Lawsuits Increase Against Companies that Collect “Voiceprints” (Amazon, American Airlines, Google, McDonald’s)

By B.N. Frank

Collecting individuals’ personal data (see 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11), images (see 1, 2, 3, 4), and “voiceprints” to analyze and sometimes sell and/or share with 3^rd parties is often referred to as “Surveillance Capitalism”. Children are not excluded from this practice and opposition to this is increasing in the U.S. and worldwide (see 1, 2, 3, 4, 5, 6, 7).

From Bloomberg:

‘Voiceprints’ Roil Companies as Biometrics Litigation Skyrockets

New wave of lawsuits targets voice-powered technologies
Illinois companies grapple with how to obtain written consent

McDonald’s wanted to create a more individualized experience in its drive-thrus. So it set up artificial-intelligence-based voice assistant Apprente to take orders, extract the duration and pitch of an individual’s speech, and use the data to identify repeat customers.

Shannon Carpenter sued the fast food chain, claiming that McDonald’s captured and stored her “voiceprint” without her consent, a practice that has been illegal in Illinois since the Biometric Information Privacy Act was enacted in 2008.

The lawsuits aren’t likely to cause McDonald’s and other companies to scrap voiceprints and other biometrics—rather, there are extensive discussions on how to implement biometrics programs and comply with the law, lawyers said.

“The benefits of using these technologies outweigh the risks, but the risks have to be understood,” said Ronald Hedges, an attorney with Dentons US in New York. “Any entity that uses these technologies has to be prepared to explain what they did and why they did it.”

How companies navigate the Illinois law is likely to shape how they will comply with future biometrics laws in other states. While Illinois is the only state that allows a private right of action over a biometrics law, a number of states are weighing bills similar to BIPA.

Written Consent Required

Under BIPA, companies are required to obtain an individual’s written consent before collecting their biometric information—like face scans, fingerprints, or voiceprints. Companies also must make a data retention and destruction schedule available to the public.

BIPA only applies in voice-recognition lawsuits if companies generate a voiceprint, which isn’t defined under the statute, but courts have clarified it to mean the sound patterns in a person’s voice that AI can analyze to confirm their identity and predict future speech.

But many companies aren’t aware of the legal risks of gathering biometrics—as evidenced by the increase in biometrics litigation in recent years.

McDonald’s didn’t respond to a request for comment on this story.

In addition to the McDonald’s lawsuit, Amazon was sued for collecting and retaining voiceprints through its Alexa devices, and unknowingly collecting information—sometimes sensitive information like passwords and Social Security numbers—when a user wasn’t intentionally trying to speak to it. A similar lawsuit was filed against Google over its Google assistants.

American Airlines got a lawsuit dismissed over its customer service hotline, which analyzed and stored callers’ voiceprints in order to better understand and predict callers, track interactions, and shorten hold times. Meanwhile, PetSmart was sued for collecting the voiceprints of its employees through their headsets, which are used to track employees and give them instructions.

In all cases, the plaintiffs said that the companies didn’t obtain consent before collecting biometric data, nor did they publish a data retention and destruction policy.

Possible Solutions

Companies are brainstorming ways to bring their technology into compliance with the law, said David Oberly, an attorney at Squire Patton Boggs in Cincinnati.

For example, call centers and customer service lines are throwing around the idea of texting or emailing someone while on a call to ask for consent to collect their biometric information. But it’s still not clear whether replying “1” to indicate consent complies with the law, Oberly said.

Companies that have voice recognition devices might choose not to enable the voice recognition feature for Illinois residents until the user gives their online consent to have their biometrics collected, Oberly said. Amazon Photos created this opt-in feature for Illinois residents for its image recognition technology.

For other companies like McDonald’s, it seems infeasible and impractical to obtain written consent, but they could still come up with a way to do it, Oberly said.

Future Litigation Trends

In the past year, voice recognition technology use has skyrocketed.

A March report from Global Market Insights Inc. estimates that the global market valuation for voice recognition technology will reach approximately $10 billion by 2028.

Some employers are considering voice-powered timekeeping systems over fingerprints, thanks to the Covid-19 pandemic and the spread of germs, while other companies are using the technology for health-care apps, banking apps, and hands-free car use.

And though the vast majority of BIPA cases involve the collection of fingerprints and face scans, litigation over voiceprints has spiked since last year.

“These are banner years,” said Debbie Reynolds, who runs a technology consulting firm in Chicago. “A lot of companies want to implement these new technologies, but it might be high risk for them to do that. A lot of companies are accustomed to collecting data and not having to delete it or let people know they are collecting.”

Attorneys interviewed for this story noted that because many Illinois companies still don’t know the risks associated with using people’s biometric information, they also don’t realize they can be held liable for the practice even if a third-party vendor supplies the technology and fails to obtain consent.

Companies can also be sued for unintentionally collecting voiceprints from individuals who haven’t given consent, like individuals in a room who don’t own the voice recognition device, they said.

“Google doesn’t say, hold on, you guys, before you start talking, which one of you owns me?” said Adrienne Arlan, an attorney at Segal McCambridge Singer & Mahoney. “This is kind of an omnipresent reality if you’re going to live in the modern world with modern technology.”

What’s more, the Illinois law’s five-year statute of limitations means companies can be sued for collecting biometrics for years after they begin complying.

“Voiceprint litigation is venomous instead of infectious,” said Arlan. “It goes in so many different directions, every case is so different, and it’s still growing.”

Attorneys aren’t sure which way the litigation is heading, since the trend is relatively new and many cases have yet to be resolved. But they are certain that voiceprint technology isn’t going away.

“There are pros and cons of every technology,” Hedges said. “But at the end of the day, businesses are going to make a case for biometric information.”

To contact the reporter on this story: Samantha Hawkins at [email protected]

To contact the editors responsible for this story: Cheryl Saenz at [email protected]; Rob Tricchinelli at [email protected]