# Otter.ai privacy rating

Cloud AI meeting assistant that records and transcribes meetings and conversations, joins video calls as a bot or captures audio from its apps, and generates summaries and action items.

## Summary

Otter.ai scores 24 out of 100 (grade F) on the dictation and transcription criteria. It meets 1 of 10 criteria: tells users about requests. It partly meets no ads or data sales, independent audit, transparency report and TLS configuration. It does not meet open source, no trackers or telemetry, security headers, runs on the device and no training on recordings. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A- and Mozilla HTTP Observatory grade D-.

- Website: https://otter.ai
- Jurisdiction: United States. Five Eyes member. Subject to the US CLOUD Act.
- Platforms: Web, Windows, macOS, iOS, Android
- Home page trackers: Amplitude, Drift, Google Tag Manager, OneTrust (not scored)
- Category: [Dictation and transcription](https://privacyratings.com/speech-to-text/)
- Grade: F (24/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | No | Closed source. |  |
| No trackers or telemetry | No | The policy lists Google Analytics, Amplitude and Facebook advertising cookies. | https://otter.ai/privacy-policy |
| No ads or data sales | Partial | Funded by subscriptions, but device and cookie data are shared with advertising partners to advertise Otter, which the policy says may count as a sale. | https://otter.ai/privacy-policy |
| Independent audit | Partial | A SOC 2 Type 2 report exists, but it is not public. | https://otter.ai/privacy-security |
| Transparency report | Partial | A data request policy is published, with no request counts. | https://otter.ai/data-request-policy |
| Tells users about requests | Yes | The policy promises to notify the customer before disclosure unless legally prohibited, and afterward when a gag order expires. | https://otter.ai/data-request-policy |
| TLS configuration | Partial | Grade A- | https://www.ssllabs.com/ssltest/analyze.html?d=otter.ai&hideResults=on |
| Security headers | No | Grade D- (25/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=otter.ai |
| Modern web standards | Not tested yet | Not tested yet. |  |
| Runs on the device | No | Audio is processed on Otter's servers. | https://otter.ai/privacy-policy |
| No training on recordings | No | De-identified recordings and transcripts are used to train Otter's models automatically, with no opt-out described. | https://otter.ai/privacy-security |

Source: https://privacyratings.com/speech-to-text/otter-ai/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/speech-to-text/otter-ai.md