Is Your Voice Biometric Data? GDPR, BIPA and CCPA

Your voice recording is personal data under the major privacy laws. It becomes biometric data in the legal sense only when a system processes it to recognize or verify who is speaking. Plain dictation usually stays on the personal data side of that line. Speaker identification, voice ID and some meeting tools cross it, and that is where the strictest rules apply under the EU's GDPR, Illinois's Biometric Information Privacy Act (BIPA) and California's CCPA. This guide reads each law and shows where the line falls. For the wider picture, see our overview of speech to text privacy.

A voice recording is personal data, and a voiceprint is biometric data

A recording of your voice is personal data because it relates to you. The GDPR defines personal data as "any information relating to an identified or identifiable natural person" ¹. The UK data protection regulator says the same logic applies to biometrics: "All biometric data is personal data, as it relates to an identified or identifiable individual" ².

Biometric data is a narrower group. The GDPR defines it as personal data from specific technical processing of physical, physiological or behavioural characteristics that allows or confirms the unique identification of a person ³. The definition turns on what the processing does, not on the raw sound. A voiceprint is the output of that processing: a model of how one person's voice sounds, built so that the system can recognize that person again. Biometric data and voiceprint are the terms the laws use.

The table below sorts the common kinds of voice data by what the law generally treats them as. The categories are a reading of the definitions above, not a ruling on any product.

Recognition that identifies who is speaking is biometric, transcription alone usually is not

Speech recognition and speaker recognition are different jobs. Speech recognition turns sound into words. Speaker recognition asks who is talking. The IEEE Technology Navigator defines speaker recognition as "the computational task of identifying or verifying the identity of an individual from characteristics of their voice" ⁴. In speaker identification, "no claim is made; the system searches a database of known speakers and selects the closest match" ⁵.

That is the line that matters. A dictation tool that only writes down your words is doing speech recognition. A tool that compares your voice with a stored model of a known person is doing speaker recognition, and the stored model is the voiceprint. Some products do both, so the question to ask is whether the system keeps or builds a model that can match the same voice later.

The GDPR's own commentary shows why the purpose matters. Recital 51 says photographs "should not systematically be considered to be processing of special categories of personal data" because they count as biometric data "only when processed through a specific technical means allowing the unique identification or authentication of a natural person" ⁶. The recital is about photographs, not audio. Applying the same reasoning to voice is an interpretation, because the recital does not name audio.

Speech data can still be personal even when it is not biometric. Microsoft says that "audio data of humans speaking and the related text transcripts may be considered personal data and/or sensitive data under various privacy regulations and laws" ⁷. So the first question is always whether the audio is personal, and the second is whether it is biometric. For how these choices look in a dictation app, see whether voice to text is safe.

GDPR treats biometric data used for identification as a special category

Article 9 of the GDPR starts from a ban. It prohibits processing "biometric data for the purpose of uniquely identifying a natural person" among other special categories, unless one of its listed exceptions applies ⁸. The UK regulator puts it the same way: biometric data is special category data "whenever you process it 'for the purpose of uniquely identifying a natural person'" ⁹. It is the purpose that moves voice data into this group. On that reading, the same audio is ordinary personal data when it is only transcribed and special category data when it is used to identify the speaker.

The ICO lists voice recognition by name among the physical or physiological biometric identification techniques, next to facial recognition and iris scanning ¹⁰. That is a guide to the category, not a ruling that every voice product falls in it. Special category data is the GDPR term for this group.

The most common exception is explicit consent. Article 9(2)(a) lifts the ban where "the data subject has given explicit consent to the processing of those personal data for one or more specified purposes" ¹¹. Two words in that sentence matter. "Explicit" is stronger than the general consent a terms page collects, and "specified purposes" means the consent must name what the voice data is for. A company that wants to build a speaker model needs consent for that purpose, and it must still meet the rest of the regulation.

Fines are high at the top. For breaches of its core processing rules, the GDPR allows administrative fines "up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year" ¹². Those are maximums. Regulators set the amount in each case.

Ordinary dictation does not normally reach Article 9. A company that transcribes your words to put text in a document is processing personal data, with the duties that come with that, such as telling you how long the data is kept ¹³. The special category rules come into play when the processing identifies the speaker.

Illinois BIPA requires written consent before anyone collects a voiceprint

Illinois is the clearest case because its statute names the voice. BIPA defines biometric identifiers to include "things like fingerprints as well as voiceprints and iris scans" ¹⁴. A voiceprint is therefore a regulated biometric identifier in Illinois, whether or not the tool calls it that.

The duties come before the collection. Under BIPA, before a business obtains a biometric identifier, it must "obtain written consent from the data subject or his or her legal representative" ¹⁵. The consent has to be written, which a single click in a general terms page often is not, although courts decide that question case by case. Consent rules for recordings cover a different question, whether you may record a conversation at all.

BIPA also lets people enforce the rules themselves. It "provides a private right of action against the offending party" ¹⁶. That is why BIPA cases are often class actions brought by employees or customers, not only by the state. The statutory damages are the reason the cases are costly. A Mintz commentary describes statutory penalties of over $1,000 for each negligent violation and $5,000 for each intentional or reckless violation ¹⁷. The Act has since been amended. Under the 2024 amendment, collecting the same identifier from the same person by the same method counts as one violation ¹⁸, which limits repeat damages but does not change the per-violation amounts. For the Illinois Supreme Court's Rosenbach decision, read the Hogan Lovells summary.

Check the current text before you rely on these details. Our sources are law firm summaries, and we could not open the statute itself from our tools.

California and other states class biometric voice data as sensitive personal information

California's CCPA uses two levels. The broad level, biometric information, names voice explicitly. It covers "voice recordings, from which an identifier template, such as a faceprint, a minutiae template, or a voiceprint, can be extracted" ¹⁹. Under that wording a voice recording is biometric information even before anyone builds a template.

The narrower level is the sensitive personal information category, and it turns on purpose. It covers "the processing of biometric information for the purpose of uniquely identifying a consumer" ²⁰. Dictation that only produces text is not processing for that purpose. Speaker identification is. The enforcement is administrative. The statute says a business that violates the title "shall be liable for an administrative fine of not more than two thousand five hundred dollars ($2,500) for each violation or seven thousand five hundred dollars ($7,500) for each intentional violation" ²¹. Those are the figures as enacted. Since January 1, 2025, an inflation adjustment has raised the operative amounts to up to $2,663 for each violation and $7,988 for each intentional violation or violation involving consumers under 16 ²². The chart below uses the adjusted amounts beside BIPA's damages.

Yap, which we make, is a dictation app. Put the same questions in this guide to any dictation app you use, including ours.

The chart compares two numbers that are not the same kind of penalty. BIPA's amounts are damages that a private person can claim for each violation. The CCPA's amounts are administrative fines that a regulator can impose. The chart shows the scale, not a like-for-like comparison. We did not check other state laws for this guide, so if you work outside California or Illinois, read your own state's statute.

Lawsuits over meeting assistants and voice analytics show where the line is tested

Courts and regulators are testing these rules on meeting tools. In August 2025, a federal class action against Otter.ai alleged that its service, "by default does not ask meeting attendees for permission to record" ²³. That complaint is about recording consent and training, not a voiceprint claim, and the allegations are unproven. Otter's position, as reported, is that its privacy policy asks users for permission before training on transcripts. Our guide to using recordings to train AI covers that question in more detail.

A Lewis Rice article describes Illinois biometric suits aimed at AI transcription and speaker recognition tools. We could not open those filings from our tools, so this guide does not rely on their details. The pattern they describe is the same one the statutes set out: a tool that goes beyond transcription and builds a model of the speaker moves into the regulated category. For how meeting tools handle recordings more broadly, see meeting transcription.

Ask any voice tool whether it builds a speaker profile and how long it keeps it

You can test a voice product against these laws with a few direct questions. A vendor that answers them plainly is easier to trust than one that says its product is "secure" without saying what it stores.

1. Does it build a speaker model or voiceprint? Ask for the term in writing. If the answer is "speaker labels," find out whether those labels are only within one recording or can match a voice across recordings. The speaker verification and voiceprint terms describe the second case.
2. Is the voice used to identify or verify a person? Identification triggers the GDPR's special category rules and the CCPA's sensitive category, and BIPA applies whenever a voiceprint is collected, so a yes here changes the analysis.
3. How long is the audio or any model kept? Under the GDPR, a controller collecting data from you must say how long it will be stored, or the criteria used to set that period if a fixed period is not possible ¹³. See how long voice data is kept for what the major platforms say.
4. Is written consent collected for Illinois users? If the answer is no, a voiceprint feature should not be on for Illinois residents.
5. Does it use audio to train models? Training is a different use from transcribing your words, so check the privacy policy for it. See whether dictation apps train AI on your voice.

If the vendor cannot answer the first two questions, assume the worst case and ask for the contract terms in writing. For a voice-cloning angle on the same data, see voice cloning and deepfakes. Who can listen to recordings is covered in human review of voice recordings.

Questions this guide answers

• Does speech to text collect biometric data?
• Is a voice recording personal data under GDPR?
• Does Illinois BIPA cover voiceprints?
• Is voice data sensitive personal information under the CCPA?

For how speech recognition itself works, see how speech recognition works, and for where on-device recognition differs from cloud recognition, see on-device vs cloud speech recognition.