Lawsuits Increase Against Companies that Collect “Voiceprints” (Amazon, American Airlines, Google, McDonald’s)

‘Voiceprints’ Roil Companies as Biometrics Litigation Skyrockets
New wave of lawsuits targets voice-powered technologies
Illinois companies grapple with how to obtain written consent
McDonald’s wanted to create a more individualized experience in its drive-thrus. So it set up artificial-intelligence-based voice assistant Apprente to take orders, extract the duration and pitch of an individual’s speech, and use the data to identify repeat customers.

Shannon Carpenter sued the fast food chain, claiming that McDonald’s captured and stored her “voiceprint” without her consent, a practice that has been illegal in Illinois since the Biometric Information Privacy Act was enacted in 2008.

The lawsuits aren’t likely to cause McDonald’s and other companies to scrap voiceprints and other biometrics—rather, there are extensive discussions on how to implement biometrics programs and comply with the law, lawyers said.

“The benefits of using these technologies outweigh the risks, but the risks have to be understood,” said Ronald Hedges, an attorney with Dentons US in New York. “Any entity that uses these technologies has to be prepared to explain what they did and why they did it.”

How companies navigate the Illinois law is likely to shape how they will comply with future biometrics laws in other states. While Illinois is the only state that allows a private right of action over a biometrics law, a number of states are weighing bills similar to BIPA.

Written Consent Required

Under BIPA, companies are required to obtain an individual’s written consent before collecting their biometric information—like face scans, fingerprints, or voiceprints. Companies also must make a data retention and destruction schedule available to the public.

BIPA only applies in voice-recognition lawsuits if companies generate a voiceprint, which isn’t defined under the statute, but courts have clarified it to mean the sound patterns in a person’s voice that AI can analyze to confirm their identity and predict future speech.

But many companies aren’t aware of the legal risks of gathering biometrics—as evidenced by the increase in biometrics litigation in recent years.

McDonald’s didn’t respond to a request for comment on this story.

In addition to the McDonald’s lawsuit, Amazon was sued for collecting and retaining voiceprints through its Alexa devices, and unknowingly collecting information—sometimes sensitive information like passwords and Social Security numbers—when a user wasn’t intentionally trying to speak to it. A similar lawsuit was filed against Google over its Google assistants.

American Airlines got a lawsuit dismissed over its customer service hotline, which analyzed and stored callers’ voiceprints in order to better understand and predict callers, track interactions, and shorten hold times. Meanwhile, PetSmart was sued for collecting the voiceprints of its employees through their headsets, which are used to track employees and give them instructions.

In all cases, the plaintiffs said that the companies didn’t obtain consent before collecting biometric data, nor did they publish a data retention and destruction policy.

Possible Solutions

Companies are brainstorming ways to bring their technology into compliance with the law, said David Oberly, an attorney at Squire Patton Boggs in Cincinnati.

For example, call centers and customer service lines are throwing around the idea of texting or emailing someone while on a call to ask for consent to collect their biometric information. But it’s still not clear whether replying “1” to indicate consent complies with the law, Oberly said.

Companies that have voice recognition devices might choose not to enable the voice recognition feature for Illinois residents until the user gives their online consent to have their biometrics collected, Oberly said. Amazon Photos created this opt-in feature for Illinois residents for its image recognition technology.

For other companies like McDonald’s, it seems infeasible and impractical to obtain written consent, but they could still come up with a way to do it, Oberly said.

Future Litigation Trends

In the past year, voice recognition technology use has skyrocketed.

Read More: Lawsuits Increase Against Companies that Collect “Voiceprints”