Recording Law for Voiceprints & Biometric Data in New York

New York does not have a statewide biometric privacy law in effect right now. The only biometric law that exists is in New York City: Local Law No. 3 of 2021 requires certain commercial establishments to post signs if they collect biometric data like voiceprints from customers. It does not require written consent, only signage. A statewide bill (S.1422-A) would change this by requiring written notice of the specific purpose and length of term, written consent that cannot be secured through a general release or user agreement, and strict limits on how long the data can be kept. As of July 2026, that bill has passed the Senate but not the Assembly, so it is not yet law. New York’s Penal Law §250.00 does not reach biometric collection at all; it governs only the act of recording conversations. Because the statute’s definitions exclude a participant present at the conversation, in-person, phone, and electronic capture are all one-party consent in practice for recording, but this permission does not extend to biometric collection.

New York City’s Local Law No. 3 of 2021 requires any "commercial establishment"—defined narrowly as a place of entertainment, retail store, or food-and-drink establishment—that collects, retains, converts, stores or shares a customer’s biometric identifier (including voiceprints)—to post a clear and conspicuous sign near all customer entrances notifying customers that biometric identifier information is being collected, retained, converted, stored or shared. The law defines "biometric identifier information" to include "a fingerprint or voiceprint." It also makes it unlawful to sell, lease, trade, share in exchange for anything of value or otherwise profit from the transaction of biometric identifier information. Penalties range from $500 per signage violation to $5,000 per intentional or reckless sale/profit violation, plus reasonable attorneys’ fees and costs. The law applies only to physical places of entertainment, retail, or food-and-drink, not to tech companies collecting voiceprints from app users. Whether it covers a company like live.law is an open question with no court rulings yet.

If enacted, S.1422-A would require any private entity that collects, captures, purchases, receives through trade, or otherwise obtains a biometric identifier—including voiceprints—to give written notice of the specific purpose and length of term, and obtain a written release (informed written consent) that may not be secured through a general release or user agreement. The bill sets strict limits: biometric data must be destroyed in no event later than sixty days after the purpose is fulfilled or within one year of the individual's last interaction with the private entity, whichever occurs first, and a public written retention/destruction policy must be maintained. It bans selling, leasing, trading, sharing in exchange for anything of value, or otherwise profiting from the transaction of biometric data, and prohibits conditioning a good or service on biometric collection unless biometric identifiers are strictly necessary to provide the good or service. The Attorney General could enforce it, seeking injunctions, restitution, disgorgement, and civil penalties of not more than twenty thousand dollars per violation, and individuals could sue and recover damages—the greater of liquidated damages or actual damages ($1,000 for negligent violations; $5,000 for intentional or reckless violations)—plus reasonable attorneys’ fees and costs, injunctive relief, and class actions are authorized for violations arising from a common policy or practice.

New York’s Penal Law §250.00 governs only the act of recording conversations, not biometric collection. It applies one-party consent uniformly to in-person conversations, telephone/telegraphic calls, and electronic communications because §250.00(1) defines wiretapping as recording a telephonic or telegraphic communication by a person other than a sender or receiver without the consent of either the sender or receiver, §250.00(2) defines mechanical overhearing of a conversation as recording without the consent of at least one party by a person not present thereat, and §250.00(6) reaches intercepting or accessing an electronic communication without the consent of the sender or intended receiver. Because the smartglasses wearer is ordinarily a first-person participant in whatever is captured, in-person, phone, and electronic capture are all one-party consent in practice for recording. However, Penal Law §250.00 does not address biometric voiceprint collection at all; biometric rules are governed by separate laws depending on where you are and whether a biometric law applies.

Imagine a company like live.law offers an app that records a user’s voice during enrollment to create a voiceprint for future authentication. In New York City, the company would need to post signs at any customer entrances of a covered commercial establishment (a place of entertainment, retail store, or food-and-drink establishment) where users enroll, if those locations are subject to the city’s biometric law. Statewide, if the company collects voiceprints from New Yorkers without the written notice, written consent, and strict retention limits required by the pending bill—once it becomes law—it could face penalties under that bill. Until then, the company must rely on the city’s signage rule in NYC and the lack of statewide biometric law elsewhere in New York.

Under New York City’s Local Law No. 3 of 2021, a person can sue a company for $500 per signage violation, $500 per negligent sale/profit violation, or $5,000 per intentional or reckless sale/profit violation, plus reasonable attorneys’ fees and costs (including expert witness fees) and injunctive or other relief. The city’s Department of Consumer and Worker Protection has no enforcement power—its role is limited to outreach and education. Under the pending statewide bill (S.1422-A), the Attorney General could bring an action to enjoin violations, obtain restitution, disgorgement, and civil penalties of not more than twenty thousand dollars per violation, and individuals could sue and recover damages—the greater of liquidated damages or actual damages ($1,000 for negligent violations; $5,000 for intentional or reckless violations)—plus attorneys’ fees and costs, injunctive relief, and class actions are authorized for violations arising from a common policy or practice. These penalties apply separately from any penalties under wiretap laws, which focus on recording conversations without consent—not on biometric data collection.