how it happened
- whomeeting notetakerstanding calendar connection
- the gapcalls with outsidersnobody else consented
- the resultclass actionrecording and training without consent
what everyone assumed
A notetaker is stationery, a convenience the organized people bring. The person who installs it consents to it, and the mental model stops there, because tools are imagined as having users and no bystanders. Nobody thinks to ask whether the room consented to the pen.
what happened
The bot joined meetings on a standing calendar connection, month after month, hearing clients, candidates, and colleagues who never made any choice about it. Each transcript landed in a vendor cloud under terms the meeting’s participants had never seen, in jurisdictions where recording carries consent rules.
step by step
- the notetaker joins meetings on a standing calendar linkClients, candidates and colleagues never choose to have it there.
- transcripts land in a vendor cloudUnder terms the participants have never seen, in places with consent rules for recording.the assumption breaks here
- August 2025a federal class action is filedBrewer v. Otter.ai alleges recording without consent and use for model training.
how it surfaced
In August 2025 a US federal class action, Brewer v. Otter.ai, alleged the notetaker recorded participants without consent and used recordings for model training. The defendant was the vendor; the exposure it described belonged to every company whose people had deployed it.
A notetaker is a data processor attending your meetings, and the weight of what it records lands on the companies in the room, not only on the vendor that built it.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersA client hears the bot was recording and that transcripts sit with a vendor they never agreed to.what it costs youYou now answer questions about consent and data use for a tool you never approved.
- or it goes like thisit happenedSamsung, 2023howEngineers paste code and notes into a free chatbot to get help.what leavesconfidential code and meeting noteswho ends up with itan AI vendor on consumer terms
- or it goes like thisit happenedDeepSeek exposed database, 2025howThe AI vendor leaves its own database open.what leaveseveryone's chats and the vendor's keyswho ends up with itanyone on the internet
sources
your turn
what you can do about it
this week
Open your OAuth grant list and find every meeting notetaker, and who connected it.
Your OAuth grant list will tell you in minutes which notetakers attend your meetings and on whose authority. The participants in your last client call did not make that choice; somebody's signup made it for them, which is exactly the pattern the lawsuit describes.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →