Fathom (meeting AI)

Does Fathom train on your meeting recordings? No training on any tier, a meaningfully better default than the main alternative in this category.

Plain-English risk rating: 3 of 5 (Free/Premium) / 2 of 5 (Team Edition with custom contract)

Fathom is a meeting-AI tool focused on Zoom, Google Meet, and Microsoft Teams call summaries. Unlike Granola's silent bot-free architecture, Fathom uses a visible-bot model — "Fathom Notetaker" appears as a named participant in your meetings. This is the same architecture as Otter.ai and Fireflies.ai. Otter is defending a consolidated class action over consent and biometric voiceprint collection. Fireflies is not. Corrected 3 September 2026: this profile described both as currently defending class actions. Cruz v. Fireflies.AI Corp. was VOLUNTARILY DISMISSED on 11 March 2026 under Rule 41(a)(1)(A)(i), before Fireflies filed any responsive pleading. Nothing was decided. (Verified 3 September 2026 against the Justia docket for 3:25-cv-03399 and the complaint itself.) Fathom has so far avoided similar litigation, which appears to be a combination of (a) contractual training exclusions binding its third-party sub-processors, though Fathom’s own first-party training remains on by default across every tier, (b) cleaner participant disclosure (the visible bot at least signals to all attendees that recording is happening), and (c) smaller market footprint making it a less attractive plaintiff target.

The CyberUnit April 2026 privacy comparison of six widely-used meeting tools ranked Fathom as "Medium" data-sharing risk vs Otter.ai's "High" — a meaningful differentiator if you are choosing between the two during the litigation pendency.

Recommended for

  • Sole proprietor: Free tier (genuinely generous — unlimited recordings and basic summaries) acceptable for personal use; Premium at $19/month (or $16/month annual) for unlimited calls and advanced summaries.
  • Small team (2-10 people): Team Edition at $15-29/user/month for shared workspaces and admin controls.
  • Regulated industry: Custom contract with explicit no-training, BAA where applicable (Fathom claims HIPAA compliance), and disabled cross-organisation sharing features.
  • The honest answer for most 1-10 employee businesses: Fathom and Otter both train their own models on de-identified meeting content by default. Fathom’s advantages over Otter are the visible bot and the absence of calendar auto-join surprises — not the training default. Turn training off in settings before any client work, on either tool. The biometric-data exposure from cloud audio upload applies to both. Granola was previously recommended here as the structurally-better alternative; that recommendation was withdrawn on 3 August 2026 following the class action filed against Granola on 30 July 2026.

Critical pre-deployment warning (consent and recording compliance)

Fathom's visible bot architecture provides automatic disclosure that recording is happening — every participant can see "Fathom Notetaker" in the participant list. This is a meaningful privacy-and-compliance advantage over Granola's silent operation. However, visible-bot disclosure alone may not satisfy all-party consent requirements in some jurisdictions. California, Washington, Florida, Illinois, Maryland, Massachusetts, Montana, Nevada, New Hampshire and Pennsylvania in the US require the consent of every party to a recorded conversation, and their law may reach your call if a participant is sitting in one of them. Corrected 3 September 2026: this sentence previously also listed "the EU under GDPR" and "New Zealand under the Privacy Act 2020" as requiring affirmative consent. Neither belongs there. New Zealand is a one-party consent jurisdiction under s216B(2) of the Crimes Act 1961, where a participant may lawfully record. The GDPR is a lawful-basis regime rather than an all-party consent rule — consent is only one of its six bases, and it is frequently not the one an organisation relies on. What both regimes do require is that you tell people what you are collecting and why: in New Zealand that is information privacy principle 3 of the Privacy Act 2020, a notification duty rather than a consent one.

The right practice for any external meeting: verbal disclosure at the start ("I'm using an AI tool to take notes and create a summary of our call") plus a meeting-invite line item disclosing AI use. The visible bot is the floor; affirmative consent is the standard.

Data retention default

  • Standard Fathom retention for transcripts and summaries
  • AI provider retention per contractual arrangements (typically zero-retention for paid tiers)
  • Account deletion removes Fathom-side stored content; user can request complete data deletion at any time
  • End-to-end encryption for recordings and transcripts (per Fathom security documentation)

Tracking and advertising, documented 24 August 2026. This surface was not covered in earlier versions of this profile:

  • Fathom works with third party advertisers to show ads for its own service. Some are members of the Network Advertising Initiative or the Digital Advertising Alliance, so opting out runs through those bodies rather than through Fathom
  • Analytics run through Google Analytics and HubSpot. Fathom states that Google may use the collected data to contextualise and personalise ads on its own advertising network
  • Email open tracking is in use. The policy now describes tracking pixels used to build recipient profiles based on observed preferences and interests, in order to deliver tailored content or advertising. Consent is obtained only where applicable law requires it
  • Fathom does not respond to Do Not Track signals. It does honour the Global Privacy Control

Controller position, changed 16 August 2026. Fathom removed its statement that it is the entity responsible for processing your personal information. The policy now deems the customer the controller wherever the EU GDPR, the California Consumer Privacy Act, the UK GDPR, the UK Data Protection Act or any similar law applies, states that the customer solely determines the purposes and means of processing, and directs data subjects to contact the customer rather than Fathom. If you deploy Fathom across your business, more of the legal obligation sits with you than it did before.

Training opt-out

Fathom trains its OWN models on de-identified customer data by default. Opt-out is available but must be switched on.

Two questions must be kept apart, and Fathom answers only the first one loudly. Third-party sub-processors (Anthropic, OpenAI, Google) are contractually barred from training on customer data. That part is genuine, and the current policy states it plainly: Fathom does not authorise third parties to use your personal information or Meeting Content Information to train their AI models. Fathom itself uses de-identified Meeting Content Information to train, improve and customise its in-house models, by default, across tiers. Users opt out in My Settings; Team Edition organisations can opt out everyone from Organization Settings. This is materially the same posture as Otter.ai’s Free/Pro tiers, not a differentiator from it.

Re-verified 24 August 2026 against the live policy, last updated 16 August 2026. The training and opt-out position above was checked word for word and is unchanged.

Corrected 3 August 2026. This profile previously stated that training was contractually excluded across all tiers. That was wrong — it conflated the sub-processor exclusion with Fathom’s own first-party training. The error was ours. One further correction, 24 August 2026: that note went on to say Fathom’s policy was “last updated 11 August 2025” and “has not changed”. Both statements are now out of date, because Fathom rewrote the policy on 16 August 2026. A third correction, 2 September 2026: five statements elsewhere on this page still described Fathom’s training default as clearer or structurally better than Otter’s, contradicting the corrected position directly above them. They have been rewritten. Checked against this site’s own Otter profile, which records de-identified training as the default on Otter Free and Pro and contractually excluded at Enterprise.

For any team handling client-sensitive content this is a setting to change, not a protection to rely on: training is on by default on every Fathom tier and somebody has to switch it off. Otter’s position is materially the same on Free and Pro, and stronger at Enterprise, where training is contractually excluded and on Fathom it is not.

Zero Data Retention availability

  • Available at Team Edition and Enterprise tiers via zero-retention API arrangements with model providers
  • End-to-end encryption applied to all recordings and transcripts at-rest

Plan tiers and pricing (as of early 2026)

TierPrice (USD)Training defaultSuitable for
Free$0Own models: yes (de-identified, opt-out) / Third parties: noPersonal use; genuinely generous unlimited recordings
Premium$19/month ($16/month annual)Own models: yes (de-identified, opt-out) / Third parties: noIndividual professionals
Team Edition$15-29/user/month (tier-dependent)Own models: yes (de-identified, opt-out) / Third parties: noSmall teams with shared workspaces
EnterpriseCustomOwn models: yes (de-identified, opt-out) / Third parties: noLarger orgs needing SSO, custom contracts

Jurisdiction

  • Primary processor: Fathom Video Inc., San Francisco, California, USA
  • Cloud infrastructure: AWS
  • SOC 2 Type 2 certified; GDPR-compliant; claimed HIPAA compliance (verify per contract for regulated use)
  • Subject to California privacy law (CCPA/CPRA), California Invasion of Privacy Act, BIPA (Illinois) for voice biometric considerations

Breach history (public incidents)

No major public breach of Fathom infrastructure as of May 2026.

No publicly-disclosed Fathom-specific class action litigation as of May 2026 — in contrast to Otter.ai (In re Otter.AI Privacy Litigation, consolidated October 2025) and Fireflies.ai (Cruz v. Fireflies.AI Corp., filed December 2025 and voluntarily dismissed 11 March 2026). Why Fathom has not been a target so far appears to be a combination of: (a) sub-processor training exclusions that are genuinely clearer than Otter’s, Fathom’s own first-party training default notwithstanding, (b) smaller market footprint making it less attractive to plaintiffs, (c) visible-bot architecture providing better automatic disclosure than Otter's auto-join behaviour. None of these is a guarantee against future litigation; the BIPA voiceprint question applies to any vendor that performs speaker recognition.

13 August 2026 — the Otter ruling, and why it is recorded on a vendor with no litigation of its own. In In re Otter.AI Privacy Litigation, No. 25-cv-06911-EKL (N.D. Cal.), the court decided Otter’s motion to dismiss on 13 August 2026, granting it in part and denying it in part. The federal wiretap (ECPA), California Invasion of Privacy Act and Illinois biometric claims survived and proceed. Otter had argued it was merely a tool acting for the meeting host. The court declined to accept that at the pleading stage, holding that Otter could be treated as a third-party eavesdropper because it retained the conversations and used them for its own commercial purposes, including training its models.

Fathom is not a party to that case and nothing in the order decides anything about Fathom. It is recorded here because the fact the court relied on is one this profile already documents: Fathom trains its own models on de-identified customer data by default, on every tier — see Training opt-out above. The reasoning in the order is available to plaintiffs against similarly situated products. Whether it reaches Fathom is a question for a court, and no court has been asked.

This cuts against reason (a) in the paragraph above, and we would rather say so than leave it standing. A sub-processor training exclusion — which is Fathom’s genuine strength — is not the thing the Otter court found significant. First-party training is, and Fathom does it by default.

No rating has moved and none should be inferred from this entry. Fathom stays at 3 of 5 (Free/Premium) and 2 of 5 (Team Edition with custom contract). Nothing has been proven on the merits against any vendor named here; the Otter litigation is at the pleading stage. Added 3 September 2026.

Category-level risk: Cloud audio upload means raw biometric data leaves the user's device. This is the same category risk that applies to Otter and any other cloud-transcription product. The mitigation is contractual (no-training, zero-retention) rather than architectural. Fathom's sub-processor exclusions are clearer than Otter’s, but its first-party training default is not better than Otter’s and is weaker than Otter’s Enterprise exclusion. The architectural risk is unchanged either way. If your meetings include Illinois-resident participants, BIPA voiceprint exposure applies regardless of vendor unless the vendor explicitly does not generate voiceprints — verify Fathom's current speaker-recognition implementation per its security documentation.

What this means in plain English for SMB owners

Three honest takeaways:

  1. Fathom's training default is materially the same as Otter’s, and an earlier version of this page said the opposite. Both train on de-identified meeting content by default on their consumer and professional tiers. Otter contractually excludes training at Enterprise; Fathom trains by default on every tier unless you opt out or hold a custom contract. What separates them is the filed litigation against Otter, not the training default. The CyberUnit privacy comparison ranks Fathom “Medium” against Otter’s “High”; we have not verified what drives that ranking and no longer attribute it to a training difference that does not exist.
  1. The cloud audio upload architecture is the same category risk regardless of vendor. If raw audio leaving your devices is a primary concern, no cloud meeting-AI tool in our database avoids it. Granola was previously named here as the better architectural fit; that recommendation was withdrawn on 3 August 2026 — see its profile.
  1. Visible-bot disclosure is the floor, not the ceiling, for consent compliance. Fathom's visible Notetaker bot does meaningful disclosure work — every participant can see recording is happening. But affirmative disclosure (verbal notice at meeting start + invite line item) is the right standard for any external meeting. Corrected 3 September 2026: this previously described New Zealand as a two-party-consent jurisdiction. It is not — under s216B(2) of the Crimes Act 1961 a participant may lawfully record without the others agreeing. New Zealand's actual requirement is the Privacy Act 2020 duty to tell people what you are collecting and why, which is a notification duty rather than a consent one. All-party consent is required in California, Washington, Florida, Illinois, Maryland, Massachusetts, Montana, Nevada, New Hampshire and Pennsylvania, whose law may reach your call if a participant is there.

Sources

  • Fathom security and privacy documentation (fathom.video/security, verified 2026-05-24)
  • Fathom trust documentation for current certifications
  • ScreenApp: Fathom AI Review Free Meeting Assistant 2026 (March 2026)
  • Fahimai: Fathom AI Note Taker Worth It in 2026 review (May 2026)
  • CyberUnit: AI Meeting Recorders Are Collecting More Than You Think comparison (April 2026)
  • National Law Review: When AI Takes Notes Protecting Privilege Privacy and Professional Obligations (March 2026)
  • Reworked: Your AI Notetaker May Already Be Breaking the Law (April 2026)
  • Basil AI: Your Voice Is Being Harvested BIPA Lawsuit Wave (May 2026)
  • Mason LLP: Your AI Meeting Assistant May Be Stealing Your Voiceprint (April 2026)

Related on AI Leakage