There are many worse violators than this, but it is what it is.
We also know that, regardless of the degree of privacy to which people should be entitled, they're not legally entitled to much privacy in these places. Federal court rulings have been extremely clear on this point. In these places, we don't even have the right to not be photographed.
While I think this is a really cool project, I also agree with the privacy issues. CA is a two party consent state, and recording a conversation (which this is likely to do) like this is likely illegal. While a person might not have a expectation of privacy about someone just hearing the conversation, they are protected by law if they are recorded without their knowledge.
NB: I am not a lawyer, and the above could very well be wrong.
Edit: As I was informed below, I was wrong on the legal points.
If this were a restaurant, that would be a different story.
> Exceptions (one-party consent required): (1) where there is no expectation of privacy, (2) recording within government proceedings that are open to the public, (3) recording certain crimes or communications regarding such crimes (for the purpose of obtaining evidence), (4) a victim of domestic violence recording a communication made to him/her by the perpetrator (for the purpose of obtaining a restraining order or evidence that the perpetrator violated an existing restraining order), and (5) a peace officer recording a communication within a location in response to an emergency hostage situation.
Source: https://www.mwl-law.com/wp-content/uploads/2018/02/RECORDING...
No legally protected right. This doesn't mean it is ethical, and given that it is a protected right in other jurisdictions shows it deserves more consideration and should not be hand waived away.
If "it's legal" is the argument being used to defense a behavior, it's safe to assume it's not actually a good one.
I never argued it was ethical. I think it is, but that wasn’t my argument.
Fixing this one installation wouldn't fix all the rest (example: Shot spotter)
The real harm would occur if the conversations were being stored and analysed systematically, for example by police. But the OP is not doing that (they claim).
Apply it OP's project. The project is super cool, popular, and most of all it's done and it exists. The worst thing you can say about it is that it's not perfect and failed one weird purity test. Oh no, public audio gets sent to a server!
And honestly, as a commentary on how commonplace and normal mass surveillance has become, which this project seems to be, I quite like the threat of "there is a box out there somewhere that sends everything it hears to a server and it does this not for good or evil, but because one programmer was bored and thought what if I could know what song was playing in the cafe across the street".
Why not use a Pixel phone with on-device song matching? It also keeps history on device. Getting that data out of the app might be a little tricky, but should be possible.