Lawsuit Claims Caller Voiceprints Illegally Collected, Stored, Disclosed by Amazon Web Services, Pindrop Security

New to ClassAction.org? Read our Newswire Disclaimer

Amazon Web Services and Pindrop Security have unlawfully collected, possessed, redisclosed and profited from the voiceprints of consumers who have called the companies’ call centers and spoken with customer service reps, a proposed class action claims. 

According to the complaint, consumers have been harmed in that their sensitive biometric data—voiceprints—have been “intercepted, collected, and disseminated” without their knowledge or consent and in violation of the Illinois Biometric Information Privacy Act (BIPA), a state law that outlines stringent requirements for private entities who deal with biometric information.

The 31-page lawsuit, filed by four Illinois residents, aims to represent a class of consumers in the state who made one or more phone calls to, or received one or more phone calls from, call centers, customer service representatives and/or other entities using services offered by Amazon Web Services, Inc. and had their unique biometric voiceprints “collected, possessed, and used” by Amazon and Pindrop Security without their consent or authorization, including by way of Pindrop’s biometric voice authentication technology, between December 17, 2014 and the present.

Voice biometrics, or voiceprinting, utilizes the biological characteristics of an individual’s voice to verify their identity, the case says. According to the suit, call center operators and/or customer service reps may rely on voiceprinting in place of the use of a passcode or secret answers to security questions in order to authenticate a caller.

The issue, however, is that while a passcode, for instance, can be changed in the event of a data breach or other cybersecurity incident, there is nothing an individual can do should their voiceprint, or facial template, become compromised, the lawsuit says. 

“These unique and permanent identifiers, once exposed, leave victims with no means to prevent identity theft and unauthorized tracking,” the case reads.  

In light of this growing risk, the Illinois Supreme Court codified the BIPA as a means to ensure individuals retain a right to the privacy of and control over their biometric identifiers and information, the lawsuit relays. 

Despite Illinois’ biometric privacy regulations, Pindrop, whose voiceprint services are used by the cloud storage heavyweight to authenticate callers, has fallen short of the BIPA’s requirements in handling caller voiceprints, the lawsuit alleges. 

“Defendants knew that they were extracting this biometric data from call audio intercepted in Illinois,” the complaint says. “However, Defendants fail to obtain informed written consent prior to collecting this biometric information as required by BIPA section 15 (b).”

In addition to failing to obtain informed written consent before extracting and storing proposed class members’ voiceprints, the defendants have failed to make publicly available a retention policy and guidelines for the permanent destruction of the data, the case claims. Still further, the suit says the defendants have also failed to destroy proposed class members’ biometric data as required by the BIPA. 

Amazon Web Services, Pindrop and their corporate customers also “disclose, redisclose, and disseminate” to and between each other proposed class members’ voiceprint data without consent, the lawsuit alleges, claiming the defendants have broadly failed to use a reasonable standard of care, such as that applied to healthcare data, in handling caller voiceprints. 

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s newsletter here.