Image: Pexels.
If an AI vendor answers your phones, transcribes your agents' calls or suggests their replies, this ruling tells you what saved Google and what didn't. Callers who had agreed to a privacy policy saying call recordings go to "service providers" had consented to Google listening. The caller who never agreed to anything had a real argument, and lost only on a pleading point he gets to fix.
Event date: October 22, 2026, two orders by Judge Rita F. Lin in the Northern District of California. First reports: October 23, 2026, by Courthouse News and Bloomberg Law (19:34 UTC).
Who needs this checklist
Anyone whose support line in California runs through a third-party AI product: a virtual agent that picks up first, live transcription, agent assist with "smart replies," or call analytics. The case is about Google, but in our reading nothing in the theory is specific to Google: it's a vendor listening to a call it isn't a party to. Our verdict: the order helps vendors and the companies that deploy them, but only where the caller agreed to a policy that covers the vendor.
What the court decided
The case is In re Google Cloud Contact Center AI Privacy Litigation, No. 23-cv-05437-RFL. It began as Ambriz v. Google: Misael Ambriz sued in October 2023 over calls to Verizon, the court dismissed with leave to amend in June 2024, and the amended complaint added callers to Hulu, GoDaddy and Home Depot. In February 2025 the same judge refused to dismiss that amended complaint, finding the consumers had adequately alleged Google's capability to use the call data to improve its models. The motions decided now were argued on October 13.
On October 22 the judge issued two orders. The first sent three plaintiffs, who had arbitration agreements with Verizon, Uber and Discover, to arbitration and stayed their claims. The second dismissed the three Home Depot callers, whose only claim was under Section 631(a) of the California Invasion of Privacy Act.
Screenshot: order granting motion to dismiss, Dkt. 141, N.D. Cal., October 22, 2026, via CourtListener. Captured October 24, 2026.
What the complaint says the product does matters for your own setup. Per the order's summary of the complaint, the caller "first speaks with Google's 'virtual agent,'" which "does not disclose that it is provided by Google." After a transfer, Google keeps listening and gives the human agent "a real-time transcript, suggested articles, and 'smart replies.'" The complaint also says Google "has the capability" to use the recordings to improve its own models. Those are allegations, not findings.
Why two callers lost and one didn't
The two callers with Home Depot accounts had agreed to account terms that pulled in Home Depot's Privacy and Security Statement. That statement said Home Depot collects audio recordings of "customer care calls" and discloses them to "service providers that process information on [Home Depot's] behalf." The judge's conclusion: "Those 'service providers' plainly include Google."
Screenshot: Dkt. 141, page 5. Captured October 24, 2026.
Their other arguments failed too. The policy didn't say "real time," but "there is no reason to assume some kind of delay is built into that disclosure." It didn't name Google, but nobody showed why Google wasn't a "service provider." On training, the judge said Section 631(a)(3) only punishes using information that was obtained unlawfully in the first place. Home Depot's statement "did not say service providers' access to calls would be conditioned on them only using the calls for certain purposes."
The third caller, Christopher Barulich, didn't allege a Home Depot account, and Google hadn't shown he ever saw the policy. That calls are commonly recorded "does not establish that Barulich impliedly consented to share the recording of his call to an unannounced third party." He adequately pled lack of consent.
All three still lost on intent. The court held that the defendant must intend every element, "including the lack of consent," and the complaint only repeated the statute's words. At oral argument, plaintiffs' counsel conceded that if Home Depot had told Google it obtained consent and Google reasonably relied on that, Google couldn't be liable.
The checklist: an AI vendor on your phone line
Run it against your own call flow. Each line comes from something the court weighed.
| # | Check | Why, from the October 22 orders | Pass if |
|---|---|---|---|
| 1 | Your privacy policy names call recordings and disclosure to service providers | That language is what defeated the account holders' claims | A reader could tell a third party may get the call |
| 2 | Account holders actually agree to that policy | The terms "incorporated" the statement; that's how consent attached | Signup terms incorporate the policy by reference |
| 3 | Callers without an account hear a notice before the AI picks up | Barulich never saw the policy and plausibly alleged no consent | The first seconds of the call name recording and outside AI processing |
| 4 | The notice covers live listening, not only recording | The judge read "disclose" without a delay, but that's one judge's reading | It says calls may be processed live by service providers |
| 5 | You decided whether the vendor may train on your calls | The policy here didn't limit use, and the court treated that as consent to collection; consent is "strictly construed in scope" | The contract and the policy say the same thing about training |
| 6 | The vendor contract says who obtains consent | Google argued its contract made Home Depot responsible; the court found that relevant, though not always enough | One named party owns consent, in writing |
| 7 | You keep dated copies of every policy version | Home Depot had "several different versions" in the class period | You can produce the version live on any call date |
On row 5, our view is that the safest answer is a short yes or no in the policy. Home Depot's current statement lists "Customer care and software-based customer care analysis" and "Training" among the reasons it collects recordings, and says it discloses them to service providers "such as security and fraud prevention services." Those examples don't mention AI or call analytics. The order quotes only the "service providers that process information on [Home Depot's] behalf" part, so we don't know whether the versions the judge read carried the same examples. Don't count on a vague list holding up for you.
Screenshot: Dkt. 141, page 8. Captured October 24, 2026.
How to adapt it
- Small team, one vendor: rows 3 and 6 are the ones to do this week. A recorded line at the top of the call costs nothing. A consent clause is one paragraph in the order form.
- Calls from people with no account: treat row 3 as mandatory. That's the caller the court said had consented to nothing.
- Arbitration clauses: the arbitration order read each company's privacy policy and its customer agreement "together as a single contract," which let Google, a non-party, send three plaintiffs to arbitration. Whether you want that is a question for counsel. The order shows the policy and the terms work as a pair.
- SB 690 doesn't help here. It amends section 637.2 for pen register claims only, so Section 631 wiretap claims still carry statutory damages of $5,000 per violation. Our SB 690 explainer covers which CIPA suits it ends.
What people said
We found no forum thread, video or social post about this ruling, so there's nothing to embed here. The closest public conversation is a r/law thread from October 20 on New York City's proposal for a one-touch route to a human. One commenter, u/K_Linkmaster, wrote: "I also have one that will hang up unless you consent to a voice print." Another, u/DrE7HER, described an agent that "spoke / paused like a bot and denied it was a bot." Neither is about Google. Both describe the caller in row 3: someone who doesn't know who, or what, is on the line.
What this doesn't cover
This is a dismissal with leave to amend, not a win on the merits. The three Home Depot callers can refile by November 12, 2026, and the judge left room for facts showing Google "knew Home Depot was not obtaining customers' consent." The ruling is one federal judge applying California law; it binds no other court. It says nothing about Section 632 eavesdropping claims for the Home Depot callers, about other states' all-party consent laws, or about disclosure rules for AI agents.
We read both orders, Home Depot's current privacy statement and SB 690's text on October 24. We couldn't read the operative complaint, Google's contract with Home Depot or the paywalled Law360 and MLex coverage of the October 13 hearing, and Bloomberg Law only past its first paragraphs. We don't know whether Google trains on these calls: the order recites only the complaint's claim that it "has the capability." Neither side commented to Courthouse News.
