Wiretap laws

How wiretap laws work

Wiretap laws control interception. The US federal law defines “intercept” as “the aural or other acquisition of the contents” of a communication with a device. The Electronic Communications Privacy Act of 1986 (ECPA) added electronic communications. Thus email and chat are in scope.

A wiretap claim asks three questions:

1. Did someone capture the contents?
2. Who gave consent?
3. Was the one who captured it a party, or a third party?

	Federal Wiretap Act	California CIPA §631
Consent	One party	All parties
Civil damages	$10,000, or $100 a day if more	$5,000 for each violation
Criminal penalty	Prison, 5 years maximum	Fine, $2,500 maximum, or jail, 1 year maximum, or both

The Reporters Committee for Freedom of the Press counts “about 11 states” that require all-party consent.

Why wiretap laws matter for AI

An AI tool that records or transcribes a conversation captures its contents. The user of the tool gives consent. The other persons on the call frequently do not know about the tool.

Under CIPA, courts use two tests for the vendor:

• Extension test. The software is a tool of the business that uses it. The vendor is not a third party.
• Capability test. The vendor is a third party if it can use the data “to its benefit, regardless of whether or not it actually did so”.

With the capability test, a vendor that can use calls to make its models better can be a third party. The vendor does not have to use the calls.

Two AI cases under wiretap laws

Case	AI tool	Ruling
Ambriz v. Google, N.D. Cal.	Google Cloud Contact Center AI, a virtual agent for customer calls	10 Feb 2025: motion to dismiss denied. The court used the capability test.
In re Otter.ai Privacy Litigation, N.D. Cal.	Otter Notetaker, an AI meeting notetaker	13 Aug 2026: the ECPA and CIPA §631 claims continue.

In Ambriz, the plaintiffs alleged that they did not consent to Google “transcribing or analyzing the call”. The law firm Goodwin Procter gives a summary of the ruling. It says the court found a plausible capability to use the data to make the AI models of Google better.

In the Otter case, Judge Eumi K. Lee wrote that software that acts “only as an extension of a user or client” is not a third-party interceptor. The plaintiffs alleged that Otter “does not solely act on behalf of users”. On the federal claim, the court accepted the crime-tort argument at this step. The court wrote that “committing a tort and seeking a profit are not mutually exclusive.”

What security and privacy teams can check

These checks come from the statutes and the two rulings. They are not legal advice.

1. Map the consent rule. Find the location of each party to a call or meeting. The rule can change from state to state.
2. Tell all parties. A notice to the meeting host does not tell the guests.
3. Read the data terms of the vendor. Find out if the vendor can use recordings or transcripts to train its models.
4. Limit what the vendor keeps. A contract term such as zero data retention limits what the vendor can use for its own benefit.
5. Check the third-party code on AI chat pages. CIPA §631 also covers a person who “aids, agrees with, employs, or conspires” with an interceptor.

Where courts disagree

The extension test and the capability test give different results for the same AI tool. The National Law Review describes “two distinct branches” of CIPA cases about software service providers.

• Under the extension test, an AI vendor that only serves its customer is not a third party.
• Under the capability test, the same vendor can be a third party because it can use the data.

The sources on this page show no appeals court ruling that settles which test applies to AI tools. Until one does, the result can change from judge to judge.

Questions and answers

Is it legal to use an AI notetaker in a meeting?

Under the US federal Wiretap Act, the consent of one party is usually sufficient. In about 11 US states, all parties must consent. In August 2026, a federal court let wiretap claims against the Otter.ai notetaker continue. The plaintiffs alleged that the vendor used the recordings for its own purposes. The court did not find liability.

What is the difference between the capability test and the extension test?

The two tests show if a software vendor is a third party that listens to a call under CIPA. The extension test treats the software as a tool of the business that uses it. The capability test treats the vendor as a third party if it can use the data for its own benefit. The vendor does not have to use the data.

How much money can a wiretap claim cost?

Under the federal Wiretap Act, a court can award $10,000, or $100 for each day of violation if that is more. Under CIPA, the sum is $5,000 for each violation. The person does not show actual damages.