This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
Otter.ai is facing a class-action lawsuit alleging that its 'Otter Notetaker' service records virtual meeting participants without their informed consent and uses the captured audio data to train its proprietary machine learning models. The plaintiff, Justin Brewer, claims his privacy was invaded when the service recorded a confidential meeting he attended without his knowledge. The lawsuit highlights concerns regarding the lack of transparency, the default settings that enable recording without participant notification, and the inability of non-users to opt out of data collection.
In February 2025, Otter.ai's Notetaker reportedly recorded and transcribed a Zoom conversation involving Justin Brewer, a San Jacinto, California resident who was not an Otter account holder, without his informed consent. Brewer later alleged that Otter obtained and retained his meeting communications and used captured data to train its speech-recognition and machine-learning systems.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
AI systems that memorize and leak sensitive personal data or infer private information about individuals without their consent. Unexpected or unauthorized sharing of data and information can compromise user expectation of privacy, assist identity theft, or cause loss of confidential intellectual property.
Also classified as
The lawsuit highlights a lack of transparency regarding Otter's de-identification process and its failure to notify participants of recording.
The incident involves Otter.ai obtaining and recording private, non-public conversations of meeting participants without their consent to train its AI models.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The privacy risks and unauthorized recordings were caused by human design decisions and corporate policies of Otter.ai. These actions were intentional as the system was designed to collect data to train its models post-deployment.
Otter.ai faces a class-action lawsuit alleging unauthorized recording of virtual meetings to train its AI models. While representing a significant privacy concern and an evolved method of automated data harvesting, the national security impact remains minor and is manageable through standard legal and regulatory channels.
The report characterizes Otter Notetaker as an 'AI-powered meeting assistant' that automatically takes notes and transcribes meetings to augment human capabilities, though it operates with some automated features like auto-joining calendars.
Level 3: Limited Risk. The system is an AI transcription and note-taking assistant that requires specific transparency obligations, such as notifying participants when they are being recorded and when their data is being processed by an AI.
The primary function of Otter.ai is speech-to-text transcription, which relies on voice recognition technology to convert spoken language into written transcripts.
The reports provide consistent and detailed information regarding the class-action lawsuit against Otter.ai, including specific dates, legal claims, and the technical mechanisms of the Otter Notetaker tool. The legal arguments and company responses are well-documented across multiple sources.
None. The incident is clearly a privacy-related legal dispute over unauthorized data collection for AI training.
Technology
Default Settings Disable Notifications
Pre-recording email alerts to participants are turned off by default.
Unreliable De-identification
AI training data de-identification lacks transparency and may be unreliable.
No Participant Recording Control
Unlike competitors, non-users cannot stop Otter from recording the meeting.
Data Inputs
Non-Consensual Voice Harvesting
Voice and meeting data of non-consenting participants are used for training.
Indefinite Data Retention
Otter retains captured conversational data indefinitely for model training.
Lack of Training Data Extraction
Once data is incorporated into the AI model, it cannot be easily extracted.
Human Factors
User Neglect of Notice Rules
Users fail to manually notify or get consent from other meeting participants.
Overreliance on Default Settings
Users do not enable optional pre-meeting notification settings.
Process and Methods
Shifting Consent Burden to Users
Otter's terms outsource legal consent obligations entirely to the accountholder.
Automatic Calendar Integration
Software automatically joins and records meetings linked to workplace calendars.
Host-Only Consent Mechanism
The system only requests consent from the host, ignoring other participants.
Management
Prioritizing Growth Over Privacy
Company focused on rapid user growth and revenue over robust privacy safeguards.
Lack of Transparency on Data Use
Management failed to provide public details on de-identification processes.
Regulatory Environment
Inadequate Wiretap Law Enforcement
Ambiguity in whether AI transcription tools constitute third-party eavesdroppers.
Varying Multi-Party Consent Laws
Jurisdictional differences in consent requirements complicate compliance.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
