If you thought you addressed legal risk from wiretapping/eavesdropping claims when you adjusted your website digital trackers – think again.  Plaintiffs' attorneys have found their next target.

Many organizations are allowing use of AI to “attend” meetings or calls with employees, customers, consumers, or others.  In health care in particular, ambient AI listening, recording, and transcribing can be an extremely useful tool allowing practitioners to focus on patients and not on the data entry.  The use cases are infinite, but they carry risk.

Recent California Invasion of Privacy Act ("CIPA") lawsuits are showing preliminary success when plaintiffs argue that CIPA applies to chats, calls, and other oral and written communications where an artificial intelligence ("AI") bot or agent provided by a third party is “listening” in on the communication or even participating in the conversation on its own. The risk is not just in California.  Many states have wiretapping/eavesdropping laws similar to California, and these types of claims are sure to proliferate.  Judges have expressed frustration at having to apply old laws not well-suited to emerging technologies, but legislatures have done nothing to update these laws for the Internet era, much less the AI era.

To help mitigate this risk, organizations should consider whether notices should be provided or consent should able obtained.  Consent does not always mean signing a form, but state laws may set different standards for acceptable notice and consent.  Further, organizations should consider their contract terms with AI tool providers.  Organization are more likely to successfully argue that the AI tool is an extension of the organization (and not a third party listener) if the AI tool provider is not allowed to use the data it receives for its own benefit (e.g., improving the AI tool).  

As we continue to move into a world where AI is everywhere and always listening, we cannot forget about how the old applies to the new.