Otter.ai rant
Posted by Neither-State-211@reddit | sysadmin | View on Reddit | 28 comments
What the hell is wrong with them?
I know they’re a “legitimate” business and have real enterprise customers that apparently like their product, but their user acquisition approach is basically to user acquisition is basically to spread like a virus.
For those that don’t know, Otter is an AI note taking service. You give it access to your calendar and then toga in to anything with a meeting link to listen in and “take notes.” After the meeting, it emails the notes to everyone at the meeting (everyone whose email was included in the invite).
That’s all fine and good, except that to see the notes, you have to sign up for an account. The account signup process heavily pushes users to sign in with their Microsoft or Google credentials, provide access to calendars and contacts, and regulate to attend all meetings with a link. Most users have no idea they’ve done this, they’re just there for the meeting notes (at the prompting of a trusted colleague/earlier victim).
Yes, it’s easy to fix, and even easier to prevent, but it’s still a really, really shitty way to pump your active user base.
If anyone from Otter is reading—cut this shit out. You are now an automatic “do not consider” for any shop I lead, and I have to assume I’m not alone.
Sk1tza@reddit
We block it. All those ai tools are blocked.
keoltis@reddit
I had it banned from teams and entra and was forced to unban it globally due to people using it for accessibility reasons (I offered copilot as an alternative) and it was already paid for. Risks were raised an rejected. No longer my problem but I still hate it with a passion, especially the emails it sends out to all participants who aren't using it.
SnooMachines9133@reddit
Yep, just found it yesterday. Had to tell users to uninstall it and going to block it next week.
topher358@reddit
Like others have said, block the ability for users to consent to apps in Entra ID. Stops this and lots of other annoying apps trying to get your data cold.
shsheikh@reddit
Yes, any org should turn on the app approval process at minimum. For those that don't know: Configure the admin consent workflow - Microsoft Entra ID | Microsoft Learn
baz938@reddit
You should read their privacy policy. Some great excerpts about training their models on your voice and potential personal info. Ran it up the flag pole and had it banned pretty quickly
Neither-State-211@reddit (OP)
Holy shit, I just gave it a look and… WOW. Might have to make that into a separate post…
Kaligraphic@reddit
Crunchbase tells me otter.ai is based in California. California is a two-party consent state.
Crimes. Crimes everywhere.
uptimefordays@reddit
Why are you users able to install things like this? AI note taking and transcription apps are a data exfiltration nightmare.
Chaucer85@reddit
There's nothing to install. It's an app you can invite into the tenant like an external user account. Plenty of companies have to allow the inviting of external accts for vendors, clients, etc. you have to go and block Otter.ai as a domain.
Neither-State-211@reddit (OP)
There’s no installation, but it pushes users to create an account with their Microsoft or Google credentials, and then pressures them to give it access to the users calendar and contact list. Most people just blindly accept because why wouldn’t they? The easy fix/prevention is to disable those APIs for anything except whatever’s been white listed. Dealing with those bits showing up “on behalf” of outside meeting attendees is a separate issue…
serverhorror@reddit
Wait, you're taking notes with 3rd party apps that sends stuff around?
Isn't that highly problematic if you do that with customers or vendors in the meeting, or any 3rd party for that matter?
Neither-State-211@reddit (OP)
Yes. It’s a privacy and security nightmare. It’s a Christmas miracle they haven’t been litigated out of existence.
Unbelievr@reddit
It's very cool when you invite someone temporarily to a meeting, then boot them off to discuss whether to give the person a job or not and at what wage, or the maximum price you are willing to pay for some service, and then when you end the meeting the guest gets a transcript too.
serverhorror@reddit
I don't know which jurisdiction you're in, but for all of the EU that would quite problematic to just record this without prior consent.
Plus: you need a proof of consent for this and you, likely, need proof that you deleted all the data afterwards and since you invited the third party, you need to list them as a sub-processor and put agreements into place that they delete the data and you will need to deal with a GDPR request and provide they proof they your 3rd-party deleted.
It gets you into a nightmarish dependency hell real quick.
Personally: I'll just write it down in notepad or pen an paper and burn the text file or delete the page afterwards.
Just to be clear: Once you have that in your org it's not a problem at all, it's just really, really problematic if there are people outside your organization that might hold a grudge for one reason or another. It can get unreasonably expensive, even without anyone suing.
serverhorror@reddit
If you did that with us, we'd sue you, not them.
Neither-State-211@reddit (OP)
They join as a user that’s labeled Otter-ai and, I think, copy a link to some kind of user agreement in the chat, so they kind of make it on the meeting host to boot them. But… yeah.
serverhorror@reddit
Yeah, you would be the host. You'd have to ensure that any NDA (which usually rules out 3rd parties) are kept out.
That would be the thinking.
At the very least people would go real silent in the meeting, not even acknowledging why they go silent.
Neither-State-211@reddit (OP)
In theory, under the best possible circumstances, with users that have been given (and paid attention) to thorough training on how to [checks notes] use AI without getting sued out of existence… this works. Anything lest and it’s a full CLUSTER.
serverhorror@reddit
Yeah ... I mean the risk that someone starts using this outside of their own org is quite high (unless technical restrictions can be put in place).
The company promoting their own "3rd-party-ness" after the fact doesn't help either ...
ollytheninja@reddit
Not OP, the users. And yes, extremely problematic in most situations!!
Chaucer85@reddit
Yeah, it took us several months to catch this, but it spread like wildfire. The users who were doing it were clueless developers who thought it was a "neat, free tool." Otter.ai is now blocked from being invited to our tenant, and we push users to Copilot (or the built-in transcriber for Zoom).
Capable_Tea_001@reddit
I'm out!
DatManAaron1993@reddit
Right?
What could go wrong with giving AI access 🤣🤣
pdp10@reddit
LinkedIn and Facebook also did the viral marketing thing. Even Microsoft to a degree -- who else remembers when leadership caved to that Office 97 upgrade so the users would finally stop complaining that they couldn't open random attachments that showed up in their email inboxes?
AppIdentityGuy@reddit
Block that level of Auth to your users at the tenant level.. The software will be DOA
dboytim@reddit
I'm guessing they (wrongly) assume customers are using it internally, where everyone at the meeting already HAS Otter through the company. In that case, not a big deal to add them if the whole company is supposed to be using it.
Now, when you start having external people in the meetings, that's terrible and I agree, needs to stop.
Neither-State-211@reddit (OP)
My guess is that the paid/enterprise version doesn’t behave like this, but the free one 100% does. Anything to goose the daily active user count and grab that next round of VC funding, right? 🤬