Voiceprint Privacy Lawyer

A person’s voice can do more than carry a conversation. Technology can analyze characteristics of speech and use them to recognize or authenticate an individual.

Banks, call centers, applications, security systems, and other services may use voice-based technology to confirm identity, prevent fraud, or control access to accounts. Artificial intelligence has also made it increasingly possible to analyze, reproduce, and imitate human voices.

But a recording of someone’s voice and a biometric voiceprint are not necessarily the same thing.

That distinction is central to voiceprint privacy. Depending on how technology processes audio, it may generate biometric information based on characteristics of a person’s voice that can be used to identify that individual. Some biometric privacy laws specifically regulate voiceprints and impose requirements concerning their collection, use, storage, disclosure, and destruction.

Net Law Advocates represents individuals nationwide in matters involving voiceprints and other forms of biometric privacy.

What Is a Voiceprint?

A voiceprint is biometric information derived from characteristics of a person’s voice and used to identify or authenticate that individual.

Human voices contain characteristics that can be measured computationally. Voice-biometric systems can analyze aspects of speech and create a mathematical representation that can later be compared with another sample.

Depending on the system, the technology may evaluate multiple characteristics rather than simply recognizing the words being spoken.

The resulting biometric representation can then be used to answer a question such as: does the person speaking now match the voice previously associated with this account?

That makes a voiceprint conceptually similar to other biometric identifiers. A fingerprint system analyzes characteristics of a finger. Facial recognition can analyze facial geometry. Voice-biometric technology analyzes characteristics associated with a person’s voice.

A Voice Recording Is Not Automatically a Voiceprint

This is one of the most important distinctions in voice privacy.

Companies record voices for many reasons.

A customer-service center may record telephone calls for quality assurance. A smartphone may save an audio message. A video can contain someone’s speech. A virtual meeting platform may record a conversation.

Those recordings contain a person’s voice, but their existence alone does not necessarily mean a biometric voiceprint has been created.

The question is what the technology does with the audio.

If software analyzes characteristics of a person’s voice for purposes of recognizing or authenticating that individual, the analysis may generate biometric information that is legally different from an ordinary recording.

State statutes illustrate why the distinction matters.

Illinois BIPA expressly includes a “voiceprint” within its definition of a biometric identifier. Washington’s commercial biometric law similarly recognizes biometric data generated from biological characteristics such as a voiceprint when used to identify a specific individual, while expressly excluding an ordinary audio recording and data generated from that recording from its definition.

The applicable statutory language and the operation of the technology therefore matter more than the simple fact that someone’s voice was recorded.

How Is Voice Biometrics Used?

Voice authentication can provide an alternative to passwords, security questions, or other credentials.

Potential applications include:

• Financial account authentication
• Call-center identity verification
• Fraud prevention
• Customer-service systems
• Device or application access
• Workplace security
• Remote identity verification
• Access to sensitive accounts or services

Some systems ask a person to repeat a particular phrase. Others may analyze speech more passively during a conversation.

The individual may therefore be actively participating in voice enrollment in one system while having much less awareness that voice analysis is occurring in another.

That difference can become important when a law requires notice or consent before covered biometric information is collected.

Voice Authentication Is Different From Speech Recognition

Several technologies can process a person’s voice without performing the same function.

Speech recognition generally attempts to determine what a person said.

Voice recognition or speaker recognition may instead attempt to determine who said it.

A virtual assistant converting spoken words into a command is therefore not necessarily doing the same thing as a bank comparing someone’s voice with a biometric template associated with an account.

Technology can also perform multiple functions simultaneously.

Understanding what the system was designed to analyze is important when determining whether biometric information was actually created.

Voiceprints Can Be Used for Identity Verification

One of the most common reasons to create a voiceprint is authentication.

A financial institution or other company may enroll a customer’s voice and later compare new speech against that biometric reference.

Voice authentication can provide convenience because the user does not need to remember another password or answer knowledge-based security questions.

But it also changes the type of information being used to secure the account.

Passwords are credentials a person knows. A voiceprint is based on a characteristic associated with the individual.

That difference raises questions about notice, consent, storage, security, retention, and what happens if the biometric information is disclosed or compromised.

Passive Voice Authentication Can Be Harder to Recognize

Not every voice-biometric system requires someone to recite a special phrase into a microphone.

Some technologies can perform speaker recognition using natural conversation.

This can make voice biometrics less obvious to the person being analyzed.

Someone who intentionally records a fingerprint or facial scan usually understands that some form of biometric process is occurring. A person speaking normally with a call center may not necessarily know whether software is simultaneously analyzing the voice for identification purposes.

Whether notice or consent is legally required depends on the jurisdiction, technology, organization, and circumstances.

But the ability to perform biometric analysis during ordinary speech makes transparency particularly important in the voiceprint context.

Illinois BIPA Specifically Protects Voiceprints

Illinois’ Biometric Information Privacy Act expressly defines a voiceprint as a biometric identifier.

When BIPA applies, private entities generally must satisfy statutory requirements before collecting or obtaining covered biometric identifiers or biometric information.

Those requirements include informing the individual in writing that biometric information is being collected or stored, informing the person of the specific purpose and length of time for which it will be collected, stored, and used, and receiving a written release.

BIPA also regulates retention, destruction, disclosure, sale, and protection of covered biometric information.

The statute provides a private right of action to people aggrieved by violations of the Act.

Whether a particular voice-processing system creates a BIPA-covered voiceprint is a fact-specific question. The existence of an audio recording alone should not be treated as proof that biometric information was collected.

Other States Also Regulate Voice Biometric Information

Voiceprint privacy is not limited to Illinois.

Other states regulate biometric information through biometric-specific statutes, comprehensive privacy laws, or other legal frameworks.

Texas’ commercial biometric law includes a voiceprint within its definition of a biometric identifier and regulates the capture of covered biometric identifiers for commercial purposes. It also addresses disclosure, protection, retention, and destruction. The Texas Attorney General enforces the statute.

Washington’s commercial biometric law includes data generated by automatic measurements of biological characteristics, such as a voiceprint, when the data is used to identify a specific individual. The statute regulates enrollment of biometric identifiers in databases and certain subsequent uses, disclosures, and retention.

These statutes are not interchangeable.

The definition of protected biometric information, consent requirements, exceptions, enforcement mechanisms, and ability of individuals to bring claims can vary significantly by jurisdiction.

Consent Can Be Important Before a Voiceprint Is Created

Some biometric laws require specified notice or consent before covered biometric information is collected.

That creates an important distinction between knowingly speaking to a company and knowingly agreeing to biometric analysis of the voice.

Consent to participate in a telephone call does not necessarily answer every legal question about whether a voiceprint may be created from that call.

Similarly, consent to an ordinary recording and consent to biometric enrollment can involve different disclosures depending on the applicable law.

An analysis may therefore examine what the individual was told about:

• Whether voice biometric technology would be used
• Why the voiceprint was being created
• How the biometric information would be used
• How long it would be retained
• Whether another company would receive it
• What choices the individual had

Whether those disclosures were legally required and sufficient depends on the statute governing the particular situation.

Third-Party Vendors May Process Voice Biometric Data

The company interacting directly with a consumer may not have developed its own voice-recognition technology.

Businesses can rely on outside vendors to provide voice-authentication software, fraud-detection tools, cloud infrastructure, or other services.

As a result, a person’s biometric information may potentially be processed or stored by a company the individual has never heard of.

That creates several distinct questions.

Who created the voiceprint? Where was it stored? Did the original business retain a copy? Did the vendor receive it? Could the vendor use the information for another purpose?

Applicable biometric laws may impose separate requirements concerning collection and disclosure.

Issues involving the transfer of biometric information to outside companies are addressed more specifically through Net Law Advocates’ biometric data sharing content.

Voiceprints and AI Voice Cloning Are Related but Different

Artificial intelligence has introduced another concern involving human voices: voice cloning.

Modern AI systems can generate synthetic audio designed to sound like a real person. The Federal Trade Commission has warned that these technologies can facilitate impersonation, fraud, extortion scams, and misuse of biometric data.

Voice cloning and biometric voice authentication are not the same technology.

A voiceprint is generally created to recognize or authenticate a speaker. Voice cloning attempts to reproduce how a person sounds.

The two issues can nevertheless intersect.

Audio samples and information about a person’s voice can potentially become inputs into technologies that reproduce or analyze speech. At the same time, organizations may increasingly rely on voice authentication in an environment where synthetic speech can imitate real people.

The FTC has highlighted this tension in its work on AI-enabled voice cloning, including the challenges of distinguishing authentic voices from synthetic ones.

For privacy purposes, the important question remains what information about a person’s voice was collected and how it was used.

Voiceprints Create Different Security Concerns From Passwords

A password can be changed after a security incident.

A person’s natural voice cannot be replaced in the same way.

That does not mean exposure of a voiceprint automatically allows someone to impersonate a person or access every voice-authenticated account. Voice-biometric systems differ, and stored templates may not be equivalent to reusable audio recordings.

Still, biometric information requires careful protection because it is based on characteristics associated with the individual.

Illinois BIPA, for example, requires covered private entities possessing biometric identifiers or biometric information to use a reasonable standard of care within their industry and to protect that information in a manner at least as protective as other confidential and sensitive information.

Washington’s data-breach law also expressly includes certain biometric data, including voiceprints used to identify a specific individual, within its definition of protected personal information.

When voice biometric information is exposed through a cybersecurity incident, the matter may overlap with Net Law Advocates’ biometric data breaches practice area.

How Long Can Voiceprint Data Be Retained?

The need to authenticate someone today does not necessarily mean a company should keep the person’s biometric information forever.

Some biometric statutes address retention and destruction.

Illinois BIPA requires covered private entities possessing biometric identifiers or biometric information to maintain a publicly available written policy establishing a retention schedule and guidelines for permanent destruction.

Under the statute, covered information generally must be destroyed when the initial purpose for collection or obtaining it has been satisfied or within three years of the individual’s last interaction with the private entity, whichever occurs first, subject to the statute’s terms.

Other states use different requirements.

The retention period can become particularly important when someone stops using a service but the company or its technology vendor continues to possess the person’s biometric voice information.

These issues are addressed more fully through Net Law Advocates’ biometric data retention and destruction content.

What If a Company Recorded My Voice Without Permission?

A recording issue should not automatically be treated as a voiceprint issue.

Audio recording can implicate federal and state laws governing interception and recording of communications. Those laws have their own consent standards and exceptions.

Biometric privacy law presents a different question: whether technology generated protected biometric information from characteristics of the person’s voice.

A single event could potentially involve both issues, but the legal analysis is not identical.

For example, a recorded call might raise questions about whether recording consent requirements were satisfied. If software separately analyzed that recording to create a biometric identifier used to recognize the caller, biometric privacy law might also become relevant.

Determining what actually happened to the audio is therefore critical.

Can You Sue Over the Collection of a Voiceprint?

Potentially, depending on the circumstances and applicable law.

The fact that a company recorded someone’s voice or used voice technology does not automatically establish a biometric privacy claim.

Relevant questions can include:

• Was a biometric voiceprint actually created?
• Was the technology identifying the speaker or merely processing speech?
• Where did the individual live or interact with the system?
• Which biometric law applies?
• What notice was provided?
• Was consent required?
• Was legally sufficient consent obtained?
• Was the voiceprint shared with another company?
• How long was it retained?
• Was it adequately protected?
• Does the applicable law provide a private right of action?

Illinois BIPA can permit private lawsuits when its statutory requirements are satisfied. Other biometric statutes may rely on government enforcement rather than allowing individuals to sue directly.

The technology and jurisdiction must therefore be considered together.

Evidence Can Help Determine Whether a Voiceprint Was Created

Unlike a fingerprint scanner, voice biometric technology may leave the individual uncertain whether biometric processing occurred at all.

Documentation can help answer that question.

Relevant materials may include:

• Notices played at the beginning of telephone calls
• Written biometric consent forms
• Privacy policies
• Account-enrollment screens
• Emails describing voice authentication
• Terms governing telephone or account services
• Screenshots of voice-verification settings
• Communications concerning changes to authentication
• Information identifying a voice-technology vendor

If a company expressly refers to “voice authentication,” “voice biometrics,” “voice ID,” a “voiceprint,” or enrollment of a person’s voice, that information may help clarify what technology was being used.

Technical evidence may ultimately be necessary to determine what data was generated, how it was stored, and whether it was transmitted to another organization.

Voiceprint Privacy Is Part of the Biometric Data Lifecycle

Voice biometric information can move through the same general lifecycle as other biometric identifiers.

A voice may be captured, analyzed, converted into a biometric template, stored for future authentication, shared with a technology provider, retained over time, and eventually deleted or exposed.

Legal issues can arise at several of those stages.

Biometric data collection without consent focuses on whether covered biometric information was obtained with legally sufficient authorization. Third-party sharing raises separate disclosure questions. Retention requirements address what happens after the original reason for keeping the voiceprint has ended.

Voiceprints nevertheless present a distinctive issue within that broader framework because the source material can be an ordinary human conversation.

Understanding whether technology merely recorded speech or actually transformed characteristics of that speech into biometric information is often the starting point for determining whether biometric privacy law applies.

Speak With Net Law Advocates About Voiceprint Privacy

Voice technology can perform many functions, and not every recording or analysis of speech creates a biometric voiceprint. Determining whether a potential biometric privacy claim exists can require examining what the technology did, why the voice was analyzed, what disclosures and consent were provided, who received the resulting information, and which state’s law applies.

Net Law Advocates represents plaintiffs nationwide in biometric privacy matters. If you believe a company collected, created, stored, or shared a biometric voiceprint without appropriate authorization, contact Net Law Advocates at 888-913-2318 to schedule a free, confidential consultation.