Does speech to text collect biometric data?

Usually not. Speech to text, also called dictation or transcription, collects personal data about you in almost every case. It collects biometric data only when the same system also uses your voice to recognize or verify who you are. A tool that only writes down what you say is doing speech recognition, and that is a different job from speaker recognition.

Turning sound into words is not the same as identifying the speaker

Speech recognition asks what was said. Speaker recognition asks who is saying it. The IEEE Technology Navigator draws that line directly: speaker recognition is "the computational task of identifying or verifying the identity of an individual from characteristics of their voice" ¹. A dictation engine is built for the first job. Its output is words, not a model of your voice.

The law turns on the second job. The GDPR defines biometric data as personal data from specific technical processing of physical, physiological or behavioural characteristics, and that processing must "allow or confirm the unique identification of that natural person" ². Writing down words does not confirm who a person is. Matching a voice to a person does.

Speaker identification and verification are the steps that count

In speaker identification, "no claim is made; the system searches a database of known speakers and selects the closest match" ³. In speaker verification, the system "accepts or rejects a claimed identity" ⁴. Both depend on a stored model of how one person's voice sounds. That model is the voiceprint, and building or comparing one is the step that moves a voice into the biometric data category.

Dictation audio is still personal. Microsoft says that "audio data of humans speaking and the related text transcripts may be considered personal data and/or sensitive data under various privacy regulations and laws" ⁵. So the first question for any dictation product is whether it handles personal data, and the answer is almost always yes. The second is whether it is biometric, which depends on what it does with your voice.

Where the line is crossed without you noticing

The features that cross the line are the ones built to recognize a person. The table sorts common cases by what the processing does.

The speaker diarization label is the one that confuses people. A label such as "Speaker 1" can be used only inside a single recording. It becomes a biometric question when the system can recognize the same voice in a later recording, because then it has a model of the person.

It depends on the product's data flow, so ask it directly

Three things settle most cases. Ask whether the product builds or stores a voiceprint or speaker model. Ask whether it uses your voice to identify or verify anyone. Ask how long any voice model is kept. If the answer to the first two is yes, the stricter rules apply. Under the GDPR, processing biometric data to identify someone is prohibited unless an exception applies, such as explicit consent for a stated purpose ^{6 7}. Illinois requires written consent before collection ⁸, and California treats biometric information processed to identify a consumer as sensitive personal information ⁹.

If you dictate on a device that does not send audio to a server, the question is simpler, because there is no outside party holding the audio. Our overview of on-device recognition explains where the audio goes in each setup.

What to do

1. Read the privacy policy for the words "voiceprint", "speaker model" and "biometric". If they are absent, the product is probably not building one, though you should still confirm it.
2. If a feature offers voice login or speaker identification, check whether it is turned on by default, and turn it off if you do not need it.
3. Check how long audio and transcripts are kept, because even plain dictation audio is personal data under the GDPR ¹⁰.
4. If you are in Illinois and the product collects a voiceprint, ask for the written consent flow. The BIPA question covers what the law requires.

Related questions

• Is a voice recording personal data under GDPR?
• Does Illinois BIPA cover voiceprints?
• Is voice data sensitive personal information under the CCPA?

For the full picture, read the guide to whether your voice is biometric data, and the overview of speech to text privacy.