Overview
Over 750 suits have been filed under the Illinois's Biometric Information Privacy Act (BIPA) since it was enacted in 2008, targeting a broad range of practices, including retailers that offer virtual try-on features, and employers who use finger scanning technology for timekeeping and security purposes.
Now, retailers are looking away from fingers and faces and toward retailers' uses of voice recognition technology. Twenty of these cases have been filed this year—representing an exponential increase from previous years. These new suits have targeted a broad range of retailers, including retail and e-commerce giants, drug stores, office supply stores, and grocers.
Just last month, arguably the largest voice recognition data case to date was filed in Cook County Circuit Court, Illinois, against a string of eight restaurants, targeting their automated voice ordering (AVO) systems. In the weeks since this case was filed, seven new voice recording suits have been filed across the United States – reflecting over a 400% monthly increase in these suits.
Recent Litigation
These suits are not limited to the Alexas of the world. Many retailers use voice recognition technology to personalize their customer service experiences and to decrease the risk of fraud. This can be done through the creation of a "voiceprint," which like a fingerprint, is unique to a specific individual. Voiceprints can be created by taking a customer's past verbal communications with a retailer and creating a literal unique print of their voice. This, in turn, allows retailers to recognize customers more quickly in the future. For example, the technology can expedite customer service calls by, e.g., allowing retailers to more quickly pull up a customer's order history, or to identify identity thieves who may be fraudulently impersonating other customers to place orders.
In Guy-Powell v Applebee's Restaurants LLC et al., case number 2022-CH-08365, filed on August 24, 2022, in Cook County Circuit Court, the plaintiffs allege defendants were creating voiceprints through their AVO systems, and therefore allegedly violating plaintiffs' rights to biometric privacy when used without written notice or consent. Specifically, they claim that numerous prominent restaurant chains—including Applebee's, Blaze Pizza, Chipotle, Dine Brands, Interactions, Noodle & Company, Portillo's, Red Lobster—and their third-party voice recognition system provider, SynQ3, violate BIPA by creating voiceprints for customers, without notice or their consent, when the customers called to order food or obtain directions.
At a high level, BIPA prohibits a business from "collect[ing], captur[ing], purchas[ing], receiv[ing] through trade, or otherwise obtain[ing]" a person's biometric data—which is defined to include voiceprints—without first providing written notice of the company's biometric data collection, retention, and storage practices and obtaining written consent. In 2019, the Illinois Supreme Court held that individuals can bring claims under BIPA even if they have not been injured by the defendant’s failure to satisfy these notice and consent requirements.
The statute allows consumers to sue for statutory damages up to $1,000 for each negligent violation and up to $5,000 for intentional or reckless violations—making it an incredibly attractive statute for the plaintiffs' bar.
Voice recognition cases are still in their infancy. Most case law to date has involved jurisdictional questions, such as where a suit under BIPA (Illinois law) should be filed when the company, customer, and voiceprint vendor are all based in different states. In one suit against an e-commerce retailer,[1] for example, the District Court for the Southern District of Illinois dismissed the case for lack of personal jurisdiction, where the plaintiffs lived in and made the phone call that was the basis of their claims in Illinois, but the company they were calling was Massachusetts-based and the technology vendor was based in Delaware. The court held that (1) being a citizen of a state and (2) making a voice audio in that state was not enough to establish personal jurisdiction.
The plaintiffs subsequently re-filed their case in the District of Delaware, where the voiceprint was allegedly made.[2] In September 2021, the court dismissed the case based on its holding that BIPA does not apply extraterritorially. Plaintiffs were given leave to amend and in February 2022, the court granted their leave to amend. In April 2022, both defendants filed motions to dismiss, arguing, inter alia, that the plaintiffs had not alleged sufficient facts to support their claims. The motions have been fully briefed since June but have not yet been decided.
Conclusion
In-house legal departments are often the last to hear about their companies' technological innovations. Given the steep penalties and increasing number of cases, however, counsel should insert themselves in any discussions concerning voice recognition technology to determine whether BIPA applies to the voice recognition application at issue and if so, to ensure that the requisite consent is obtained and that BIPA’s other detailed requirements are satisfied.
Endnotes
[1] McGovern v. Amazon Web Services Inc., United States District Court for the Southern District of Illinois, Case No. 3:20-CV-31.
[2] McGovern v. Amazon Web Services Inc., United States District Court for Delaware, Case No. 1:20-CV-1399.