Courts across the United States are applying wiretapping laws written decades before the internet to AI tools such as chatbots and transcription software, raising legal questions about whether these systems intercept communications without consent. The rulings could reshape how companies deploy AI in customer service, healthcare, and legal workflows.
The central legal debate turns on whether AI vendors act as eavesdroppers or as independent actors when they process user communications. Under laws like the Federal Wiretap Act and state equivalents, intercepting a communication without consent from at least one party can create civil and criminal liability. Plaintiffs argue that AI tools "listen" to conversations the same way a hidden microphone would. Defendants counter that the AI is a party to the exchange, processing input to generate output rather than intercepting it.
Old statutes, new technology
Most wiretapping statutes date to the 1960s and 1980s, long before automated transcription or conversational AI existed. Courts now must decide whether a chatbot that records, analyzes, and stores user messages qualifies as a third-party interceptor. Some early rulings have sided with plaintiffs, finding that AI vendors can face liability when their tools process communications without clear disclosure.
State legislatures are responding. Several states have begun passing laws that require companies to disclose when AI tools are listening to or recording interactions. These laws vary in scope, but they share a common thread: consent must be explicit, not buried in a privacy policy.
What companies should do now
Legal teams should audit every AI tool that touches customer or employee communications. That includes chatbots, meeting transcription services, voice assistants, and call analytics platforms. For each tool, document what data it collects, how it processes that data, and whether consent is obtained at the point of collection.
Consent mechanisms need review. A blanket privacy policy may not satisfy wiretap statutes if a court finds that users did not meaningfully agree to AI processing. Companies should consider in-the-moment disclosures: a clear notice before a call is transcribed, or a chatbot greeting that identifies itself as an AI system.
Privacy policies should also be updated to name specific AI vendors and describe their role in processing communications. Generic language about "third-party service providers" may not hold up if a court asks whether users were informed that an algorithm would analyze their words. For legal professionals, staying current on these developments is part of broader AI for Legal risk management, and paralegals can build relevant skills through an AI Learning Path for Paralegals.
Why this matters for legal professionals
If you advise clients on technology contracts, data privacy, or litigation risk, wiretapping claims against AI vendors should be on your radar now. A single class action alleging unlawful interception can expose a company to statutory damages that dwarf the cost of the AI tool itself. Review your clients' AI deployments before a plaintiff's attorney does. Ask whether consent is explicit, whether disclosures name the AI vendor, and whether the vendor's data retention practices create additional exposure. The law is moving, and early court decisions suggest that "we didn't think the wiretap statute applied" will not be a winning defense.
Your membership also unlocks:
