The AI notetaker in your client meetings is not a passive tool. It is a third party recording conversations that may include people who never agreed to be recorded. A federal judge in California has now ruled on whether that violates decades-old wiretap laws, and the answer reshapes how every wealth management firm deploys these tools.
The Ruling Otter Did Not Want
In re Otter.AI Privacy Litigation consolidates four class suits filed against Otter.ai in 2025. Plaintiffs allege Otter recorded, transcribed and used conversation contents without consent from every participant, violating the federal Electronic Communications Privacy Act (ECPA) and the California Invasion of Privacy Act (CIPA). Only the Otter account holder consented. Otter captured the other participants’ voices and used them to train its AI models, though those participants consented to nothing.
Judge Eumi K. Lee heard argument on Aug. 3, after the hearing date was reset three times, and issued her order 10 days later. She granted Otter’s motion in part and denied it in part. The ECPA wiretap claim survives. The core CIPA claim survives for every California plaintiff. The Illinois biometric privacy claims over voiceprint capture survive.
Otter argued its bot merely acts for the meeting host and cannot be a third-party eavesdropper. The court rejected that: Because Otter also retains conversation data to train its own models, it plausibly functions as an independent interceptor, not an extension of the person who invited it.
Not every claim survived. The court dismissed the federal and state computer-access claims for lack of a cognizable loss. Invasion of privacy claims survived only for the plaintiff who alleged a call with a medical provider. Plaintiffs describing their calls merely as “sensitive” did not clear the bar. Most dismissals come with leave to amend.
The lead plaintiff, Justin Brewer, never had an Otter account. Another participant’s bot recorded him on a call, though he never signed up for the service and never consented. The case is not about Otter. It is about any AI notetaker that auto-joins calls, records participants without affirmative all-party consent and repurposes that content commercially. Plaintiffs named Otter because Otter is large. The theory reaches the category.
The Consent Gap Your Vendor Left You
Every AI notetaker vendor points to its terms of service. Otter’s already instruct account holders to “make sure you have the necessary permissions” before using the bot. The vendor transferred the consent obligation to you. If a participant sits in an all-party consent state, your firm bears responsibility for confirming consent existed before the recording started.
Your compliance team likely never evaluated this when it approved the tool.
The ruling confirms this is no longer theoretical. A federal court has held that a notetaker vendor can be an independent, liable eavesdropper when it uses call content for its own purposes, and that all-party consent statutes reach its customers too. Your compliance team likely never evaluated this when it approved the tool. The SOC 2 audit passed, the data processing agreement got signed and the vendor joined the approved list. Consent under ECPA and CIPA was never on the checklist because nobody had framed it as a firm obligation. This order removes that excuse.
ECPA generally needs only one-party consent, but that protection falls away when an interception furthers a tortious purpose, and Judge Lee found that theory plausible here. CIPA reaches further: It prohibits learning the contents of a communication without consent, so a notetaker that never stores audio stays exposed. Transcription is the interception.
The Damages Math Still Is Not Comfortable
ECPA allows the greater of $10,000 per violation or $100 per day. CIPA allows $5,000 per violation. Your firm is not a defendant in Otter’s case, but a client suing your firm directly over an undisclosed recording inherits the same statutory exposure.
Three Things To Do Now
The response is not to abandon AI notetaking. Firms that deploy these tools well are building real capacity advantages. The response is to govern the tool.
The response is not to abandon AI notetaking. Firms that deploy these tools well are building real capacity advantages.
Audit which tools are running. Advisors add notetakers without compliance review. You cannot manage exposure you cannot name.
Build disclosure into your pre-call process. In all-party consent states, disclosure before recording begins is not optional. Give advisors a standard pre-call statement naming the tool and giving participants a real chance to decline.
Add consent to vendor due diligence as its own line item. SOC 2 certification says nothing about how a tool secures consent from non-account holders, or what your firm gets contractually if that mechanism fails.
Govern The Tool, Not The Docket
Judge Lee’s order is not a verdict. It signals that this legal theory reaches discovery, with the core wiretap and consent claims against Otter intact. Firms that already built a consent process do not need a final judgment to know they are protected. Firms without one now know exactly what a plaintiff’s attorney will point to first.
John O’Connell is Founder and CEO of The Oasis Group, a consultancy for the wealth management industry serving wealth management and technology firms.
