The AI Notetaker Lawsuit Every HR Manager Needs to Read

Every HR manager I have spoken to in the last six months has the same reaction when I describe what BarnOwl does. They lean forward. Not because of the transcription. Because of the word "local."

HR sits at the intersection of the most sensitive meetings in any organisation — disciplinary proceedings, performance reviews, termination conversations, union discussions. These are meetings where confidentiality is not a preference, it is a legal obligation. And for the past two years, AI notetakers have been quietly joining those meetings, sending audio to third-party servers, and creating records that nobody thought carefully about.

A class action lawsuit now pending in the U.S. District Court for the Northern District of California is making this concrete. In re Otter.AI Privacy Litigation — consolidated before Judge Eumi K. Lee — alleges that Otter.ai's notetaking tools recorded participants without the consent of all attendees, and used those recordings to train AI models without adequate disclosure. No substantive ruling has been issued yet. But employment attorneys say the case already signals where the liability will land — and it is not just with Otter.

The employer is the liable party

Bradford Kelley, a shareholder at Littler Mendelson who co-authored the firm's February 2026 analysis of the litigation, told HR Executive that human resource teams should be "very interested in this case."

The key point from Littler is that the employer cannot simply point to the vendor's terms of service. Otter's position in its motion to dismiss is that its terms place responsibility for obtaining participant consent on the account holder — the employee who turned the tool on — not on Otter itself. Courts may find that framing insufficient. And even if they accept it, what it means in practice is that the employee's employer is responsible for what that employee deployed.

Banning AI notetakers does not solve this. Littler's analysis states directly that banning these tools outright is likely unenforceable. A 2025 survey by SoftwareFinder.com found that one in five professionals reported frequently using AI to draft meeting notes. The attorneys' recommendation: get ahead of it. Select, configure, and control a vetted tool rather than cede that ground to whatever employees happen to download.

Seven risk areas HR has not fully mapped

Kelley and co-author Zoe Argento, also a Littler shareholder, identify seven distinct risk areas that a single AI notetaker can activate simultaneously. The breadth of the list is the point.

The multinational problem

For HR teams at organisations with employees in the EU, the compliance picture is significantly more complex. Under GDPR, consent must be freely given, specific, and unambiguous from each individual whose data is processed. A model that relies on one meeting participant to authorise recording on behalf of all others does not satisfy this standard.

Data transfer adds another layer. When an AI notetaker sends meeting audio to US-based servers for processing, that transfer must comply with international transfer mechanisms such as Standard Contractual Clauses. HR meetings involving European employees — performance conversations, disciplinary proceedings, works council discussions — are exactly the meetings where this becomes a problem.

In co-determination countries including Germany and France, deploying an AI notetaker may require works council consultation before rollout. This is a requirement with no US equivalent that multinational HR teams frequently overlook.

The architecture question

The Littler recommendation — select, configure, and control a vetted tool — points toward a real question: what does a vetted tool look like for meetings that HR cannot record?

The answer cannot be a cloud-based tool with a better privacy policy. The structural problem is the pipeline: audio leaves the device, goes to a server, gets processed under someone else's terms. That pipeline is what creates the consent exposure, the GDPR transfer problem, the privilege waiver risk, and the retention issue simultaneously.

Local-first transcription eliminates the pipeline. Audio is processed on the device, in memory, and never transmitted. There is no third-party server receiving your termination conversations. No terms of service governing your investigation records. No data retention policy you cannot control.

In all-party consent states, users are recommended to inform all meeting participants that transcription is active before the meeting begins. That is the only practical disclosure step. Everything else — where the audio goes, who processes it, what they do with it — disappears when the processing happens on your machine.

Frequently asked questions