Have You Heard? Voiceprint Biometric Suits Are on the Rise
Biometric technology, and the corresponding regulation thereof, has dramatically expanded in recent years. While most people may be familiar with fingerprint scanning and facial recognition, audio recognition has grown rapidly throughout the employment, consumer, transportation, and business sectors. Because of this, audio recognition technology has also become the most recent target for class action litigation under the Illinois Biometric Information Privacy Act (“BIPA”).
This article discusses the capture of a voiceprint as a biometric identifier; the implementation of audio recognition technologies across industries; the rapidly developing litigation landscape that has targeted industries implementing audio recognition technology; and provides practical compliance advice for companies using—or considering the use of—audio recognition technology.
Voiceprints as a biometric identifier
Broadly speaking, biometric technologies capture, collect, and/or store an individual’s unique physical characteristics for identification and authentication purposes. As defined by BIPA, a “biometric identifier” includes a “retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.” Relevant here, biometric technologies can also capture unique patterns of an individual’s voice/speech patterns.
To that end, a “voiceprint” is the use of the human voice to uniquely identify an individual by creating a digital model of unique vocal characteristics, and then comparing those features to the voice presented. A key distinction between “voice” or “audio recognition” and “speech recognition” is the latter simply recognizes the spoken words and may produce responsive results. Conversely, audio recognition technology used to capture an individual’s biometric voiceprint is solely concerned with the features of the voice for verification; the words themselves are of lesser importance.
Creating a voiceprint biometric often involves “feature extraction” from speech samples that isolate personalized calculations about an individual’s vocal characteristics. This speech sample is initially input into the system and stored as a print for authentication. Software splits the input print into multiple frequencies for comparison. The input data, and personalized features of the individual’s voice, are then compared to a Universal Background Model—a repository of voiceprints created by machine learning AI. Each time a speech sample is given, it is compared to the Universal Background Model and the individual’s speech sample to “recognize” the voice presented.
More recently, audio recognition technology has become even more sophisticated. Although similar to the traditional Universal Background Model, newly developed audio recognition technologies have increasingly implemented Deep Neural Networks to more accurately identify an individual’s voiceprint. A Deep Neural Network, similar in form, but more advanced than a Universal Background Model, uses AI that has listened to hundreds, if not thousands, of hours of speech samples. An individual’s specific speech sample is then fed into a Deep Neural Network that implements a modeling process capable of learning the individual’s unique characteristics to verify said user. The Deep Neural Network modeling system can identify and compare characteristics straight from the individual’s speech sample itself through deep learning AI. Unlike more traditional forms of audio recognition technology, feature extraction is no longer necessary.
These advances in neural network technology have made audio recognition more sophisticated, efficient, and accurate. A voiceprint can now be identified with fewer amounts of speech samples, making the technology more accessible and user friendly.
Voice recognition implementation across industries
Audio recognition technology has already been broadly implemented across industries and technology platforms; this trajectory is expected to continue, with projected growth to $3.6 billion by 2026. Below are some of the industries are already implementing audio recognition technologies.
Financial Industries: Audio recognition technology has long been appealing to the financial services industries, primarily for security purposes. Voice-based accounting services have been implemented globally by banks to allow customers to access their accounts via voice command. And banks have increasingly moved to use voice recognition for security purposes to restrict third parties from accessing user account details and sensitive information. Because voice biometrics are increasingly providing authentication in real time, the once familiar security questions, or even pin numbers, may become a thing of the past.
Employment: Many employers have transitioned from physical timecards to employee fingerprint scanning. Employee time and attendance is also being tracked through audio recognition technology. In this context, employees simply speak, or call into a system, to indicate the start/stop of their shift. Audio recognition technology is especially appealing to employer’s who have remote or on-the-go-employees, where it may not be possible to physically scan their fingerprint or face at the workplace daily; audio-recognition technology can allow these employees to simply call in via a mobile app.
Transportation: The transportation sector, led by the aviation industry, has also begun to implement audio recognition technology—particularly with respect to customer check-in. United Airlines, in a partnership with Google Assistant, enables users to check-in for flights by saying “Hey Google, check in to my flight.” Virgin Australia recently partnered with Amazon’s Alexa to check flight statuses. And in the automotive industry, while hands-free speech recognition features have been implemented in cars for years, secure voice features are developing.
Technology Sectors: Tech companies that have been on the forefront of biometrics have followed suit on implementing audio recognition technology. While Amazon, Google, and Apple have long deployed their speech recognition platforms through Google Assistant, Siri, and Alexa, these platforms have expanded to biometric voice recognition. For instance, Amazon’s Alexa Voice ID creates a personalized experience and can recognize an individual’s voice. Likewise, Google Assistant offers a “Voice Match” feature that allows it to recognize an individual’s voice and provide personal results; the feature allows up to 6 people to be recognized on a device. Apple has followed this trend, implementing voice recognition through Siri to allow multiple users to make personal requests and access personalized playlists, messaging, and storage.
Consumer Services: Even the fast-food industry has widely adopted forms of implemented audio recognition technology. McDonalds tested voice recognition software to recognize a consumer’s voice to automate orders and make customer predictions. More recently, Amazon partnered with KFC to introduce its Alexa voice recognition technology to customer drive-through lanes. Other restaurants and consumer services industries have joined in, implementing audio recognition technology in the customer ordering/customer service process.
Legal landscape
While Illinois—home of BIPA, the first biometrics law of its kind, and the only one with a private right of action—has been a litigation hotbed for biometric class actions since 2015, a recent trend has targeted companies’ implementing audio recognition technology.
In one notable class action filed in August 2022, plaintiffs targeted a series of high-profile restaurant chains and their voice recognition system provider claiming customer voiceprints were collected without obtaining consent in the customer ordering process. Despite being one of the most large-scale voice recognition cases to date, it was voluntarily dismissed without prejudice by the plaintiff in October 2022.
Another international restaurant chain was also targeted for implementing voice assistant technology. In that BIPA case, plaintiff alleged his voice print was collected when he had his order taken at a drive-through in Lombard, Illinois. Although initially filed in the Circuit Court of Cook County, the case was removed to the Northern District of Illinois. While some of plaintiff’s claims were then remanded back to state court for lack of Article III standing, the Section 15(b) claim (alleging defendant improperly collected the plaintiff’s voiceprint without obtaining consent) survived a motion to dismiss for failure to state a claim, and remains pending in federal court. At the motion to dismiss stage, the court found plaintiff’s allegations “plausible”—in that defendant collected the plaintiff’s voiceprint through its voice assistant technology.
Most BIPA cases involving audio recognition technology, however, have not survived the early stages in the litigation process—thus, most defenses have not been widely tested in the courts. And some decisions have disposed of these cases on procedural, rather than substantive, grounds.
For example, the Southern District of Illinois dismissed a case against a web services provider for lack of personal jurisdiction, reasoning plaintiffs, who were in Illinois, and who claimed to have called call-centers implementing audio recognition technology in Massachusetts, provided by a Delaware vendor, could not assert personal jurisdiction over the defendants to haul them into Illinois. And when the case was refiled in Delaware, it was initially dismissed without prejudice on extraterritoriality grounds. Motions to dismiss an amended complaint are pending.
Finally, outside of Illinois, plaintiffs are also targeting the financial sector based on California state law. At least five suits—against five separate major banking institutions in September 2022—allege defendants violated the California Invasion of Privacy Act by analyzing callers’ voiceprints to verify identities without first obtaining written consent.
Implications
As the use of audio recognition technology rapidly expands across industries, and the effectiveness and sophistication of said technologies continues to improve, the proliferation of putative biometric class actions are destined to follow close behind.
This is especially after recent decisions by the Illinois Supreme Court expanded the scope of BIPA by applying a five-year statute of limitations, as opposed to a one-year limitations period in Tims v. Blackhorse Carriers, Inc., 2023 IL 127801 (Feb. 2, 2023). And in a landmark decision in Cothron v. White Castle System, Inc., 2023 IL 128004 (Feb. 17, 2023), the Illinois Supreme Court held a BIPA claim accrues upon each collection of a biometric identifier, and dramatically expanded the scope of available statutory damages. For companies’ implementing any form of audio recognition technology, compliance is critical to protect against significant exposure.
"Have You Heard? Voiceprint Biometric Suits Are on the Rise," by Jeffrey N. Rosenthal and Amanda M. Noonan was published in Biometric Update on March 31, 2023. Reprinted with permission.