Illinois BIPA and voice biometrics

See also

Sources

1. 1
   The 2024 BIPA amendment (P.A. 103-0769) took effect on August 2, 2024, the same day the governor signed it.

   Clay v. Union Pacific Railroad Co., No. 25-2185 (consolidated with Nos. 25-2761 and 25-2762) · Clay, No. 25-2185, background (fragment 'took effect on August 2, 2024—the same day the governor signed it into') · Checked 2026-10-14
2. 2
   As amended in 2024, 740 ILCS 14/20(b) provides that an aggrieved person is entitled to at most one recovery under section 20 for repeated collection covered by the subsection.

   Clay v. Union Pacific Railroad Co., No. 25-2185 (consolidated with Nos. 25-2761 and 25-2762) · Clay, No. 25-2185, quotation of 740 ILCS 14/20(b) ('the aggrieved person is entitled to, at most, one recovery under this Section') · Checked 2026-10-14
3. 3
   The 2024 amendment treats repeated collection of the same biometric identifier or information from the same person using the same method of collection, in violation of section 15(b), as a single violation.

   Clay v. Union Pacific Railroad Co., No. 25-2185 (consolidated with Nos. 25-2761 and 25-2762) · Clay, No. 25-2185, quotation of the amendment (fragment 'from the same person using the same method of collection in violation of subsection (b) of Section') · Checked 2026-10-14
4. 4
   Voice embeddings produced by a Chime SDK speaker search task can be persisted as voice profiles for only 24 hours before being deleted, and task results are available for at most 7 days.

   Understanding data retention for Amazon Chime SDK voice analytics · Second and third paragraphs · Checked 2026-10-14
5. 5
   By default, Amazon Chime SDK voice analytics deletes voice embeddings after three years; UpdateVoiceProfile can refresh expired embeddings.

   Understanding data retention for Amazon Chime SDK voice analytics · First paragraph · Checked 2026-10-14
6. 6
   When creating a Chime SDK voice profile domain or call analytics configuration that uses voice analytics, the administrator must check a box agreeing to provide the Illinois notice in writing and obtain an executed written release from each speaker in Illinois.

   Understanding the voice analytics consent notice · First paragraph and final paragraph ('By checking the box below') · Checked 2026-10-14
7. 7
   AWS's sample BIPA written release for Chime SDK speaker search says biometric data is kept up to three years after the caller's last interaction, or longer only if the law allows, and is destroyed earlier when the purpose is met or the caller asks.

   Understanding the voice analytics consent notice · Paragraph beginning 'For each speaker in Illinois', quoted sample notice · Checked 2026-10-14
8. 8
   AWS states that Chime SDK speaker search is not designed for authentication or identity-verification use cases that need extremely high accuracy.

   Enabling voice analytics · Speaker search bullet, Note · Checked 2026-10-14
9. 9
   AWS requires Amazon Chime SDK voice analytics customers to give each caller a written release, through a process that clearly reflects the caller's informed consent, before using the service.

   Enabling voice analytics · Important box at the top of the page · Checked 2026-10-14
10. 10
    AWS's Biometric Notice and Consent Terms require customers using Amazon Connect Voice ID and similar services to give legally adequate notices and obtain the necessary consents, including informed written consent where required, citing BIPA, Texas CUBI and Washington's biometric statute.

    Biometric Notice and Consent Terms · Second body paragraph · Checked 2026-10-14
11. 11
    AWS's biometric terms require the customer to provide verification of consents on request, to indemnify AWS against third-party claims from failing to meet the notice and consent requirements, and they bar use of the service by customers who do not comply.

    Biometric Notice and Consent Terms · Third body paragraph · Checked 2026-10-14
12. 12
    Under AWS's biometric terms, notices and consents are obtained on behalf of both the customer and AWS, with AWS identified as the customer's service provider.

    Biometric Notice and Consent Terms · Second body paragraph · Checked 2026-10-14
13. 13
    In the documented Voice ID flow, after the Set Voice ID block Voice ID listens to the caller until it has accumulated 30 seconds of net speech or the call ends.

    Get started enabling Voice ID in Connect Customer · Example Voice ID flow, Caller not enrolled, step 3 · Checked 2026-10-14
14. 14
    AWS states that for BIPA compliance, Voice ID automatically expires speakers not accessed for enrollment, re-enrollment or successful authentication for three years.

    Voice ID domains in Connect Customer Voice ID · Expired speakers · Checked 2026-10-14
15. 15
    AWS's Voice ID transition guidance points to AWS Marketplace partner solutions such as Pindrop, or do-it-yourself one-time-PIN authentication using AWS End User Messaging SMS.

    Amazon Connect Customer Voice ID end of support · Introductory paragraph and 'Do-it-yourself solutions with AWS End User Messaging SMS' · Checked 2026-10-14
16. 16
    Enabling Amazon Connect Voice ID required reading a BIPA Consent Acknowledgement in the console once per AWS account across all Regions, and the step could not be done through APIs.

    Get started enabling Voice ID in Connect Customer · Step 1: Read the BIPA Consent Acknowledgement · Checked 2026-10-14
17. 17
    To make sure all Voice ID customer data is deleted, AWS says to run the DeleteDomain API for every Voice ID domain in every AWS Region and every account.

    Amazon Connect Customer Voice ID end of support · Managing your Voice ID data · Checked 2026-10-14
18. 18
    A Voice ID domain stores speaker identifiers, voiceprints, the customer audio used to create enrollment voiceprints, and enrollment statuses, plus fraudster identifiers, voiceprints and audio for watchlists.

    Voice ID domains in Connect Customer Voice ID · Introductory paragraph · Checked 2026-10-14
19. 19
    AWS ended support for Amazon Connect Voice ID on May 20, 2026, and stopped accepting new Voice ID customers from May 20, 2025.

    Amazon Connect Customer Voice ID end of support · Introductory paragraph · Checked 2026-10-14
20. 20
    Before migrating off Voice ID, enrolled-caller data can be downloaded with the ListSpeakers API and registered fraudsters with the ListFraudsters API.

    Amazon Connect Customer Voice ID end of support · Managing your Voice ID data · Checked 2026-10-14
21. 21
    Voice ID encrypts stored customer data, including audio files, voiceprints and speaker identifiers, under an AWS KMS key the customer chooses.

    Get started enabling Voice ID in Connect Customer · Create an AWS KMS key to encrypt data stored in the domain · Checked 2026-10-14
22. 22
    When a caller does not consent to biometric enrollment, Voice ID can mark them OPTED_OUT; it then generates no voiceprint, stores no audio for them, and rejects future enrollment requests unless the entry is deleted.

    Voice ID domains in Connect Customer Voice ID · Enrollment status, OPTED_OUT bullet · Checked 2026-10-14
23. 23
    Voice ID DeleteDomain is a soft delete: Amazon Connect waits 30 days before completely erasing domain data, and a domain can be restored in that window through an AWS Support ticket.

    Voice ID domains in Connect Customer Voice ID · Domain guidelines list, DeleteDomain bullet · Checked 2026-10-14
24. 24
    Because Voice ID stores biometric information for each speaker, AWS strongly recommends that the CustomerSpeakerId contain no PII.

    Get started enabling Voice ID in Connect Customer · Step 3, Set contact attributes note · Checked 2026-10-14
25. 25
    Judge Easterbrook wrote the Seventh Circuit opinion in Cisneros v. Nuance Communications, No. 24-2982, filed August 28, 2026.

    Cisneros v. Nuance Communications, Inc., No. 24-2982 · Cisneros, No. 24-2982, PDF header and first line ('EASTERBROOK, Circuit Judge.') · Checked 2026-10-14
26. 26
    Cisneros v. Nuance uses the Gramm-Leach-Bliley Act definition of 'financial institution' to read BIPA's financial-institution exemption.

    Cisneros v. Nuance Communications, Inc., No. 24-2982 · Cisneros, No. 24-2982, analysis (fragment 'definition of "financial institution" from the Gramm-Leach-Bliley Act') · Checked 2026-10-14
27. 27
    The Seventh Circuit in Cisneros affirmed judgment for Nuance, holding that Schwab's voice-ID vendor was exempt from BIPA's requirements.

    Cisneros v. Nuance Communications, Inc., No. 24-2982 · Cisneros, No. 24-2982, disposition ('AFFIRMED') and exemption analysis · Checked 2026-10-14
28. 28
    In Cisneros v. Nuance, Charles Schwab, a broker-dealer in securities, let customers make telephone requests using voice-ID technology that checks the caller's voice against a stored mathematical representation.

    Cisneros v. Nuance Communications, Inc., No. 24-2982 · Cisneros, No. 24-2982, opening paragraph (fragments 'Charles Schwab, a broker-dealer in securities, allows customers' and 'voice-ID technology. The system checks the caller's voice against a mathematical') · Checked 2026-10-14
29. 29
    Clay v. Union Pacific (No. 25-2185) was decided on April 1, 2026, together with Willis v. Universal Intermodal Services (No. 25-2761) and Gregg v. Central Transport (No. 25-2762), with an opinion by Judge Brennan.

    Clay v. Union Pacific Railroad Co., No. 25-2185 (consolidated with Nos. 25-2761 and 25-2762) · Opinion PDF header and court opinion URLs (J:Brennan) for 25-2185, 25-2761 and 25-2762 dated 2026-04-01 · Checked 2026-10-14
30. 30
    Because Clay is a federal court's prediction of Illinois law, Illinois state courts are not bound by it, and the Illinois Supreme Court could still decide retroactivity differently.inferred

    Clay v. Union Pacific Railroad Co., No. 25-2185 (consolidated with Nos. 25-2761 and 25-2762) · Inference from Clay's posture (federal appeal applying Illinois law), with no Illinois Supreme Court retroactivity decision located · Checked 2026-10-14
31. 31
    The question presented in Clay v. Union Pacific was whether the 2024 BIPA amendment applies retroactively to cases pending when it was enacted.

    Clay v. Union Pacific Railroad Co., No. 25-2185 (consolidated with Nos. 25-2761 and 25-2762) · Clay, No. 25-2185, opening paragraph ('whether this amendment applies retroactively to cases pending when it was enacted') · Checked 2026-10-14
32. 32
    Clay reasons that the Supreme Court of Illinois treats remedial statutory changes as procedural rather than substantive for retroactivity purposes.

    Clay v. Union Pacific Railroad Co., No. 25-2185 (consolidated with Nos. 25-2761 and 25-2762) · Clay, No. 25-2185, analysis (fragment 'Crucially, the Supreme Court of Illinois treats remedial changes as procedural, not substantive') · Checked 2026-10-14
33. 33
    The Seventh Circuit in Clay v. Union Pacific held that the 2024 BIPA damages amendment applies retroactively to cases pending when it was enacted.

    Clay v. Union Pacific Railroad Co., No. 25-2185 (consolidated with Nos. 25-2761 and 25-2762) · Clay, No. 25-2185, analysis and conclusion · Checked 2026-10-14
34. 34
    As described in Cothron, BIPA section 20 provides statutory damages of $1,000 or $5,000 for each violation.

    Cothron v. White Castle System, Inc., 2023 IL 128004 · 2023 IL 128004, discussion of section 14/20 ('provides for statutory damages of $1,000 or $5,000 for each violation') · Checked 2026-10-14
35. 35
    Cothron v. White Castle held that a separate BIPA claim accrues each time a private entity scans or transmits a person's biometric identifier or information in violation of the Act.

    Cothron v. White Castle System, Inc., 2023 IL 128004 · 2023 IL 128004, holding sentence beginning 'We hold that a separate claim accrues under the Act each time a private' · Checked 2026-10-14
36. 36
    The Cothron v. White Castle opinion (No. 128004) exists in two versions dated February 17, 2023 and July 18, 2023 in the court's opinion records.

    Cothron v. White Castle System, Inc., 2023 IL 128004 · CourtListener opinion records for docket 128004 (download URLs e304b011... and f8eb9228... on illinoiscourts.gov) · Checked 2026-10-14
37. 37
    The financial-institution exemption rulings in McGoveran and Cisneros turn on the deploying business being a GLBA financial institution, so they give no evident protection to voiceprint authentication run for retail, healthcare, utility or other non-financial contact centers.inferred

    Cisneros v. Nuance Communications, Inc., No. 24-2982 · Inference from the GLBA-definition reasoning in Cisneros and McGoveran · Checked 2026-10-14
38. 38
    The Third Circuit affirmed the District Court in McGoveran v. Amazon Web Services in a precedential opinion filed May 12, 2026.

    McGoveran v. Amazon Web Services, Inc., No. 24-3215 (precedential) · McGoveran, No. 24-3215, introduction ('For the reasons below, we will affirm the District Court.'); file name 243215p.pdf ('p' = precedential) · Checked 2026-10-14
39. 39
    McGoveran's exemption analysis invokes the standard of activities determined by order or regulation to be so closely related to banking as to be a proper incident thereto.

    McGoveran v. Amazon Web Services, Inc., No. 24-3215 (precedential) · McGoveran, No. 24-3215, exemption analysis (fragment 'order or regulation . . . , to be so closely related to banking or managing or controlling banks as to') · Checked 2026-10-14
40. 40
    McGoveran required the plaintiffs to show that the conduct underlying their BIPA claims occurred primarily and substantially in Illinois, and found that standard unmet as to Amazon.

    McGoveran v. Amazon Web Services, Inc., No. 24-3215 (precedential) · McGoveran, No. 24-3215, part addressing Amazon (fragment 'occurred primarily and substantially in Illinois') · Checked 2026-10-14
41. 41
    In McGoveran v. Amazon Web Services, the plaintiffs were Illinois citizens who called the financial services company John Hancock, whose calls were routed through Amazon Connect, where technology authenticated callers by their voiceprints.

    McGoveran v. Amazon Web Services, Inc., No. 24-3215 (precedential) · McGoveran, No. 24-3215, opening facts (fragments 'citizens who called the financial services company John Hancock, which routed their calls through Amazon Connect' and 'to authenticate those callers using their voiceprints') · Checked 2026-10-14
42. 42
    McGoveran applies the Gramm-Leach-Bliley definition of a financial institution as one whose business is engaging in financial activities as described in 12 U.S.C. 1843(k).

    McGoveran v. Amazon Web Services, Inc., No. 24-3215 (precedential) · McGoveran, No. 24-3215, exemption analysis (fragment 'the business of which is engaging in financial activities as described in section 1843(k) of title') · Checked 2026-10-14
43. 43
    The Third Circuit held that Pindrop, as the voice-authentication provider for John Hancock's calls, fell within BIPA's financial-institution exemption because authenticating people conducting financial transactions is a financial activity.

    McGoveran v. Amazon Web Services, Inc., No. 24-3215 (precedential) · McGoveran, No. 24-3215, part addressing Pindrop and section 25(c) · Checked 2026-10-14
44. 44
    For a non-exempt contact center, the 2024 amendment as applied in Clay turns exposure from a per-call count into roughly one statutory award per caller per collection method, so caller volume rather than call volume drives class exposure.inferred

    Clay v. Union Pacific Railroad Co., No. 25-2185 (consolidated with Nos. 25-2761 and 25-2762) · Inference combining the amended 14/20(b) text quoted in Clay with the Cothron per-scan accrual holding · Checked 2026-10-14
45. 45
    Rosenbach v. Six Flags held that a person need not allege actual injury or adverse effect beyond a violation of BIPA's rights to be an aggrieved person entitled to sue.

    Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186 · 2019 IL 123186, statement of the question and holding (fragment 'some actual injury or adverse effect, beyond violation of') · Checked 2026-10-14
46. 46
    The Illinois Supreme Court in Rosenbach v. Six Flags describes BIPA biometric identifiers as including voiceprints, alongside retina or iris scans, fingerprints and scans of hand or face geometry.

    Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186 · 2019 IL 123186, background discussion of the Act (fragment 'retina or iris scans, fingerprints, voiceprints, scans of hand or face geometry') · Checked 2026-10-14
47. 47
    Tims v. Black Horse Carriers held that the five-year limitations period in 735 ILCS 5/13-205 governs BIPA claims.

    Tims v. Black Horse Carriers, Inc., 2023 IL 127801 · 2023 IL 127801, holding (fragment 'the five-year limitations period codified in section 13-205') · Checked 2026-10-14
48. 48
    Washington's RCW 19.375 may be enforced solely by the attorney general under the Consumer Protection Act, unlike BIPA's private right of action.

    RCW Chapter 19.375 Biometric identifiers · RCW 19.375.030(2) · Checked 2026-10-14
49. 49
    Under RCW 19.375.020(7), no notice or consent is required to enroll a biometric identifier for a security purpose, which RCW 19.375.010(8) defines to include preventing fraud and protecting account security.

    RCW Chapter 19.375 Biometric identifiers · RCW 19.375.020(7) and 19.375.010(8) · Checked 2026-10-14
50. 50
    Washington's biometric identifier statute (RCW 19.375.010) includes voiceprints but excludes audio recordings and data generated from them.

    RCW Chapter 19.375 Biometric identifiers · RCW 19.375.010(1) · Checked 2026-10-14

Documents

Cite this page

WarmTransfer. (2026, October 14). Illinois BIPA and voice biometrics. WarmTransfer. https://warmtransfer.net/knowledge/bipa-voice-biometrics

@misc{warmtransfer-bipa-voice-biometrics,
  title  = {Illinois BIPA and voice biometrics},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/bipa-voice-biometrics},
  note   = {Verified 2026-10-14}
}