We write a lot about privacy class actions. We also write a lot about false advertising class actions. Increasingly, these theories have converged. The latest such case is a putative class action in the Northern District of California against Pocket AI. The lead claim relies on a seldom-used provision of the California Invasion of Privacy Act (“CIPA”) targeting devices “intended for eavesdropping.” While it uses familiar theories of liability, understanding the technical architecture, disclosures, and legal landscape are critical in warding off such suits.

Allegations of Eavesdropping and False Advertising

The complaint alleges that Pocket AI sells a magnet that attaches to the back of a smartphone and records and transcribes what it hears. The feature that the complaint focuses on is a contact microphone, which captures a telephone call by sensing the vibrations of the handset. The complaint alleges that Apple and other manufacturers disable recording apps once a call connects, and that the Pocket AI magnet bypasses that restriction. From there, the complaint describes two false advertising and eavesdropping theories.

Pointing to Pocket AI’s marketing, the complaint alleges that the company asks buyers whether the product is “cheating” and promises an “unfair advantage.” It highlights an ad where a well-known actor from the legal drama Suits records opposing counsel using Pocket AI and catches him in “three contradictions.” Another ad that the complaint relies upon allegedly shows a coworker in a meeting who is unaware that he is being taped by his colleague. 

The complaint’s theory of false advertising is based on alleged material omissions in the company’s marketing. The complaint alleges that twelve states require the consent of every party before a call is recorded and make recording without consent a crime.¹ Pocket AI, the complaint alleges, fails to disclose these legal prohibitions in its ads, on its site, in the shopping cart, at checkout, and in other marketing materials. The plaintiff alleges that he bought the device and only later learned he could not lawfully use it the way the ads depicted.

On the eavesdropping side, the complaint adds that recordings are transmitted to third-party AI providers (OpenAI, Anthropic, Google) for processing, while the website assures consumers their data is “never sold or shared.” It further alleges that these third parties may be retaining the confidential conversations and using them to train AI models.

A Novel CIPA Section 635 Claim

The lead claim in the complaint is based on an infrequently invoked provision of CIPA: Section 635. This provision prohibits manufacturing, selling, or advertising any device “primarily or exclusively designed or intended for eavesdropping upon the communication of another.” The complaint seeks to allege intent based on the company’s ads and marketing, and it seeks to allege eavesdropping based on the third-party AI-processing allegations. As with other CIPA claims, statutory damages run to $5,000 per violation.

While CIPA is the lawsuit’s main claim, the complaint also asserts claims under California’s False Advertising Law, Cal. Bus. & Prof. Code § 17500, and Consumers Legal Remedies Act, California Civil Code (“CLRA”) § 1770. Both claims are based on allegations that the company misleadingly omitted the fact that twelve states prohibit one-party recording. These claims allegedly reach purchasers who never recorded anyone on the theory that those purchasers would not have bought the product had they known about these legal prohibitions.

The Case Coincides with a Significant AI-Transcription Decision

One week before the Pocket AI case was filed, Judge Eumi K. Lee granted in part and denied in part a motion to dismiss in In re Otter.AI Privacy Litigation, No. 5:25-cv-06911 (N.D. Cal. Aug. 13, 2026), a case involving an AI-powered meeting assistant that transcribes meetings on platforms like Zoom. The Electronic Communications Privacy Act (“ECPA”), CIPA Section 631 (the wiretapping provision prohibiting reading the contents of communications while they are in transit), and Illinois Biometric Information Privacy Act (“BIPA”) claims survived the motion based on allegations that Otter.AI retained the conversations and used them to train its own models. The court held that the complaint plausibly alleged that Otter was a third-party interceptor rather than a tool operating at the host’s direction.

The Pocket AI complaint builds on that same framework, likely seeking to leverage Judge Lee’s decision. It alleges that Pocket AI designed and operates the systems carrying each recording and discloses the contents to outside AI providers, where they can be used to train those companies models. Whether the analogy holds is a closer question. A hardware seller sits steps removed from the alleged interception, Pocket AI is not alleged to be training its own models, and Section 635 has been litigated far less and requires different elements.

Compliance Must Consider the Whole

Even when defenses are strong, it’s preferable to avoid litigation in the first place. This new case showcases how compliance and risk mitigation efforts must run across departments. The engineering choices of where data is processed, how long it is retained, and who gets to train on it drives the wiretap/eavesdropping risks, while marketing copy concerning those engineering choices drive the false advertising risk. And terms of service and privacy policies sit at the crux of both.

These all come together to create potential exposure that can easily go unrecognized. It’s crucial to assess technical architecture, marketing copy, consumer contracts and mandatory privacy disclosures to strike the right balance in risk mitigation.