted per violation, and class actions multiply them across every participant on every call. Facebook’s $650 million BIPA settlement over photo tagging shows how large that math can get.

Where all-party consent applies

All-party (or two-party) states include California, Florida, Illinois, Maryland, Massachusetts, Connecticut, Pennsylvania, Washington, Oregon, Montana and New Hampshire. The list is not exhaustive, and some states apply different rules to phone versus in-person conversations. When participants sit in different states, assume the strictest state’s rule governs the whole call. For EU and UK participants, GDPR requires a lawful basis before processing begins (see Article 6). Recording first and asking later does not cure that.

The Method: An 8-Step Consent Checklist Your Team Can Adopt Today

A defensible consent process takes notice, a real option to decline and a written trace, and none of it depends on the tool you use. Every step below works with pen and paper, any recorder or no recorder at all.

Step 1: Map participants

Before the call, note where attendees are located. If anyone is in an all-party state, or you don’t know, treat the call as all-party.

Step 2: Give notice before recording starts, through three channels

• Calendar invite: add a line saying the call may be recorded and transcribed. Treat this as weak on its own.
• Verbal notice: say it at the top of the call, before you press record.
• Chat message: post it as a written trace.

Copy-paste script:

“I’d like to record and transcribe this call so I can take accurate notes. The recording stays with our team and isn’t used to train AI. Is everyone OK with that? If not, I’ll take notes by hand.”

Only say the AI-training line if it is true for your setup.

Step 3: Offer a real “no”

Agree as a team that one objection means no recording for that call. The fallback is manual notes, so declining costs the participant nothing.

Step 4: Pause on request

Anyone can ask to pause for a sensitive segment such as pricing, HR or health details. Resume only after an explicit OK, and mark the pause in your notes.

Step 5: Handle voiceprints separately

Turn off speaker identification for calls with Illinois participants, or collect written notice and a release first. Verbal consent to recording does not cover biometrics.

Step 6: Write and publish a retention policy

State a default deletion window, who can access recordings and how someone requests deletion. BIPA explicitly expects a public policy.

Step 7: Require no default training

Check vendor settings and your contract or DPA so recordings are not used to train vendor or third-party models. Opt out where a setting exists and document that you did.

Step 8: Log consent

Keep one line per call in your CRM or notes doc: date, participants, notice given, objections, pauses.

Summary checklist

• Before: map locations · calendar notice · speaker ID off for Illinois · confirm training opt-out
• During: verbal notice before record · chat notice · accept any “no” · pause on request
• After: log consent · apply retention window · honor deletion requests

External-call variant: for customer and prospect calls, confirm the other company’s recording policy. Many enterprises prohibit third-party notetakers outright, and your champion may not know until legal objects.

Worked Example: A Product Team Recording Customer Calls Across States

A team in a one-party state still inherits all-party rules the moment a California or Illinois customer joins. Take a 10-person B2B product team in Texas running about 30 customer discovery calls a month. Some participants are in California and Illinois, and some are in Germany.

Decision 1: Classify calls. Any call with a California, Illinois or unknown-location participant is all-party. German participants trigger GDPR, which requires a lawful basis before processing.

Decision 2: Understand the stakes. The following is illustrative arithmetic using statutory maximums, not a prediction. One unconsented call with 3 California participants: CIPA allows up to $5,000 per violation, so up to $15,000 if each participant counts as a violation (how “per violation” is counted is itself litigated). Speaker recognition on 1 Illinois participant adds $1,000 to $5,000 under BIPA. Repeat that pattern across 30 calls a month and the theoretical exposure passes $450,000 in a month, even before ECPA.

Decision 3: Pick the capture mode per call. Record only after the Step 2 notice, either with a visible bot or a local recording announced verbally. When the customer’s legal team is on the call or their policy is unknown, make the recording obvious or don’t record.

Decision 4: Switch off speaker identification by default. Label speakers manually in notes.

Decision 5: Set retention. Keep raw recordings for 90 days (a figure the team chose, not a legal standard) and keep anonymized insights longer. Publish the policy on the company site.

Decision 6: Handle an objection live. A California participant says no. The PM stops recording and asks a teammate to take notes. The log entry reads: “Oct 14, Acme discovery, 4 attendees (CA, TX), verbal + chat notice given, 1 objection, not recorded, manual notes by J.R.”

The result is a one-page team policy, a consent script and a consent log, built in an afternoon without buying anything.

Common Mistakes Teams Make With AI Notetakers

Most exposure comes from a handful of repeatable habits, not exotic edge cases.

• Relying on a calendar disclaimer alone. Many people never read invites, and notice must come before recording starts.
• Letting bots auto-join. Auto-join is central to the Otter allegations. Turn it off and require a person to start recording.
• Assuming bot-free means consent-free. No visible bot means participants get less notice, not more. The Granola suit targets this pattern.
• Assuming a visible bot equals consent. A bot in the attendee list is passive notice at best, especially if it joined automatically.
• Treating consent to record as consent to voiceprints. BIPA requires separate written notice and release.
• Never checking AI-training defaults. The court’s “own commercial purposes” reasoning makes vendor data use your problem too.
• Keeping recordings forever. No written retention policy means no defense on retention.
• Applying your own state’s law. The strictest participant’s state sets the bar.
• Recording first, asking second. This is especially damaging under GDPR, where the lawful basis must exist before processing.

Bot vs. Bot-Free Capture: Visibility and Consent Risk Compared

Capture mode changes who holds the data and how visible the recording is. It never replaces notice and a real option to decline.

Local capture removes the commercial-reuse theory as long as the file stays on your machine. It does not remove the interception theory. Notice is still your job.

When You Need Tooling, and Choosing a Recorder After the Lawsuits

A few calls a week can run on manual notes and the checklist; past roughly 15 to 20 recorded calls a week, a recorder you control becomes the safer option. At that volume, or once several teammates record, consistency slips: missed notices, forgotten pauses, recordings scattered across laptops and vendor accounts.

Selection criteria:

• Where recordings are stored: on device or vendor cloud
• Whether data is used for training by default
• Whether you can pause and resume
• Speaker-identification controls you can turn off
• Export and deletion you control
• Whether recording can start silently, and how to prevent that

1. BB Recorder by BuildBetter

BB Recorder’s Meeting Recorder captures system audio directly through macOS ScreenCaptureKit, so no bot joins your Zoom, Meet or Teams call. Transcription runs on device with Whisper, Parakeet or Apple Intelligence, and you can bring your own model, from Ollama locally to OpenAI, Anthropic or Groq keys, or opt in to BuildBetter cloud. Recordings link to your calendar, speaker diarization separates voices, template summaries cover discovery calls, 1:1s and standups, and you can chat with a transcript for a three-bullet catch-up. No account is required, and the same app handles dictation and screen recording. An iOS app covers in-person conversations.

The limits, stated plainly. Local mode is bot-free capture, the same pattern the Granola suit targets. The real advantage is that files stay on your device and aren’t used to train anyone’s model, which removes the vendor-reuse theory. BB Recorder does not collect consent for you and does not make you compliant on its own. If you turn on auto-start for detected meetings, pair it with the Step 2 habit so recording never begins before notice, and pause when the call opens if needed. Consider turning off speaker labels on calls with Illinois participants.

2–4. Other local-first options

• Meetily: open-source meeting notes with local transcription.
• Hyprnote: open-source, local-first meeting notepad.
• MacWhisper: on-device transcription for audio files you already have.

The same consent caveat applies to every tool on this list. For a longer comparison, see our roundup of local meeting recorders.

FAQ: AI Notetakers and Recording Consent

Is it legal to record meetings with an AI notetaker?

Generally yes, if you get the consent the strictest applicable law requires before recording begins. Federal law and most states require one party’s consent. California, Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Pennsylvania, Washington and others require everyone’s consent, and EU/UK participants require a GDPR lawful basis.

Did Otter.ai lose its lawsuit?

No. On August 13, 2026, the judge in In re Otter.AI Privacy Litigation partly denied Otter’s motion to dismiss. The ECPA, CIPA and BIPA claims proceed to discovery, and the computer-intrusion claims were dismissed. There has been no liability finding and no class certification.

Why are people who never used Otter, Fireflies or Granola the ones suing?

They never agreed to the vendor’s terms, so the account holder’s acceptance does not cover them and they are generally not bound by its arbitration clause. Wiretap and biometric laws protect every participant whose words or voice are captured.

Is a bot-free AI meeting recorder safer legally?

Not by itself. Bot-free capture is less visible, which is the core allegation in the Granola suit. If audio stays local and is never used for training, the vendor-reuse theory weakens, but you still need verbal notice and a real chance to decline.

Does a notice in the calendar invite count as consent?

It is weak on its own, because many people never read invite text and it doesn’t confirm agreement. Use a calendar line, verbal notice before recording, a chat message as a written record, and stop if anyone objects.

What is a voiceprint and why does BIPA care?

A voiceprint is a biometric identifier derived from someone’s voice, such as a speaker-recognition profile. BIPA requires written notice, a written release and a public retention policy before collection, with damages of $1,000 to $5,000 per violation.

What if one participant says no?

Don’t record that call. Take notes by hand. A partial-consent workaround isn’t worth the risk.

Sources and Further Reading

• Otter consolidated case and August 2026 ruling: The Little Binger
• Fireflies BIPA suits and recorder litigation overview: tl;dv
• Granola class action coverage: Computerworld
• Biometric Information Privacy Act (Wikipedia)
• Electronic Communications Privacy Act (Wikipedia)
• Telephone call recording laws by jurisdiction (Wikipedia)
• GDPR Article 6: lawful basis for processing

Case facts verified October 15, 2026. Filings and rulings may have changed since; check the docket on PACER or CourtListener for current status.

Record Meetings on Your Own Terms

The lawsuits share one lesson: know where your recordings go and tell people before you hit record. BB Recorder keeps meeting audio, transcripts and summaries on your Mac, with no bot on the call, no required account and no training on your data. Pair it with the checklist above and your team has a process you can explain to any customer.

Record, dictate, and capture — all on your device. Download for Mac