- within Insolvency/Bankruptcy/Re-Structuring topic(s)
Otter.ai’s AI notetaker tool has been accused of violating Illinois’s biometric privacy law, and the California court hearing the case recently let the proceedings move forward. As we have previously written in our sister blog, AI notetaker tools carry a growing range of legal risks. These include exposure under wiretapping and biometric privacy laws.
According to the plaintiffs, Otter’s AI-powered notetaker joins virtual meetings and records and transcribes participants’ speech in real time. They also allege that Otter keeps the meeting data and uses it to train its AI models without getting consent from non- subscribers. This, they allege, violates Illinois’ biometric law (BIPA) as well as eavesdropping laws. Namely, the federal Electronic Communications Privacy Act (ECPA) and California’s Invasion of Privacy Act (CIPA). The court allowed all of these claims to proceed.
While the ruling addresses only the pleading stage and does not establish that Otter actually violated any of these laws there are several things worth keeping in mind. Regarding California’s wiretapping law (CIPA), Otter argued that its bot was an authorized meeting participant and therefore a party to the conversation. The court disagreed because Otter uses the notetaker for its own commercial purpose: training AI. This was unlike a prior case, Graham v. Noom, Inc., in which the company’s recording tool acted as an extension of the customer who deployed it. The court did set limits. It dismissed privacy claims where plaintiffs simply called their conversations “private” without alleging specific facts showing they had a reasonable expectation of privacy. But it allowed claims to proceed when the conversations involved sensitive topics, such as medical discussions.
On the BIPA claims, the court found that Otter’s speaker-tagging features plausibly involve capturing voiceprints. I.e., biometric identifiers under Illinois law. This allows plaintiffs' allegation that Otter violated the law by building speaker profiles without giving notice or getting consent. It also allows the allegation that the company should have had -and published- a written retention policy to proceed. The court rejected Otter's extraterritoriality defense, noting the plaintiffs were Illinois residents physically in Illinois when their data was collected. With BIPA carrying liquidated damages of $1,000 per negligent violation and $5,000 per intentional one, these claims add meaningful exposure.
Putting It Into Practice: This ruling is a reminder of the importance of understanding the extent to which notetaker tools might use information for their own purposes. As always, practical steps include conversations with vendors, not just building terms into contracts (although those matter too). And understanding with the business the true value of using a notetaker, and balancing it against the risks.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]
