Your AI agent is a recording device — and the vendor can be the one on the hook

When a business drops an AI voice agent into its call center, it's buying efficiency. What it may not realize is that it's also inviting a third party onto every call — one that can hear, transcribe, and potentially learn from the conversation. In 2026, a wave of lawsuits built on a simple reframe: an AI voice product isn't just a tool the business uses, it's a separate party listening in. And under California law, that party can be sued in its own right.

The theory is narrow, specific, and it has already survived a motion to dismiss against one of the biggest vendors in the market. It turns on a single idea that should make every AI-voice buyer and builder pay attention: it may not matter whether the vendor used what it heard. Under the standard a California court applied, the capability to use it can be enough.

The reframe: the agent is a party, not a tool

For years, the assumption behind call-center technology was that the vendor was invisible — just plumbing the business used to do its own recording. The AI-voice lawsuits attack that assumption directly. Their argument: when a sophisticated AI system sits on a live call, recording it, transcribing it in real time, and holding the capability to feed that data back into its own models, the vendor isn't plumbing. It's a third party to the conversation — and California's wiretap law, CIPA §631(a), prohibits a third party from intercepting the contents of a communication without all parties' consent.

That reframe is what makes these cases different from the website-tracking suits. It's not a pixel on a page; it's a listener on a call. And the person potentially liable isn't just the company whose phone number you dialed — it's the AI company whose product was on the line. (For the broader shift from pixels to AI, see our overview of CIPA's expanding frontier from pixels to AI and AI chatbots and privacy law.)

The anchor case: Ambriz v. Google

The case that put this theory on the map is Ambriz v. Google (No. 3:23-cv-05437, N.D. Cal., Judge Rita F. Lin), since consolidated into In re Google Cloud Contact Center AI Privacy Litigation. The plaintiffs alleged that Google's Cloud Contact Center AI product intercepted and recorded their calls to other companies' customer-service lines — and transcribed them in real time — without the callers' consent.

In February 2025, the court denied Google's motion to dismiss the CIPA §631(a) claim. The reasoning is the part worth internalizing. The court found the plaintiffs had adequately pleaded that Google:

• was a "person" who engaged in a wiretap under the statute;
• read the contents of the communication "in transit," because it learned the content before or at the same time as the business whose line was called; and
• did so over a "telephone" — smartphones satisfying the statute's wire-line requirement.

Crucially, the court treated Google as a third party, not as a mere extension of the business customer. That's the whole ballgame — because a true "extension" of the business isn't a wiretapper, but a genuine third party listening in can be.

The "capability test" — why not using the data may not save you

Two competing standards have emerged in the California federal courts for when a technology vendor crosses from "extension" to "third-party wiretapper," and the AI-voice cases turn on which one applies.

Ambriz followed the capability test. The plaintiffs alleged Google had the capability to use the captured call data to improve its own AI and machine-learning models — and the court held that Google's denial that it actually trained on the data didn't defeat the claim at the pleading stage, because capability alone was enough. That is the single most important sentence for anyone in the AI-voice business to understand: under this standard, "we don't use it for training" is not, by itself, a complete answer.

What the 2026 rulings actually did (read this carefully)

It would be wrong to tell you the vendor always loses — the 2026 developments are more nuanced, and the nuance is the useful part. In October 2026, the consolidated litigation produced a mixed set of rulings:

• Three callers' claims were sent to individual arbitration (and stayed) — because those callers had agreed to arbitration terms with the businesses they called.
• Three other callers' §631 claims were dismissed, with leave to amend — but notably, the court rested that on consent and intent grounds (some account holders had agreed to a privacy statement disclosing that recordings could go to service providers, and the court found the callers hadn't adequately alleged Google intended to record without consent) — not on rejecting the capability theory.

In other words: the capability theory that makes the vendor a potential defendant survived. What tripped up specific plaintiffs was the ordinary stuff — arbitration clauses and whether consent had been given — not the core idea that an AI voice vendor can be a §631 third party. The theory is alive and, per the trackers, is now being pressed in related matters involving other AI-voice providers.

Who carries the risk — vendor and buyer both

The striking feature of this theory is that it points at both ends of the deal, for different reasons.

For a business, the practical consequence is that "our vendor handles compliance" is a shaky position. If the AI on your line is a third party under this theory, you are the one who let it listen — and your exposure doesn't disappear because the vendor is also exposed.

What to do if you use or build AI voice or chat agents

1. Get all-party consent before the AI listens. A clear, up-front disclosure and consent ("this call may be recorded and processed by an AI service") obtained before processing begins is the most direct answer to a §631 interception claim.
2. Pin down what the vendor can do with the data — in the contract. Don't rely on a verbal "we don't train on it." Get explicit, binding terms on whether the vendor may use, retain, or train on call content, and narrow the capability where you can.
3. Map every AI system that touches a communication. Voice agents, chat agents, real-time transcription, "agent assist," copilots — inventory anything that processes what a user says or types.
4. Treat consent and disclosure as a product requirement, not a banner. The disclosure has to actually precede the processing, and you should be able to prove it did.
5. Watch the extension-vs-capability split. The law here is moving; where the capability test applies, "we didn't use it" is weak. Build as if the stricter standard governs. (See also does your chatbot need consent? and AI agents and consent.)

Key takeaways

Frequently asked questions

The bottom line

The AI-voice wiretap cases mark a genuine shift: for the first time, the technology vendor — not just the business deploying it — is squarely in the frame. The mechanism is a reframe anyone can grasp: an AI agent on a live call is a party listening in, and under California's capability standard, the mere ability to use what it hears can be enough to make it a wiretapper. That theory survived its first big test against Google, even as individual plaintiffs' claims turned on arbitration and consent.

For buyers and builders alike, the move is the same one that answers almost every privacy question: consent before processing, and clarity about what the technology can do with what it captures. An AI agent is a recording device whether or not you think of it that way. The safe posture is to treat it like one — disclose it, get agreement, and control it — before a court does the reframing for you.

Sources