Voiceprints, BIPA, and Amazon: What Illinois Law Really Protects

Voice-driven technologies are everywhere: smart speakers answering questions in the living room, automated phone systems verifying callers, and virtual assistants embedded in phones and cars. As these systems become more sophisticated, they often rely on voiceprints — mathematical representations of a person’s voice used to recognize or authenticate that person. In Illinois, voiceprints sit at the center of the state’s influential Biometric Information Privacy Act (BIPA), and recent litigation involving Amazon shows both the limits and the continuing strength of this law.

This article explains how BIPA treats voiceprints, what the Amazon–John Hancock case reveals about BIPA’s geographic reach, and how other Amazon Alexa and voice assistant cases highlight the compliance risks for companies that handle biometric data. It also offers practical guidance for organizations designing voice technologies, and for Illinois residents who want to understand their rights.

Understanding Voiceprints and Why They Matter

A voiceprint is not simply an audio recording. It is typically a biometric template derived from the unique physical and behavioral characteristics of a person’s speech, such as pitch, timbre, and vocal tract shape.[10] These features can be processed into numerical models that allow systems to answer questions like “Is this the same person who spoke before?” or “Does this voice match the enrolled account holder?”

From a legal perspective, voiceprints are important because:

• They can identify individuals directly or indirectly, making them similar to fingerprints or facial geometry in terms of privacy risk.
• They are difficult to change — unlike passwords, you cannot easily replace your voice if a biometric template is compromised.
• They can be reused across systems, creating the possibility of tracking or profiling if the same voiceprint appears in multiple databases.[10]

Illinois lawmakers viewed these risks as sufficiently serious to warrant dedicated statutory protections, which is why voiceprints are expressly listed as a protected biometric identifier under BIPA.[10]

Illinois’ Biometric Information Privacy Act: Core Rules

BIPA, enacted in 2008, is one of the most stringent biometric privacy laws in the United States. It regulates how private entities collect, use, disclose, and retain biometric identifiers and biometric information, including

voiceprints

These provisions apply to private entities operating in Illinois or dealing with Illinois residents, and they have generated significant litigation in industries ranging from financial services to consumer technology.

Amazon, John Hancock, and the Limits of BIPA’s Reach

One high-profile dispute involved voice authentication during calls to John Hancock, a major financial services company. Illinois residents alleged that when they called John Hancock, their voices were routed through Amazon’s cloud-based contact center service (Amazon Connect) and analyzed using a third-party tool called Pindrop to generate voiceprints for fraud detection and caller verification.

The plaintiffs claimed that Amazon and Pindrop violated BIPA by creating and using voiceprints without the disclosures, consent, and restrictions required by Sections 15(b) and 15(d). In essence, they argued:

• Voiceprints are biometric identifiers under BIPA.[10]
• Amazon and Pindrop allegedly created and stored voiceprints when handling calls, triggering Section 15(b)’s notice and written release requirements.
• Data routing and risk scoring involving voiceprints allegedly amounted to disclosure governed by Section 15(d).

However, both the federal court in Delaware and, on appeal, the Third Circuit focused closely on where the relevant conduct occurred. The courts noted that Amazon’s call processing and data handling took place primarily on servers located outside Illinois, and they concluded that BIPA could not be applied extraterritorially to that conduct.

On the merits, the appellate panel also held that Amazon — as opposed to Pindrop — did not itself “collect” biometric data within the meaning of Section 15(b, because it did not create or store voiceprints; it merely transmitted call audio and related data to the third-party provider. As a result, Amazon avoided liability, while Pindrop’s alleged role in generating and using voiceprints remained the focal point for potential biometric claims.

Key Lessons from the Amazon–John Hancock Litigation

• Technical architecture matters: Courts examined which entity had access to biometric data and where systems were located. Companies that only route data, without creating or storing biometric templates, may face different liability risks than those that generate or use voiceprints.
• Geographic nexus to Illinois is critical: BIPA claims must show that the relevant biometric handling occurred “primarily and substantially” in Illinois, not just that Illinois residents were affected.
• BIPA is narrowed, not eliminated: Even as Amazon escaped liability, the courts emphasized that defendants who directly manage biometric identifiers and whose conduct is centered in Illinois can still face robust claims.

The case thus illustrates a key tension: Illinois residents’ biometric privacy rights are strong, but they are not unlimited, especially when complex, multi-state technical infrastructures are involved.

Amazon Alexa and Voiceprint Claims in Illinois

While the John Hancock matter addressed server-side call processing, other cases have focused on consumer-facing devices like Amazon Alexa. In one Illinois federal case, plaintiffs alleged that Alexa devices collected, analyzed, and stored voiceprints of people who spoke near an active device, without providing the detailed notice and obtaining the written consent required under BIPA.

According to the court’s description, plaintiffs claimed violations of several BIPA sections:

• Section 15(b): Collecting biometric data (voiceprints) without specific, written notice and consent.
• Section 15(c): Profiting from biometric data, allegedly by using voiceprints as part of Alexa’s business model.
• Section 15(d): Disclosing biometric data without consent.

The Illinois federal court allowed the case to proceed past the motion-to-dismiss stage and later granted class certification for a proposed class of more than one million Illinois Alexa users enrolled in voice ID, underscoring that whether Alexa’s processes create biometric identifiers and whether Amazon’s disclosures meet BIPA’s requirements are common, class-wide questions.

This line of cases stands in contrast to Amazon’s success in the John Hancock matter because the Alexa litigation focuses on:

• Devices physically located in Illinois homes.
• Direct interactions between Illinois consumers and Amazon’s technology.
• Allegations that Amazon itself created and stored voiceprints through Alexa’s voice ID features.

In other words, where the biometric activity is clearly anchored in Illinois, BIPA’s reach is considerably broader.

Voiceprints Beyond Amazon: Other Technology Cases

Amazon is not the only major technology company facing scrutiny over voice-based biometrics. Litigation against Apple’s Siri, for example, alleges that Siri creates biometric voiceprints both to unlock devices and to process user requests, again raising BIPA issues about informed consent, retention policies, and disclosure to third parties.

The Siri case, in which an Illinois court certified a class of millions of users, demonstrates that courts are increasingly willing to treat voice recognition and speaker identification technologies as generating biometric identifiers within the scope of BIPA. This broader trend means companies offering any voice-based personalization or authentication features should assume that Illinois residents’ voiceprints are legally sensitive and subject to heightened duties.

Compliance Priorities for Companies Using Voice Technology

Organizations that design or deploy voice-driven systems — whether cloud contact centers, mobile apps, or smart home devices — should treat BIPA compliance as a structured, ongoing process.

1. Determine Whether You Are Using Voiceprints

• Assess whether your system creates a voice template used to recognize or authenticate individuals.[10]
• Consult internal technical documentation to identify whether biometric feature vectors or unique speaker profiles are stored.
• Distinguish simple audio recording (for quality or training) from biometric processing that can uniquely identify a person.

2. Map Data Flows and Responsibility

• Document which entities (first-party, vendor, subprocessor) create, access, and store voiceprints.
• Note where servers are located and which jurisdictions’ laws may apply.
• Clarify contractual responsibilities around biometric data, including allocation of compliance duties and indemnities.

3. Implement BIPA-Compliant Notice and Consent

For Illinois residents, Section 15(b) requires a specific form of notice and release before collecting biometric data:

• Inform individuals that their biometric identifiers or information will be collected or stored.
• Explain the specific purpose and length of time for which the biometric data will be collected, stored, and used.
• Obtain a written release signed by the individual (or legally authorized representative).

In practice, this often means providing a standalone biometric notice document, not burying references to voiceprints deep inside a generic privacy policy.

4. Avoid Unlawful Sale or Unclear Monetization

• Review business models to ensure the company is not selling or trading biometric data or using it as a commodity in ways that might violate Section 15(c).
• Where monetization is indirect (e.g., using biometrics to support personalized services), ensure that disclosures clearly describe this use.

5. Control Disclosure and Vendor Sharing

• Limit third-party access to biometric data to what is necessary and lawful.
• Ensure written agreements with vendors include BIPA-related obligations: confidentiality, security, and restrictions on further disclosure.
• Obtain appropriate consent where BIPA requires it before disclosing biometric information to another private entity.

6. Establish Retention and Destruction Practices

• Adopt a publicly available schedule for biometric data retention and destruction, as required by Section 15(a).
• Delete voiceprints once the original purpose is satisfied, or within statutory limits if the act specifies a maximum term.
• Ensure backups and logs do not silently retain biometric templates beyond the stated period.

Practical Guidance for Illinois Consumers

Illinois residents using voice-enabled services have meaningful rights under BIPA. Understanding these rights can help individuals make informed decisions and recognize potential violations.

Questions Consumers Can Ask

• “Do you create a voiceprint or other biometric profile when I use this service?”
• “Where is my biometric data stored, and for how long will you keep it?”
• “Will my voiceprints be shared with or accessible to third-party vendors?”
• “How can I revoke consent and have my biometric data deleted?”

Under BIPA, individuals may pursue private lawsuits if their biometric data is collected or used in violation of statutory requirements, which is why many voice-related cases take the form of class actions.

Frequently Asked Questions (FAQs)

1. Are voiceprints always considered biometric data under BIPA?

Yes. BIPA explicitly lists voiceprints as protected biometric identifiers, meaning that if a system generates a template capable of identifying an individual by voice, it is generally subject to BIPA’s requirements.[10]

2. Does every audio recording implicate BIPA?

No. Simple audio recordings, such as a basic customer-service call recorded for quality assurance, do not necessarily involve biometric identifiers. BIPA typically applies when the system extracts and uses unique voice features to recognize or authenticate individuals, thereby creating a voiceprint.[10]

3. Why did Amazon avoid liability in the John Hancock case?

The courts concluded that Amazon did not itself collect or store voiceprints and that the core conduct — including server operations and data processing — occurred outside Illinois. As a result, BIPA was found not to apply to Amazon’s role, even though Illinois residents were parties to the calls.

4. Are Amazon Alexa users in Illinois protected by BIPA?

Yes, they can be. In separate litigation, an Illinois federal court allowed a class action by Alexa users to proceed, focusing on whether Alexa’s voice ID features create voiceprints and whether Amazon’s notices and consents comply with BIPA. The outcome of such cases depends on the specific facts and legal arguments, but BIPA clearly covers voiceprints generated within Illinois.

5. Can companies rely on general privacy policies to satisfy BIPA?

Relying solely on broad, generic privacy policies is risky. Courts have signaled that BIPA requires targeted notice addressing biometric collection, specific purposes, retention periods, and written releases, not just general statements about data collection.

Looking Ahead: Voice Technology and Biometric Law

As voice interfaces become standard, the boundary between ordinary audio data and biometric voiceprints will be increasingly scrutinized. The Amazon litigation highlights how infrastructure design, vendor relationships, and geographic factors can determine whether BIPA applies and who bears liability. At the same time, successful class actions against consumer-facing voice assistants demonstrate that Illinois residents retain strong rights when biometric processing is clearly tied to their daily use of technology.

For companies, the safest path is to treat voiceprints as highly sensitive personal data, implement clear and specific notice and consent for Illinois users, and design architectures that minimize unnecessary biometric collection. For Illinois consumers, understanding the basics of BIPA and asking informed questions about voice-based services can help ensure that the convenience of talking to machines does not come at the expense of their biometric privacy.

Similar Articles

Your First Credit Card: How to Avoid Costly Fine‑Print Traps

Smart Student Borrowing: A Financial Literacy Guide

Brendlin v. California and the Fourth Amendment Passenger Rule

Miranda v. Arizona and the Birth of Modern Police Warnings

Bankruptcy Glossary: Plain-Language Guide To Common Terms Now

Understanding Bankruptcy Noticing in Federal Courts

Author

medha deb

 

Medha Deb is an editor with a master's degree in Applied Linguistics from the University of Hyderabad. She believes that her qualification has helped her develop a deep understanding of language and its application in various contexts.

Read full bio of medha deb