Key findings
- Notice depends on the platform. Zoom and the Google Meet SDK ask participants to approve the bot. Elsewhere the bot joins, and participants must remove it unless the 1-hour email notice is on.
- Morgan State University, CUSM, UW-Madison, Case Western Reserve, and Virginia Tech publish IT guidance that names Fireflies among the bots they block, deny, or warn about.
- Cruz v. Fireflies.AI Corp., filed December 18, 2025, alleged that speaker recognition collects voiceprints without the notice and written consent Illinois law requires, and the plaintiff dropped it on March 11, 2026. The same claims continue in Fricker v. Fireflies.AI Corp., where Fireflies' request to dismiss the case has awaited a ruling since briefing closed on August 26, 2026.
- Fireflies' Privacy Policy, updated September 28, 2026, answers the Illinois law directly. Service providers may extract voice data to tell speakers apart, and Fireflies destroys it within three years of a person's last interaction.
Lock auto-join, recap recipients, and link access at the team level before rollout, because Fireflies' defaults send meetings outside your company. By default the notetaker joins every calendar meeting with a conferencing link, emails a recap to every invitee, and opens the meeting to anyone with the link. Those defaults explain why universities block the bot and why participants get recaps from a tool they never signed up for. A consolidated Illinois class action now tests how its speaker recognition handles voice data.
What the defaults send out
Three settings decide how far a Fireflies meeting travels. Auto-join is set to all meetings by default, so the notetaker attends every calendar event with a conferencing link, including meetings other people host. The recap email goes to everyone on the invite, internal and external. New meetings open to teammates and anyone with the link, so a forwarded recap opens the meeting for whoever clicks it.
Fireflies explains that a non-user receives a recap because someone in the meeting used Fireflies. That recap is also how the product spreads. One Product Hunt reviewer's business adopted Fireflies after receiving notes from a client meeting.
How participants are told
Checked against Fireflies' documentation on October 12, 2026.
- Hosts can remove Fireflies.ai Notetaker from the participant list. If they remove it within 3 minutes, Fireflies creates no transcript or notes.
- Zoom and the Google Meet SDK show an approval prompt, and Fireflies does not join if anyone declines. Elsewhere the flow is opt-out.
- An optional email one hour before the meeting announces recording and lets invitees decline. An optional chat message announces the bot and lists /ff pause and /ff leave. Fireflies' FAQ says /ff pause and /ff resume work only on Google Meet.
- Take Notes on the desktop app has no bot. Its audio notice, camera watermark, and Mac chat message are on by default, and a user who turns them off must notify participants another way.
- The Terms of Service make the user responsible for ensuring each participant consents to recording.
- Only the meeting owner can delete a meeting. A participant without a Fireflies account asks the host, or emails support@fireflies.ai if the host does not respond.
Why organizations block the bot
Since June 2026, Morgan State University has rejected unauthorized AI notetakers, including Fireflies.ai, from university-hosted Zoom meetings. Such tools store recordings, transcripts, and participant information outside the university's managed environment. CUSM places external participants in a Teams lobby and tells hosts to deny accounts such as Fireflies.ai. UW-Madison warns that connecting a calendar lets bots join uninvited. Case Western Reserve has blocked Fireflies.ai across Zoom, Teams, and Meet since September 12, 2025. Such tools rejoin future meetings without other attendees' consent and the university holds no enterprise contract with the vendors. Virginia Tech's March 2026 notice lists Fireflies.ai among tools not authorized for university use.
IT administrators report the same pattern inside companies. In an October 2025 r/sysadmin thread, one admin found Fireflies adding itself to every meeting of users who clicked its link and spreading across Teams. Blocking the app did not stop it, and only deleting each Fireflies account did. Another admin traces the spread to tenants that let users consent to apps for the whole organization. An MSP switched to Copilot in 2026 after Fireflies became, in the poster's words, spammy and virus-like. Fireflies documents how to disable auto-join and remove the bot from scheduled meetings.
The Illinois biometric suits
The complaint in Cruz v. Fireflies.AI Corp., filed in the Central District of Illinois on December 18, 2025, alleged that Fireflies records, analyzes, and stores the voices of meeting participants, including people who never used Fireflies. It alleged that speaker recognition creates voiceprints without the notice, written consent, and retention policy that Illinois' Biometric Information Privacy Act requires. The plaintiff dismissed the case without prejudice on March 11, 2026, before Fireflies answered.
The same law firm filed Fricker v. Fireflies.AI Corp. in the Northern District of Illinois on March 10, 2026, for a plaintiff who joined meetings at a company that used Fireflies. The court consolidated it with Martinez v. Fireflies.AI Corp. on June 4, 2026 and stayed discovery on July 8. Fireflies asked the court to dismiss it on July 15, for lack of personal jurisdiction and failure to state a claim, and briefing closed on August 26, 2026.
Fireflies' current Privacy Policy states that its service providers may extract voice characteristics to tell speakers apart and never to identify people. It says Fireflies does not receive that data on its own servers and that the data is destroyed within three years of a person's last interaction. The allegations are unproven, and GILD offers no legal opinion.
A meeting policy that holds
Lawyers commenting on the Cruz case recommend vendor due diligence, clear notice and consent at the start of each meeting, access restrictions, and retention periods aligned with legal holds.
- Name the meeting types the notetaker may join, and limit auto-record to meetings your team hosts.
- Send recaps to your own team by default, and share with outside participants deliberately.
- Set the default access level to participants or teammates, and decide whether teammates may create public links.
- Turn on the 1-hour email notice and the in-meeting message, and keep the desktop notices on.
- For HR, legal, and medical meetings, use Recording Rules to skip them, or on Enterprise a recording mode that keeps no audio.
Methodology
GILD checked Fireflies' joining, recap, privacy, and consent documentation on October 12, 2026, alongside its Privacy Policy and Terms of Service, and rechecked the consent and deletion pages on October 25, 2026. GILD read the legal sources on October 25, 2026. They are the Cruz complaint, The National Law Review on January 8, 2026, Top Class Actions on March 19, 2026, and the Cruz and Fricker dockets on CourtListener. Organization sources are IT pages from Morgan State, CUSM, UW-Madison, Case Western Reserve, and Virginia Tech. Other accounts come from 2025 and 2026 r/sysadmin and r/msp threads and the public accounts on GILD's Fireflies page. GILD offers no legal opinion, and recording and biometric law varies by jurisdiction.
Products in this piece
Sources
- Official documentation
- 12
- Public source
- 14
- Fireflies Knowledge Base: How to stop Fireflies from auto-joining your meetings
- Fireflies Knowledge Base: Auto-join and email recap settings
- Fireflies Knowledge Base: How to configure privacy settings for your meeting recaps
- Fireflies Knowledge Base: Why did I get a meeting recap if I don't have an account?
- Fireflies Knowledge Base: Recording consent and meeting compliance
- Fireflies Knowledge Base: How to remove Fireflies from a meeting or stop it from joining
- Fireflies Knowledge Base: How consent notifications work on the Desktop App
- Fireflies Privacy Policy (updated September 28, 2026)
- Fireflies Terms of Service (updated September 28, 2026)
- Fireflies Knowledge Base: Updates to our Privacy Policy, Terms of Service & DPA
- Cruz v. Fireflies.AI Corp., class action complaint, C.D. Ill. No. 3:25-cv-03399 (Dec 18, 2025)
- The National Law Review: Illinois BIPA Suit Targets AI Note-Takers (Jan 8, 2026)
- Top Class Actions: Fireflies.AI sued over alleged unlawful data collection from meeting participants (Mar 19, 2026)
- Morgan State University: AI Meeting Note-Taking Tools (Jun 10, 2026)
- CUSM Help Desk: Stopping AI note-taking bots from joining university Teams meetings (Apr 21, 2026)
- UW-Madison KnowledgeBase: Zoom third-party AI assistant bots (Mar 27, 2025)
- Case Western Reserve University: Learn about upcoming third-party AI note-taker application block (Aug 27, 2025)
- Virginia Tech Division of Information Technology: Use of unauthorized AI meeting assistants (Mar 11, 2026)
- Reddit r/sysadmin: Teams meeting AI note taker virus (Oct 7, 2025)
- Reddit r/sysadmin: user consent settings behind the Fireflies spread (Oct 7, 2025)
- Reddit r/msp: AI Transcribing (Apr 28, 2026)
- Jimmy Acton, Product Hunt review of Fireflies.ai (Nov 11, 2025)
- CourtListener: Cruz v. Fireflies.AI Corp., 3:25-cv-03399 (C.D. Ill.) docket (viewed Oct 25, 2026)
- CourtListener: Fricker v. Fireflies.AI Corp., 1:26-cv-02675 (N.D. Ill.) docket (viewed Oct 25, 2026)
- Fireflies Knowledge Base: How to delete meetings in Fireflies
- Fireflies blog: Ensuring meeting compliance with Fireflies AI Notetaker (Nov 22, 2022)