Voiceprints and biometric laws

Illinois, Texas and Washington all list voiceprints as biometric identifiers and restrict selling or disclosing them. A call recording is not automatically a voiceprint, but voice data licensed for AI training can be turned into one, so these laws belong in any review of a call archive.

How do the three laws compare?

Point	Illinois BIPA	Texas CUBI	Washington RCW 19.375
Names voiceprints	Yes, in the definition of biometric identifier (740 ILCS 14/10).	Yes (Bus. & Com. Code 503.001).	Yes, in the definition of biometric identifier.
Before collecting	Written notice of purpose and retention period, and a written release.	Inform the person and receive consent before capture for a commercial purpose.	Notice and consent, or a mechanism to prevent later commercial use, before enrolling in a database.
Selling	No selling, leasing, trading or otherwise profiting.	No selling, leasing or disclosing outside narrow exceptions.	No selling or disclosing inconsistent with the notice without consent, outside listed exceptions.
Retention	A public written policy; destroy when the purpose is met or within 3 years of the last interaction, whichever comes first.	Destroy within a reasonable time, no later than one year after the purpose expires, with some exceptions.	Keep no longer than reasonably necessary for the stated purpose.
Enforcement	Private lawsuits: $1,000 per negligent, $5,000 per intentional or reckless violation, or actual damages if higher.	Attorney General: civil penalty up to $25,000 per violation.	Attorney General, under the Consumer Protection Act.

Where these facts come from (3)

BIPA full text, 740 ILCS 14, on ilga.gov (seen Nov. 7, 2026)
Texas CUBI, chapter 503 of the Business and Commerce Code, on the Legislature’s statutes site (seen Nov. 7, 2026)
Washington’s biometric identifiers chapter, RCW 19.375, on leg.wa.gov (seen Nov. 7, 2026)

What does this mean for a call archive?

Know where your callers are. If you cannot separate Illinois, Texas and Washington callers, assume some are in the archive.

Ask what the buyer will do with voices. Training speech recognition on de-voiced transcripts is a different risk from training a model on the raw voices. Labelbox Prism, the one buyer page we read that names voice, excludes voice without explicit, timestamped consent.

Prefer transcripts where they will do. A redacted transcript carries no voiceprint. If a buyer needs audio, ask whether it can work with speaker-anonymized audio.

Get advice in writing. Have your own lawyer read the license, including who bears the risk if a biometric claim follows.

Questions about voiceprints

Is a call recording a voiceprint under BIPA?

The statute lists "voiceprint" as a biometric identifier but does not call every recording one. The risk turns on whether someone extracts a voice template that can identify a person, and a buyer training speaker recognition or voice cloning may do exactly that.

Can a company sell voiceprints of Illinois callers?

BIPA says no private entity holding a biometric identifier may sell, lease, trade or otherwise profit from it. That is why audio from Illinois callers needs particular care, and often exclusion.

Does CUBI let people sue?

No. The Texas law is enforced by the Attorney General, with a civil penalty of up to $25,000 per violation.

Does Washington’s law apply to recordings?

RCW 19.375 covers enrolling a biometric identifier, which it defines to include a voiceprint, in a database for a commercial purpose. It requires notice and consent, or a way to prevent later commercial use, and limits selling or disclosing it.

Do other states have similar laws?

Some cities and states have biometric or privacy laws that reach voice data, and more are proposed each year. Ask your lawyer to check every state your callers are in.