Glossary
Biometric data
Biometric data is personal data produced by technical processing of a person's physical, physiological or behavioral characteristics that allows or confirms who that person is. A voice recording becomes biometric data when it is processed to identify the speaker.
Updated October 17, 20263 cited facts, each traced to its source
Also called biometric information, biometric identifier.
Biometric data is information about a person's body or behavior that can identify them. The European Union's General Data Protection Regulation (GDPR) defines it as personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person 1. Fingerprints, face geometry and voiceprints are common examples.
The test is identification, not the raw recording
Biometric data is not every recording of a person. The GDPR definition turns on whether the processing allows or confirms who the person is. A voice recording used only to write down words is usually ordinary personal data. The same recording analyzed to match a speaker against a known voice is biometric data.
Illinois takes a similar approach in a different law. Its Biometric Information Privacy Act defines biometric identifiers to include voiceprints, alongside fingerprints and iris scans 2. The word "voiceprint" appears in that definition, so a voice used to identify someone falls inside the law.
Why the law treats it strictly
The GDPR prohibits processing special categories of personal data, including biometric data used for the purpose of uniquely identifying a natural person, unless one of the listed exceptions applies 3. That rule sits above the ordinary consent and purpose rules, so a company cannot simply rely on its general data policy.
Biometric data cannot be changed the way a password can. If a voice model leaks, the speaker cannot choose a new voice. That is why regulators and lawyers focus on it.
An example: dictation versus speaker identification
A dictation app that turns your speech into text is usually handling personal data. A meeting tool that labels each speaker by matching their voice against stored samples is handling biometric data. Both start from the same audio, but the second step creates an identifier. Read the product's documentation for whether it compares voices, because that changes which laws apply.
Why it matters for dictation
Dictation tools can store audio, voice settings and voice models. If a tool keeps a voice profile that can recognize you, or offers speaker identification, the privacy stakes rise. Check whether the tool keeps voice models, where they are stored, and whether you can delete them. See voice profile for how profiles differ from speaker identification.
Related terms and guides
A voiceprint is the stored voice model that makes a voice into an identifier. The process of confirming a claimed identity from a voice is speaker verification. Health data has its own rules, described in protected health information. For the full legal picture, read is your voice biometric data? GDPR, BIPA and CCPA and the question on whether speech to text collects biometric data. For where your recordings go, see voice data retention.
Evidence
Every number on this page, with where it comes from. Open a fact to see the exact words in its source.
- 1.
- 2.
- 3.
Related terms
- Speech to Text Privacy: Where Your Voice GoesThe topic this term belongs to
- All-party consentAll-party consent is a recording rule under which every participant in a conversation must agree before it can be recorded or intercepted. California, Florida and Maryland use it in their statutes, and it is stricter than one-party consent.
- Attorney-client privilegeAttorney-client privilege protects confidential communications between a lawyer and their client about seeking legal advice or services. A third party who is present, or a tool that handles the conversation, can put that protection at risk.
- Business associate agreement (BAA)A business associate agreement (BAA) is the written contract that HIPAA requires before a covered entity lets a vendor create, receive, maintain or transmit protected health information on its behalf. Dictation tools used in clinics often need one, and a BAA alone does not make a product compliant.
- False accept (accidental activation)A false accept, also called a false wake or accidental activation, is when a voice assistant or dictation feature starts listening or recording although the wake word was not said. Smart speakers have been measured to wake by accident, and that can capture speech the user did not mean to share.
- Federated learningFederated learning is a way to train one machine learning model on data spread across many devices. Each device computes an update from its own data, and only those updates are sent to a server, so the raw data does not have to be collected in one place.
- On-device speech recognitionOn-device speech recognition converts speech to text with a model that runs on your own computer or phone, so the audio does not need to be sent to a server. It is also called local, offline or on-device dictation.
- One-party consentOne-party consent is a recording rule under which a conversation can be recorded lawfully when one of its participants agrees, which is usually the person doing the recording. The US federal wiretap law uses this rule, and individual states may set stricter ones.
- Protected health information (PHI)Protected health information (PHI) is individually identifiable health information that HIPAA protects when it is held or sent in electronic or other form by a covered entity or its business associate. Patient names with diagnoses, in dictated notes or voice recordings, are PHI. It is also called ePHI when held electronically.
- Speaker verificationSpeaker verification is a voice biometric check in which a system accepts or rejects a claimed identity by comparing a voice with stored models of the person claimed. It is also called voice authentication, voice ID or voice biometrics.
- Special category data (GDPR)Special category data is the group of personal data that Article 9 of the GDPR bans organizations from processing unless a listed exception applies. It includes health data and biometric data used to identify a person, and a voice recording can fall into it when it is processed that way.
- Voice cloningVoice cloning is the use of a model trained on recordings of one person to generate new speech in that person's voice. Some products need only minutes of clear audio, and cloned voices have been used in fraud, so recordings of your voice carry a real risk.
- VoiceprintA voiceprint is a stored model of a person's voice, built from measurable features of their speech and used to recognize or verify that person. Illinois law lists voiceprints among biometric identifiers, and other vendors call the same idea a voice template or speaker model.
Pages that use this term
- Speech to Text Privacy: Where Your Voice GoesTopic
- Is Your Voice Biometric Data? GDPR, BIPA and CCPAGuide
- Voice Cloning and Deepfakes: Risks and ProtectionGuide
- Can your typing rhythm identify you?Question
- Does Illinois BIPA cover voiceprints?Question
- Does speech to text collect biometric data?Question
- How does a voice recognition security system work?Question
- Is a voice recording personal data under GDPR?Question
- Is it legal to clone someone's voice?Question
- Is voice data sensitive personal information under the CCPA?Question
- What is voice biometrics and how does a voice biometric system work?Question
- Protected health information (PHI)Glossary
- Speaker verificationGlossary
- Special category data (GDPR)Glossary
- Voice cloningGlossary
- VoiceprintGlossary