Why 'De-Identified' AI Meeting Data Isn't Really Anonymous: Inside Otter.ai's Opt-Out Training Default

If your Otter.ai account has been active for more than a few minutes, the company is almost certainly training its speech recognition models on your recordings right now — and on the voices of every person you've spoken to on a call. Otter's own Privacy & Security page confirms it uses "a proprietary method to de-identify user data before training our models," and the setting is on by default. The consolidated federal class action In re Otter.AI Privacy Litigation (5:25-cv-06911-EKL, N.D. Cal.) is now testing whether that arrangement is legal at all — and independent research suggests the "de-identification" itself doesn't hold up to scrutiny.

The default nobody sees: opt-out training

The single most important sentence about Otter.ai's business model is buried on a settings page most users will never open. According to Otter's own documentation, "Otter uses a proprietary method to de-identify user data before training our models so that an individual user cannot be identified. This training method is automatic and as such audio recordings and transcripts are not manually reviewed by a human."

Two words in that paragraph do enormous work: "automatic" and "proprietary." Automatic means opt-out. As independent analysis from Voibe puts it plainly, "Otter trains automatically on de-identified user data unless you find and flip the setting in account data controls." Compare that to peer privacy-first products, which don't train on user data at all.

"Proprietary" means Otter has published no technical specification of what the de-identification actually does — no whitepaper, no threat model, no adversarial evaluation. Users are asked to trust that whatever transformation happens between recording and training is robust enough to prevent re-identification. That trust, as we'll see, is not well-grounded in the science.

The lawsuit that put the whole model on trial

The consent problem exploded into federal court in August 2025. As UC Today reported, "Otter.ai is fighting to dismiss a consolidated federal class action that accuses its OtterPilot bot of quietly recording and transcribing millions of Zoom, Microsoft Teams and Google Meet conversations without participants' consent." The four suits — Brewer, Walker, Theus and Winston — were consolidated by Judge Eumi K. Lee on October 22, 2025.

The complaint's core theory is spelled out by Jackson Lewis attorney Joseph Lazzarotti in the Workplace Privacy Report: plaintiffs allege "that Otter effectively acted as an unauthorized third party eavesdropper, intercepting communications and repurposing them for product training without consent." That last phrase — "repurposing them for product training" — is where the de-identification claim becomes a legal question, not just a technical one.

According to a case tracker from Recording Law, "Judge Lee heard argument on the motion on May 20, 2026 in San Jose" and, as of June 20, 2026, had not issued a ruling. The court's decision will be the first federal test of whether decades-old wiretap statutes reach an AI bot quietly recording a video call and repurposing the audio to train commercial models.

What Otter actually says vs. what it actually does

Otter's public posture is that de-identification neutralizes the privacy concern. CEO Sam Liang told TechCrunch in October 2025 — as summarized by LegalClarity — "If they accuse us, then they could accuse everyone else, all the tools you heard about doing meeting notes. My view is that we are on the right side of history." He also acknowledged that "privacy laws needs to be enhanced to support the new AI world."

But the plaintiffs' factual case, as summarized in a Kilpatrick Townsend analysis, is much more concrete: "the tool provides real-time transcriptions for accountholders, but according to the complaint, it only seeks permission from the meeting host and even then, only if the host is not an Otter.ai user. Other participants cannot disable the tool."

You can also read Otter's data-use commitments directly in Otter.ai's privacy policy. What you won't find is a technical description of the de-identification pipeline, a public re-identification threat model, or a commitment that the raw audio is deleted before training.

Why 'de-identified' voice data isn't the same as anonymous

Here's the part that regulators and courts are increasingly focused on: even if you take Otter's de-identification claim at face value, the technique itself is not privacy-preserving in the way most people assume.

A peer-reviewed 2022 paper published on arXiv — "Privacy-Utility Balanced Voice De-Identification Using Adversarial Examples" — reviews the entire field and finds that classical signal-processing de-identification methods based on frequency warping and Vocal Tract Length Normalization use "invertible warping function[s]" that are "probably employed to recover the original voice by informed adversaries," indicating "the intrinsic vulnerability for voice de-identification."

In plain English: many of the mainstream voice-anonymization techniques can be reversed by an adversary who knows what transformation was applied. Deep-learning-based methods are more robust in benchmarks, but they require exactly the kind of published threat model Otter has never released. And even academic analysis of the Otter complaint observes that "ML models trained on de-identified data remain vulnerable to re-identification attacks, rendering the de-identification claim weak."

None of this is theoretical for a meeting transcript. Your voice on a call is a biometric identifier. The words you say frequently contain names, companies, dollar figures, medical conditions, and legal strategy. Text de-identification that strips "James" or a phone number may still leave enough context for a motivated adversary — or a subpoena — to reconstruct who was speaking, and about what.

What the research literature actually shows

A separate line of research published in ACM's Proceedings on Interactive, Mobile, Wearable and Ubiquitous Technologies ("VoiceCloak") frames the same problem from the other direction: voice de-identification is a genuinely hard engineering problem where "existing machine-centric studies employ direct modification or text-based re-synthesis to de-identify users' voices but cause inconsistent audibility for human participants in emerging online communication scenarios, such as virtual meetings."

That's the researchers saying, in effect: solving this well is an open research problem. A cloud vendor asserting they've solved it — without publishing anything — is asking for a level of trust the field does not currently support.

Cloud transcription vs on-device transcription: the training pipeline that isn't there

The most important comparison to make is not "which vendor has better de-identification." It's "which architecture creates a training pipeline in the first place."

The distinction matters because "opt out of training" is only a meaningful remedy for someone who (a) has an account, (b) reads the privacy policy, and (c) navigates to the correct settings page. It does nothing for the person on the other end of your Zoom call — the client, the patient, the counterparty — who never signed up for Otter and never saw a consent screen.

Why regulators are skeptical of 'de-identification' claims generally

Otter's legal risk here is not just California wiretap law. Under EU law, the reason "anonymization" is such a high bar is that Article 5 of the GDPR requires personal data to be "collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes" (purpose limitation) and to be "adequate, relevant and limited to what is necessary" (data minimization).

Training a commercial speech recognition model is arguably a very different purpose from transcribing a specific meeting for a specific customer. If de-identification is reversible in practice, the trained model still constitutes processing of personal data, which brings the entire GDPR framework — including Article 9 protections for biometric data — back into scope.

US regulators have followed a similar line of skepticism. As Kilpatrick Townsend's privacy team advises companies building AI products: "With respect to establishing use rights in data for AI training, avoid relying solely on de-identification. Updating product settings to provide notice and meaningful control can help reduce exposure to claims like those facing Otter.ai."

How Basil AI solves this: no server, no training, nothing to opt out of

Basil AI takes the entire de-identification debate off the table by not participating in it. There is no server-side transcription pipeline. There is no OtterPilot-style bot that joins your Zoom call as a visible participant. There is no proprietary de-identification method to trust or distrust, because there is no data leaving your device to be de-identified in the first place.

Instead, Basil AI uses Apple's on-device Speech Recognition framework — the same one documented in Apple's Speech developer documentation — combined with the Neural Engine to process your meeting audio locally. Recordings, transcripts, and summaries live in your device's storage (and, optionally, your own iCloud) and are readable only by you. Apple's own privacy commitments guarantee that on-device processing does not send data to Apple's servers for model training either.

If you want to understand the deeper architectural distinction, our bot-free vs on-device explainer lays out why "no bot in the call" and "no data in the cloud" are two separate privacy properties — and why Basil AI is one of the only tools that gives you both.

What to do right now — regardless of which tool you use

If you're an Otter.ai user

Open Account → Data Controls in your Otter dashboard and flip off model training. Then decide whether you want your existing recordings retained; Otter's privacy policy explains retention windows for account data. If you invite Otter into meetings with clients, patients, or counterparties in California, Illinois, or any other two-party-consent state, you should also add explicit verbal consent scripts at the top of every call — the visible-bot-is-notice theory is being litigated, and organizations that rely on it are effectively depending on Judge Lee's forthcoming ruling.

If you handle regulated data

Healthcare providers, attorneys, financial advisors, and coaches have a stronger reason to avoid the entire de-identification question. For a deeper dive into the ambient AI scribe HIPAA problem, see our analysis of the Sutter/Abridge ambient scribe case. Attorneys should also read our note on discovery and privilege risk with cloud notetakers.

If you're evaluating alternatives

Read our Granola vs Basil AI comparison for the specific tradeoffs between hybrid cloud-enhanced tools and fully on-device tools. The one-line summary: any tool that has your audio touch a server is a tool where "de-identification for training" becomes a policy question you have to trust.

The bigger picture: the AI industry has to solve consent, not just de-identification

Otter is not unique. As tl;dv's tracker of the 2026 lawsuits notes, "Otter.ai is facing four consolidated lawsuits in federal court over how its AI notetaker records participants without their explicit consent. Fireflies.ai has two separate biometric privacy suits filed against it in Illinois." Fireflies' own commitments are laid out in Fireflies' privacy policy, and Zoom's AI Companion terms are in Zoom's privacy statement — each of which requires readers to make similar leaps of faith about how their audio and transcripts are used downstream.

The good news is that the whole category is finally being scrutinized. The bad news is that the scrutiny is happening in litigation, not product design. Until the federal courts rule — and until vendors publish real de-identification threat models rather than marketing paragraphs — the safest architecture is the one where the audio never leaves your device.

The bottom line

"De-identified" is a claim, not a guarantee. It is opt-out by default at Otter.ai. It is technically brittle according to the peer-reviewed literature. And it is currently the subject of a consolidated federal class action that will define how far US wiretap and privacy statutes reach into the AI meeting notes industry. If any of that gives you pause about what happens to the words you speak in your next meeting, the answer is not a better toggle — it's an architecture where the training pipeline doesn't exist in the first place.

Take meeting notes that literally cannot be used to train anyone's AI

Basil AI processes every second of your meetings on your iPhone or Mac. No cloud upload. No de-identification claims to verify. No training pipeline your voice could enter.