Are voiceprints biometric data? BIPA, CUBI and Washington explained

Most compliance reviews of a call archive start with recording consent. For audio that might be licensed for AI training, there is a second question that is easy to miss: whether the voices themselves are regulated as biometric data. In three states the answer is plainly yes.

What is a voiceprint?

A voiceprint is a mathematical description of the features of a person’s voice that can be used to recognize them, the way a fingerprint template is used to recognize a finger. Speaker verification systems create one when they enroll a caller. A plain recording contains the raw material for a voiceprint but is not, by itself, the template.

That distinction is real, but thin. Once audio leaves your systems, you cannot control whether a buyer, or a model trained on the audio, extracts speaker features. Speech recognition trained on many voices is a different risk from speaker identification or voice cloning, and a license should say which is allowed.

What does Illinois BIPA require?

Illinois passed its biometric privacy law, codified at 740 ILCS 14, in 2008. It names “voiceprint” in its definition of a biometric identifier. A private entity that collects one must give written notice of the purpose and how long it will be kept, and obtain a written release. It must publish a retention policy and destroy the data when the purpose is met or within three years of the person’s last interaction, whichever comes first.

The section that matters most for a license is the bar on profit. A private entity in possession of a biometric identifier may not sell, lease, trade or otherwise profit from it. BIPA also gives individuals the right to sue, with damages of $1,000 per negligent violation and $5,000 per intentional or reckless violation, or actual damages if higher. That private right of action is why BIPA claims are common.

What does Texas CUBI require?

The Texas law on capture or use of biometric identifiers, Business and Commerce Code 503.001, also lists voiceprints. Before capturing one for a commercial purpose, a business must inform the person and receive consent. It may not sell, lease or otherwise disclose the identifier except in narrow cases, such as when required by law. It must destroy the identifier within a reasonable time, generally no later than a year after the purpose for collecting it ends.

There is no private lawsuit under CUBI. The Attorney General enforces it, with a civil penalty of up to $25,000 for each violation.

What does Washington’s law require?

Washington’s chapter 19.375 RCW defines biometric identifiers to include voiceprints. A person may not enroll one in a database for a commercial purpose without first giving notice, obtaining consent, or providing a mechanism to prevent later commercial use. Selling or disclosing an enrolled identifier for a purpose inconsistent with the notice is restricted without consent, subject to listed exceptions. The Attorney General enforces it under the Consumer Protection Act.

How do the three compare?

Point	Illinois	Texas	Washington
Voiceprint named	Yes	Yes	Yes
Consent form	Written release	Consent after being informed	Notice and consent, or a way to block commercial use
Selling	Barred	Barred outside narrow exceptions	Restricted without consent
Who enforces	Individuals can sue	Attorney General	Attorney General

What does this mean for a recorded call archive?

Three practical steps follow.

Know where your callers are. If you cannot separate callers from these three states, assume some are in the archive. For Illinois callers, the bar on profiting from biometric identifiers is a strong reason to leave their audio out.

Offer transcripts where they will do. A redacted transcript carries no voice. Several buyers describe support records as text, and for some uses that is all they need.

Ask the buyer what it will do with voices. Labelbox Prism, the one buyer page we read that names voice data, excludes voice without explicit, timestamped consent. A recording notice is not that kind of consent, so ask what evidence it accepts before sizing anything.

What should a license say about voices?

If audio is licensed at all, the agreement should name the permitted uses in plain terms: for example, speech recognition training is allowed, while speaker identification, voice cloning and any attempt to re-identify callers are not. It should require the buyer to delete audio on request and at the end of the term, and say who carries the risk if a biometric claim follows. A buyer that will not put those limits in writing is telling you how it plans to use the voices.

Is this the full list of laws?

No. Other states and some cities have biometric or general privacy laws that can reach voice data, and new bills appear every session. Treat these three as the floor, and have your own lawyer check every state your callers are in. Our voiceprints and biometric laws page keeps the side-by-side version, including retention rules.

For the wider picture of what buyers publish and which checks come first, see the main briefing on how to sell call recordings. Decide what the voices may be used for before you decide what the archive is worth.