Class Action Claims Apple Violated Illinois Privacy Law by Collecting Siri Users’ Voiceprints

Apple Inc. was hit with a proposed class action out of Illinois’s Cook County Circuit Court that alleges the tech giant unlawfully captures and stores the voiceprints of anyone who uses the Siri virtual assistant feature on an Apple device.

Alleging violations of the Illinois Biometric Information Privacy Act (BIPA), the lawsuit claims Apple doesn’t inform users—or even ask for their permission—before collecting their sensitive biometric data.

What’s all this talk about biometric information?

The Illinois BIPA has been behind hundreds of lawsuits filed over the past few years against companies who purportedly collect and store consumers’ biometric information—personal identifiers such as fingerprints, iris scans, scans of hand or face geometry and, as alleged in this case, voiceprints.

The lawsuit points out that the use of a biometric identifier, defined in the complaint as “a dataset that corresponds to a person’s unique physical or behavioral characteristic that is used for identification purposes,” has “serious implications” for the individual’s privacy. Unlike passwords or even Social Security numbers, a person’s physical characteristics cannot be changed if they are compromised by an unauthorized party, the case says.

“An entity that obtains possession of an individual’s biometric identifier is able to track that individual wherever a device capable of capturing biometric identifiers is present,” the complaint warns. “Additionally, because many financial institutions and healthcare providers use biometric identifiers for authentication, possession of a person’s biometric identifier can provide access to an individual’s bank accounts or medical records.”

In 2008, Illinois legislators, foreseeing a need to regulate such sensitive data, passed the BIPA, which requires that entities who collect certain biometric identifiers make specific disclosures first, as well as secure the individuals’ authorization to use the data.

The lawsuit alleges that Apple, despite positioning itself as a leader in privacy protection, failed to comply with the BIPA’s requirements before recording the voices of Illinois consumers who activated Siri on their devices.

Siri knows who I am?

According to the case, the personal assistant software included on Apple devices—including the iPhone, iPad, iPod touch, AirPod headphones, CarPlay, Apple Watch, HomePod, Mac, MacBook, and Apple TV—was developed to be able to recognize not only what a user says but also who the user is.

The suit explains that in order to activate the feature, known as Siri, for the first time, an Apple device user is asked to repeat the following five phrases:

1. “Hey Siri”
2. “Hey Siri”
3. “Hey Siri”
4. “Hey Siri, how is the weather today?”
5. “Hey Siri, it’s me.”

The recordings of these phrases, according to Apple, are used to “create a statistical model for the user’s voice,” that the case says is then stored as the person’s “User Profile” and can be used to identify him or her.

The lawsuit argues that this “profile” is actually a voiceprint that qualifies as a biometric identifier and therefore falls under BIPA disclosure requirements.

Hey Siri, are you using my biometric information?

According to the proposed class action, Apple failed to obtain users’ informed written consent before collecting and storing their voiceprints.

In particular, the lawsuit claims the tech giant has violated the BIPA by failing to:

The case further claims that Apple has unlawfully shared users’ voiceprints with third parties despite not obtaining the individuals’ permission to do so.

Siri users could be owed up to $5,000, case says

The lawsuit is seeking at least $1,000 for each alleged violation of the BIPA, but the amount could increase to $5,000 if the violations are found to be “intentional or reckless.”

Who is the lawsuit looking to cover?

The case seeks to cover anyone who used the Siri function on an Apple device in Illinois and had their voiceprint “collected, captured, received, or otherwise obtained and/or disseminated by Apple.” The full complaint can be read below.