Why Letting an AI Notetaker Join Interviews and HR Investigations Destroys Your Best Evidence
After the August 2026 Otter.ai ruling, an unvetted transcription bot can trigger wiretap suits, BIPA voiceprint liability, and Cal. Penal Code § 632(d) evidence exclusion.
- Jurisdiction
- All-Party Consent States (CA, PA, FL, IL, MA, WA, MD) + IL BIPA/AIVIA
- Employer threshold
- All employers (1+ participant in an all-party state or Illinois)
- Decision trigger
- Auto-joining AI meeting bots in candidate interviews, ER witness calls, or legal holds
- Review cadence
- Event-triggered on N.D. Cal. CIPA rulings, IL BIPA/AIVIA updates, or state wiretap decisions
Direct operational answer
Admitting an unconsented or vendor-trained AI notetaker into a candidate interview or workplace investigation exposes employers to $5,000-per-violation statutory damages under Cal. Penal Code § 637.2, evidentiary exclusion under § 632(d), and voiceprint claims under 740 ILCS 14/15. On hr.cafe, People teams ban personal bots in HR investigations. They require zero-training enterprise tenants, written BIPA/AIVIA releases, and live all-party consent for recruiting calls.
How Vendor Model Training Turns a "Note-Taker" Into a Third-Party Wiretapper
When an AI transcription vendor retains call audio or transcripts to train its own machine-learning models, federal courts refuse to treat the bot like an employer's passive notepad. Under In re Otter.ai Privacy Litigation (N.D. Cal. Aug. 13, 2026), commercial model training plausibly converts the vendor into an independent third-party eavesdropper under California wiretap law.
Join almost any remote hiring loop or employee-relations intake call and an uninvited tile quietly enters the grid: "Hiring Manager's Notetaker." Recruiters and investigators defend the habit as harmless administrative hygiene because nobody wants to miss a quote while holding eye contact. That convenience argument rests on a shaky legal premise. It assumes a cloud AI vendor occupies the exact same statutory seat as a yellow legal pad on your desk.
On August 13, 2026, Judge Eumi K. Lee rejected that premise at the pleading stage in In re Otter.ai Privacy Litigation (Brewer v. Otter.ai, Inc.), Case No. 5:25-cv-06911-EKL (N.D. Cal.). The court declined to dismiss core claims under the Electronic Communications Privacy Act (ECPA), the California Invasion of Privacy Act (CIPA, Cal. Penal Code § 631(a)), and the Illinois Biometric Information Privacy Act. A vendor that strictly stores encrypted audio for one customer's sole use acts like a passive tape recorder under the party exception. Once that vendor ingests speech or transcripts to train its own machine-learning models, it plausibly acts as an independent third-party wiretapper reading conversations in transit for its own gain.
For multi-state people operations teams, the statutory exposure compounds across every remote dial-in. California CIPA authorizes $5,000 per violation in statutory civil damages under Cal. Penal Code § 637.2(a)(1) even without financial loss. All-party wiretap statutes also protect participants calling from Pennsylvania (18 Pa. C.S. § 5704(4)), Florida (Fla. Stat. § 934.03), Illinois (720 ILCS 5/14-2), Massachusetts (M.G.L. c. 272, § 99), Washington (RCW 9.73.030), and Maryland (Md. Code, Cts. & Jud. Proc. § 10-402).
The sharpest trap for Employee Relations sits inside Cal. Penal Code § 632(d). Aside from prosecuting the illegal recording itself, no evidence obtained by eavesdropping upon or recording a confidential communication without all-party consent is admissible in any judicial, administrative, or other proceeding. Record a misconduct respondent's admission through a manager's unannounced personal AI bot, fire for cause, and watch the trial judge bar your primary investigation record from court.
Speaker Diarization Under Illinois BIPA and Video Interviews Under AIVIA
Clicking past a generic video-platform banner never satisfies biometric statutes when speaker-identification tools map vocal geometry across calls under 740 ILCS 14/15. Illinois employers also face separate pre-interview notice, prior consent, sharing, and 30-day deletion mandates under 820 ILCS 42 whenever AI evaluates applicant video interviews.
A passive pop-up chime on Zoom or Teams does not cure biometric liability. Commercial AI meeting assistants pitch "speaker diarization"—separating Speaker A from Speaker B and matching recurring voices to calendar profiles. Under the Illinois Biometric Information Privacy Act (740 ILCS 14/10 and 14/15), extracting vocal features to identify speakers plausibly captures a regulated voiceprint, one of the exact claims sustained in Otter.ai.
Under 740 ILCS 14/15(a) and 15(b), an employer cannot capture or obtain a voiceprint without first publishing a public retention-and-destruction schedule and securing an informed written release before capture begins. Verbal assent at the start of an interview falls short of BIPA's text. Even after Illinois P.A. 103-0769 (SB 2979, effective Aug. 2, 2024) shifted BIPA recovery from per-scan to per-person calculation, 740 ILCS 14/20 imposes $1,000 per aggrieved person for negligent violations and $5,000 per aggrieved person for reckless or intentional violations, plus attorneys' fees. Run 300 Illinois engineering candidates through an unconsented personal bot and the statutory floor hits six or seven figures fast.
Teams governing AI and work tools in recruiting must also apply the Illinois Artificial Intelligence Video Interview Act (820 ILCS 42/1 et seq.) whenever AI analyzes or evaluates applicant video interviews for positions based in Illinois. Employers must notify applicants before the interview, explain how the AI works and what general characteristics it evaluates, obtain prior applicant consent, limit sharing to evaluators who need access, and delete all copies within 30 days of an applicant's request under 820 ILCS 42/15.
Why Raw AI Transcripts Sabotage HR Investigations and Upjohn Privilege
Even with signed consent forms, automated speech-to-text bots manufacture discoverable impeachment traps in workplace investigations by dropping negations and misattributing crosstalk. Routing counsel-directed interviews through consumer SaaS tools also threatens attorney-client privilege and work-product protection under Upjohn.
Assume IT locks down a zero-training enterprise license and every employee signs a release. Should Employee Relations bring an AI transcription bot into a harassment, retaliation, or whistleblower investigation anyway? Almost never.
Large speech-to-text models optimize for conversational fluency rather than courtroom phonetic precision. Under emotional tension, accents, or overlapping speech, automated transcription regularly drops one unstressed syllable—turning "I didn't cut her territory after her leave" into "I did cut her territory after her leave"—or assigns a witness's heated remark to the HR investigator. When the investigator corrects that draft two days later, plaintiff's counsel demands both the raw machine transcript and the edit history in discovery, framing ordinary cleanup as witness tampering—the exact credibility collapse detailed in our review of conflicted HR investigations and major jury verdicts.
Privilege makes automated bots riskier still. When internal or outside counsel directs a confidential workplace investigation under Upjohn Co. v. United States, 449 U.S. 383 (1981), counsel's structured interview memorandum weaves factual synthesis together with legal analysis and enjoys strong work-product protection under Federal Rule of Civil Procedure 26(b)(3). Raw verbatim bot transcripts contain zero attorney mental impressions, making them easier to compel in litigation, while routing privileged interviews through a consumer SaaS plugin that allows vendor review or model training risks waiving privilege completely.
Call-by-Call Governance Matrix and Pre-Interview Consent Protocol
Enforce explicit meeting-bot tiers at your Zoom, Microsoft Teams, or Google Meet admin boundary instead of policing individual browser extensions by memo. Pair approved recruiting use with prior written releases and block bots completely on ER and privileged calls.
AI Notetaker Permission Tiers Across HR & Recruiting Calls
| Meeting context | Bot policy tier | Required consent & notice | Mandatory IT / vendor controls | Primary legal exposure |
|---|---|---|---|---|
| Structured candidate video interview. | Conditional (enterprise tool only; personal bots blocked). | Signed written pre-interview release (BIPA + AIVIA) plus live verbal opt-out check. | Zero vendor ML training; disable persistent voiceprints; 30-day deletion SLA. | Cal. Penal Code § 631(a); 740 ILCS 14/15; 820 ILCS 42. |
| HR / Employee Relations witness call. | Prohibited (use human notes and signed witness summary). | If ever recorded by exception, obtain written and recorded all-party consent. | Block third-party meeting bots and browser audio capture on all ER hosts. | Cal. Penal Code § 632(d) evidence exclusion; negation errors. |
| Counsel-led Upjohn privileged interview. | Strictly prohibited. | Document solely via counsel's privileged mental-impression memorandum. | Disable cloud recording, auto-captions, and guest bots at meeting host level. | Privilege waiver and FRCP 26 work-product loss. |
| ADA / PWFA accommodation meeting. | Prohibited. | Record interactive-process options inside confidential ADA medical file only. | Block medical notes from syncing into general ATS or shared manager folders. | 42 U.S.C. § 12112(d)(3)(B) medical privacy breach. |
| Internal town hall or training session. | Permitted (enterprise tenant only). | Written handbook policy, calendar notice, and live platform banner. | Contractual zero ML training; disable biometric voice profiles; 90-day purge. | All-party wiretap statutes (CA, PA, FL, IL, MA, WA, MD). |
=== PART A: PRE-INTERVIEW WRITTEN AI NOTETAKER & BIPA/AIVIA RELEASE ===
[Include in ATS Interview Scheduling Form — Signed Prior to Call]
1. Zero-Training Enterprise Scope: With your optional consent, [Company] uses
[Approved Vendor] solely to draft text notes of structured interviews for
the hiring team. Under [Company]'s enterprise contract, your audio and
transcript are NEVER used to train external AI models.
2. Biometric & AI Disclosure (740 ILCS 14/15 & 820 ILCS 42): Persistent
voiceprint indexing is disabled. Any transient vocal data and interview
records are permanently destroyed within 30 calendar days of the call, or
within 30 days of your deletion request to [Email] per 820 ILCS 42/15.
No AI tool scores facial expressions or makes hiring decisions.
3. Penalty-Free Opt-Out: Declining transcription never affects your candidacy.
[ ] I CONSENT to enterprise transcription under the schedule above.
[ ] I DECLINE transcription; please take manual written notes only.
Applicant Signature: ________________________. Date: ______________.
=== PART B: LIVE 15-SECOND CALL-OPENING CHECK (INTERVIEWER) ===
"Before we start, you chose [Consent / Manual Notes] on your scheduling form.
Confirming nobody has a personal AI bot running, and that you remain comfortable
with [our enterprise note tool / manual written notes] for our call today?"
Enforcing Tenant-Level Controls Across People Ops, IT, and Legal
Handbook policies collapse the moment a hiring manager installs a free Chrome recorder or clicks "Admit" on an unknown waiting-room bot. Enforce technical blocks at the video-platform tenant boundary and divide ownership cleanly across three desks.
Ban AI bots from all ER, PIP, and ADA accommodation meetings, train investigators to verify written witness summaries directly with witnesses, and preserve penalty-free candidate opt-outs in the ATS.
Block unapproved bot domains and browser audio-capture extensions via MDM and Zoom, Teams, or Meet admin rules, disable speaker-voiceprint indexing, and honor 30-day candidate deletion requests.
Audit enterprise AI contracts to forbid vendor ML training on customer audio per Otter.ai, publish a BIPA retention schedule under 740 ILCS 14/15(a), and protect Upjohn investigations manually.
Primary statutes, regulations, and enforcement dockets
- California Invasion of Privacy Act (CIPA) — Cal. Penal Code §§ 631, 632(a), 632(d), and 637.2 — Imposes all-party consent rules, $5,000-per-violation statutory civil damages (§ 637.2), and evidentiary inadmissibility for unconsented recordings (§ 632(d)).
- In re Otter.ai Privacy Litigation (Brewer v. Otter.ai, Inc.), Case No. 5:25-cv-06911-EKL (N.D. Cal. Aug. 13, 2026) — Judge Eumi K. Lee order holding ECPA, Cal. Penal Code § 631(a) third-party wiretapping, and Illinois BIPA claims plausible where vendor uses call data to train ML models.
- Illinois Biometric Information Privacy Act (BIPA) — 740 ILCS 14/10, 14/15, and 14/20 (as amended by P.A. 103-0769) — Covers voiceprints; mandates public retention/destruction schedules and prior written release (§ 15(b)), with $1,000/$5,000 statutory damages per aggrieved person (§ 20).
- Illinois Artificial Intelligence Video Interview Act (AIVIA) — 820 ILCS 42/1 et seq. — Requires pre-interview AI notice, explanation, prior applicant consent, strict sharing limits, and deletion within 30 days of applicant request (§ 15).
- Upjohn Co. v. United States, 449 U.S. 383 (1981) — Corporate Attorney-Client Privilege & Work-Product Doctrine — Supreme Court precedent protecting counsel-directed corporate investigation communications and attorney mental impressions from routine adversary discovery.
Practitioner questions on the edge cases
Does Zoom or Microsoft Teams displaying a "This meeting is being transcribed" banner satisfy Illinois BIPA and California CIPA?
Not by itself. Illinois BIPA (740 ILCS 14/15(b)) explicitly requires a published retention schedule plus an informed written release prior to capturing a biometric voiceprint, which a passive screen banner cannot supply. And under In re Otter.ai Privacy Litigation (N.D. Cal. Aug. 13, 2026), undisclosed third-party vendor ML training creates independent wiretap exposure under Cal. Penal Code § 631(a).
What happens if a candidate brings their own personal AI notetaker bot into our job interview?
Block external guest bots automatically via Zoom, Teams, or Google Meet admin controls before the call connects. An applicant's personal consumer bot transmits your interviewers' voices to an unvetted third-party vendor—creating reciprocal BIPA voiceprint, wiretap, and proprietary interview-rubric leakage risks.
Why does Cal. Penal Code § 632(d) make unconsented AI recordings dangerous for employers defending wrongful-termination suits?
Section 632(d) bars any evidence obtained by recording a confidential communication without all-party consent from admission in any judicial, administrative, or other proceeding (save a wiretap prosecution). If HR relies on an unconsented bot recording as its primary record of misconduct, the court can exclude that evidence while still allowing the employee to sue for $5,000 statutory damages under § 637.2.
How quickly must an employer delete an AI-analyzed video interview if an Illinois candidate asks?
Within 30 days. Under Section 15 of the Illinois Artificial Intelligence Video Interview Act (820 ILCS 42/15), upon an applicant's request an employer must delete the applicant's video interviews and instruct any third persons who received copies to delete them within 30 days after receipt of the request.
Get the Thursday edition
One email a week with new practitioner stories and primary-sourced HR playbooks. Free, and one click to unsubscribe.