Which States Have Biometric Privacy Laws Like Illinois' BIPA?

Illinois’ Biometric Information Privacy Act (BIPA) is the strictest and most widely enforced biometric privacy law in the U.S. It defines "biometric identifiers" to include "a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry," so voiceprints are squarely covered. Before collecting a voiceprint, a private entity must: inform the subject in writing that a biometric identifier is being collected or stored; inform the subject of the specific purpose and length of term for which it is being collected, stored, and used; and receive a written release from the subject or their legally authorized representative. BIPA also requires a written, publicly available retention schedule and destruction guidelines, with destruction required when the initial purpose is satisfied or within 3 years of the individual's last interaction, whichever occurs first. The law bars selling, leasing, trading, or otherwise profiting from the voiceprint and restricts disclosure absent consent, a completed-financial-transaction exception, legal compulsion, or a valid warrant/subpoena. BIPA’s private right of action allows individuals to sue for violations, creating significant litigation risk for companies that fail to comply.

Texas’ Capture or Use of Biometric Identifier Act (CUBI) and Washington’s Biometric Privacy Act (RCW 19.375) are the only other states with dedicated biometric privacy laws. Both require notice and consent before capturing a biometric identifier for a commercial purpose, and both impose duties to protect the data and destroy it within a reasonable time. However, unlike Illinois, neither Texas nor Washington allows private individuals to sue for violations—enforcement is limited to state attorneys general. CUBI defines "biometric identifier" to include voiceprints, and Washington’s statute does too, though Washington’s definition includes an exclusion for data generated from audio recordings unless used for identification, creating a potential loophole for some voice-enrollment systems. Both laws also include exceptions for certain uses, such as security or fraud prevention, which may apply to live.law’s product depending on how it is designed and deployed.

A growing number of states have comprehensive consumer privacy laws that classify biometric data as "sensitive data" requiring opt-in consent before processing. These states include California, Colorado, Connecticut, Delaware, Iowa, Kentucky, Louisiana, Maryland, Minnesota, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, and Virginia. In these states, biometric data—including voiceprints—is treated as sensitive data when processed for the purpose of uniquely identifying an individual. Controllers must obtain the consumer’s consent, provide a clear privacy notice, and allow consumers to revoke consent. However, these laws lack the strict retention/destruction schedule requirements and private rights of action found in BIPA. Some states, like Maryland, impose stricter requirements, such as a "strict necessity" standard for processing sensitive data, which may prohibit processing even if consent is obtained. Others, like Iowa, only require notice plus an opportunity to opt out, making them less stringent than BIPA-style consent regimes. Iowa’s law does not require opt-in consent, only notice plus an opt-out right.

Most states have no dedicated biometric privacy laws applicable to private companies, meaning no consent, notice, or retention requirements apply to voiceprint collection. This includes states like Alabama, Arizona, Arkansas, Florida, Hawaii, Idaho, Kansas, Maine, Massachusetts, Michigan, Mississippi, Missouri, Montana, North Carolina, North Dakota, Ohio, Oklahoma, Pennsylvania, South Carolina, South Dakota, Tennessee, Vermont, West Virginia, Wisconsin, and Wyoming. Even in states with pending bills, such as Massachusetts or Pennsylvania, no law is currently in force. Some states, like Missouri and Mississippi, have repeatedly introduced BIPA-style bills but failed to enact them, leaving companies in a state of uncertainty. For companies operating in these states, the absence of a dedicated biometric privacy law means they are not legally required to obtain consent or follow retention schedules before collecting or processing voiceprints, though other laws (such as breach notification statutes) may still apply.

New York City has a municipal biometric law that requires commercial establishments to post a sign near customer entrances if they collect, retain, convert, store, or share biometric identifier information, including voiceprints. The law does not require written consent but mandates clear and conspicuous signage. It also prohibits selling, leasing, trading, or otherwise profiting from biometric identifier information. However, the law’s scope is limited to brick-and-mortar retail, food, and entertainment venues, and it is unclear whether it applies to a technology company like live.law that captures voiceprints from its own app users. The law’s applicability to digital or remote enrollment features remains an unresolved question, and no case law has yet clarified this point.

Biometric privacy laws exist to address the unique risks posed by biometric data, which is immutable and cannot be changed if compromised. Unlike passwords or credit card numbers, a voiceprint or fingerprint cannot be canceled or reissued if stolen, making it a high-value target for identity theft and fraud. These laws aim to prevent companies from collecting, storing, or sharing biometric data without explicit consent, and to ensure that data is destroyed once it is no longer needed. They also seek to prevent companies from profiting from biometric data by selling or disclosing it to third parties without consent. The laws reflect growing public concern about the collection and use of biometric data, particularly as technology like smart glasses and voice assistants becomes more widespread. For companies like live.law, compliance with these laws is critical to avoid litigation, regulatory penalties, and reputational harm.

Even in states with biometric privacy laws, there are unresolved questions about what counts as "biometric data" and when consent is required. For example, Washington’s statute excludes "data generated from an audio recording" from the definition of "biometric identifier," creating a potential loophole for systems that derive a voiceprint from recorded audio. Similarly, Tennessee’s statute includes an exclusion for audio recordings, but the law’s text creates a genuine tension between its inclusion and exclusion clauses, leaving the issue unresolved. In Iowa, the statute excludes "a video or audio recording or data generated therefrom" from the definition of "biometric data," but it is unclear whether a voiceprint derived from audio for identification purposes falls outside the statute. These ambiguities highlight the importance of consulting legal counsel to interpret how these laws apply to specific products and use cases.