The watch answered a question about a meeting that had already ended. I hadn’t been talking to it during the meeting. I asked afterward — “what did we agree on for the Q3 dates?” — and it gave me a clean two-line summary of a conversation I’d never knowingly recorded. The three other people in that room had seen the watch on my wrist — it’s a watch, not a wire — but none of us, me included, had been thinking of it as a recording device. That’s the moment the marketing copy stopped being abstract.
I’d turned on Siri Recap and Live Rewind the morning after the Series 12 announcement, mostly to see what the fuss was about. These features aren’t shipping to the public yet: what I tested was the developer beta seeded alongside the announcement, not firmware on a watch you can buy today. The fuss came from a Bloomberg story published September 11, which quoted legal experts flagging eavesdropping statutes. My instinct, honestly, was that this was overblown. Ninety minutes of testing later I’d changed my mind, and not for the reason I expected.
What the watch is actually doing
Here’s the mechanic, as best I can reconstruct it from behaviour rather than a spec sheet — Apple has been characteristically quiet on the internals. Live Rewind works because there’s a continuous rolling audio buffer. The microphone isn’t waking up when you invoke Siri; it’s already running, holding a short window of recent sound in memory so that when you ask a question about the last few minutes, there’s something to answer from. Siri Recap is the same buffer, extended and periodically transcribed, so you can ask for a summary of a stretch of your day.
The useful analogy is a dashcam. A dashcam is always recording — that’s the whole point — but it only commits footage to storage when something triggers a save. The rest is a loop, overwritten every few minutes. Live Rewind is a dashcam for your conversations. The camera was on before the crash.
To Apple’s genuine credit, the processing appears to be on-device: transcription runs through the Apple Intelligence stack on the paired iPhone or the watch’s own silicon, and the derived text — not raw audio — is what persists, protected under the same on-device model that keeps Siri requests off Apple’s servers by default. I saw no evidence of audio leaving the device. The buffer lives on the wrist. The transcript lives in the local model’s scratch space and, if you save a recap, in a container on the phone.
That architecture is the elegant bit, and it’s a real privacy improvement over anything that streams audio to a cloud. It also has almost nothing to do with the legal question.
The consent problem doesn’t care where the buffer lives
Wiretapping and eavesdropping statutes were written about interception and recording. They generally don’t contain a carve-out for “but the recording never left the device.” The states usually described as two-party (all-party) consent — California, Florida, Illinois, Pennsylvania, Washington, Massachusetts and others, each with its own wrinkles, per the Reporters Committee for Freedom of the Press’s state-by-state recording guide — turn on capturing a confidential communication without the consent of everyone in it. A transcript is arguably a record of the communication. A rolling buffer that can be summoned after the fact is arguably an interception.
I’m not your counsel and I’m not going to pretend this is settled — it plainly isn’t, which is exactly why the experts in the Bloomberg story are hedging. But the shape of the exposure is easy to see. The person wearing the watch consented. The three people across the table did not, and in most cases don’t know a rolling transcript of their words briefly existed. “On-device” answers where the data went. It doesn’t answer who agreed to be recorded. Those are different questions, and consent law only asks the second one.
Now put that watch on a clinician. A HIPAA-covered conversation, buffered and transcribed by a consumer feature Apple never proposed as a business associate, sitting in a container the covered entity doesn’t control. Or put it on someone in a deposition, an HR meeting, a union negotiation. The technology is neutral. The rooms it walks into are not.
An hour in, I went looking for the off switch
This is where I expected to reassure everyone. I couldn’t.
MDM has long-standing restriction keys that touch adjacent surfaces. On a supervised device you can disable Siri outright, disable Siri while locked, disable dictation, and force any dictation that does happen to stay on-device:
Those keys are real and documented — Apple’s Device Management reference lists both allowDictation and forceOnDeviceOnlyDictation as introduced in iOS 14.5 on supervised devices. Kill allowAssistant and you take Siri — and the features that ride on it — with it. That’s the blunt instrument, and for a locked-down clinical iPhone fleet it may be the right one.
But I could not find a documented, dedicated restriction for Siri Recap or Live Rewind specifically as of today. No confirmed per-feature payload key, nothing in the Apple Intelligence restriction family that names them. If it exists, Apple hasn’t published it, and I’m not going to invent a key so an admin can paste in something that silently does nothing.
The bigger gap is the wrist itself. The Apple Watch is barely a first-class MDM citizen — it’s managed almost entirely through its paired, supervised iPhone rather than enrolled directly. So your restriction posture on the watch is inherited, indirect, and coarse. You can disable the assistant on the phone and hope the watch honours it. That’s not the same as a fleet-wide “no rolling audio buffer on any managed wrist” control, and pretending otherwise would get someone in trouble in six months.
What I’d tell the next admin
Verify, don’t assume. Before you promise your compliance team anything, push a test profile to a spare supervised device, enable the feature, and confirm with your own eyes what the restriction actually suppresses. Buffer, transcription, saved recap — check each one independently. Screenshot the result for the audit trail.
Treat this as policy first, MDM second. Technical controls on the watch are too thin to be your only line. If you’re in a two-party state or a HIPAA setting, the defensible move right now is a written acceptable-use policy that says wrist-worn assistants with continuous audio capture are off in patient areas, meeting rooms, and anywhere a confidential conversation happens — enforced by allowAssistant=false on the corporate fleet where you can, and by human rules everywhere you can’t.
And get out ahead of the BYOD case, because that’s the one that bites. The riskiest watch in your building isn’t the one you issued. It’s the personal Series 12 on the wrist of an employee who turned Live Rewind on because it’s genuinely useful, and who has no idea the person across the desk just became a data subject.
The dashcam was always on. The question was never where it stored the footage. It’s who was in frame, and whether they said yes.