AI Note-Takers Compared: What Each One Does With Your Meetings

On 13 August 2026 a federal judge decided that an AI note-taker which trains on your meetings is not a participant in them. It is a third party. That single line reorganises how you should compare AI meeting notes tools, because the feature list and the data policy stopped being separate columns. California alone sets damages at 5,000 dollars per violation.

What the 13 August 2026 ruling changed

Here is the direct answer. A recorder that only transcribes and hands the file back to the people on the call can be treated as an extension of whoever invited it. A recorder that keeps the audio and trains on it is arguing something different, and one court has now said so.

The case is In re Otter.AI Privacy Litigation, No. 5:25-cv-06911-EKL in the Northern District of California, before Judge Eumi K. Lee. Four suits filed between August and September 2025 were consolidated in October 2025, argued in May 2026, and decided in part on 13 August 2026.

Judge Lee dismissed several counts and let the important ones stand. The federal Wiretap Act claim survived, along with California Invasion of Privacy Act section 631, both Illinois biometric privacy voiceprint claims and the unfair competition claim. The Computer Fraud and Abuse Act, CDAFA and Washington Privacy Act counts were dismissed with leave to amend.

The invited-participant defence, and why it failed

Otter argued it was an invited participant, relying on the cases holding that software acting purely as a client's own tool is not a third-party interceptor. That defence has worked for plenty of analytics vendors. It did not work here, and the reason was the training clause.

The court put it plainly. Otter is not just a tool that transcribes the conversation and hands it back to the participants, but an independent party who uses the recordings to train its models for its own benefit.

Read that as a test rather than a verdict. The question a buyer now has to put to a vendor is narrow and answerable: do you retain and reuse conversation content for model training? That single fact moved Otter from one legal category into another, and you can check it before you sign.

The three things a note-taker does with your meeting

Comparisons of AI meeting notes tools sort on summary quality, integrations and price. Those matter operationally. They are not the variables that carry risk.

Retention

How long the audio, the transcript and the summary survive, and whether you can shorten that. Otter commits to storing personal information for as long as necessary to fulfil the purposes it sets out, with no published maximum. Fireflies says it holds account data while the account is active and deletes within 30 days of closure.

Those are different promises. One is bounded by an event you control. The other is bounded by the vendor's own reading of its purposes.

Training rights

Whether the vendor may use what was said to improve its models. Otter's privacy policy of 16 June 2026 lists, among its purposes, training its proprietary AI technology on de-identified audio recordings and on transcriptions, and notes those transcriptions may contain personal information.

De-identification is doing heavy work in that sentence. A transcript of a pricing negotiation stays commercially sensitive after the names come off. The same ambiguity runs through the model providers' own enterprise terms, where the training carve-out and the retention window are usually written by different teams.

Speaker identification and voiceprints

The quietest of the three, and the one carrying per-person damages. Otter generates speaker identification information so users can tell voices apart, and its policy files that under biometric information.

Illinois treats a voiceprint as a biometric identifier, requires written consent before collection, and sets damages at 1,000 dollars for a negligent violation and 5,000 for an intentional one. Both of those counts against Otter survived.

AI note-taker comparison: what each vendor's own policy says

Every row below is a vendor describing itself. That is the right source for a contractual commitment and the wrong source for a verified fact, a distinction worth holding for the rest of this section.

Read the Granola row twice. The allegation is untested and the company has not conceded it. The model weights language is its own, and it is the part a buyer should care about however the case ends.

The bundled assistants converge on one answer

Zoom, Microsoft and Google all say the same thing about training on meeting content, and they say it because enterprise buyers demanded it years ago. Google went further in May 2026, shipping an admin control that requires participants on supported devices to actively agree before recording, transcription or Gemini note-taking starts.

It is off by default with no end-user setting, which is the correct design. Consent policy is an administrative decision, not a personal preference. The awkward finding for the standalone category is that the tool your team likes usually has the weaker consent architecture, and the tool already inside your licence usually has the stronger one. Whether that reorders your shortlist is the kind of call covered in the comparison of enterprise AI governance controls.

Otter vs Fireflies on the terms that actually differ

These two get compared endlessly on summary quality and integrations. On price they are close enough that price should not decide it.

List prices from each vendor's public pricing page, August 2026. Annual figures are the discounted per-month equivalents the vendors advertise. Tiers change without notice.

The control you need sits above the tier you buy

Read the middle three rows again. The features that reduce legal exposure are retention control, single sign-on and audit logging. On both products, all three are gated above the entry tiers.

Here is where I part company with how this category gets reviewed. Comparison posts score these tools on transcription accuracy, which is now broadly solved, and treat the security section as a footnote. The security section is the product. A tool with a 4% better word error rate and no retention control is the worse purchase for any team that talks to clients.

The second-order effect is predictable. Because the controls are gated, teams buy Pro on a card and spread it person by person, and the company ends up with meeting archives it cannot see or delete. That is the shape of unmanaged AI tools and what a breach costs, arriving through a different door.

Consent is a distributed problem, not a checkbox

Eleven to twelve US states require consent from every party to a confidential conversation, depending on how you count the states with unsettled case law. California, Illinois, Washington, Pennsylvania, Maryland, Massachusetts, Florida, Delaware, Montana, Nevada and New Hampshire appear on every list.

The mechanism matters more than the count. On a video call, one participant in California pulls the whole call under California Penal Code section 632. You do not apply the rule of the state you are sitting in. You apply the strictest rule of anyone on the invite, which you often will not know until they join. So the policy has to be uniform rather than conditional.

What the exposure is actually worth

Statutory damages are why this category attracts class actions. The plaintiff need not prove a dollar of harm, and the per-violation figures multiply across participants and calls.

Now do arithmetic you can hold in your head. A weekly client call with six external participants, running for a year, is 312 participant-instances. At the California figure alone that is a number no mid-market company wants to read in a demand letter.

The counterweight is that statutory ceilings are pleaded far more often than they are awarded, and courts can cut aggregate damages that would be ruinous. Treat these as the shape of the risk. The same discipline applies to liability caps and remedies in AI vendor contracts, where the ceiling and the realistic outcome sit far apart.

Where this argument is weakest

Three places, and the first one matters most.

A pleading-stage ruling is not a verdict

The 13 August 2026 order decided only that the claims are plausible enough to proceed. It accepts the complaint's allegations as true for that purpose and makes no finding that Otter violated any law. Otter may win at summary judgment or at trial.

A pleading-stage decision still changes vendor behaviour, because it sets the cost of defending the clause. Anyone telling you the law is settled has read a headline rather than the order. A ZwillGen analysis published on 30 July 2026 made the narrower point that privacy policies are not cure-alls, and that a vendor should not delegate informed consent obligations to its customers.

The consent survey is small and commissioned

The 33.4% and 34.7% figures come from one online survey of 500 employed US adults, fielded on Pollfish on 8 July 2026 and commissioned by a law firm that works on privacy claims. One field date, a modest sample, an interested sponsor.

That is not a reason to discard it. It is a reason to quote it with the sample attached and not build a business case on the decimal. I use it because no better public measurement of consent practice exists, which is itself a finding about the category.

The third weakness is simpler. Every no-training claim in the table above is self-reported, and nobody outside these companies has audited their training pipelines. A SOC 2 report tells you controls were tested against stated criteria, not that no transcript ever reached a training set.

The seven questions to put to a note-taker vendor

Send these before the demo, not after. A vendor who will not answer in writing has told you something.

Question six separates a real answer from a rehearsed one. Granola's own policy concedes that once data is incorporated into model weights, it is not technically possible to isolate or extract it. That is an honest statement of how training works, and it means a deletion right written without a training carve-out is worth less than it reads. Pre-negotiate it alongside the rest of the AI contract terms a finance team should be asking for.

Frequently asked questions

Where to start this week

Start with an inventory, because most companies do not have one. Pull the list of meeting bots that joined calls on your Zoom, Teams or Meet tenant in the last 90 days. Expect to find tools nobody procured, arriving on individual subscriptions bought with personal cards, which is the perimeter gap described in the piece on personal AI accounts inside a company.

Then change one default. If your platform can force a consent prompt, turn it on at the domain level today. If it cannot, write one sentence into the calendar template for every external meeting and make it the host's job to read it aloud. Neither needs legal sign-off and both are reversible.

Related reading