AI meeting notetakers surge as Wispr Flow enters a crowded market where privacy is an afterthought

Wispr Flow launched an AI meeting notetaker today that transcribes conversations through system audio without joining calls as a visible participant 1. The privacy control the startup prominently markets covers what its own FAQ calls "dictation data." The feature it just launched processes a different category that its updated terms of service name "Meeting Data," including meeting audio, participant information, speaker labels, and meeting transcripts 2.

Wispr Flow joins Granola, Otter, Fireflies, Read AI, and Fathom in a category racing to capture the most sensitive audio in any enterprise 2. Granola hit a $1.5 billion valuation in March after raising $125 million, a sixfold jump from its previous $250 million mark in less than a year 3. Wispr Flow, valued at $700 million at its last round, is reportedly seeking $2 billion, roughly 2.9 times that figure 2. The Notetaker can capture sessions up to six hours long, up from a six-minute ceiling that previously forced users to restart the tool repeatedly 1. WIRED's reporter observes that most tech investors he speaks with now assume their conversations are being recorded or transcribed by AI, sometimes without explicit consent 1.

A privacy control named for the wrong data

Wispr Flow's privacy page describes Privacy Mode as governing whether "dictation data" is used for model training, enumerating "audio, transcripts, edits" as the covered categories 4. The Terms of Service that TechCrunch surfaced before launch define a separate input class for the Notetaker: "Meeting Data, including meeting audio, participant information, meeting metadata, speaker labels, meeting transcripts, and other information processed in connection with a meeting" 2. The Privacy Mode FAQ does not mention Meeting Data.

The distinction matters because Meeting Data includes information about people who never agreed to Wispr's terms. CEO Tanay Kothari told WIRED that users should always disclose transcription, citing consent laws that vary between single-party and multi-party states. "It's just a basic trust-setting exercise to just make sure people know," he said 1. In San Francisco, where Wispr is based, recording a private conversation requires consent from all participants 1. The tool is designed to work invisibly.

Invisible to colleagues is not private from the vendor

Wispr Flow and Granola both transcribe through system audio rather than joining calls as visible bots 1. WIRED described this approach as transcribing "directly on your device." But Wispr's own privacy page states that "transcription always happens in the cloud" for speed and accuracy 4. The company has not clarified whether the Notetaker processes audio differently from its dictation product. Either way, meeting audio leaves the device before a transcript appears.

The legal exposure from routing that audio through third-party servers is already producing litigation. In August 2025, a federal class action filed in the Northern District of California alleges that Otter.ai recorded conversations without all participants' consent and leveraged the data to refine its speech recognition technology without permission 5. The complaint claims Otter records not only its account holders but also unsuspecting third parties involved in their meetings 5. It includes claims under the California Invasion of Privacy Act, which carries potential damages of up to $5,000 per violation 6. A law firm advisory from April 2026 warns that in all-party consent states including California, Florida, Illinois, and Massachusetts, AI transcription tools that record without explicit advance consent from all attendees risk violating wiretap statutes 6.

The same advisory flags attorney-client privilege risk: voluntarily disclosing privileged communications to a transcription vendor may destroy the privilege, and whether the vendor qualifies as the equivalent of legal staff remains legally unsettled 6. Board strategy calls, customer negotiations, and HR investigations transcribed by a third party become discoverable records stored on someone else's infrastructure.

The moat will be provable data sovereignty

Granola's leadership recognizes that AI meeting notes are commoditizing, which is why the startup is building APIs and enterprise integrations beyond basic transcription 3. If transcription quality is commoditizing, the differentiation enterprises will pay for is provable control over where meeting audio goes, who can access it, how long it persists, and whether it can train a model.

What that requires architecturally:

• On-device processing that prevents audio from reaching vendor servers, not cloud processing paired with a deletion promise
• Zero-retention contracts enforceable by independent audit, not terms of service a vendor can amend unilaterally
• Customer-held encryption keys that block the vendor from accessing content even under a third-party subpoena
• Per-meeting consent mechanisms for participants who are not account holders

Wispr Flow holds SOC 2 Type II certification and HIPAA compliance 4. SOC 2 attests to a company's security and availability practices. It does not govern what the company does with your data. HIPAA protects health information. It does not protect board strategy. And Privacy Mode, as documented, governs dictation data. The gap between those certifications and the reality of processing meeting audio from non-account-holders in the cloud is where the next phase of competition in this category will be decided.