On April 23, 2026, Sandra Thompson called the Chipotle at 1302 Broadway in Oakland to place a food order. An automated voice answered, took her order, and collected her name and credit card number. According to a class action complaint filed July 30, 2026 in Alameda County Superior Court, the voice on the line was never Chipotle’s. By the time any greeting played, the call had already been routed through the servers of SoundHound AI, a Santa Clara company Thompson says she had never heard of, where it was answered, recorded, and transcribed in real time.
Thompson v. SoundHound AI asks a question no California appellate court has answered: when an AI agent picks up a restaurant’s phone line, is that a wiretap under a statute written in 1967? The complaint pleads three counts under the California Invasion of Privacy Act (Penal Code sections 631(a), 632, and 632.7), plus intrusion upon seclusion and unfair competition. CIPA carries statutory damages of $5,000 per violation under section 637.2, with no proof of actual harm required. SoundHound says its phone ordering system has processed more than 100 million customer interactions across over ten thousand restaurant locations. Run the class math on the California slice of that number and the notional exposure clears a billion dollars before anyone argues about the merits.
The case will not turn on privacy rhetoric. It will turn on a specific technical fact: what SoundHound does with the audio after the order is placed. The complaint knows this, and it is built around it.
What the complaint actually alleges
The core factual theory sits in paragraph 3. The complaint alleges that when a consumer dials a participating restaurant, the call is routed to and through SoundHound’s servers, where SoundHound, not the restaurant, answers the call, converses with the customer, records and transcribes the conversation in real time, captures the customer’s name and payment card information, and then, this is the operative part, “retains and reuses the contents of the call for SoundHound’s own commercial purposes, including to train SoundHound’s artificial-intelligence models.”
The complaint also alleges that SoundHound shares call data with outside processors, quoting SoundHound’s own partner privacy policy for the phrase “AI vendors such as OpenAI.” That is a notable sourcing move: the plaintiff’s most aggressive data-flow allegation is a citation to the defendant’s published policy, not an inference.
On consent, the theory is timing. Paragraph 5 alleges that by the time any automated greeting plays, the call has already been routed through and intercepted by SoundHound’s systems, and that a generic “this call will be recorded” notice identifies the restaurant, not SoundHound, and says nothing about transcription, retention, model training, or third-party sharing. Thompson alleges she believed she was speaking with Chipotle and would not have read out her card number otherwise.
Two structural choices in the pleading reveal how carefully this case was engineered. First, paragraph 16 goes out of its way to disclaim any agency relationship: “SoundHound is not the agent of the restaurants that deploy its technology.” Plaintiffs do not usually volunteer facts that narrow their own case. This one is strategic, and the reason sits in a federal courtroom across the Bay, covered below. Second, paragraphs 20 through 22 are a removal firewall. The class is defined as California citizens only, the complaint pleads that SoundHound is a California citizen through its Santa Clara headquarters, and it walks through why the Class Action Fairness Act’s minimal diversity requirement fails and why the home-state exception would apply anyway. Counsel wants this case decided in an Alameda County courtroom, not a federal one, and drafted accordingly.
How an AI phone agent actually works, and why the pipeline is the case
Strip the branding away and a restaurant voice AI is a five-stage pipeline. The restaurant’s published number is forwarded or ported so that inbound calls terminate on the vendor’s telephony infrastructure, not on a phone behind the counter. Audio streams from the carrier into the vendor’s cloud, where a speech recognition model, SoundHound markets its own under the name Polaris, transcribes it. Transcription is streaming by design: the model emits partial hypotheses on live audio, typically within a few hundred milliseconds, because a phone agent that waits for you to finish talking before it starts thinking feels broken. A dialogue system interprets the transcript, tracks the order state, and injects items into the restaurant’s point-of-sale system. A text-to-speech engine talks back. SoundHound assembled this stack partly through acquisition, buying restaurant phone specialist SYNQ3 in early 2024, and its Smart Ordering roster includes Chipotle, Jersey Mike’s, Applebee’s, Habit Burger, and Noodles & Company, among others.
Every stage of that pipeline creates a copy. The telephony layer buffers audio. The recognition model consumes it and emits text. Transcripts land in logs, order records, and analytics dashboards that vendors sell to restaurants as a feature. And, if the vendor chooses, calls or transcripts flow into training corpora that make the next model version better at understanding people ordering burritos over bad cell connections. Which of those copies exist, how long each is retained, and which ones feed model training are configuration and contract decisions, invisible to the caller and different across deployments.
That architecture maps directly onto the statute. Section 631(a) reaches anyone who reads or attempts to learn the contents of a communication “while the same is in transit.” Streaming recognition processes audio during transmission as a design requirement, not incidentally. If any modern system “learns the contents in transit,” it is a real-time ASR pipeline sitting in the middle of a live call. The statutory language written for alligator clips on copper wire describes the latency budget of a 2026 voice agent with uncomfortable precision.
The doctrinal machinery: party, extension, or eavesdropper
CIPA has a built-in limit that this entire case orbits. A party to a call cannot eavesdrop on its own conversation. When you dial Chipotle, whoever legitimately answers on Chipotle’s behalf is a party, and a party recording its own call violates section 631’s eavesdropping prongs against no one. The California Supreme Court framed the statute’s target in Ribas v. Clark as the outsider permitted to listen in on a line, and the complaint quotes exactly that framing in its first paragraph.
So the fight is over what SoundHound is. Courts confronting software vendors in the middle of communications have split into two camps. One line, associated with Graham v. Noom in the Northern District of California, treats a vendor as an extension of the party, like a tape recorder the business happens to rent, so long as the vendor merely captures and stores data for the business. The other line asks a different question: does the vendor have the capability to use the intercepted contents for its own purposes? If yes, it is a third party, whatever the contract calls it. The Ninth Circuit’s Javier v. Assurance IQ decision confirmed that CIPA section 631 applies to internet-era communications at all, and the capability question has been the live battleground since.
For AI phone agents specifically, there is now a directly on-point ruling. On August 11, 2025, Judge Susan Illston of the Northern District of California denied a motion to dismiss in Taylor v. ConverseNow Technologies (No. 25-cv-00990-SI), a case whose facts read like a first draft of this one: a California woman ordered Domino’s pizza by phone, the call was routed through an AI vendor’s servers, and her name, address, and card details were recorded without disclosure. Judge Illston adopted the capability approach over the extension approach for section 631, and the plaintiff’s allegation that ConverseNow uses recorded conversations to improve its own AI services was central to the vendor’s third-party status. Both the section 631 and section 632 claims survived.
Read Thompson’s complaint against Taylor and the engineering becomes legible. The agency disclaimer in paragraph 16 exists to lock SoundHound out of the extension theory: an independent contractor exploiting call contents for its own model training is the textbook capability-test defendant. The training allegation is not color. It is the element. And the anti-removal paragraphs keep the question in front of a state judge who is not bound by any of the federal district splits and could write the first California state court opinion on whether an AI answering agent is an eavesdropper.
The other two CIPA counts are weaker and stronger in opposite ways. Section 632 requires a “confidential communication,” which California measures by whether a party objectively and reasonably expected the conversation not to be overheard or recorded. A burrito order placed to a fast-casual chain is a hard sell as confidential, and defendants will lean on that. But Thompson’s section 632 theory rides on the payment card recitation, which is a more plausible candidate for a reasonable confidentiality expectation than the order itself, and the ConverseNow court let a materially identical 632 claim past the pleading stage. Section 632.7, covering communications involving cellular phones, cuts the other way: the California Supreme Court held in Smith v. LoanMe that it prohibits recording without consent by parties as well as eavesdroppers, which means it can reach SoundHound even if the party exception rescues it under 631.
Technical claims audit
The publication standard for this series is grading the complaint’s technical assertions against documented system behavior. Four claims carry the case.
Calls are routed to and answered by SoundHound’s systems, not the restaurant’s. Consistent. This is the published architecture of cloud phone AI and the entire commercial premise of the product. SoundHound’s own press materials describe an AI service answering restaurants’ phone lines and processing orders end to end. No one will litigate this.
Calls are recorded and transcribed in real time. Consistent. Streaming transcription is definitional to a voice agent. Whether raw audio is persisted after the session, as opposed to processed and discarded, is a retention configuration question the complaint does not and cannot answer from outside. The distinction matters for damages theater but not for the interception element, which concerns acquisition, not storage.
SoundHound retains and reuses call contents to train its AI models. Contested, and this is the fulcrum. The allegation is plausible: improving recognition and dialogue models on production traffic is standard practice across the industry, and SoundHound’s marketing celebrates learning from over 100 million interactions. But plausible is not proven, and the details control the legal outcome. Training on de-identified aggregate transcripts, training on raw audio, and training on nothing at all because a given enterprise contract forbids it are three different worlds under the capability test. If discovery shows Chipotle call data flowing into Polaris training runs, the third-party question is effectively answered. If it shows contractual training carve-outs and short retention windows, SoundHound’s tape-recorder argument gets much stronger.
SoundHound shares call data with AI vendors such as OpenAI. Underspecified, in an instructive way. The phrase comes from SoundHound’s own partner privacy policy, so the policy text is real. But a policy disclosure that data may flow to an LLM provider most plausibly describes inference-time subprocessing: sending a transcript to a language model API to parse an ambiguous request is processing a call, not building a corpus. API providers’ default enterprise terms do not train on customer API traffic. The complaint’s framing invites a reader to picture order audio landing in a foundation model’s training set, which is a materially different act from the one the policy language most likely describes. Discovery into the subprocessor agreement resolves it in a day. Until then, this allegation proves disclosure of a data flow, not the nature of the flow.
What discovery would settle it
Five artifacts decide this case, and none of them are legal documents. The retention configuration for the Chipotle deployment, with timestamps and TTLs, answers what copies exist. The training data manifests for Polaris and the dialogue models answer whether production calls feed model development, and dataset lineage records would show it per client. The master services agreement and data processing addendum between SoundHound and Chipotle answer the party question better than any brief: a contract that grants SoundHound rights to use call data for its own product improvement is the capability test satisfied in writing, while processor-only language pointing the other way is the extension theory’s best exhibit. The IVR greeting configuration history answers what callers were actually told, deployment by deployment, date by date. And the subprocessor agreement with any LLM provider answers what “sharing with OpenAI” actually is.
Note the irony buried in the contract question. The complaint disclaims agency because agency defeats the eavesdropper theory. Expect the defense to argue the opposite with equal energy: that SoundHound acts purely on the restaurant’s behalf, as its instrument. A vendor that spent years marketing itself as an “independent voice AI” company, language the complaint quotes back at it, may now discover the commercial branding of independence has a litigation cost.
The ruling to watch
The first written law in this case arrives at the demurrer, where SoundHound will almost certainly attack the CIPA counts on the party exception and confidentiality. The forks are clean. If the Alameda County court follows Taylor v. ConverseNow and adopts the capability approach, the training allegations carry section 631 into discovery and the case becomes a document fight over data flows. If the court instead adopts the extension theory, the 631 count dies, and the case narrows to section 632.7, where Smith v. LoanMe keeps parties on the hook for recording cellular calls without consent, and to whether a payment card number recited to a burrito line is confidential.
Either path produces the first state court answer to a question that currently lives only in federal district opinions that bind no one. And either path changes deployment behavior. The cheap compliance fix is an upfront disclosure played before routing: this call is answered and recorded by an AI service operated by a third party and may be used to improve it. Every vendor knows that sentence costs conversions, which is exactly why nobody plays it today. A ruling that makes the sentence mandatory reprices AI phone answering across California. A ruling the other way invites every vendor contract to be rewritten with agency language and training carve-outs for California callers, which quietly accomplishes half of what the statute wanted anyway.
There is precedent for statutes reshaping this exact product category. In 2022, a Cook County class action under Illinois’s biometric privacy law targeted the automated voice ordering systems at Chipotle, Applebee’s, and others, naming SYNQ3 among the defendants. SoundHound then bought SYNQ3. Privacy statutes with per-violation damages have been circling restaurant voice AI for four years. CIPA is simply the sharpest instrument yet, because it needs no biometric hook, only an undisclosed listener.
Limits
Everything above the line describing SoundHound’s internal data practices is allegation, marketing text, or engineering inference from how these systems are ordinarily built. SoundHound has not answered the complaint as of this writing, and its retention, training, and sharing practices for restaurant calls have not been tested by discovery. The complaint’s description of the pipeline comes from public materials, not from inspection of SoundHound’s systems. Deployment configurations, including what greeting a given restaurant plays, vary by client and may have changed over the class period. A pleading is one side’s theory stated as favorably as the rules allow, and the strongest version of the defense, that SoundHound is a mere instrument of restaurants that themselves consented, has not yet been written.
Frequently asked questions
Does California’s wiretap law apply to AI answering phone calls?
No appellate court has decided it. At the trial level, the closest ruling is Taylor v. ConverseNow, where a federal judge in August 2025 allowed CIPA wiretapping and recording claims against an AI phone ordering vendor to proceed, holding that a vendor with the capability to use call contents for its own purposes can be a third-party eavesdropper. Thompson v. SoundHound will test whether a California state court agrees.
Is a food order a confidential communication under CIPA?
Section 632 protects communications where a party reasonably expects no one else is listening or recording. Courts judge this objectively, and a routine order to a chain restaurant is a weak candidate. The stronger version of the claim focuses on the payment card number spoken during the call, and a nearly identical claim survived dismissal in the ConverseNow case.
What are the damages under CIPA?
Section 637.2 provides $5,000 per violation or three times actual damages, whichever is greater, and requires no proof of actual harm. In a class action where each intercepted call is a potential violation, exposure scales with call volume, which is why vendors processing tens of millions of calls face notional numbers in the billions.
Does “this call may be recorded” cover AI transcription and model training?
That is one of the live questions. The Thompson complaint alleges the generic warning identifies only the restaurant and discloses nothing about a third party transcribing the call or reusing its contents for AI training. Whether generic recording notices constitute consent to vendor-side uses is exactly the kind of issue the demurrer ruling will begin to answer.
Court records cited by caption, court, county, and filing date were retrieved from a commercial index of state trial court dockets on August 16, 2026. Quotations from the complaint are from the filed class action complaint in Thompson v. SoundHound AI, Inc., Alameda County Superior Court, filed July 30, 2026. Allegations are exactly that: SoundHound had not answered the complaint as of the retrieval date, and nothing here is legal advice. This piece is part of an ongoing series on AI cases in state courts. The series opener on why AI lawsuit counts are broken and the companion analysis of whether an LLM is a product cover the wider docket.