Illinois BIPA and call recordings: when voice data becomes biometric

Does Illinois BIPA apply to call recordings?

Not automatically. The Illinois Biometric Information Privacy Act (BIPA, 740 ILCS 14) regulates biometric identifiers, and its list includes a "voiceprint". An ordinary audio recording is not a voiceprint by itself. The risk starts when someone extracts a voice template from the audio, for example for caller authentication, speaker identification or analytics, because that template is the kind of data BIPA targets.

For a contact center or sales team with Illinois callers or agents, the practical question before licensing audio is: did any system, vendor or model ever create voiceprints from these calls? If the honest answer is "we don't know", the owner has a task before the recordings go anywhere. This is the point of the page: it keeps partners from introducing a company into a BIPA problem, and it gives owners a clear screen.

This is general information, not legal, tax or financial advice. Confirm with your own Illinois counsel before acting; read the Act's text rather than relying on a summary.

What BIPA says, in plain terms

The Act covers private entities that collect, capture, purchase or otherwise obtain biometric identifiers or information. In outline, it:

• defines biometric identifiers to include a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry
• requires a publicly available written retention and destruction policy
• requires informed written consent (a "written release") before collection
• prohibits a private entity from selling, leasing, trading or otherwise profiting from a biometric identifier or biometric information
• gives people a private right of action, which is why the statute is associated with class litigation

The prohibition on profiting is why the topic matters for licensing. If a company holds voiceprints, offering them in a data license is a serious issue. If it holds only audio and transcripts, the question becomes whether anything derived from the audio is biometric, and counsel should answer that on the facts.

Recording versus voiceprint: where the line sits

Where voiceprints hide in a contact center

Voice templates are rarely listed in the CRM, so owners should ask each vendor directly.

• Cloud contact center platforms with "voice biometrics" or "caller verification" options
• Quality assurance tools that tag individual agents by voice
• Analytics vendors that train speaker models on stored calls
• Fraud tools that compare callers against a watchlist of voices
• Employee timekeeping or access tools that use voice

The BIPA screen for audio, in six checks

1. Does the company have Illinois employees, callers or customers in the recordings?
2. Did the telephony platform, QA tool or analytics vendor ever enable voice biometrics?
3. Are there written releases and a published retention policy for any biometric feature?
4. Do vendor contracts say who owns derived templates and when they are deleted?
5. Can the company separate raw audio and transcripts from any templates?
6. Has counsel confirmed whether any derived data is a biometric identifier?

If any answer is unknown, the company should run an internal check before audio is considered for licensing. A "no biometrics were ever enabled" finding, documented by the vendors, is a good place to be.

Recording consent is a separate issue

BIPA is not the only barrier. Federal law generally allows recording with one party's consent under 18 U.S.C. section 2511, while some states require all parties' consent; California Penal Code section 632 is an example. Whether a recording notice covers AI use is a different question, discussed in does "this call may be recorded for training purposes" cover AI. Card numbers spoken on calls raise their own issue, covered in PCI DSS and call recordings.

How redaction fits

Transcript-first workflows reduce BIPA exposure because text carries no voice template, but only when the company has the right to use the audio in the first place and the transcripts are properly redacted. See how to redact PII from call transcripts. Contract limits matter too: a customer agreement may restrict reuse of call content, as explained in confidentiality clause use restrictions. Employee voices raise employee consent questions.

Whether audio is in scope at all is decided between the company and SourceX during rights review, and a company may offer transcripts or other records instead. A partner never touches recordings.

What to say to a contact center owner

Questions to put to each vendor

Illustrative scenario

Illustrative and fictional: a 200-person collections-support outsourcer records every call. Its IT lead finds that the platform's "voice verification" add-on was trialed for six months, then switched off. The company asks the vendor to confirm what templates were created and deleted, gets written confirmation, and has counsel record the finding. Transcripts of the remaining calls are then evaluated as a possible dataset, subject to notices, customer contracts and redaction.

When not to bother

Park the introduction if the company has stored voiceprints with no written releases, if recordings are the only data and no one can say what notices callers heard, or if the company is under the baseline of 50+ full-time employees at peak (contractors excluded). A company can return later once the audit is complete.

Next step

Run the company fit checker and read how it works. If the company looks like a fit, register as a partner and make the introduction.