US-State
Illinois BIPA
The short answer. BIPA is an Illinois statute, 740 ILCS 14/, and a voiceprint is one of the biometric identifiers it lists. A private entity that collects a voiceprint from an Illinois resident must give written notice, state the specific purpose and the length of term, and obtain a written release before collection, under §14/15(b). It must publish a retention and destruction schedule under §14/15(a) and may not disclose the data without consent under §14/15(d). The 2024 amendment allows an electronic signature to serve as the written release.
The law
740 ILCS 14/15(b)
No private entity may collect, capture, purchase, receive through trade, or otherwise obtain a person's or a customer's biometric identifier or biometric information, unless it first: (1) informs the subject or the subject's legally authorized representative in writing that a biometric identifier or biometric information is being collected or stored; (2) informs the subject or the subject's legally authorized representative in writing of the specific purpose and length of term for which a biometric identifier or biometric information is being collected, stored, and used; and (3) receives a written release executed by the subject of the biometric identifier or biometric information or the subject's legally authorized representative.
Three things have to happen before the recording, not after: written notice that biometric data is being collected, written notice of the specific purpose and the length of term, and a written release. The 2024 amendment, Public Act 103-0769, expanded "written release" to include an electronic signature — an electronic sound, symbol, or process attached to or logically associated with a record and executed or adopted by a person with intent to sign the record. For a dataset, the release has to cover the intended use, including resale or distribution if that is the plan.
740 ILCS 14/15(a)
A private entity in possession of biometric identifiers or biometric information must develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within 3 years of the individual's last interaction with the private entity, whichever occurs first.
The retention schedule has to be written and public, and the destruction trigger is the earlier of purpose satisfied or three years since last interaction. This is the provision that most often conflicts with a data license: a vendor that promises destruction within three years cannot also grant a perpetual right to keep and resell the recordings. The two documents have to be reconciled before signature.
740 ILCS 14/15(d)
No private entity may disclose, redisclose, or otherwise disseminate a person's or a customer's biometric identifier or biometric information unless: (1) the subject of the biometric identifier or biometric information or the subject's legally authorized representative consents to the disclosure or redisclosure; (2) the disclosure or redisclosure completes a financial transaction requested or authorized by the subject of the biometric identifier or the biometric information or the subject's legally authorized representative; (3) the disclosure or redisclosure is required by State or federal law or municipal ordinance; or (4) the disclosure is required pursuant to a valid warrant or subpoena issued by a court of competent jurisdiction.
This is the provision that decides whether a dataset can be resold. Consent to collect is not consent to disclose. If the same recordings are delivered to more than one buyer, that is a disclosure and it needs its own consent — the transactional exception in item (2) covers a payment the subject asked for, not a wholesale license to a data buyer.
740 ILCS 14/20(a)
A prevailing party may recover for each violation: (1) Against a private entity that negligently violates a provision of this Act, liquidated damages of [1,000 dollars] or actual damages, whichever is greater. (2) Against a private entity that intentionally or recklessly violates a provision of this Act, liquidated damages of [5,000 dollars] or actual damages, whichever is greater.
Statutory damages are per violation and do not require proof of harm, with attorney's fees available to a prevailing party on top. For a dataset business the risk model is a class action: one collection practice applied across thousands of recordings is one practice, but every speaker in it is a potential plaintiff. The 2024 amendment limits how many times a single person's claim can be counted, not how many people can claim.
Who it applies to
BIPA applies to private entities, not to government bodies, and it is not limited to Illinois companies. The operative questions are where the collection happened and whether the person is an Illinois resident. Out-of-state defendants have been held to be covered where the collection involved people in Illinois, which is the ordinary situation for a vendor that recruits speakers by phone or over a platform without regard to state lines.
There is no requirement to show actual harm. The Illinois Supreme Court held in Rosenbach v. Six Flags (2019 IL 123186) that a person whose rights under the statute were violated is an aggrieved person without a separate injury, which is why the statute produces class actions rather than individual claims.
For a buyer, one point is easy to miss: §14/15(a) applies to a private entity in possession of biometric identifiers. If you take delivery of voiceprints or speaker embeddings, you are in possession, and the retention policy and destruction schedule obligations attach to you directly rather than only to the vendor who recorded the audio. Receiving the data is enough to be regulated by it.
What it costs to get wrong
Statutory damages are 1,000 dollars per violation for a negligent violation and 5,000 dollars per violation for an intentional or reckless one, or actual damages if greater, plus reasonable attorney's fees and costs for a prevailing party, with injunctive relief available as well.
The 2024 amendment changed how violations are counted. 740 ILCS 14/20(b) provides that a private entity that collects the same biometric identifier from the same person using the same method of collection in more than one instance has committed a single violation, for which the aggrieved person is entitled to at most one recovery. Section 14/20(c) does the same for repeated disclosure of the same identifier to the same recipient. That responds to Cothron v. White Castle System, Inc. (2023 IL 128004), where the Illinois Supreme Court had held that each scan or transmission without consent was separately actionable. The Seventh Circuit held in April 2026 that the amendment applies to cases already pending when it was enacted; the Illinois Supreme Court has not ruled on the same question under state law.
The practical reading for a data business: the amendment caps the per-person exposure for a repeated practice, and it does not cap the number of people. A collection practice that failed to obtain releases across a corpus of several thousand Illinois speakers is still a several-thousand-person class, at 1,000 to 5,000 dollars each, before fees.
How to comply when you are buying data
BIPA compliance in a data purchase is mostly a document check, and the documents have to exist before the recording rather than after it.
- Ask the vendor whether any recordings in the delivery were collected in Illinois and from which speakers. If the answer is that location is not tracked, treat it as yes and price the risk accordingly.
- Require executed written releases. Electronic signatures satisfy the requirement following the 2024 amendment, but the release still has to state the purpose and the length of term, not merely record agreement.
- Check whether the release covers disclosure to third parties. Section 14/15(d) requires consent for disclosure, and a corpus delivered to two buyers is a disclosure.
- Ask for the public retention and destruction schedule required by §14/15(a) and confirm it is consistent with your own retention period and with the term of the license you are buying.
- If you take delivery of voiceprints or embeddings, write your own retention policy. Possession triggers §14/15(a) whether or not you collected the data yourself.
Related compliance topics
-
Data Protection Impact Assessment
dpia
-
Data Processing Agreement
data processing agreement
-
Vendor Due Diligence Checklist
vendor due diligence checklist
-
Voice Anonymization
voice anonymization
-
Anonymisation vs Pseudonymisation
anonymisation vs pseudonymisation
-
Ethical Data Collection
ethical data collection
Not legal advice
We are a sourcing company, not a law firm. Nothing on this page is legal advice, and it does not create a lawyer–client relationship. Whether a particular dataset is permissible in your jurisdiction depends on your use case, where you operate, and where the people in the recordings are located. Our role is to document the chain of consent accurately so that your counsel can assess it.
Sourcing data under Illinois BIPA?
Tell us the language, the hours, and what the data needs to look like. You will get a real number and a real timeline — not a range. If we cannot source it well, we will tell you that instead.
- Pilot batch before the full run, so problems surface early.
- Consent documentation delivered with the data.
- No medical or clinical data. No recorded telephone calls.