Recording Law for Voiceprints & Biometric Data in Illinois

In Illinois, recording a voiceprint—meaning a digital scan of someone’s unique voice patterns for identification—is not governed by the state’s all-party consent law for conversations. That law (720 ILCS 5/14-2) criminalizes the surreptitious recording of private conversations or electronic communications without the consent of all parties, but it does not address the extraction or use of biometric data like a voiceprint. However, Illinois has a separate and stricter law that does control voiceprint collection: the Biometric Information Privacy Act (BIPA), 740 ILCS 14/1 et seq. Under BIPA, a voiceprint is treated as a "biometric identifier," which means you must get written consent before collecting, storing, or using it. The law requires you to tell the person in writing what you’re collecting, why, and how long you’ll keep it. You also have to publish a retention schedule and destroy the data within three years of the person’s last interaction with you. Selling or profiting from the voiceprint is forbidden. Violating BIPA can lead to lawsuits with damages of $1,000 per negligent violation or $5,000 per intentional or reckless violation, plus attorneys’ fees.

BIPA sets out specific steps you must follow before collecting a voiceprint. First, you must provide written notice that explains you’re collecting a biometric identifier (your voiceprint), the purpose of the collection, and how long you’ll keep and use it. Second, you must receive a written release from the person—an electronic signature now counts under the 2024 update to the law. Third, you must create and publish a publicly available policy that states how long you’ll keep the data and when it will be destroyed, which must be no later than three years after the person’s last interaction with you. BIPA also bans selling or profiting from voiceprints and restricts sharing them without consent, except in limited situations like legal process. If you don’t follow these rules, the person whose voiceprint you collected can sue you in state or federal court. BIPA’s definition of "biometric identifier" at 740 ILCS 14/10 expressly includes voiceprints, and the statute’s notice, consent, retention, destruction, and prohibition provisions apply directly to voiceprint collection.

BIPA gives people a private right of action, meaning they can sue you directly if you collect their voiceprint without consent or fail to follow the law’s requirements. The law allows damages of $1,000 for each negligent violation or $5,000 for each intentional or reckless violation, whichever is greater. You could also have to pay the person’s attorneys’ fees and costs, including expert witness fees. In 2023, the Illinois Supreme Court ruled in Cothron v. White Castle System, Inc., 2023 IL 128004 (Feb. 17, 2023), that a new claim can arise each time biometric data is collected or shared, which increased potential exposure. However, the legislature narrowed that in 2024 by clarifying that multiple collections or disclosures using the same method count as a single violation for one person. Even with that change, the stakes remain high—BIPA is one of the most claim-friendly biometric privacy laws in the country. The 2024 amendment (Public Act 103-0769, eff. Aug. 2, 2024) also allows electronic signatures to satisfy the written consent requirement.

BIPA allows voiceprint collection only if you get written consent and follow all the law’s requirements. There are very limited exceptions, such as if the collection is covered by another law like the Gramm-Leach-Bliley Act for financial institutions, but those exceptions don’t typically apply to most businesses or legal tech tools. For example, if a law firm wants to use a voice-ID feature for client authentication, it must first provide written notice about what biometric data it’s collecting, why, and how long it will keep the data. The firm must also publish a retention schedule and get the client’s written consent—an electronic signature is now enough. Without these steps, collecting the voiceprint would violate BIPA and expose the firm to a lawsuit. BIPA’s retention limit is three years after the individual’s last interaction with the entity, and the law bars selling, leasing, trading, or otherwise profiting from the voiceprint.

Say a law firm wants to use a voice-ID feature so clients can verify their identity when calling in. Under BIPA, the firm must first tell each client in writing that it’s collecting a voiceprint, the purpose (client authentication), and how long it will keep the data (for example, three years after the client’s last interaction). The firm must also publish a retention schedule online and get the client’s written consent—an electronic signature on a digital form would satisfy this. If the firm skips these steps and starts collecting voiceprints anyway, a client could sue under BIPA, seeking $1,000 or $5,000 in damages plus attorneys’ fees. The 2024 update to BIPA doesn’t change this—it only clarifies that multiple collections using the same method count as one violation per person, not separate claims each time.

If you’re recording the actual audio of a conversation or electronic communication in Illinois, the all-party consent law (720 ILCS 5/14-2) applies. This means everyone in the conversation must agree before you can record it, but only if the communication is a "private conversation" or "private electronic communication" under 720 ILCS 5/14-1(d) and (e). Those provisions define a private conversation as one where at least one person intended it to be private under circumstances that reasonably justify that expectation, and a private electronic communication in parallel terms. Openly recording a loud argument on the street, a political debate in a park, or the public interactions of police officers with citizens would not count as a private conversation, as the Illinois Supreme Court explained in People v. Clark, 2014 IL 115776, ¶21. But recording a private meeting in an office would. The law also requires the recording to be done "in a surreptitious manner"—meaning secretly or deceptively—to trigger the all-party consent rule. There is an explicit statutory carve-out for recording on-duty police in public: 720 ILCS 5/14-2(e) provides that "Nothing in this Article shall prohibit any individual, not a law enforcement officer, from recording a law enforcement officer in the performance of his or her duties in a public place or in circumstances in which the officer has no reasonable expectation of privacy. However, an officer may take reasonable action to maintain safety and control, secure crime scenes and accident sites, protect the integrity and confidentiality of investigations, and protect the public safety and order."

Recording a private conversation or electronic communication without all parties’ consent in Illinois is a felony under 720 ILCS 5/14-2. A first offense is generally a Class 4 felony, punishable by up to one to three years in prison and fines up to $25,000. Subsequent offenses or aggravating factors can elevate the charge to a Class 3 felony, with penalties including two to five years in prison and fines up to $50,000. Illinois also imposes enhanced penalties for eavesdropping on certain officials performing their duties: 720 ILCS 5/14-4(b) upgrades the offense to a Class 3 felony (two to five years) for a first offense and a Class 2 felony (three to seven years) for a second or subsequent offense when the victim is a law enforcement officer, State’s Attorney, or judge. These enhanced penalties target surreptitious recording of genuinely private communications involving such officials, not open recording of public police-citizen encounters.

Illinois’s eavesdropping statute provides a private right of action for aggrieved parties. Under 720 ILCS 5/14-6, a person whose conversation or electronic communication was illegally recorded without consent may sue for damages, injunctive relief, and reasonable attorneys’ fees. The statute does not specify a fixed damages amount, so plaintiffs typically seek actual damages plus punitive damages where appropriate. The civil remedy is separate from any criminal prosecution and can be pursued in state circuit court or as a supplemental claim in federal district court. This private right of action complements the criminal penalties and reinforces the all-party consent requirement for private communications.