Somewhere in the last year or two, a new participant started showing up to client calls and council meetings without anyone formally deciding to invite it. An AI notetaker joins the video call, listens to everything said, and produces a transcript and summary a few minutes after everyone logs off. Tools like Otter, Fireflies, Read.ai, Granola and the AI companions built into Zoom and Teams have become common enough that a lot of people stopped thinking of them as a decision at all. Someone added the bot to their calendar once, it worked well, and now it's just there.
That's the same pattern we wrote about with shadow AI a few weeks back, a convenience tool adopted quietly, with nobody stopping to ask what happens to the data. Notetakers deserve their own look because they're a different kind of risk. A staff member pasting a paragraph into a chatbot exposes that paragraph. A notetaker sitting silently on a client call captures everything anyone in that meeting says, including the things nobody would have chosen to write down.
What the Otter.ai lawsuit is actually about
In August 2025, a federal class action was filed against Otter.ai in California district court. The suit, In re Otter.AI Privacy Litigation, alleges the company recorded and transcribed conversations without properly disclosing that the audio would also be used to train its AI models, and that people on the call who weren't Otter customers themselves never had a real chance to say no. The case is still working its way through the court as of this writing, so treat it as an allegation rather than a settled finding. What it does establish is that "we've always just used the notetaker" is not the same thing as "we checked whether that was allowed."
What Canadian consent law actually requires
Canada's Criminal Code takes a fairly permissive one-party consent approach to recording, meaning any single participant in a conversation can record it without telling anyone else. That rule was written for a person hitting record on their own phone, not for a business running every call through a third-party AI vendor. Once an organization is the one doing the collecting, PIPEDA (the federal Personal Information Protection and Electronic Documents Act) and the provincial equivalents, including Alberta's Personal Information Protection Act, take over, and they set a meaningfully higher bar: meaningful consent, meaning the other party actually knows a tool is listening, understands roughly what will happen with the recording, and has a genuine chance to object before the meeting starts, not a mention buried in a calendar invite nobody reads.
This matters more for regulated professionals than it might seem. A lot of the popular notetaker tools were built for the American market and are HIPAA-compliant, which sounds reassuring until you notice that HIPAA is a US health privacy law that has nothing to say about PIPEDA's consent requirements or about where in the world your clients' data is actually stored. A tool being HIPAA-compliant tells you nothing about whether it satisfies the Alberta or federal Canadian rules a law firm, accounting practice or municipal office actually has to follow.
The questions a notetaker needs to answer before it joins a call
The vendor vetting we've recommended for any AI tool applies here too, with a couple of extra questions specific to something that's recording live conversations. Ask whether the tool trains its models on your audio by default and whether that can actually be turned off, not just hidden in a settings menu. Ask where the recordings and transcripts are stored and whether that's inside or outside Canada, since data residency shapes which privacy law actually governs what happens to the file. And ask what happens to a transcript after the meeting: who besides the people on the call can see it, how long it's kept, and whether it gets deleted on request. A business or enterprise tier of these tools is usually where actual answers to those questions live; free consumer versions are, again and predictably, the ones most likely to default to training on whatever audio comes through.
The fix costs almost nothing to implement. Say out loud, at the start of the call, that a notetaker is on and what it's for, and give people a real chance to ask for it to be turned off. Treat the AI-generated summary the same way you'd treat a junior associate's first draft of meeting notes: something a person reads and corrects before it goes into a client file or a council record, not something that gets forwarded as-is. And put the notetaker on the same one-page vendor list as every other AI tool in the building, because right now, in a lot of offices, it's the one nobody thought to add.