CHICAGO, September 10, 2026 – Consider phoning your bank to ask about your balance, answering a common security question, and hanging up without ever noticing that a voice recognition technology had been silently analyzing your voiceprint.
That exact scenario sat at the heart of a high-stakes legal battle in Chicago that just reached a decisive end.
It was a huge win for Nuance Communications as the United States Court of Appeals for the Seventh Circuit upheld the lower court’s decision to dismiss the class action suit filed against Nuance under the stringent Biometric Information Privacy Act of Illinois. The judgment is a breath of fresh air for any tech vendor supplying software to large companies.
And this matters because BIPA litigation has been hammering tech companies with devastating statutory damages for nearly a decade.
The lawsuit was brought against Nuance for its voice biometric authentication software that is employed by business organizations such as banks and telecommunication companies to authenticate the caller’s identity. According to the plaintiffs, Nuance engaged in unauthorized collection and usage of voiceprints of customers without giving prior written notice or written consent, in violation of Section 15(b) of BIPA.
Now comes the nitty-gritty of the issue. Nuance doesn’t deal directly with consumers; it licenses its software to third-party institutions that process voice data.
Defended by a legal team from Jenner & Block, Nuance argued that its voice authentication work for financial institutions falls squarely under BIPA’s exemption for entities subject to the federal Gramm-Leach-Bliley Act (GLBA).
This is what the 7th Circuit thought too. The Court, in its decision, found that there is no separate duty imposed by BIPA on third-party tech vendors to get consent when processing biometrics for a client who has a direct relationship with the customer. Would it be feasible for a backend software company to provide disclosures to someone else’s customers before a call begins? Impossible.
Experts tracking the case note that this decision establishes a very important demarcation in terms of privacy compliance. It would be extremely cumbersome from an operational perspective if all behind-the-scenes software vendors had to independently obtain consent from end users.
This ruling establishes an important precedent in Illinois privacy law. While it’s one of the strictest laws on consumer privacy in the country, the Seventh Circuit established that BIPA’s compliance requirements are not carte blanche for attorneys pursuing cases against technology providers.
So what does this mean for privacy compliance going forward?
For primary service providers – the banks, hospitals, utilities that provide services directly to consumers – the requirement for BIPA consent hasn’t changed at all. But for the technology providers developing the software, the Seventh Circuit has now drawn a definitive line in the sand.
