IN RE: OTTER.AI PRIVACY LITIGATION (2026)

ORDER GRANTING MOTION TO DISMISS IN PART

Re: Dkt. No. 42

This putative class action alleges that Defendant Otter.ai Inc. (“Otter”) surreptitiously eavesdrops and records conversations held over virtual meeting platforms like Zoom and Microsoft Teams without obtaining consent from all meeting participants. Plaintiffs contend that Otter's practices violate numerous privacy laws. Otter moves to dismiss, arguing that Plaintiffs lack Article III standing and fail to state a claim. See Mot. to Dismiss, ECF No. 42. The Court carefully reviewed the parties' briefs and relevant authority and heard argument on the motion. For the reasons set forth below, the Court GRANTS in part and DENIES in part Otter's motion.

I. BACKGROUND

Otter is a technology company that provides transcription services for meetings. Compl. ¶ 2, ECF No. 35. Plaintiffs allege that Otter's AI-powered meeting assistant, the “Otter Notetaker,” joins meetings as a “silent participant,” recording and transcribing conversations in real-time without obtaining the consent of all participants. Id. ¶ 6. According to Plaintiffs, these conversations included sensitive medical, financial, and professional discussions that participants reasonably expected would remain private. Id. ¶¶ 143, 155, 167, 181, 194, 209, 305, 377. Plaintiffs further allege that Otter retains the contents of these conversations, voiceprints, and other personal information for its own commercial use, including to train its automatic speech recognition and machine-learning models. Id. ¶¶ 69-71.

Plaintiffs are seven individuals from California, Illinois, and Washington state who participated in virtual meetings where the Otter Notetaker was allegedly used without their consent to record, transcribe, and store the contents of their communications. Justin Brewer is a California resident who participated in a Zoom meeting that involved his “sensitive” information. Id. ¶¶ 135, 143. Chaka Theus is a California resident who used Zoom to communicate with a medical professional regarding “deeply personal and private medical information.” Id. ¶¶ 146-147. Emily Ryan is a California resident who used Microsoft Teams to “communicate with her work colleague(s) regarding sensitive discussions.” Id. ¶ 159. Jasper Walker is an Illinois resident who used Zoom to communicate with a financial professional regarding “deeply personal and private financial information.” Id. ¶ 171. Michael Walker is an Illinois resident who also used Zoom to communicate with a financial professional regarding “deeply personal and private financial information.” Id. ¶ 184. Nadine Winston is an Illinois resident who used Zoom, Microsoft Teams, and other video conferencing platforms for sensitive business discussions, strategic planning sessions, confidential project meetings, performance reviews, and discussions with clients. Id. ¶ 197. The Illinois Plaintiffs allege that, during their virtual meetings, Otter captured their voiceprints and created transcripts of the meetings. Id. ¶¶ 178, 191, 206. Finally, Riley Dolan is a Washington resident who used Zoom to communicate regarding certain professional opportunities, which Otter recorded, transcribed, and stored without his knowledge, permission, or consent. Id. ¶ 213.

Plaintiffs assert violations of the Electronic Communications Privacy Act (“ECPA”), the Computer Fraud and Abuse Act (“CFAA”), the California Invasion of Privacy Act (“CIPA”), the California Comprehensive Computer Data and Access Fraud Act (“CDAFA”), the California Constitution, California's Unfair Competition Law (“UCL”), the Illinois Biometric Information Privacy Act (“BIPA”), the Washington Privacy Act, and related common-law privacy claims. Otter moves to dismiss the complaint in its entirety for lack of Article III standing and for failure to state a claim.

II. LEGAL STANDARDS

A. Rule 12(b)(1)

To establish Article III standing, “a plaintiff must show (i) that he suffered an injury in fact that is concrete, particularized, and actual or imminent; (ii) that the injury was likely caused by the defendant; and (iii) that the injury would likely be redressed by judicial relief.” TransUnion LLC v. Ramirez, 594 U.S. 413, 423 (2021). A “concrete” injury must be “real” and not “abstract,” but not necessarily “tangible.” Spokeo, Inc. v. Robins, 578 U.S. 330, 340 (2016). The Supreme Court has identified “history as the touchstone for concreteness.” Popa v. Microsoft Corp., 153 F.4th 784, 789 (9th Cir. 2025). Specifically, “courts should assess whether the alleged injury to the plaintiff has a ‘close relationship’ to a harm ‘traditionally’ recognized as providing a basis for a lawsuit in American courts.” Id. (quoting TransUnion LLC, 594 U.S. at 424). A plaintiff must “demonstrate more than just a statutory violation” to plausibly allege a concrete injury. Id. at 793.

B. Rule 12(b)(6)

Under Federal Rule of Civil Procedure 12(b)(6), a court must dismiss a complaint if it fails to state a claim upon which relief can be granted. To avoid dismissal, plaintiffs must allege “enough facts to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). A claim is facially plausible when the pleaded facts allow the court “to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). The court generally “accept[s] factual allegations in the complaint as true and construe[s] the pleadings in the light most favorable to the nonmoving party.” Manzarek v. St. Paul Fire & Marine Ins. Co., 519 F.3d 1025, 1031 (9th Cir. 2008). However, the court need not “assume the truth of legal conclusions merely because they are cast in the form of factual allegations.” Fayer v. Vaughn, 649 F.3d 1061, 1064 (9th Cir. 2011) (per curiam) (quoting W. Mining Council v. Watt, 643 F.2d 618, 624 (9th Cir. 1981)). If the court finds that dismissal pursuant to Rule 12(b)(6) is warranted, the “court should grant leave to amend even if no request to amend the pleading was made, unless it determines that the pleading could not possibly be cured by the allegation of other facts.” Lopez v. Smith, 203 F.3d 1122, 1127 (9th Cir. 2000) (en banc) (quoting Doe v. United States, 58 F.3d 494, 497 (9th Cir. 1995)).

III. DISCUSSION

The Court first addresses whether Plaintiffs plausibly allege Article III standing before turning to whether Plaintiffs have plausibly stated their various privacy claims.

A. Article III Standing 1

Otter argues that Plaintiffs fail to allege a concrete injury as required for Article III standing. Mot. at 5. To determine whether a plaintiff has alleged a concrete injury in a privacy case, courts ask whether the alleged harm bears a “close relationship” to a harm traditionally recognized as providing a basis for suit in American courts. Popa, 153 F.4th at 789. Although a statutory violation alone does not establish standing, the unauthorized collection or interception of private information may constitute a concrete injury if it closely resembles a traditionally recognized privacy tort. See Spokeo, 578 U.S. at 340-42. Having reviewed the complaint holistically, the Court concludes that Plaintiffs have met their burden at this stage. The harm alleged here is the unauthorized interception, recording, transcription, and retention of Plaintiffs' private conversations without their consent. Compl. ¶¶ 4-9. Plaintiffs allege that they had a reasonable expectation of privacy in their conversations, and that Otter recorded and transcribed their private conversations without consent. Id. ¶ 65. This type of injury involves the unauthorized collection, use, and loss of control of highly sensitive personal information, which closely resembles the common-law privacy tort of intrusion upon seclusion. See Campbell v. Facebook, Inc., 951 F.3d 1106, 1117 (9th Cir. 2020). Accordingly, Plaintiffs have plausibly alleged a concrete injury.

The injury that Plaintiffs allege in this case is distinguishable from the harm that was found insufficient in Popa, on which Otter principally relies. In Popa, the defendant employed session-replay technology to record a user's interactions with a pet supply website, including information such as computer mouse movements, clicks, keystrokes, and pages visited. 153 F.4th at 786. The Ninth Circuit concluded that the alleged conduct was analogous to “a store clerk's observing shoppers” and held that the plaintiff failed to identify the collection of “embarrassing, invasive, or otherwise private information” to establish a traditionally recognized privacy harm. Id. at 791. By contrast, Plaintiffs here allege the interception of the contents of their private communications that were of a “sensitive nature,” which Plaintiffs expected to remain confidential. Compl. ¶¶ 143, 155, 167, 181, 194, 209, 305, 377. Plaintiffs further allege details indicating that they participated in private conversations involving sensitive topics – for example, medical, financial, and professional discussions. This alleged intrusion is therefore materially more invasive than the monitoring of browsing activity in Popa, both in terms of the sensitivity of the information at issue and the nature of the intrusion (i.e., eavesdropping on entire conversations).

The injury that Plaintiffs allege in this case is more analogous to the concrete injury alleged in Campbell. In Campbell, the Ninth Circuit held that plaintiffs adequately alleged a concrete injury where the defendant intercepted and used the contents of users' private Facebook messages. 951 F.3d at 1119. The Ninth Circuit explained that the “intrusion itself makes the defendant subject to liability” because the common-law privacy tort of intrusion upon seclusion does not require additional consequences to be actionable. Id. at 1117. Here, Plaintiffs similarly allege that Otter intercepted, recorded, and transcribed the contents of their private conversations without consent.

Otter argues that Plaintiffs fail to allege specific details about the information they shared in the conversations that were allegedly intercepted. This argument ignores allegations in the complaint and conflates the requirements for Article III standing with the merits of the underlying privacy claims. At the pleading stage, Plaintiffs must “clearly ․ allege facts” demonstrating each element of Article III standing. Spokeo, 578 U.S. at 338. Plaintiffs have done so by alleging a theory of harm that sounds in the well-recognized common law tort of intrusion upon seclusion, and by pleading examples of sensitive information – such as medical information – that Otter allegedly intercepted. The adequacy of Plaintiffs' factual allegations regarding the degree of the intrusion and sensitivity of the information goes to the merits of Plaintiffs' claims, not the threshold question of Article III standing. See Maya v. Centex Corp., 658 F3d 1060, 1068 (9th Cir. 2011) (“The threshold question of whether plaintiff has standing (and the court has jurisdiction) is distinct from the merits of his claim. Rather, the jurisdictional question of standing precedes, and does not require, analysis of the merits.” (citation modified)).

Accordingly, the motion to dismiss Plaintiffs' claims for lack of standing is denied.

B. Illinois Biometric Information Privacy Act (Counts 15 and 16)

The Illinois Biometric Information Privacy Act (“BIPA”), 740 ILCS 14/1 et seq., provides a private right of action for certain statutory violations relating to the collection and retention of biometric identifiers and biometric information. A biometric identifier is “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.” 740 ILCS 14/10. Biometric information is “any information, regardless of how it is captured, converted, stored, or shared, based on an individual's biometric identifier used to identify an individual.” Id. Two BIPA provisions are asserted here. Section 15(a) requires private entities that are “in possession of biometric identifiers or biometric information” to “establish a retention schedule and guidelines for permanently destroying” such identifiers and information, and section 15(b) prohibits collection of biometric identifiers without a written release. Specifically, section 15(b) provides:

No private entity may collect, capture, purchase, receive through trade, or otherwise obtain a person's or a customer's biometric identifier or biometric information, unless it first: (1) informs the subject or the subject's legally authorized representative in writing that a biometric identifier or biometric information is being collected or stored; (2) informs the subject or the subject's legally authorized representative in writing of the specific purpose and length of term for which a biometric identifier or biometric information is being collected, stored, and used; and (3) receives a written release executed by the subject of the biometric identifier or biometric information or the subject's legally authorized representative.

740 ILCS 14/15.

Plaintiffs allege that Otter violated both provisions. Count 15 alleges that Otter violated section 15(a) by failing to develop and publicly disclose a written retention schedule and destruction guidelines for biometric information. Count 16 alleges that Otter violated section 15(b) by collecting Plaintiffs' biometric identifiers – their voiceprints – without first providing the required disclosures and obtaining written consent. Otter moves to dismiss these claims for lack of Article III standing and for failure to state a claim.

1. Article III Standing

Otter argues that Plaintiffs lack Article III standing to pursue their BIPA claims. With respect to the section 15(b) claim, Otter argues that Plaintiffs do not allege “that Otter actually received their biometric information or that it somehow identified them.” Mot. at 6. With respect to the section 15(a) claim, Otter argues that its alleged failure to publish a retention schedule and guidelines for destroying biometric information is a violation of a duty owed to the public generally, not a particularized injury to Plaintiffs. Neither argument is persuasive.

As discussed above, to establish Article III standing, Plaintiffs must allege a concrete injury. See supra Section III.A. When the plaintiff alleges injury to a statutory right, courts ask whether the statutory provision was established to protect the plaintiff's concrete interests as opposed to purely procedural rights, and whether the procedural violations “actually harm, or present a material risk of harm to, such interests.” Patel v. Facebook, Inc., 932 F.3d 1264, 1270-71 (9th Cir. 2019) (citation modified). Here, the answer to both questions is “yes.” The Ninth Circuit has held that the “ ‘the statutory provisions at issue’ in BIPA were established to protect an individual's ‘concrete interests’ in privacy, not merely procedural rights.” Id. at 1274. Moreover, because the privacy right protected by BIPA is “the right not to be subject to the collection and use of such biometric data, [a defendant's] alleged violation of these statutory requirements would necessarily violate the plaintiffs' substantive privacy interests.” Id. at 1274. Therefore, if Plaintiffs plausibly allege a BIPA violation with respect to their biometric identifiers or biometric information, Plaintiffs have plausibly alleged a concrete injury.

Plaintiffs plausibly allege that Otter violated section 15(b) by capturing their voiceprints during virtual meetings, Compl. ¶¶ 178, 191, 206, and voiceprints are biometric identifiers under BIPA, 740 ILCS 14/10. Otter quibbles that Plaintiffs fail to allege that they “said anything” during the meetings, precluding an inference that their voiceprints were captured. Reply at 10, 19. But the Illinois Plaintiffs allege that they used Zoom or Teams “to communicate” with others, and that during these conversations, “Otter captured [each Plaintiff's] voiceprint.” Compl. ¶¶ 171, 178, 184, 191, 197, 206. These allegations are sufficient, and Otter cites no case law to the contrary. Otter also argues that Plaintiffs fail to allege that the voiceprints are capable of identifying Plaintiffs. Mot. at 30. This argument fails too. Plaintiffs directly allege that Otter “stores each voiceprint so that, in future meetings, Otter can identify the same individuals and transcribe their conversations.” Compl. ¶ 11. Plaintiffs allege details to explain how Otter associates each voiceprint with a specific individual. Depending on the version of the Otter Notetaker being used, Otter “automatically tag[s] speakers in real-time based on the participant names of Zoom meetings” or it relies on data that its clients manually input. Compl. ¶ 118. Through the tagging process, Otter creates a “speaker identification profile” associated with each individual's name and speaker data so that Otter “will be able to recognize that speaker in future conversations.” Compl. ¶ 119. Accepting these allegations as true, Plaintiffs plausibly allege that the voiceprints Otter collected can be and are used to identify Plaintiffs individually.

With respect to the section 15(a) claim, Otter incorrectly argues that “Plaintiffs bringing these claims lack standing.” Mot. at 6. In doing so, Otter reads the Ninth Circuit's holding in Zellmer v. Meta Platforms, Inc., 104 F.4th 1117 (9th Cir. 2024), too broadly. In Zellmer, the plaintiff alleged that Facebook violated section 15(b) by capturing a “face signature” from user-uploaded photographs. Id. at 1120. However, the section 15(b) claim failed because a face signature is not a biometric identifier or biometric information; instead, it is “a string of numbers” that cannot be used “to derive information about a person.” Id. at 1120-21. The plaintiff conceded that “if there is no section 15(b) violation, he lacked standing to bring a section 15(a) claim.” Id. at 1127 (citation modified). The Ninth Circuit did not hold that a plaintiff could never allege a concrete and particularized injury based on a violation of section 15(a). Instead, the Ninth Circuit reaffirmed its holding in Patel that if a plaintiff plausibly alleges “a violation of section 15(b), they could show direct and discrete harm from the alleged section 15(a) violation” as well. Id. (citation modified). Here, Plaintiffs plausibly allege a section 15(b) violation, and in turn, they plausibly allege a concrete and particularized harm flowing from Otter's alleged indefinite retention of their biometric identifiers. Compl. ¶¶ 120, 125, 366.

Because Plaintiffs plausibly allege that they have suffered an injury – the collection of their voiceprints due to Otter's violation of section 15(b) – per Zellmer, they likewise have standing to pursue the violation of section 15(a).

Accordingly, the motion to dismiss Plaintiffs' BIPA claims for lack of standing is denied.

2. Failure to State a Claim

Otter also moves to dismiss the BIPA claims because BIPA does not apply extraterritorially. Mot. at 29-30. A plaintiff asserting a BIPA claim must plausibly allege the BIPA violation “occur[ed] primarily and substantially in Illinois.” Avery v. State Farm Mut. Auto. Ins. Co., 835 N.E.2d 801, 854 (2005). There is “no single formula or bright-line test for determining whether a transaction occurs within [Illinois].” Id. Rather, “each case must be decided on its own facts.” Id.

Here, Plaintiffs allege that they are Illinois residents, that they participated in meetings while they were physically located in Illinois, and that Otter collected their data during those meetings. Compl. ¶¶ 170, 183, 196, 366, 371. These allegations permit a reasonable inference that the alleged BIPA violations occurred “primarily and substantially in Illinois.” Avery, 835 N.E.2d at 854. Although Plaintiffs do not allege where their biometric data was created, processed, or stored, courts have recognized that the absence of such details is “not necessarily” dispositive at the pleading stage, and “more information is needed to reach any determination.” Vance v. Google LLC, No. 20-cv-04696-BLF, 2024 WL 5011611, at *3 (N.D. Cal. Dec. 5, 2024) (citation modified); see also Patel, 932 F.3d at 1276 (“[I]t is reasonable to infer that the [Illinois] General Assembly contemplated BIPA's application to individuals who are located in Illinois, even if some relevant activities occur outside the state.”). Ultimately, Otter raises factual questions that cannot be resolved at the pleading stage.

Otter's other argument for dismissal is that it does not collect biometric identifiers or information. Mot. at 30-31. However, the Court already rejected this argument above as part of the Article III standing discussion. Accordingly, the motion to dismiss Plaintiffs' BIPA claims for failure to state a claim is denied.

C. Failure to State a Claim

Otter also moves to dismiss the remainder of the complaint for failure to state a claim. Because the legal requirements of each claim differ, the Court considers the sufficiency of Plaintiffs' allegations claim-by-claim.

1. Electronic Communications Privacy Act (Count 1)

The Electronic Communications Privacy Act (“ECPA”) prohibits, among other conduct, the intentional interception of “any wire, oral, or electronic communication.” 18 U.S.C. § 2511(1). Section 2520(a) provides a private right of action to any person whose “wire, oral, or electronic communication” is intercepted in violation of Section 2511. The parties do not dispute that the Plaintiffs' communications through Google Meet, Zoom, and Microsoft Teams constitute “electronic communications” within the meaning of 18 U.S.C. § 2510(12). Rather, the parties dispute whether Otter contemporaneously intercepted those communications, and if so, whether the party exception shields Otter from liability. See id. § 2511(2)(d). The Court addresses each issue in turn.

First, an actionable interception under Section 2511 requires an “acquisition contemporaneous with transmission.” Konop v. Hawaiian Airlines, Inc., 302 F.3d 868, 878 (9th Cir. 2002). Here, Plaintiffs plausibly allege a contemporaneous acquisition of their communications because Otter allegedly records and processes meetings “in real time” as they occur. Compl. ¶¶ 8, 40-41, 50, 139, 151, 163, 175, 188, 202, 217. Plaintiffs further allege that “Otter's interceptions of Plaintiffs' and Class members' oral communications was done contemporaneously while those communications transpired.” Id. ¶ 246. Accepting these allegations as true, the Court finds that Plaintiffs plausibly allege an acquisition contemporaneous with transmission sufficient to state a claim under Section 2511. See, e.g., Krzyzek v. OpenX Techs., Inc., 817 F. Supp. 3d 857, 868 (N.D. Cal. 2026) (finding allegations of “real-time” interception sufficient).

Second, Otter argues that the ECPA claim is barred because Otter was a party to Plaintiffs' virtual meetings. Mot. at 8. Under the party exception, it is not a violation of the ECPA if communications are intercepted by “a party to the communication or where one of the parties to the communication has given prior consent to such interception.” 18 U.S.C. § 2511(2)(d); see In re Yahoo Mail Litig., 7 F. Supp. 3d 1016, 1026 (N.D. Cal. 2014) (“The consent of one party is a complete defense to [an ECPA] claim.”). However, the party exception does not apply if the communication is intercepted for a “criminal or tortious” purpose. 18 U.S.C. § 2511(2)(d).

Here, Plaintiffs argue that even if Otter could be considered a “party” to their conversations, the party exception does not apply because a “primary motivation or a determining factor” in Otter's conduct “has been to injure plaintiffs tortiously.” Brown v. Google LLC, 525 F. Supp. 3d 1049, 1067 (N.D. Cal. 2021) (citation modified). In particular, Plaintiffs allege that Otter tortiously used their conversational data without their knowledge or consent to train its “machine learning systems for its own pecuniary gain.” Compl. ¶ 255. Otter responds that its alleged interception was undertaken only for “commercial purposes.” Mot. at 8. However, “committing a tort and seeking a profit are not mutually exclusive.” Riganian v. Liveramp Holdings, Inc., 791 F. Supp. 3d 1075, 1090 (N.D. Cal. 2025).

Accordingly, the motion to dismiss Plaintiffs' ECPA claim is denied.

2. Computer Fraud and Abuse Act (Count 2)

Plaintiffs allege that Otter violated two provisions of the CFAA: 18 U.S.C. § 1030(a)(2)(c) and § 1030(a)(4). The Court addresses each provision separately.

i. 18 U.S.C. § 1030(a)(2)(c)

Section 1030(a)(2)(c) prohibits “intentionally access[ing] a computer without authorization or exceed[ing] authorized access, and thereby obtain[ing] information from any protected computer.” Otter argues that Plaintiffs fail to allege that Otter accessed their computers. Mot. at 10. The Court agrees. For purposes of the CFAA, “access” requires “the act of entering a computer ‘system itself’ or a particular ‘part of a computer system,’ such as files, folders, or databases.” Van Buren v. United States, 593 U.S. 374, 388 (2021). Here, Plaintiffs allege that Otter accesses their “computers, including but not limited to, desktop computers, laptop computers, and mobile devices.” Compl. ¶ 267. This allegation is conclusory. Plaintiffs do not allege facts explaining how Otter Notetaker supposedly accesses any part of their computers, such as “files, folders, or databases.” Van Buren, 593 U.S. at 388. In their opposition, Plaintiffs argue that when the Otter Notetaker joins a meeting, “it does not just passively observe, it interacts directly with components of each participant's computer system.” Opp. at 13. But the allegations in the complaint do not support this assertion. See Compl. ¶¶ 90-94.

Accordingly, the motion to dismiss Plaintiffs' CFAA Section 1030(a)(2)(c) claim is granted.²

ii. 18 U.S.C. § 1030(a)(4)

Section 1030(a)(4) prohibits a person from accessing a protected computer without authorization “knowingly and with intent to defraud.” The private right of action for this claim requires Plaintiffs to allege a loss of “at least $5,000 in value.” 18 U.S.C. § 1030(g). Section 1030(e)(11) defines loss as “any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense.” The term also includes “any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service.” Id.

Otter argues that Plaintiffs fail to plausibly allege losses that are cognizable under the CFAA, such as “cost[s] of responding to an offense” or “damages incurred because of interruption of service.” 18 U.S.C. § 1030(e)(11). The Court agrees. The Ninth Circuit has emphasized that the CFAA reflects a “narrow conception” of “loss” and that “any theory of loss must conform to the limited parameters of the CFAA's definition.” Andrews v. Sirius XM Radio Inc., 932 F.3d 1253, 1262-63 (9th Cir. 2019). In Andrews, the plaintiff alleged that the defendant deprived him of the value of his personal information by obtaining it without compensation. The Ninth Circuit held that such allegations did not constitute a cognizable CFAA loss because the alleged injury did not fall within the enumerated categories in § 1030(e)(11). Like the plaintiff in Andrews, Plaintiffs here seek to recover for the alleged loss of value or control over their personal information, which falls outside the CFAA's narrow definition of “loss.” Plaintiffs also allege that they “felt frustrated, embarrassed, and stressed to learn that [their] conversation was recorded without [their] consent, and [their] information, voice, and conversation content remains in Otter's possession indefinitely for Otter's commercial use and training of its machine/technology.” Compl. ¶¶ 144, 156, 168, 210, 222. However, these allegations describe emotional harm and the alleged loss of value of Plaintiffs' personal information, neither of which constitutes a cognizable loss under 18 U.S.C. § 1030(e)(11).

Accordingly, the motion to dismiss Plaintiffs' CFAA Section 1030(a)(4) claim is granted.

3. Intrusion Upon Seclusion (Count 3) & Invasion of Privacy Under California Constitution (Count 13)

i. California Law (Plaintiffs Brewer, Ryan, and Theus)

The California Plaintiffs bring separate claims for the common law tort of intrusion upon seclusion and invasion of privacy in violation of the California Constitution. Because the common law and California constitutional sources of privacy protection are closely related, courts often analyze these claims together. See Hernandez v. Hillsides, Inc., 47 Cal. 4th 272, 286-88 (2009).

To state a claim for intrusion upon seclusion, a plaintiff must allege that (1) a defendant “intentionally intrude[d] into a place, conversation, or matter as to which the plaintiff has a reasonable expectation of privacy,” and (2) the intrusion “occur[red] in a manner highly offensive to a reasonable person.” Id. at 286. Otter contends that Plaintiffs fail to plausibly allege either element. As explained below, the Court agrees that Plaintiffs Brewer and Ryan fail to plausibly allege the first element – that they had a reasonable expectation of privacy. By contrast, Plaintiff Theus plausibly alleges both elements.

The first element of a claim for intrusion upon seclusion requires the plaintiff to allege an “objectively reasonable expectation of seclusion or solitude in the place, conversation or data source.” Shulman v. Group W. Prods., Inc., 18 Cal. 4th 200, 232 (1998). In determining whether a plaintiff has a reasonable expectation of privacy, courts consider “the amount of data collected, the sensitivity of the data collected, and the nature of the data collection.” Brown, 525 F. Supp. 3d at 1076-77.

Here, Plaintiff Brewer alleges that Otter intercepted his “private conversational data,” Compl. ¶ 143, and Plaintiff Ryan alleges that Otter intercepted “sensitive” workplace discussions. Id. ¶ 159. Neither Plaintiff provides any additional information about the content or nature of the allegedly intercepted conversations. Standing alone, these allegations are insufficient. See In re Google Assistant Privacy Litig., 457 F. Supp. 3d 797, 830 (N.D. Cal. 2020) (Plaintiffs who had “not alleged sufficient information about the conversations that were allegedly intercepted” failed to plausibly allege a reasonable expectation of privacy.). Conclusory allegations that a conversation was “private” and “sensitive” provide no factual content regarding the “the amount of data collected, the sensitivity of the data collected, and the nature of the data collection.” Brown, 525 F. Supp. 3d at 1076-77. Therefore, Plaintiffs Brewer and Ryan fail to plausibly allege a reasonable expectation of privacy.

Plaintiff Theus, however, alleges that Otter intercepted communications with a medical provider involving “deeply personal and private medical information.” Compl. ¶ 147. This allegation is materially different. In In re Meta Pixel Healthcare Litig., the court held that plaintiffs plausibly alleged a reasonable expectation of privacy in communications with healthcare providers concerning sensitive medical information. 647 F. Supp. 3d 778, 799-800 (N.D. Cal. 2022). Likewise, Plaintiff Theus alleges interception of confidential medical communications, which plausibly establishes a reasonable expectation of privacy based on the sensitive nature of the information that Otter allegedly intercepted.

Plaintiff Theus also plausibly alleges the second element – that Otter's alleged intrusion was highly offensive.³ Whether an intrusion is “highly offensive to a reasonable person” requires a holistic consideration of “the likelihood of serious harm to the victim, the degree and setting of the intrusion, the intruder's motives and objectives, and whether countervailing interests or social norms render the intrusion inoffensive.” In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 606 (9th Cir. 2020). “While analysis of a reasonable expectation of privacy primarily focuses on the nature of the intrusion, the highly offensive analysis focuses on the degree to which the intrusion is unacceptable as a matter of public policy.” Id. Here, Theus alleges that Otter secretly intercepted, recorded, retained, and used the contents of his private conversations without consent for its own commercial purposes. Compl. ¶¶ 277-279. Theus plausibly alleges that the interception and use of his sensitive medical information for Otter's private financial gain is unacceptable as a matter of public policy. See In re Meta Pixel Healthcare Litig., 647 F. Supp. 3d at 800-01.

Accordingly, the motion to dismiss is granted with respect to Brewer's and Ryan's claims, but denied with respect to Theus's claims.

ii. Washington Law (Plaintiff Dolan)

Plaintiff Dolan asserts an intrusion upon seclusion claim under Washington law. Under Washington law, a plaintiff must establish:

1. An intentional intrusion, physically or otherwise, upon the solitude or seclusion of plaintiff, or his private affairs;

2. With respect to the matter or affair which plaintiff claims was invaded, that plaintiff had a legitimate and reasonable expectation of privacy;

3. The intrusion would be highly offensive to a reasonable person; and

4. That the defendant's conduct was a proximate cause of damage to plaintiff.

Gray v. Amazon.com, Inc., 653 F. Supp. 3d 847, 860 (W.D. Wash. 2023).

Otter argues that Plaintiff Dolan fails to plausibly allege a reasonable expectation of privacy. This argument has merit. Plaintiff Dolan alleges that he “used Zoom to communicate regarding certain professional opportunities, which Otter recorded, transcribed, and stored without his knowledge, permission or consent.” Compl. ¶ 213. Although Plaintiff argues that the “subject matter of the communication – professional opportunities – is one in which there is a reasonable expectation of privacy,” Opp. at 34, the complaint describes only the general topic of the conversation without alleging its substance or explaining why the conversation was confidential. These generalized allegations are insufficient to plausibly establish that Plaintiff Dolan had a reasonable expectation of privacy.

Accordingly, the motion to dismiss Plaintiff Dolan's intrusion upon seclusion claim is granted.

4. California Invasion of Privacy Act (Count 8)

The California Invasion of Privacy Act (“CIPA”) prohibits the unauthorized interception and recording of communications. Plaintiffs allege violations of California Penal Code §§ 631 and 632 as independent bases to support their CIPA claim. The Court addresses each provision below.

i. Section 631

California Penal Code § 631(a) provides a cause of action against a defendant that “willfully and without the consent of all parties to the communication ․ reads, or attempts to read, or to learn the contents or meaning of any ․ communication while the same is in transit or passing over any wire, line, or cable.” Otter argues that section 631 does not apply because the Otter Notetaker is a party to the communications at issue. Under section 631(a), “if a person secretly listens to another's conversation, the person is liable.” Graham v. Noom, Inc., 533 F. Supp. 3d 823, 831 (N.D. Cal. 2021). “By contrast, a party to a communication can record it (and is not eavesdropping when it does).” Id.

Otter argues that the Otter Notetaker joins meetings as an invited participant and functions as the meeting host's recording tool. Opp. at 3. It is true that software providers acting only as an extension of a user or client are not considered third-party interceptors. Graham, 533 F. Supp. 3d at 832. In Graham, for example, the court held that a software vendor was simply “an extension of Noom” that provided “a tool ․ that allows Noom to record and analyze its own data,” and therefore was not independently intercepting communications. Id. However, Plaintiffs allege that Otter does not solely act on behalf of users who choose to deploy the Otter Notetaker. Instead, Plaintiffs allege that Otter also retains their conversational data and uses it to improve its machine-learning models and services. Compl. ¶ 69. Software providers may qualify as third-party interceptors under these circumstances. See Yockey v. Salesforce, Inc., 745 F. Supp. 3d 945, 952 (N.D. Cal. 2024). Because Plaintiffs plausibly allege that Otter independently collects, retains, and uses communications for its own commercial purposes, they have sufficiently alleged that Otter is a third-party eavesdropper under section 631.

ii. Section 632

California Penal Code § 632 prohibits recording or eavesdropping on a confidential communication without the consent of all parties. A communication is confidential if it is carried on under circumstances that reasonably indicate that a party desires it to be confined to the participants. Cal. Penal Code § 632(c). Otter argues that Plaintiffs fail to allege confidential communications because Otter was a party to the communications and because Plaintiffs fail to allege facts showing that the communications were confidential. As discussed with respect to the section 631(a) claim, Plaintiffs have plausibly alleged that Otter is a third-party eavesdropper. The remaining question is whether Plaintiffs plausibly allege confidential communications.

Here, Plaintiff Theus plausibly alleges a confidential communication because he alleges that he communicated “with a medical professional, and thus, the call involved deeply personal and private medical information.” Compl. ¶ 147. By contrast, Plaintiffs Brewer and Ryan allege only that their conversations were “private” or “sensitive” without providing additional factual detail regarding the substance of those communications. Id. ¶¶ 143, 159. As previously discussed in relation to the intrusion upon seclusion claim, these conclusory allegations are insufficient.

***

In sum, because Plaintiffs plausibly allege a violation of section 631(a), Count 8 survives regardless of whether Plaintiffs alternatively state a claim under section 632. Although Plaintiffs Brewer and Ryan fail to plausibly allege a violation of section 632, all three California Plaintiffs have adequately alleged a violation of section 631. Accordingly, the motion to dismiss Plaintiffs' CIPA claim is denied.

5. Comprehensive Computer Data and Access Fraud Act (Count 11)

CDAFA imposes liability on whoever “[k]nowingly accesses and without permission takes, copies, or makes use of any data from a computer ․, or takes or copies any supporting documentation, whether existing or residing internal or external to a computer.” Cal. Penal Code § 502(c). Otter argues that Plaintiffs fail to allege that they suffered injury or damage within the meaning of the CDAFA as a result of Otter's alleged access to their data. The Court agrees. Plaintiffs allege that Otter benefitted from using their conversations to improve its products and machine-learning technology. But this alleged commercial benefit does not establish that Plaintiffs suffered a cognizable loss under the CDAFA. Cottle v. Plaid Inc., 536 F. Supp. 3d 461, 488 (N.D. Cal. 2021) (rejecting that “the loss of the right to control their own data, the loss of value of their data, and the loss of the right to protection of that data, [constitute] ‘damage or loss’ within the meaning of the CDAFA”).

Accordingly, the motion to dismiss Plaintiffs' CDAFA claim is granted.

6. Unjust Enrichment (Count 5)

Otter also seeks dismissal of Plaintiffs' claim for unjust enrichment. “In California, there is no cause of action for unjust enrichment. Rather, unjust enrichment is a basis for obtaining restitution based on quasi-contract or imposition of a constructive trust.” Myers-Armstrong v. Actavis Totowa, LLC, 382 F. App'x 545, 548 (9th Cir. 2010) (citation modified). “When a plaintiff alleges unjust enrichment, a court may ‘construe the cause of action as a quasi-contract claim seeking restitution.’ ” Astiana v. Hain Celestial Grp., Inc., 783 F.3d 753, 762 (9th Cir. 2015) (quoting Rutherford Holdings, LLC v. Plaza Del Rey, 223 Cal. App. 4th 221, 231 (2013)); see also Hartford Cas. Ins. Co. v. J.R. Mktg., L.L.C., 61 Cal. 4th 988, 998 (2015) (“Where the doctrine [of unjust enrichment] applies, the law implies a restitutionary obligation, even if no contract between the parties itself expresses or implies such a duty.”). To state a claim for unjust enrichment, a plaintiff must allege that the defendant “received and unjustly retained a benefit at [plaintiff's] expense.” ESG Cap. Partners, LP v. Stratos, 828 F.3d 1023, 1038 (9th Cir. 2016).

First, Otter argues that Plaintiffs fail to allege that they conferred a specific, measurable economic benefit on Otter, or that the retention of such a benefit would be unjust. Mot. at 17. The Court disagrees. Plaintiffs allege that “Otter knowingly obtained significant revenue from its unlawful collection and use of Plaintiffs' ․ data by using and processing it for commercial gain, including improving its products.” Compl. ¶ 274. Specifically, Otter allegedly “exploits illegally obtained conversations for ․ training its proprietary software, improving its services, contracting with service vendors, and more.” Id. ¶ 275. Otter also allegedly enriched itself “by saving the costs it reasonably should have spent by obtaining users consent to record and use their private communications.” Id. ¶ 276. Finally, Plaintiffs allege that it would be unjust for Otter to retain these benefits at the expense of the privacy rights of Plaintiffs and putative class members. Id. ¶¶ 277-78. These allegations plausibly state a claim for unjust enrichment.

Second, Otter argues that Plaintiffs have an adequate remedy at law, as evidenced by the fact that Plaintiffs also seek damages. See Compl. ¶¶ 257, 271, 307, 314, 323, 330, 341, 367, 372, 385; see also Sonner v. Premier Nutrition Corp., 971 F.3d 834, 844 (9th Cir. 2020). Although Plaintiffs also seek damages, they plausibly allege that they lack an adequate remedy at law, which is sufficient at the pleading stage to seek restitution and injunctive relief in the alternative. Plaintiffs allege, among other things, that no adequate remedy at law exists because:

Otter has not yet implemented adequate protections to protect Plaintiffs and Class Members' personal data or conversations, ․ leaving individuals potentially unsure if their conversations have been recorded and kept by Otter. Therefore, the equitable relief requested here would prevent ongoing and future harm to Plaintiffs and the Class Members. Since Otter still has Plaintiffs' and Class Members' information, without an injunction, Plaintiffs and the Class Members cannot be sure that the information is secure and private or properly destroyed.

Compl. ¶ 285a. Thus, Plaintiffs plausibly allege that legal remedies are inadequate to prevent ongoing and future harm arising from Otter's alleged nonconsensual use of their private data.⁴

Otter cites several cases for the proposition that a plaintiff may not seek legal and equitable relief in the alternative, see Reply at 17, ECF No. 52, but that misstates the law. At the pleading stage, Plaintiffs may seek equitable relief in the alternative, but in order to do so, they must allege that their legal remedies are inadequate. Sharma v. Volkswagen AG, 524 F. Supp. 3d 891, 907 (N.D. Cal. 2021) (“The issue is not whether a pleading may seek distinct forms of relief in the alternative, but rather whether a prayer for equitable relief states a claim if the pleading does not demonstrate the inadequacy of a legal remedy.”). The cases cited by Otter do not dispute this principle. Instead, in each case, the plaintiffs simply failed to allege that legal remedies were inadequate.⁵

Accordingly, the motion to dismiss Plaintiffs' unjust enrichment claim is denied.

7. Unfair Competition Law (Count 14)

To bring a claim under California's Unfair Competition Law (“UCL”), a person must have “suffered injury in fact and ․ lost money or property as a result of the unfair competition.” Cal. Bus. & Prof. Code § 17204. Thus, a UCL plaintiff must “(1) establish a loss or deprivation of money or property sufficient to qualify as injury in fact, i.e., economic injury, and (2) show that that economic injury was the result of, i.e., caused by, the unfair business practice or false advertising that is the gravamen of the claim.” Kwikset Corp. v. Superior Court, 51 Cal. 4th 310, 322 (2011).

Otter moves to dismiss on two grounds. First, Otter argues that Plaintiffs cannot plead a UCL claim because they “have an adequate remedy at law.” Mot. at 28. The Court rejected this argument above. See supra Section III.C.6. Second, Otter argues that Plaintiffs fail to allege a loss of “money or property.” Mot. at 29. But to the contrary, Plaintiffs allege that they lost personal information, which has economic value to Plaintiffs. Specifically, Plaintiffs allege that “[m]arket exchanges have sprung up where individual users ․ can sell or monetize their own data.” Compl. ¶¶ 107, 108 (discussing an application that “pays users for recording their phone conversations, which are subsequently passed along to AI developers who use it to train their chatbots”). Plaintiffs further allege details about the market value of their data, and that Otter's interception of their data and private conversations decreases its value. Id. ¶¶ 103, 105. These allegations are sufficient.

Accordingly, the motion to dismiss Plaintiffs' UCL claim is denied.

8. Declaratory Judgment (Count 6)

“[J]ust like suits for every other type of remedy, declaratory-judgment actions must satisfy Article III's case-or-controversy requirement.” California v. Texas, 593 U.S. 659, 672 (2021). A justiciable case or controversy exists for purposes of declaratory relief if “the facts alleged, under all the circumstances, show that there is a substantial controversy, between parties having adverse legal interests, of sufficient immediacy and reality to warrant the issuance of a declaratory judgment.” MedImmune, Inc. v. Genentech, Inc., 549 U.S. 118, 127 (2007) (quoting Maryland Cas. Co. v. Pac. Coal & Oil Co., 312 U.S. 270, 273 (1941)).

Otter argues that Plaintiffs are not entitled to declaratory relief because Plaintiffs lack standing and have not suffered harm by Otter's actions. This argument fails for the reasons discussed above. Plaintiffs plausibly allege Article III standing, and they have sufficiently alleged that their legal remedies are inadequate such that declaratory relief may be appropriate. See supra Sections III.A., III.C.6.

Accordingly, the motion to dismiss Plaintiffs' declaratory judgment claim is denied.

9. Washington Privacy Act (Count 17)

Washington's Privacy Act prohibits intercepting or recording any “private communication” or “private conversation” without first obtaining the consent of all parties. Wash. Rev. Code § 9.73.030. The parties dispute whether Plaintiff Dolan has plausibly alleged that his communications were “private” within the meaning of the statute and whether Dolan consented to the recording.

First, courts consider several factors in determining whether a communication is “private,” including “[t]he subjective intention of the parties,” “the duration and subject matter of the communication[,] the location of the communication and the presence of potential third parties[,] and the role of the nonconsenting party and his or her relationship to the consenting party.” State v. Townsend, 147 Wash. 2d 666, 673 (2002). Here, although Dolan alleges that his meetings concerned “professional opportunities,” he fails to allege other facts such as the duration of the meetings, the setting in which they occurred, the presence of other third parties, or details showing why the conversations were private. Because Dolan fails to allege sufficient facts supporting the reasonableness factors to determine whether a communication is private, he does not plausibly allege that the intercepted communications were “private” within the meaning of section 9.73.030.

Second, Washington law provides that “a communicating party will be deemed to have consented to having his or her communication recorded when the party knows that the messages will be recorded.” Townsend, 147 Wash. 2d at 675-76. Otter argues that Dolan consented because he saw the “potential presence of [a] third party” – that is, the Otter Notetaker – and should have known that another party was involved. Mot. at 32. This argument prematurely raises a factual dispute. Dolan expressly alleges that he was “not aware that [his] electronic communications [was] being intercepted by Otter, nor did [he] ever consent to the same.” Compl. ¶ 65. Even if the Otter Notetaker appeared in the meeting as another participant, the Court cannot infer that Dolan knew his communications were being recorded, transcribed, and retained by Otter. Thus, Dolan plausibly alleges that he did not consent to the recording.

Accordingly, because Dolan fails to allege that his communications were private, the motion to dismiss his claim under the Washington Privacy Act is granted.

10. Withdrawn Claims

Although Defendants moved to dismiss the complaint in its entirety, Plaintiffs did not oppose dismissal as to certain claims. Instead, Plaintiffs withdrew their claims for intrusion upon seclusion (Count 3) with respect to Plaintiff Winston, and withdrew entirely their claims for conversion (Count 4), trespass to chattels (Count 7), CIPA § 635 (Count 9), CIPA § 638.51 (Count 10), and larceny (Count 12). Opp. at 2 n.1, 34 n.5. At the hearing, Plaintiffs requested that dismissal be without prejudice. However, Plaintiffs failed to identify any additional facts they could allege to support the withdrawn claims, and Plaintiffs represented that they do not intend to replead these claims at this time. Hr'g Tr. 27:14-28:11, ECF No. 67. Accordingly, the Court will dismiss the withdrawn claims without prejudice. Because the deadline to request leave to amend the pleadings expired on May 15, 2026, see ECF No. 47, Plaintiffs may only reassert these claims with leave of Court upon a showing of good cause, see Fed. R. Civ. P. 16(b)(4).

D. Dismissal is With Leave to Amend

Except for the withdrawn claims, the Court grants leave to amend because this is its first ruling on the legal sufficiency of the complaint and the Court cannot conclude that amendment of the dismissed claims would be futile. See Lopez, 203 F.3d at 1127 (holding that the “court should grant leave to amend ․ unless it determines that the pleading could not possibly be cured by the allegation of other facts” (citation modified)). Although the Court grants leave to amend, Plaintiffs are encouraged to consider whether to reassert the dismissed claims, given that many others are proceeding. If Plaintiffs choose to file a second amended complaint, the Court may dismiss deficient claims without granting further leave. See Zucco Partners, LLC v. Digimarc Corp., 552 F.3d 981, 1007 (9th Cir. 2009) (holding that failure to correct pleading deficiencies after dismissal is a “strong indication” that further amendment would be futile (citation and quote marks omitted)); see also Salameh v. Tarsadia Hotel, 726 F.3d 1124, 1133 (9th Cir. 2013) (“A district court's discretion to deny leave to amend is ‘particularly broad’ where the plaintiff has previously amended.” (citation omitted)).

IV. CONCLUSION

For the foregoing reasons, the Court ORDERS as follows:

1. The motion to dismiss is GRANTED with leave to amend as to Count 2, Count 3 (as to Plaintiffs Justin Brewer, Emily Ryan, and Riley Dolan), Count 13 (as to Plaintiffs Justin Brewer and Emily Ryan), Count 11, and Count 17.

2. The withdrawn claims – Count 3 (as to Plaintiffs Jasper Walker, Michael Walker, and Nadine Winston), Count 4, Count 7, Count 9, Count 10, and Count 12 – are DISMISSED without prejudice but without leave to amend absent a showing of good cause.

3. The motion is DENIED in all other respects.

4. Plaintiffs may file an amended complaint within 14 days of this Order. Otter shall file its responsive pleading within 21 days thereafter, whether or not Plaintiffs choose to amend.

IT IS SO ORDERED.

FOOTNOTES

2.   After Otter's motion was submitted for decision, the Ninth Circuit issued a precedential opinion discussing aspects of Section 1030(a)(2)(c) that appear to be relevant to this case. See Amazon.com Servs., LLC v. Perplexity AI, Inc., ––– F.4th ––––, No. 26-1444, 2026 WL 2237587 (9th Cir. Aug. 4, 2026). The Court did not rely on Perplexity AI for purposes of ruling on Otter's motion to dismiss, given that the parties did not have the benefit of addressing this new authority. However, the Court observes that Perplexity AI casts doubt on whether Plaintiffs can state a CFAA claim based on their current theory that Otter accesses Plaintiffs' computers indirectly through the acts of Otter users who deploy the Notetaker. See id. at *6.

3.   Because Plaintiffs Brewer and Ryan fail to plausibly allege a reasonable expectation of privacy, the Court does not address whether they adequately allege a highly offensive intrusion.

4.   Otter cites Huynh v. Quora, Inc., 508 F. Supp. 3d 633 (N.D. Cal. 2020), for the proposition that risks to a user's data in the future “could be remedied by damages.” Reply at 17. This argument raises a premature factual dispute that the Court cannot resolve at the pleading stage. The court in Huynh concluded at summary judgment that the plaintiff “failed to meet her burden of production” to show that her legal remedy was inadequate. Huynh, 508 F. Supp. 3d at 663.

5.   See Coast Surgery Ctr. v. Cigna Health & Life Ins. Co., No. SACV 22-02102-CJC (JDEx), 2023 WL 10405133, at *2 (C.D. Cal. Aug. 1, 2023) (holding that plaintiffs must “allege some facts suggesting that damages are insufficient to make them whole”); In re Cal. Gasoline Spot Mkt. Antitrust Litig., No. 20-cv-03131-JSC, 2021 WL 1176645, at *7 (N.D. Cal. Mar. 29, 2021) (“Plaintiffs do not plead that they have inadequate remedies at law.”); see also In re MacBook Keyboard Litig., No. 18-cv-02813-EJD, 2020 WL 6047253, at *4 (N.D. Cal. Oct. 13, 2020) (“Plaintiffs have failed to allege that they lack an adequate remedy at law, as required to state a claim for equitable relief.”).

Eumi K. Lee, United States District Judge