Recording Law for Voiceprints & Biometric Data in South Dakota

South Dakota does not have a state law that specifically regulates biometric voiceprints or other biometric identifiers like fingerprints or face scans. Unlike Illinois, Texas, or Washington, South Dakota has not passed a biometric privacy statute that requires consent before collecting, storing, or using a voiceprint. The only places the word “biometric” appears in South Dakota’s statutes are in two unrelated contexts: the data-breach-notification chapter’s definition of “personal information,” which includes within that term “an identification number assigned to a person by the person’s employer in combination with any required security code, access code, password, or biometric data generated from measurements or analysis of human body characteristics for authentication purposes,” and the identity-theft chapter’s list of examples of “identifying information,” which enumerates “Biometric data” alongside Social Security numbers and account numbers. Neither of those sections places any limits on when a voiceprint can be captured or stored. Because there is no dedicated biometric law, South Dakota does not impose consent, notice, or retention requirements for voiceprint collection.

South Dakota’s wiretapping law, found at SDCL 23A-35A-20, makes it a Class 5 felony to intercept or record a “wire, electronic, or oral communication” without consent. The statute defines an “oral communication” as “any oral communication uttered by a person exhibiting an expectation that the communication is not subject to interception under circumstances justifying the expectation.” State v. Woods, 361 N.W.2d 620 (S.D. 1985) held that when one party to the conversation consents, there is no “justified expectation” and therefore no “oral communication” under the statute. State v. Braddock, 452 N.W.2d 785 (S.D. 1990) extended that one-party-consent rule to wire communications. The statute’s penalties apply to the act of recording the audio itself, not to extracting or storing a biometric voiceprint from that recording.

South Dakota’s hidden-camera law, SDCL 22-21-1, makes it a Class 1 misdemeanor to install a device for observing, photographing, or recording in a “private place” without the consent of the person entitled to privacy there. The law also includes drone-specific provisions added in 2020 that prohibit using a drone to photograph or record a person in a private place with a reasonable expectation of privacy, as well as a provision addressing drone landings on others’ property. This statute applies to video and still images, not to extracting a biometric voiceprint from an audio recording. Recording a conversation you are part of is legal under one-party consent, but secretly filming someone in a private place is a separate offense.

South Dakota’s data-breach-notification chapter (SDCL ch. 22-40) requires businesses to notify affected individuals and the Attorney General when a breach of system security compromises already-held personal information. The chapter defines “personal information” to include, among other things, “an identification number assigned to a person by the person’s employer in combination with any required security code, access code, password, or biometric data generated from measurements or analysis of human body characteristics for authentication purposes.” The Attorney General enforces this chapter under SDCL 22-40-25, which authorizes civil penalties up to $10,000 per day per violation plus attorney’s fees and requires notice to the Attorney General when a breach affects more than 250 South Dakota residents. This law does not impose any consent, notice, or retention requirements before collecting a voiceprint.

Because South Dakota has no biometric-specific law, a lawyer or legal-technology tool can lawfully capture and store a biometric voiceprint from a recorded conversation without obtaining separate consent beyond the one-party consent already required to record the conversation itself. The wiretapping statute governs the act of recording the audio, not the extraction or storage of a voiceprint derived from that recording. The breach-notification law only kicks in if the stored voiceprint is later compromised in a data breach, not when it is first collected. There is no South Dakota ethics opinion or court decision that says a lawyer must get extra consent before using a voiceprint feature like live.law’s.

Imagine you record a phone call with a client using a tool that also creates a biometric voiceprint for authentication. You already have the client’s consent to record the call under South Dakota’s one-party-consent rule. Because South Dakota has no law that requires separate consent for capturing or storing a voiceprint, you do not need to ask the client for additional permission to use the voiceprint feature. If the stored voiceprint is later involved in a data breach, the breach-notification law would require notice to affected individuals and the Attorney General, but that duty arises only after the breach, not at the time of collection.