In the legal matter of Wilcosky et al. vs Amazon, the US District Court for the Northern District of Illinois ruled that private entities should embrace a stringent interpretation of the notice and consent prerequisites outlined in the Illinois Biometric Information Privacy Act (BIPA).

The case centers on Amazon's gathering and examination of users' "voiceprints" as biometric identifiers via its "Voice ID" feature within Alexa. Namely, the plaintiffs claimed that Amazon collected users' biometric data without providing them with the requisite notice and obtaining their written consent, (ii) impermissibly "profiting from" their biometric data, and (iii) disclosing their biometric data without consent.

Amazon argued that the notice was offered during the enrollment process but was dismissed by the court, which determined that it did not completely meet the requirements of the BIPA. Furthermore, the court addressed a scenario in which a user who did not enroll in Voice ID still had their voiceprint collected, asserting that the application applies even to individuals lacking any preexisting association with the company.

Why does it matter?

This ruling underscores the significance for companies, particularly those operating in Illinois, to ensure their privacy notifications are precise and transparent regarding biometric data collection, regardless of the company's contention that the data doesn't strictly qualify as "biometric" according to the law. Businesses should contemplate aligning their privacy disclosures with the exact language of the BIPA to mitigate legal liabilities.