OpenAI Wiretapping

A document summarizing allegations, lawsuits, and regulatory controversies over OpenAI's voice AI collecting and transcribing conversations without authorization.

OpenAI Wiretapping

Overview

“OpenAI Wiretapping” (오픈AI 도청) is a term collectively referring to allegations that OpenAI's speech recognition and conversational AI services collect, store, and transcribe users' conversations without sufficient notice or consent, along with the lawsuits, regulatory investigations, and media reports that followed. Technically, the core concern is the infringement of privacy and communications secrecy that occurs when microphone input is transmitted to the cloud and converted into text; legally, the issue is whether this violates wiretapping prohibitions and personal information protection laws in various countries. The word “wiretapping” itself is a contentious expression: critics emphasize the possibility of always-on listening, while OpenAI emphasizes that the feature is activated directly by the user.

Main Content

Background: Spread of Voice AI

OpenAI released its speech-to-text model Whisper as open source in 2022, and introduced voice conversation mode to the ChatGPT mobile app in 2023. In May 2024, it unveiled GPT-4o and began supporting real-time voice conversations; in this process, the always-on streaming structure for reducing latency drew attention. As use cases such as voice assistants, automated meeting minutes, and call center consultation analysis rapidly expanded, the question of “where normal service use ends and wiretapping begins” became serious.

Technical Structure and Collection Paths

A typical voice AI pipeline goes through the steps of ① microphone input, ② encrypted streaming transmission, ③ server-side speech recognition, ④ text conversion and storage, and ⑤ deciding whether to use it for model improvement. The controversy focuses on steps ③–⑤. Criticism has been raised that it is unclear how long original audio is retained, whether transcribed text is reused as training data, and whether audio delivered through third-party APIs or plugins is stored separately. In particular, as the open-source Whisper was used by hospitals, counseling institutions, and others on their own, the issue of conversation collection through paths not directly controlled by OpenAI also came to the fore.

Legal Issues

In Korea, under the Protection of Communications Secrets Act, recording or wiretapping by a third party who is not a party to the conversation is in principle prohibited, and under the Personal Information Protection Act, voice information is treated as highly sensitive information. In the United States, the federal Wiretap Act and state laws apply, and some states, including California and Illinois, adopt an “all-party consent” principle requiring the consent of all participants in a conversation, so even merely using an AI assistant can create grounds for illegality. In the European Union, based on the GDPR, lawfulness of processing, purpose limitation, and guarantee of data subject rights are at issue. In addition, claims for damages through class actions, the possibility of punitive damages, and the interpretation of data processing agreement (DPA) provisions with corporate customers are also treated as major issues.

Major Controversy Cases

Media reports in 2024 revealed that medical institutions were widely using Whisper for transcribing examinations and consultations, raising patient privacy concerns. In the same year in the United States, class actions were filed one after another alleging that the methods of collecting and using voice data violated wiretap laws and privacy laws. On the regulatory side, a representative case is Italy's data protection authority (Garante) imposing sanctions on ChatGPT's operation for violations of privacy law, and supervisory authorities in various European countries and Korea's Personal Information Protection Commission have also begun inspections and drafting guidelines. The controversy over wearable AI devices (such as Rabbit R1 and Humane Pin) with always-on recording features also spread the “AI wiretapping” discourse.

OpenAI's Position and Counterarguments

OpenAI explains that the voice feature works only when explicitly activated by the user, and that conversation content is processed according to the terms of service and privacy policy. It also provides an opt-out procedure for not using conversations for model training. The opposing camp points out that the term “wiretapping” is overly provocative and that the actual service is processing at the user's request. Critics, on the other hand, take issue with the fact that the opt-out procedure is complicated and the default is closer to collection and use, and that corporate and consumer policies differ, causing significant confusion.

Social Impact

Companies have increasingly reorganized their video conference and call recording policies and established prior consent procedures when introducing AI meeting assistants. In sectors handling sensitive information, such as education, healthcare, and finance, there have also been moves to postpone the introduction of voice AI itself or switch to on-premises (own server) methods.

Latest Trends

In 2024–2025, OpenAI greatly increased the proportion of voice processing by expanding real-time voice conversations and agent features, and accordingly revised its privacy policy and transparency reports several times. In the European Union, a phase began in which the EU AI Act and GDPR apply together, strengthening purpose limitation and notice obligations for voice data, and regulatory authorities in Korea and other countries continue to conduct preliminary inspections and announce guidelines on the processing of voice and video data by generative AI services. Technologically, on-device speech recognition and edge processing are emerging as alternatives, and “AI assistants without cloud transmission” are being presented as a next-generation differentiator. At the same time, as AI meeting assistants and wearable recording devices continue to spread, whether product-level designs that enforce obtaining consent from all participants will become an industry standard remains a key issue.