Once an AI Notetaker Trains on Your Meeting, You Can't Get It Back: The Model Absorption Problem

Published September 17, 2026

Published September 17, 2026 · 9 min read

If your team uses a cloud AI notetaker and later decides you don't want the vendor training its models on your meeting content, you can toggle the setting off. What you cannot do is undo the training that already happened. That distinction — between deleting a recording file and removing a data point from a set of model weights — is the quiet architectural fact that reshapes how privacy, GDPR erasure rights, and vendor risk actually work.

It is also the fact plaintiffs' lawyers have started building cases around. The Chamberlain v. Granola complaint, filed July 30, 2026 in the Northern District of California, alleges that Granola uses captured communications for AI model training by default — and quotes Granola's own privacy policy conceding that data incorporated into models cannot be extracted once training is complete. That sentence, buried in a policy document, is now a load-bearing exhibit in a wiretap class action.

What "Model Absorption" Actually Means

When a cloud notetaker records your meeting, three separate things happen with your data. The audio file is stored on the vendor's servers. A transcript is generated and stored alongside it. And — critically — the audio, transcript, or both may be fed into training runs that update the weights of the vendor's speech recognition, diarization, or summarization models.

The first two artifacts behave like normal files. You can request their deletion; the vendor can, in principle, verify the deletion; and standard data retention policies apply. The third does not behave like a file at all. It behaves like an ingredient stirred into a cake.

The academic literature is unambiguous on this point. A 2024 survey of machine unlearning on arXiv notes that when users revoke permissions over training data, simply removing those records from the original dataset is inadequate — attackers can still extract user information from the trained model itself. The influence of a data point on the weights persists even after the source record is deleted.

The Granola Complaint's Load-Bearing Sentence

The July 30, 2026 complaint in Chamberlain v. Granola did something unusual. Plaintiffs' counsel did not need leaked internal documents or a whistleblower to prove intent on the training-data question. They pointed at Granola's own published policy language.

According to the Barnes & Thornburg analysis of the case, Granola's design captures audio directly from the user's computer without a visible bot in the meeting, and the complaint frames all seven causes of action around Granola's ability to run and record without any notification to meeting participants. Layered on top of that no-notice recording is the training default: content flows into model improvement unless a user finds and flips a toggle.

The Granola case is not an outlier. As Computerworld reported, the complaint alleges Granola "purposefully" designed its app to record calls without requiring disclosure to all participants, and the California Invasion of Privacy Act violation carries statutory damages of $5,000 per violation.

The Otter Ruling: Training Claims Survive Motion to Dismiss

The training-absorption theory is not hypothetical anymore. On August 13, 2026, Judge Eumi K. Lee issued a ruling in In re Otter.AI Privacy Litigation. According to the Hintze Law analysis, the U.S. District Court for the Northern District of California allowed significant portions of the proposed class action to proceed, with plaintiffs alleging that Otter's meeting assistant joined virtual meetings, transcribed conversations in real time, collected voice-related information, retained meeting content, and used that information to improve its products and machine-learning systems.

The claim that survived is the training claim. As the Sheppard Mullin privacy alert summarized, Otter.ai's AI notetaker tool has been accused of violating Illinois's biometric privacy law, and the California court hearing the case recently let the proceedings move forward on wiretapping and biometric privacy theories.

For any organization currently using a cloud notetaker, the practical question is no longer whether these lawsuits are serious. It is whether the training-absorption problem has an actual remedy, or only a legal apology.

Why Machine Unlearning Isn't a Practical Fix

The field of "machine unlearning" exists precisely because deleting a training record and deleting its influence on a trained model are not the same operation. IBM Research's 2025 review of LLM unlearning lays out the difficulty plainly: modern models train on terabytes of data and contain tens of billions of weights, and isolating and removing an individual data point's influence without degrading the model's other capabilities remains an open research problem.

A separate arXiv paper on machine unlearning notes that the ideal remedy is retraining the model from scratch without the data that should be removed, but this is practically impossible because training deep neural networks is prohibitively expensive in both time and energy. Everything else in the literature — influence functions, gradient subtraction, SISA sharded training — is either approximate or requires the model to have been built for unlearning from day one.

No major AI notetaker vendor has published architectural evidence of SISA-style sharded training or produced a data-subject-request workflow that demonstrates unlearning of a specific user's contribution. When a vendor tells you they will "delete your data," they almost always mean the source recording and transcript. The model weights that absorbed them do not get retrained.

GDPR Article 17 vs. Model Weights

European data subjects have a statutory right to erasure under GDPR Article 17, sometimes called the right to be forgotten. The right is not absolute, but where it applies, the controller must delete personal data "without undue delay." The unresolved question is whether that obligation extends to model weights the personal data was used to train.

Regulators are moving toward yes. Recent arXiv research on LLM unlearning traces the entire machine-unlearning field back to Article 17 and the CCPA — the discipline exists because compliance requires it. But existing enforcement guidance does not yet demand cryptographic proof of unlearning, and vendors have exploited that gap by treating "we deleted the source file" as sufficient.

For a compliance officer, the risk is asymmetric. If a European regulator or a plaintiffs' class subsequently defines Article 17 to reach model weights, every cloud notetaker deployment that trained on EU meeting content becomes a retroactive liability that no amount of "we turned the setting off" can cure. The safe posture is the architectural one: don't let the data reach the model in the first place. This is exactly what our compliance checklist flags as the top DPA question.

The Opt-Out Default Problem

Most enterprise notetaker plans set model training to opt-out rather than opt-in. As the HR Executive analysis of the Granola case notes, model training is opt-out rather than opt-in on many notetaker plans, and the opt-out typically applies only to the account holder — not to the other participants whose voices are being captured.

This creates a specific failure mode that a bot-free architecture makes worse rather than better. As Runtime Wire reported, Granola's own training documentation acknowledges that anonymized data from Free and Business accounts may be used by default to improve services. The consent architecture assumes the account holder can consent on behalf of the meeting. The wiretap statutes assume otherwise.

For a deeper analysis of how bot-free capture models differ from bot-based ones under these lawsuits, see our comparison of bot vs bot-free AI notetaker approaches.

Cloud vs On-Device: Where Does Training Absorption Even Become Possible?

The comparison table below shows where each risk vector originates. The point is not that on-device processing is "better" in every dimension — it is that model absorption is architecturally impossible when audio never reaches a vendor server.

Risk Vector	Cloud Notetaker (Otter, Fireflies, Granola)	On-Device Notetaker (Basil AI)
Processing location	Vendor servers	Apple Neural Engine on your device
Audio ever leaves device	Yes — required for cloud transcription	No — Apple Speech Recognition runs locally
Training on your content (default)	Opt-out; account holder only	Impossible — no vendor server to train from
Right-to-erasure covers model weights	Contested; no proven unlearning workflow	N/A — no model was trained on your content
Non-consenting participants	Captured with account holder's consent only	Same recording-consent rules apply; but no third-party training exposure
Vendor policy change risk	New TOS can retroactively enable training	No vendor pipeline exists to change
Data extraction after training	Not reliably possible	Not applicable

How Basil AI Solves This

Basil AI is a fully on-device iOS and Mac transcription app. It uses Apple's Speech Recognition framework and the Apple Neural Engine to convert audio to text without sending any of it to a Basil server, because there is no Basil server in the transcription path. There is no vendor pipeline that could ingest your meetings into a training corpus. There is no policy toggle that could be flipped by a future acquirer to change that. There is no data absorption problem because the architecture does not permit absorption to happen.

The design implication for compliance officers, general counsel, and privacy engineers is that the GDPR Article 17 question about model weights simply does not arise. If nothing was ever sent to a model, nothing needs to be erased from a model. This is a fundamentally different posture from any cloud notetaker's "we promise not to train" clause — a promise is a policy, and policies change; architecture is a fact, and facts don't.

Basil also supports 8-hour continuous recording, speaker diarization, Apple Notes export, and "Hey Basil" voice activation — none of which require the audio to leave the device. For deeper technical grounding, see Apple's privacy platform overview.

A Procurement Checklist That Actually Addresses Absorption

If you have to buy a cloud notetaker despite everything above, ask these questions in writing and have your CCO sign off on the answers before the DPA is countersigned:

1. Is training opt-in or opt-out by default? Opt-out means every meeting between contract signing and toggle-flipping was absorbed.
2. What is the documented unlearning workflow? If the vendor cannot describe how a specific user's contribution is removed from model weights, then "deletion" means source-file deletion only.
3. Does the vendor commit that customer audio and transcripts are excluded from foundation-model training? Get it in the DPA, not the marketing site.
4. Are non-account-holder participants covered? Under the Granola and Otter theories, the account holder's opt-out does not cover the other participants.
5. What happens on acquisition? A future TOS can re-enable training on the data corpus you handed over. Ask what protects historical content.

If any of those answers is vague, hedged, or subject to change — the on-device path is the only one that removes the question entirely. Our post-Otter-ruling procurement checklist walks through the full evaluation.

The Bottom Line

The AI notetaker category has spent three years telling customers that "your data is safe with us." The Granola complaint and the surviving claims in the Otter litigation have started translating that promise into terms a court can rule on: safe until when, safe from whom, and recoverable in what sense. On the specific question of model training, the honest answer — the one buried in vendor privacy policies and now surfacing in complaints — is that once audio enters the training pipeline, no one, including the vendor, can put it back.

The architectural remedy is to never send it. On-device transcription is not a marketing story. It is the only design that makes the training-absorption question unanswerable in the way that matters: by making it not exist.