Voiceprints from retirement calls don’t revive Illinois privacy suit

For Illinois customers calling about financial accounts, a routine service line turned into a fight over who gets to use a voice like data. The Third Circuit sided with Amazon Web Services and Pindrop Security, affirming rulings that blocked the proposed class action under the Illinois Biometric Information Privacy Act, or BIPA.

The plaintiffs said John Hancock routed their calls through Amazon Connect and that Pindrop used cloud-based technology to authenticate callers by their voiceprints. The court left the lower-court outcome in place.

Where the privacy claim ran aground

BIPA is Illinois’ biometric privacy law, and it limits how companies collect and handle data such as fingerprints, face geometry and voiceprints. The callers said their voices were gathered without the consent the statute requires.

The court said Pindrop fit BIPA’s financial-institution exemption because the authentication work was tied to financial transactions. It also said Illinois law could not reach the conduct as framed, because the key processing happened outside the state: Amazon Connect received the calls on servers in Northern Virginia, sometimes sent them to Pindrop in Georgia for voiceprint authentication, and then connected them back to John Hancock in Massachusetts.

Why the ruling matters beyond one call center

Voice authentication is becoming a familiar part of customer service, especially for financial accounts where companies want faster identity checks. For consumers, that can make a simple phone call feel less simple when software is listening in for patterns that identify who they are.

The panel also rejected efforts to reopen discovery and revive one of the claims after dismissal. For now, the decision narrows the path for people trying to use Illinois biometric law against outside vendors that process voice data.