📅 September 11, 2026 • ⏱️ 11 min read • By Basil AI Team

SoundHound, Chipotle, and the CIPA Trap: When AI Voice Agents Intercept Your Phone Calls

Published September 11, 2026

If you called a Chipotle in Oakland this year to order a burrito, you may not have been talking to Chipotle. According to a class action complaint filed July 30, 2026 in Alameda County Superior Court, the voice on the other end of the line was an AI voice agent operated by SoundHound AI, Inc. — routed through SoundHound's servers before the call was ever answered, recording the conversation, and allegedly sharing the audio with third parties including OpenAI. The plaintiff, Sandra Thompson, says she consented to none of it. She just wanted food.

That's the fact pattern behind Thompson v. SoundHound AI, Inc., and it opens a new front in the AI-recording lawsuit wave that has already ensnared Otter, Fireflies, Granola, and Microsoft Teams. The novelty here isn't a meeting notetaker joining a Zoom call. It's an AI voice agent quietly sitting between a customer and the business the customer thought they were calling — and the theory of liability reaches all the way back to California's 1967 wiretap statute.

What the Complaint Actually Alleges

The complaint tells a simple, old-fashioned story with a modern twist. Thompson dialed the phone number Chipotle publishes for its Broadway location in Oakland. According to reporting on the filing at Mondaq's summary of the case, the call was quietly routed to SoundHound's servers before anyone said hello, where an AI voice agent — not a Chipotle employee — answered, transcribed the conversation in real time, and allegedly retained the audio for training and data-sharing purposes.

The plaintiff's theory has two moving parts. First, SoundHound is a third party to the phone call between Thompson and Chipotle. Second, California's Invasion of Privacy Act (CIPA) prohibits third parties from intercepting the contents of communications in transit without the consent of every participant. Bolting an AI processor into the middle of that call, plaintiffs argue, is exactly the interception the statute was written to prevent — even if the restaurant that hired SoundHound is fine with it.

Why CIPA § 632.7 Is the Real Sleeper Threat

Most CIPA cases that reach the news involve § 631 (interception in transit) or § 632 (recording of a confidential communication). Confidentiality is a fact-specific fight — courts routinely dismiss claims where a caller couldn't reasonably expect a business call to be private. But Holland & Knight's analysis of the SoundHound complaint highlights the strategic move plaintiffs made: they anchored the case on § 632.7, which prohibits recording any cellular or cordless communication without all-party consent, with no confidentiality element to argue about.

That's a materially lower threshold. Almost every consumer call to a restaurant today comes from a mobile phone. If § 632.7 governs, every such recording without upfront disclosure is potentially actionable. Statutory damages under CIPA start at $5,000 per violation — and when you multiply by the volume of calls flowing through a national restaurant chain's AI ordering system, the math gets loud fast.

This Isn't the First AI Voice Agent to Get Sued

The SoundHound case didn't emerge in a vacuum. On August 11, 2025, in Taylor v. ConverseNow Technologies, the U.S. District Court for the Northern District of California denied a motion to dismiss a CIPA class action against another AI voice-assistant vendor that Domino's Pizza used to answer phone orders. As Wilson Sonsini's write-up of the ConverseNow ruling explains, the court held that a communications software provider that could potentially improve its own models by ingesting call content was plausibly acting as a third-party eavesdropper under § 631 — even though ConverseNow had a contract with the restaurant.

That ruling matters because it broke the industry's assumption that a vendor-under-contract is automatically "the business" for CIPA purposes. As Squire Patton Boggs's Privacy World blog noted at the time, the decision was a cautionary note not just to software companies but to any business deploying those technologies, because of the aiding-and-abetting exposure that flows back to the restaurant.

Where SoundHound Fits in the Broader AI Wiretap Wave

Zoom out and 2025-2026 has become the year the AI-recording defense bar started billing overtime. Every major architecture for AI conversation capture is now in federal court somewhere:

Case	Defendant	Capture architecture	Lead legal theory	Status
In re Otter.AI Privacy Litigation	Otter.ai	Meeting bot joins virtual calls	ECPA / CIPA §§ 631, 632	Motion to dismiss partly denied Aug. 13, 2026
Cruz v. Fireflies.AI Corp.	Fireflies.ai	Meeting bot + speaker recognition	Illinois BIPA §§ 15(b), (d)	Filed Dec. 18, 2025
Chamberlain v. Granola, Inc.	Granola	Bot-free device-audio capture	ECPA / CIPA / CDAFA	Filed July 30, 2026
Basich v. Microsoft Corp.	Microsoft Teams	Cloud diarization voiceprints	Illinois BIPA	Filed Feb. 5, 2026
Thompson v. SoundHound AI	SoundHound (Chipotle)	Inbound AI voice agent	CIPA §§ 631, 632.7	Filed July 30, 2026

Read together, the through-line is unmistakable: whenever an AI vendor's cloud captures audio from someone who did not personally click "I agree," plaintiffs' firms are finding a wiretap or biometric statute that fits. Bot-based, bot-free, phone-based — the architecture doesn't save you when the audio still leaves the user's device.

The OpenAI Angle: Data Sharing as a Damages Multiplier

One detail from the SoundHound complaint deserves its own paragraph. Plaintiffs allege the call audio wasn't just processed by SoundHound — it was shared with third parties like OpenAI. As the Mondaq analysis emphasizes, the theory is that routing calls through SoundHound's servers for AI training and data sharing with OpenAI constitutes unauthorized eavesdropping, even when customers believe they're speaking directly with the restaurant.

Why the Downstream Sharing Matters

CIPA does not just police the initial interception. It also cares about what happens to the recording afterward — use, disclosure, and retention are each potential violations. Once your voice ends up in a third-party foundation-model training pipeline, it becomes very hard for the vendor to argue the recording was ever "just for order fulfillment." That's the same dynamic that made the training-by-default allegation in the Granola complaint so damaging: once audio is in the model, it can't be extracted.

What About Federal Law? The ECPA Overlay

California is the marquee jurisdiction, but the federal GDPR's Article 5 data-minimization principles and the U.S. Electronic Communications Privacy Act (ECPA) create parallel exposure. ECPA prohibits the intentional interception of wire, oral, or electronic communications and, unlike CIPA, applies nationwide. Cases like Chamberlain v. Granola and In re Otter.AI pair ECPA claims with state statutes precisely to give plaintiffs a fallback if the state-law class fails.

For AI voice agent vendors, the practical implication is that even a Nevada or Texas restaurant chain doesn't escape wiretap risk just by avoiding California. ECPA travels with the call.

Do Restaurants (and Employers) Share the Liability?

Yes — and this is the part most enterprise buyers underestimate. The ConverseNow ruling made clear that businesses using AI voice vendors can face aiding-and-abetting claims. In the meeting-notetaker world, an HR Executive analysis of the AI notetaker litigation wave pointed out that under the federal Wiretap Act, private plaintiffs may seek statutory damages calculated as the greater of a per-day amount or a minimum statutory award — exposure that flows through to the employer that turned the tool on, not just the vendor that built it.

For a restaurant chain, that means every location that piped its published phone number through a third-party AI voice service is a potential co-defendant. For a corporate compliance officer, it means "we bought it from a vendor" is not the shield it used to be — a point we've covered in depth for compliance officers in financial services.

The Consent Design Problem

The lawsuits keep landing on the same design flaw: the AI capture is invisible, and the burden of disclosure is punted downstream. Granola's own website, quoted in the Chamberlain complaint, marketed the tool with the line "other people in the room won't know it's there," per the Barnes & Thornburg analysis of the consent problem. SoundHound's Chipotle deployment has the same architectural signature: the caller has no reasonable way to know that dialing the restaurant's number will put an AI vendor in the middle of the call.

An audible "this call may be recorded" tone at the start of every AI-answered call is necessary — but even that may not be legally sufficient in an all-party-consent state, particularly for § 632.7 recording of cellular calls. The safer design is not routing the audio to a third party at all.

A Decision Framework for AI Voice Deployments

• Does audio leave your infrastructure? If yes, you have vendor-side wiretap exposure. If no, you don't.
• Is the vendor training its models on your audio? If yes, that's a damages multiplier under CIPA § 632 and state consumer-protection statutes.
• Do callers know a third party is on the line before speaking? If no, § 631 interception risk is live.
• Are calls arriving from mobile phones? If yes (they almost always are), § 632.7 applies and there is no confidentiality defense.
• Can you produce a written all-party consent record? If no, your CIPA affirmative defense is weak.

How Basil AI Solves This: On-Device by Architecture

Basil AI is not an AI voice agent for inbound calls — it is a private AI meeting recorder for iOS and Mac. But the reason we exist is exactly the architectural problem SoundHound is now defending. When transcription runs on Apple's on-device Speech framework and the Apple Neural Engine, no vendor server ever receives the audio. There is no third party in the middle to be an "eavesdropper" under CIPA. There is no cloud pipeline to accidentally repurpose the recording as training data. There is no vendor database to subpoena.

That doesn't discharge the user's consent obligations under California, Illinois, or Florida law — those still bind whoever hits "record" — but it eliminates the class of lawsuit that has been the industry's most expensive risk in 2025-2026. For a deeper technical breakdown of the on-device model, see our iOS 26 SpeechAnalyzer explainer. For a side-by-side product comparison across every major cloud AI notetaker, see the Basil AI comparison guide.

Cloud AI Voice vs. On-Device AI: The Liability Delta

Dimension	Cloud AI voice/notetaker	On-device AI (Basil)
Audio processing location	Vendor cloud (US or global)	User's iPhone / Mac
Third-party eavesdropper theory (CIPA § 631)	Live risk — vendor is a third party	No third party in the audio path
Recording under CIPA § 632.7	Applies to every mobile call captured	User controls the recording locally
Model training on your audio	Common default; opt-out often opaque	No cloud, no training pipeline
Subpoena exposure at the vendor	Vendor holds discoverable recordings	Vendor holds nothing
Voiceprints / biometric identifiers	Generated and stored server-side (BIPA risk)	Any embeddings stay on-device
Data sharing with OpenAI / third-party models	Alleged in Thompson v. SoundHound	N/A — no cloud pipeline

What to Do Monday Morning

1. Inventory every AI system that touches customer or employee audio — phone systems, meeting tools, drive-thru, contact-center bots.
2. Map the audio path. For each system, answer: does audio leave our infrastructure? Where does it go? Who else touches it? Is it used to train a model?
3. Update your vendor contracts to require disclosure of subprocessors, training use, retention windows, and deletion SLAs. If a vendor cannot answer these in writing, that's your answer.
4. Add an audible upfront disclosure to every AI-answered inbound call, and a visible in-meeting disclosure to every AI-transcribed meeting.
5. For regulated conversations (legal, medical, financial, HR), prefer architectures where the vendor never receives the audio. Read our related coverage on the August 13 Otter ruling on vendor training and on AI notetakers and NDA-covered client work.

The Bottom Line

Every AI recording lawsuit filed in 2025 and 2026 has the same skeleton: a cloud AI vendor captured audio from people who did not personally consent, and a decades-old privacy statute is now the plaintiffs' bar's tool of choice. Thompson v. SoundHound extends the theory from meeting notetakers to inbound phone calls. If your product routes third-party audio through a vendor's servers, you now have to underwrite that risk explicitly — or you have to architect it out. On-device processing is the only architecture that removes the vendor from the audio path entirely, and that is why it will keep winning the compliance conversation.