Does Illinois BIPA cover voiceprints?

Yes. Illinois's Biometric Information Privacy Act (BIPA) names voiceprints as biometric identifiers. A company that collects a voiceprint from a person in Illinois must first get that person's written consent, and anyone harmed by a violation can sue. The 2024 amendment changed how damages are counted, but it did not remove the consent duty.

The statute names voiceprints in its definition

BIPA defines "biometric identifiers" to include "things like fingerprints as well as voiceprints and iris scans" ¹. Illinois is the clearest case among US state laws because the word appears in the statute itself. A voiceprint is therefore regulated in Illinois whether or not the product calls it that.

Our sources for the statute are law firm summaries, because we could not open the Illinois statute from our tools. Read the current text on the Illinois General Assembly site before you rely on a detail here.

Written consent comes before collection

The duty comes before the collection. Under BIPA, before a business obtains a biometric identifier, it must "obtain written consent from the data subject or his or her legal representative" ². Courts decide case by case whether a click on a general terms page counts as written consent. The consent rules for recordings cover a different question, whether you may record a conversation at all.

Individuals can sue, and the damages add up

BIPA "provides a private right of action against the offending party" ³. That is why BIPA cases are often brought by employees or customers rather than the state. The statutory penalties are what make these claims costly: over $1,000 for each negligent violation and $5,000 for each intentional or reckless violation, according to a Mintz commentary ⁴.

The 2024 amendment counts repeated collection once per person

The amendment, SB 2979, changed how often a violation is counted. A private entity that collects the same identifier from the same person more than once by the same method "only commits one single violation" ⁵, so the aggrieved party can recover at most once. The effect is that a company scanning the same voice repeatedly cannot multiply the damages by the number of scans.

The Seventh Circuit has held that this limit applies to cases already pending when the amendment took effect. It described the amendment as "a procedural change to the law and therefore must be applied retroactively to cases pending when the amendment was enacted" ⁶. Courts elsewhere can read it differently, so treat that holding as the current trend, not a settled rule across all cases.

It depends: different people, methods or uses

The one-violation rule applies to the same identifier from the same person by the same method. A different person, a different collection method, or a new use can still count as a separate violation. The rule also does not waive consent. A company that collects a voiceprint without written consent has the consent problem whatever the count.

Dictation that only writes down words does not build a voiceprint, so it usually falls outside BIPA's voiceprint definition. A feature that identifies or verifies a speaker by voice, such as voice login or speaker identification in meetings, is where BIPA applies.

What to do

1. If you use a voice tool in Illinois, ask whether it builds a voiceprint or speaker model. Ask for the answer in writing.
2. If it does, ask for the written consent flow and a copy of the consent text. No written consent means no voiceprint feature for Illinois users.
3. Do not treat the one-violation rule as a safe harbor. It limits counting, not liability, and the consent duty applies from the first collection.
4. If you are a business, keep the written consent records with the voiceprint data and set a retention schedule for both.

Related questions

• Does speech to text collect biometric data?
• Is a voice recording personal data under GDPR?
• Is voice data sensitive personal information under the CCPA?

For the definitions, see the voiceprint and biometric data terms. For the full comparison, read the guide to whether your voice is biometric data.