Otter.ai Class Action: What a Transcription Lawsuit Means for Your AI Privacy Program

What actually happened

Otter.ai, a transcription service, is facing a class action over how it handles recorded conversations. The claim centers on consent: people who appeared in recordings, but never signed up for the service or agreed to its terms, had their conversations captured, transcribed, and stored. The plaintiffs argue that this violates privacy laws because the people being recorded never agreed to have their words processed by an AI system.

The mechanism is important. This is not a data breach where an attacker stole files. The harm is in the collection itself. The service records a meeting, transcribes it, and stores the text. The people speaking in that meeting may not have known the service was running, let alone consented to having their voice processed and stored indefinitely. The class action targets that gap between what the service does and what the speakers agreed to.

Why this is an AI risk management failure

The failure mode is missing lawful basis for processing. Under the GDPR, every processing of personal data needs a legal justification. Consent is one, but consent must be freely given, specific, informed, and unambiguous. A meeting attendee who never saw a consent form has not given any of those things.

This same pattern repeats across AI deployments. A company deploys an AI tool that processes customer calls, employee communications, or visitor interactions, and the people being processed were never told. The tool works fine. The data is handled securely. But the legal basis is missing, and that is enough for a lawsuit.

The precedents are clear. Samsung's 2023 incident showed what happens when confidential data flows into an AI system without proper controls. OpenAI's 2023 Redis bug exposed chat titles and payment data, and the lesson was about data isolation and impact assessment. Clearview AI's 2022 GDPR fines across the EU and UK were about scraping facial images without a lawful basis. The common thread is not technical failure. It is processing personal data without a defensible reason.

What the law actually requires

Under the GDPR, you need a lawful basis before you process personal data. For AI systems that record or transcribe conversations, the relevant bases are usually consent, legitimate interest, or contract. Each has limits. Consent must be obtained from the actual speakers, not just the person who set up the meeting. Legitimate interest requires a balancing test that weighs your business need against the privacy rights of the individuals. That test must be documented.

The EU AI Act adds another layer. High-risk AI systems under Annex III, which includes certain biometric and emotion-recognition applications, must meet data governance requirements, and providers need to show they have appropriate data management practices. A transcription service that processes voice data sits close to this line. Even if your system is not classified as high-risk, the data governance expectations are a useful benchmark.

The practical tool is a Data Protection Impact Assessment, or DPIA. A DPIA forces you to document what data you are processing, why, what the risks are, and what mitigations you have in place. For any AI system that processes personal data, a current DPIA is not optional paperwork. It is the evidence that you actually thought about the privacy impact before you deployed.

Key risk indicators to track

Track three things. First, your PII redaction catch rate on sampled traffic. If you are redacting names and other identifiers from transcripts, how often does the redaction actually work? Second, completions flagged for personal-data leakage per 10,000. This tells you how often your system is emitting personal data it should not. Third, the percentage of your AI systems that have a current DPIA on file. If that number is not 100%, you have a gap.

What to do

• Audit every AI system that processes personal data and confirm you have a documented lawful basis for each one. If you cannot name the basis, you do not have one.
• Run a DPIA for any system that records or processes conversations, voice, or other sensitive data. Update it whenever the system's functionality changes.
• Check your vendor agreements. If you use a third-party transcription or analytics tool, confirm the vendor's data handling practices and who is the controller for the data. The class action against Otter.ai is a reminder that the vendor's consent model becomes your problem.
• Review your redaction and data minimization settings. If you do not need the full transcript, do not keep it. If you do not need the voice recording, delete it.
• Document your incident response plan for privacy complaints. If a data subject asks what you have on them, or a regulator asks about your lawful basis, you need to be able to answer quickly and accurately.

More from our platforms

These sister platforms cover the parts of this problem that sit outside governance.

• Argus (argus.threatclaw.ai) records every trace an AI application produces and scans it for prompt injection, jailbreaks and data leaks, including the attacks hidden inside retrieved documents and tool results rather than in what the user typed. Governance decides what an AI agent is allowed to do. Argus shows what it actually did.
• ThreatClaw (www.threatclaw.ai) tracks the threat side of the same systems: 22 live intelligence feeds, exploitation predicted before it is officially confirmed, threat actor profiles, and detection rules you can deploy straight away. A control is only as good as the threat it is sized against.