Biometric Voiceprint Consent Form

What Is Biometric Voiceprint Consent Form?

A biometric voiceprint consent form is the written disclosure and signed release a business must obtain before it captures, creates, stores, or shares a person's voiceprint. A voiceprint is not the audio file. It is the mathematical template, the set of vocal characteristics extracted from a recording, that can single out one person the way a fingerprint does. Under Illinois law a voiceprint is named outright as a biometric identifier (740 ILCS 14/10), and the same is true under Texas CUBI, the GDPR, and California's CCPA as amended by the CPRA. Because the data identifies the individual, every one of those regimes wants the person told what is being collected and why, and wants their agreement on the record before a single template is generated.

The form does two jobs. It delivers the statutory notice (the purpose of collection, how long the data is kept, the method, and any third parties who will receive it), and it captures the release, meaning the person's informed written or electronic agreement to all of that. Get both right and you have built the consent defense that almost every defendant in the current wave of voiceprint litigation wishes it had. Skip the notice, bury the consent in a terms-of-service checkbox, or quietly route the voiceprint into a model-training pipeline you never mentioned, and you have built the exact fact pattern plaintiffs' firms are filing on right now.

Why This Matters Now

Voice biometrics used to live quietly inside call centers and warehouse headsets. That changed when the AI meeting assistant moved into every Zoom and Teams call. Tools like Otter.ai and Fireflies.AI run speaker diarization, the technical step that separates who said what, and speaker recognition that builds a per-person voiceprint so the software can label the same speaker across meetings. That is biometric processing, and most users never agreed to it. In August 2025 plaintiffs filed Brewer v. Otter.ai and Walker v. Otter.ai in the Northern District of California, alleging voiceprint collection for speaker identification and model training with no notice and no consent. In December 2025, Cruz v. Fireflies.AI Corp. made nearly identical claims. On January 29, 2026 a court certified a class against Apple over Siri voiceprints, covering roughly three million Illinois users.

The dollars behind these filings are why general counsel are paying attention. Whole Foods settled the first voiceprint BIPA class action for about $300,000 in January 2023 over warehouse headset collection. Petco paid $445,000 in 2024 for voiceprint capture through a Honeywell warehouse system that swept in 445 workers. Meta paid Texas $1.4 billion in July 2024 over facial recognition, the largest state biometric settlement on record, and Clearview AI settled facial-scraping claims for $51.75 million in March 2025 using a novel deal that hands the class 23 percent equity in the company. Voice is simply the next modality, and the legal theory is identical. If you record voices, route them through software that recognizes speakers, or feed them to a model, you are collecting voiceprints, and a court will not care that your privacy lawyer never used that word.

The Legal Backbone

What separates a consent form that holds up from one that invites a class action

The defendants losing these cases did not all fail to ask for consent. Many had a consent buried somewhere. They lost on specifics. Look at what the Otter.ai, Fireflies.AI, Apple Siri, and Verizon Voice ID complaints actually allege, and a pattern appears: the voiceprint was created or reused for a purpose the person was never told about, usually speaker identification across sessions or training a machine-learning model. A consent form that names 'voice authentication' and then quietly routes the same voiceprint into a model-improvement pipeline is worse than no form, because it documents that you knew the data was sensitive and chose not to disclose the actual use. The strongest forms disclose every purpose by name, and they treat AI model training as its own line item with its own checkbox, separate from the core function. As of 2025 most consent forms in the market still do not do this, which is exactly the gap the current suits are exploiting.

Then there is the line between the raw recording and the derived voiceprint. BIPA and the GDPR both care about the template, not just the audio, and a precise form says so. It tells the person that a voiceprint, a mathematical identifier, will be generated from their voice, names the method, and states the retention period by reference to a public destruction schedule (three years from last interaction under BIPA, one year after purpose expires under Texas CUBI, 24 months under Colorado). A form that says 'we may collect voice data' without acknowledging the biometric template is the kind of language plaintiffs' experts pick apart, because diarization-based speaker recognition demonstrably creates an identifier whether or not the drafter used the word voiceprint.

Last comes the mechanics. The consent must be affirmative and unbundled. A pre-checked box does not count, and folding biometric consent into a forty-page terms-of-service nobody reads is precisely the bundling the GDPR forbids and the kind of fact a BIPA court treats skeptically. Capture the consent with an explicit action (a checkbox the person ticks, a signature, or a clicked agreement), timestamp it, store proof, and give a genuine way to withdraw it. For employees, BIPA permits a release signed as a condition of employment, but Colorado now limits which biometric uses can be forced as a condition of the job to things like secure facility access and timekeeping, so a consent that conditions the entire job on broad biometric processing can itself be unlawful. Build the form to over-disclose, separate the secondary uses, and make withdrawal real, and you have the defense the headline defendants did not.

When You Need This

You record customer service or sales calls and run any speaker-recognition or voice-authentication step (Verizon's Voice ID program drew a 2024 suit for exactly this).

You deploy an AI meeting assistant or transcription tool that labels or identifies speakers across sessions, the conduct at the center of the Otter.ai and Fireflies.AI cases.

You use voiceprints for employee or worksite timekeeping, the warehouse-headset scenario behind the Whole Foods and Petco settlements.

You build a voice authentication, IVR, or fraud-detection product that enrolls a customer's voice as a credential.

You train or fine-tune a speech or speaker model on real voices, which makes model training a disclosed secondary purpose you must consent for separately.

You collect any voice data from Illinois, Texas, Washington, Colorado, or New Jersey residents, or from anyone in the EU or UK, where the GDPR's special-category rules apply.

You are a controller or vendor receiving voiceprints from another company, since BIPA bars obtaining a biometric identifier through trade without the same notice and release.

How to Fill Out Biometric Voiceprint Consent Form

1. 1. Identify the data as a voiceprint

   State plainly that you will create a voiceprint, a mathematical template of the person's vocal characteristics, and distinguish it from any raw audio recording. Do not hide behind 'voice data.' BIPA section 10 and GDPR Article 4(14) both regulate the template, so name it. If you keep the underlying recording too, say so on its own line.

2. 2. State every specific purpose by name

   List each use: voice authentication, speaker identification in meetings, timekeeping, fraud detection, accessibility. Give AI model training its own separate disclosure and its own checkbox, because reusing a voiceprint to train a model is the secondary use driving the 2025-2026 lawsuits. A purpose you do not name is a purpose you are not authorized to use the data for.

3. 3. Disclose the retention period and link the destruction schedule

   Give a concrete trigger and an outside cap, then link to a public retention and destruction policy. Use the strictest cap that applies: three years from last interaction under BIPA, one year after purpose expires under Texas CUBI, 24 months under Colorado HB 24-1130. Confirm that the data is destroyed when the stated purpose is satisfied or the cap hits, whichever is first.

4. 4. List every third party that will receive the voiceprint

   Name the cloud vendors, AI processors, and authentication providers that touch the data. For EU and UK subjects the GDPR expects granular per-recipient consent, so present the third-party transfer as its own choice rather than rolling it into the main agreement. If you transfer outside the EEA, note the transfer mechanism.

5. 5. Add the GDPR granular-consent block when EU or UK subjects are involved

   Split consent into the recording itself, the creation of the voiceprint, and any third-party or training use, each as a distinct affirmative choice under Article 9(2)(a). Reference or attach your Data Protection Impact Assessment if the processing is large-scale or systematic, as Article 35 requires, and include the Data Protection Officer's contact if you have one.

6. 6. Capture affirmative, unbundled, timestamped consent

   Use an unchecked checkbox, a signature, or an explicit click. Never pre-check it, and never bundle biometric consent with unrelated terms of service. Record the timestamp, the version of the notice the person saw, and the identity of the signer. Electronic signatures satisfy BIPA after the 2024 amendment, so a clicked and logged consent is enough if you preserve the proof.

7. 7. Build in a real withdrawal mechanism

   Give clear instructions for revoking consent and a separate opt-out for secondary uses like model training, so a person can keep the core service while declining to feed the AI. State honestly what withdrawal does to the service. Weak or missing opt-out is a recurring GDPR and CPRA deficiency, so make this functional, not decorative.

8. 8. Handle the employment and minor scenarios with care

   For employees, BIPA allows a release signed as a condition of employment, but Colorado limits which biometric uses can be a condition of the job to secure access, timekeeping, and safety, so do not condition the whole job on broad processing. For anyone under 18, obtain a parent or guardian's consent. Keep the signed form, the notice version, and proof of delivery for the full retention period.

Key Terms Defined

Voiceprint

A mathematical template of a person's unique vocal characteristics, extracted from a voice recording through technical processing, that can single out one individual. It is a biometric identifier under BIPA section 10, Texas CUBI, the GDPR, and the CCPA, and it is distinct from the underlying audio file.

Speaker diarization

The technical process that partitions a recording by speaker, answering 'who spoke when.' When paired with speaker recognition, it generates a per-person voiceprint, which is why meeting-assistant tools that diarize are treated as performing biometric processing under the GDPR and BIPA.

Written release (BIPA)

Under 740 ILCS 14/15, the informed written consent that a private entity must obtain before collecting a biometric identifier. It can be an electronic signature, and in the employment context a release signed as a condition of employment. The 2024 amendment confirmed electronic signatures qualify.

Private right of action

The ability of an individual, not just a government regulator, to file suit for a statutory violation. BIPA is the only U.S. biometric law that grants one broadly. Texas, Washington, and Colorado leave enforcement to the attorney general; California's is limited to data breaches.

Special category data (GDPR Article 9)

A class of personal data, including biometric data processed to identify someone, whose processing is prohibited unless a narrow exception such as explicit consent under Article 9(2)(a) applies. Voiceprints fall in this category, which is why EU consent must be specific and granular.

Data Protection Impact Assessment (DPIA)

A documented risk analysis required by GDPR Article 35 before any large-scale or systematic processing of special category data begins. It identifies the risks of the voiceprint processing, assesses their severity, and records the measures taken to reduce them.

Related Documents

Legal Authorities & Sources

This page is grounded in primary law. The statutes and official resources below are the authorities behind the guidance above. Verify the current text of any statute before relying on it.

• Illinois Biometric Information Privacy Act, 740 ILCS 14 (full text, Justia)
• Illinois General Assembly, official BIPA text (ActID 3004)
• Texas Attorney General, Capture or Use of Biometric Identifier Act (CUBI)
• Washington RCW 19.375, Biometric Identifiers
• GDPR, Regulation (EU) 2016/679 (EUR-Lex consolidated text)
• Colorado HB 24-1130, Privacy of Biometric Identifiers
• Seventh Circuit BIPA retroactivity analysis, Clay v. Union Pacific (Sidley Data Matters, April 2026)

Frequently Asked Questions