Illinois BIPA: Court Says a Recorded Voice Is Now a Face Scan

A court in Illinois just decided that a company can be on the hook for collecting your voice — even if it never once used that voice to figure out who you are. Not "did they identify you." Just "could they." That single word — could — is quietly rewriting what counts as biometric data in America.

If you've ever left a voice message, joined a video

If you've ever left a voice message, joined a video call, or talked to a smart speaker in your kitchen, your voice has been processed by software you'll never see. And most of us assumed that was fine, as long as nobody was actually trying to name us. That assumption just broke. Today I want to walk you through what actually turns an ordinary recording into a legally protected biometric — because the line is much finer than you'd think. So where exactly does audio stop being audio?

Start with the law itself. Illinois passed the Biometric Information Privacy Act back in two thousand eight. Most people call it B.I.P.A. It says private companies have to tell you, in writing, before they collect things like your fingerprint or your face scan — and they need your written permission. What surprises people is that the law also lists voiceprints. Your voice sits in the same legal category as your fingerprint.

But the law never spelled out what makes a voice a voiceprint. A voiceprint isn't the sound of you talking. It's a pattern — a machine measurement of the curves and whorls in your vocal sounds, built specifically to tell one speaker apart from another. Pitch. Cadence. Frequency. The particular timbre of your voice.

Legal analysts at Blank Rome describe the distinction this way, and I think it's the cleanest way to hold it in your head. A voiceprint is like taking someone's fingerprint without ever touching their finger. Fingerprint software reads ridge patterns. Voice software reads acoustic patterns. Same idea, different body part. The moment a system pulls those patterns out and could link them back to a person, it isn't recording a conversation anymore. It's capturing a body measurement.

The misconception

Now, the misconception. A lot of businesses tell themselves this: we're only recording calls for quality assurance, so the biometric rules don't touch us. And honestly, that reasoning makes sense. The word "recording" sounds passive — like a security camera just sitting there, storing footage nobody watches. That's how the word works in everyday life. But courts have now drawn the line somewhere else entirely. If your system simply captures a voice and never extracts speaker-identifying features, you're fine. If your system has the technical pipeline to pull those features out — you're covered, whether or not you ever push the button.

That's exactly what sank Meta's attempt to get its case thrown out. Carnegie Mellon professor Rita Singh testified as an expert about how Meta processes audio from Facebook and Messenger — converting it into standardized formats built for speech analysis. The plaintiffs never had to prove Meta identified anyone. Showing the capability was enough to keep the case alive.

For a compliance team, that flips the whole audit question from "what did we do with the voice" to "what could our system do with it." For the rest of us, it means the smart speaker on your counter is governed by what it's capable of — not by what it happens to be doing right now.

There's one more wrinkle, and it's the one I keep thinking about. Consent for your voice belongs to you, and only you. If someone uploads a podcast you spoke on, their permission doesn't cover your vocal patterns. The copyright owner's permission doesn't either. Under B.I.P.A., only the speaker holds that right. In May of two thousand twenty-six, seven broadcast journalists, podcasters, audiobook narrators and voice actors filed nine coordinated class actions against companies including Meta, Google, Apple and NVIDIA — arguing their voiceprints were pulled from publicly available audio to help train commercial A.I. voice models.