"Are AI meeting notes private" is the wrong question, and so is "is Otter AI safe", because neither "private" nor "safe" is a property a tool has. The useful questions are narrower: who holds the audio, for how long, who can subpoena it, is it training a model, and did everyone in the room agree. Vendors answer the first question loudly and the rest quietly.
This is an opinion piece on AI note taker privacy, and the opinion is this: the category has been sold on convenience while the legal ground underneath it moved, and most teams using these tools have not re-read the terms since they signed up.
What actually changed
Wiretap litigation is live. A wave of federal class actions is testing whether Otter, Fireflies, and Microsoft Teams have been violating decades-old wiretap statutes. Whatever the outcomes of the Otter AI lawsuit and the others, the existence of the cases tells you the legal theory is not fringe.
Biometrics entered the picture. Fireflies has faced allegations under the Illinois Biometric Information Privacy Act over collecting voiceprints without the informed written consent BIPA requires. This is the part most users never considered. Speaker identification means building a voiceprint, and a voiceprint is biometric data with its own regulatory regime. Your meeting tool may be running biometric identification on people who never installed it.
Consent isn't one thing. Recording, transcription, and AI processing are legally separable activities, each potentially carrying its own notice requirement. About 11 US states, often called two-party consent states, primarily require all-party consent — California, Delaware, Florida, Illinois, Maryland, Massachusetts, Michigan (at least for third-party recordings), Montana, New Hampshire, Pennsylvania, and Washington. Connecticut, Missouri, Nevada, and Oregon require it for either phone calls or in-person conversations (Reporters Committee for Freedom of the Press). "I clicked the button in my account" is not consent from everyone else on the call.
Platforms are pulling back. Microsoft Teams began auto-blocking external AI notetakers in August 2026. Zoom administrators can lock third-party apps to an allow-list. When platforms start defaulting against a category, that's a signal about where they think the liability sits.
The three settings that matter more than the privacy page
Retention. The default in many of these tools is indefinite. Not thirty days, not a year — indefinite. What you're building is a permanent, searchable, cloud-hosted archive of every conversation your company has had. Think about that as a discovery target in litigation, or as a breach surface, and the convenience looks different. Go find the retention setting. If you can't find it, that's the answer.
Training. Check whether transcripts may be used to train or improve models. Consumer tiers of several tools have used content for model improvement, sometimes with an opt-out rather than an opt-in. Enterprise agreements usually carve this out; the free plan your colleague signed up for probably doesn't.
Sharing scope. Who in your organization can search the archive? Many tools default to broadly accessible team libraries. A recruiting conversation, a performance discussion, or an early acquisition call landing in a company-wide searchable index is a specific, foreseeable problem.
The argument I'd actually make
The privacy conversation usually gets framed as paranoia versus productivity, and that framing is wrong. Cloud notetakers are good products. Otter, Fireflies, and Granola do real work, and a sales team without shared searchable transcripts is worse off.
The problem is that the defaults optimize for the vendor's retrieval story, not for your risk. Indefinite retention makes their search feature better. A visible bot makes their attribution cleaner. Broad team access makes the workspace feel valuable. None of those defaults were chosen with your legal exposure as the objective, and none of them are unreasonable of the vendor — they're just not yours.
So the honest position isn't "never use these." It's: match the tool to the conversation.
For a public webinar, a recurring standup, or an all-hands, a cloud notetaker is fine. The content isn't sensitive, and the searchable archive is genuinely useful.
For client calls under NDA, legal or medical conversations, HR matters, security incidents, salary discussions, unreleased product, or anything involving a participant who'd be uncomfortable knowing it's archived forever in a vendor's cloud — don't. The convenience isn't worth the exposure, and you can get the transcript without it.
The structural alternative
If audio never leaves the machine, most of this analysis becomes unnecessary. There's no retention policy to audit because the files are yours. No training question because there's no vendor. No sub-processor list, no cross-border transfer, no breach surface holding your meetings. No bot in the participant list, so no platform blocking it.
That's what local transcription buys — not better privacy in a marketing sense, but the elimination of the entire category of question. Vext records microphone and system audio on your Mac, transcribes on-device with Parakeet TDT v3 on Apple Silicon, generates speaker labels and summaries with a local model, and stores everything locally. The mechanics are in meeting transcription without a bot.
brew install muvon/tap/vext
The tradeoffs are real and I won't pretend otherwise: no transcripts of meetings you skip, no shared team workspace, no CRM sync. If those are core to your workflow, a cloud tool is the right answer and you should configure it carefully rather than replace it. We laid the options out in Otter.ai alternatives for Mac.
What to do this week
Three concrete things, none of which require changing tools:
- Open your notetaker's retention setting and look at it. Change it from indefinite to something defensible. Most people have never opened this screen.
- Check the training clause for whatever tier you're actually on, not the enterprise page.
- Say it out loud at the top of the call. "I'm recording this for notes, let me know if you'd rather I didn't." In all-party consent states this isn't courtesy, it's the requirement — and a bot appearing in the participant list is not a substitute for asking.
The tools aren't the problem. Running them on defaults, on every conversation, forever, is. If you want the setup where the question doesn't arise, that's offline voice-to-text.