Shannon Carpenter sued the fast food chain, claiming that McDonald’s captured and stored her “voiceprint” without her consent, a practice that has been illegal in Illinois since the Biometric Information Privacy Act was enacted in 2008.
The lawsuits aren’t likely to cause McDonald’s and other companies to scrap voiceprints and other biometrics—rather, there are extensive discussions on how to implement biometrics programs and comply with the law, lawyers said.
“The benefits of using these technologies outweigh the risks, but the risks have to be understood,” said Ronald Hedges, an attorney with Dentons US in New York. “Any entity that uses these technologies has to be prepared to explain what they did and why they did it.”
How companies navigate the Illinois law is likely to shape how they will comply with future biometrics laws in other states. While Illinois is the only state that allows a private right of action over a biometrics law, a number of states are weighing bills similar to BIPA.
Written Consent Required
Under BIPA, companies are required to obtain an individual’s written consent before collecting their biometric information—like face scans, fingerprints, or voiceprints. Companies also must make a data retention and destruction schedule available to the public.
BIPA only applies in voice-recognition lawsuits if companies generate a voiceprint, which isn’t defined under the statute, but courts have clarified it to mean the sound patterns in a person’s voice that AI can analyze to confirm their identity and predict future speech.
But many companies aren’t aware of the legal risks of gathering biometrics—as evidenced by the increase in biometrics litigation in recent years.
McDonald’s didn’t respond to a request for comment on this story.
In addition to the McDonald’s lawsuit,
In all cases, the plaintiffs said that the companies didn’t obtain consent before collecting biometric data, nor did they publish a data retention and destruction policy.
Companies are brainstorming ways to bring their technology into compliance with the law, said David Oberly, an attorney at Squire Patton Boggs in Cincinnati.
For example, call centers and customer service lines are throwing around the idea of texting or emailing someone while on a call to ask for consent to collect their biometric information. But it’s still not clear whether replying “1” to indicate consent complies with the law, Oberly said.
Companies that have voice recognition devices might choose not to enable the voice recognition feature for Illinois residents until the user gives their online consent to have their biometrics collected, Oberly said. Amazon Photos created this opt-in feature for Illinois residents for its image recognition technology.
For other companies like McDonald’s, it seems infeasible and impractical to obtain written consent, but they could still come up with a way to do it, Oberly said.
Future Litigation Trends
In the past year, voice recognition technology use has skyrocketed.
A March report from Global Market Insights Inc. estimates that the global market valuation for voice recognition technology will reach approximately $10 billion by 2028.
Some employers are considering voice-powered timekeeping systems over fingerprints, thanks to the Covid-19 pandemic and the spread of germs, while other companies are using the technology for health-care apps, banking apps, and hands-free car use.
And though the vast majority of BIPA cases involve the collection of fingerprints and face scans, litigation over voiceprints has spiked since last year.
“These are banner years,” said Debbie Reynolds, who runs a technology consulting firm in Chicago. “A lot of companies want to implement these new technologies, but it might be high risk for them to do that. A lot of companies are accustomed to collecting data and not having to delete it or let people know they are collecting.”
Attorneys interviewed for this story noted that because many Illinois companies still don’t know the risks associated with using people’s biometric information, they also don’t realize they can be held liable for the practice even if a third-party vendor supplies the technology and fails to obtain consent.
Companies can also be sued for unintentionally collecting voiceprints from individuals who haven’t given consent, like individuals in a room who don’t own the voice recognition device, they said.
“Google doesn’t say, hold on, you guys, before you start talking, which one of you owns me?” said Adrienne Arlan, an attorney at Segal McCambridge Singer & Mahoney. “This is kind of an omnipresent reality if you’re going to live in the modern world with modern technology.”
What’s more, the Illinois law’s five-year statute of limitations means companies can be sued for collecting biometrics for years after they begin complying.
“Voiceprint litigation is venomous instead of infectious,” said Arlan. “It goes in so many different directions, every case is so different, and it’s still growing.”
Attorneys aren’t sure which way the litigation is heading, since the trend is relatively new and many cases have yet to be resolved. But they are certain that voiceprint technology isn’t going away.
“There are pros and cons of every technology,” Hedges said. “But at the end of the day, businesses are going to make a case for biometric information.”