Illinois BIPA: A Voiceprint Isn't Just a Recording

Illinois’ Biometric Information Privacy Act is having a moment again, and this time the target isn’t fingerprint scanners at a warehouse, it’s AI meeting and voice tools. A fresh wave of BIPA class actions in 2025 and 2026 has gone after AI notetaking and voice-analysis vendors for collecting “voiceprints,” the unique vocal characteristics that can identify or distinguish a speaker, without the written notice and written consent the law requires before that collection happens. If your GCC team is building, buying, or operating an AI voice-screening tool anywhere in a hiring pipeline that touches Illinois, the distinction between “we recorded a call” and “we extracted a voiceprint” just became the difference between routine and litigation-exposed.

The legal line: recording versus identification

BIPA doesn’t regulate audio recordings generally, it regulates biometric identifiers, and voiceprints are explicitly one of them. The trigger isn’t whether a voice interview happened or was stored, it’s whether the system analyzed the audio to identify or distinguish who was speaking, the same category of processing as a fingerprint or a face scan, just built from sound instead of an image. Recent class actions have targeted vendors whose tools perform speaker recognition or voice identification, functions law firms tracking this litigation describe as sitting “squarely in biometric territory.” A tool that transcribes what was said and analyzes how it was said, pace, clarity, structure, is doing something legally different from a tool that builds a biometric profile to recognize that specific person’s voice again later. Most employers using these tools don’t know which side of that line their vendor sits on, because the marketing language rarely says.

Why this reaches a Delhi or Bengaluru delivery center

A large share of India’s global capability centers now build, configure, or operate AI hiring and screening tools on behalf of US-headquartered parent companies and clients, and campus and lateral hiring pipelines routinely include candidates or roles tied to Illinois. BIPA’s private right of action doesn’t require the vendor to be headquartered in Illinois, it requires the biometric collection to reach an Illinois resident, which means a GCC building a voice-screening tool for a US business unit can be pulled into this exposure even while every engineer on the team is sitting in India. We wrote about a similar extraterritorial pattern with the EU AI Act’s reach into Indian hiring vendors: the law doesn’t care where the code was written, it cares where the candidate is.

What BIPA actually requires, and what it costs to get wrong

The statute is specific, not vague. Before collecting a biometric identifier, an organization must give written notice that collection is happening, disclose in writing how long the data will be retained and when it will be destroyed, obtain written consent, and maintain a published, BIPA-compliant retention and destruction policy. Violations carry statutory damages of $1,000 per negligent violation and $5,000 per intentional or reckless violation, though a 2024 amendment now caps recovery to a single violation per person rather than one per data collection event, which lowers the ceiling on any one claim but hasn’t slowed the volume of new suits. None of the recent AI-meeting-tool cases turned on some obscure technicality, they turned on the same missing step every time: nobody told the person in writing that their voice was being biometrically processed, or for how long the data would sit somewhere.

The distinction that should shape your vendor questions

The honest complication here is that not every AI voice-screening tool does voice identification, and conflating “we use AI to evaluate a voice interview” with “we collect voiceprints” isn’t accurate for every vendor, but you can’t tell which one you’re running without asking directly. The question worth putting to any AI screening vendor, including us: does the system build a biometric profile to recognize a specific person’s voice, or does it evaluate the content and delivery of what was said without creating an identifier tied to that person’s vocal signature. Those are different products with different compliance obligations, and “AI voice screening” as a category description doesn’t tell you which one you’ve bought. In our own work running structured voice interviews at hiring-drive scale, across more than a thousand interviews to date, the screening signal we’ve built the product around is communication clarity and content, whether someone can explain themselves, follow instructions, and hold a conversation under mild pressure, cutting HR screening time by 89% and flagging over 60% of clear no-gos before a recruiter opens the file. That’s a different processing question than voice identification, but it’s on every vendor, including HireQwik, to be able to answer clearly rather than assume.

The take

This isn’t a reason to avoid voice-based screening, it’s a reason to stop treating “AI voice tool” as one undifferentiated category when a state law is actively drawing a line through the middle of it. If your GCC is building or buying AI hiring tools with any Illinois-connected candidates in the pipeline, the question isn’t whether you recorded a voice interview, everyone does that. It’s whether anyone can tell you, in writing, whether that recording became a biometric identifier, and if it did, whether the notice and consent BIPA requires happened before it did.

If you want to walk through what a compliance-aware voice-screening architecture actually looks like, talk to us about the distinction between communication signal and biometric identification.

Sources: AI Meeting Tools Are The Latest Target of Illinois BIPA Class Actions — Fisher Phillips, Illinois Legislature Modifies Damages Rule Under BIPA — WilmerHale