Can AI Use Your Voice Without Permission? U.S. Biometric Privacy Law Explained

Woman concerned about AI using her voice without permission under U.S. biometric privacy law

Your voice may sound like ordinary personal information, but modern artificial intelligence can turn it into something much more sensitive.

AI systems can analyze characteristics such as pitch, tone, cadence and other features of a person's speech. Those characteristics can potentially be used to identify, authenticate or reproduce a person's voice.

That creates a difficult legal question:

Can a company collect and use your voice to develop or train AI without your permission?

In 2026, that question is no longer theoretical. Recent lawsuits in Illinois are putting the issue directly before the courts. Reuters reported on August 20, 2026, that major technology companies including Apple, Amazon, Meta, Microsoft, Nvidia and Samsung are facing lawsuits alleging that human voice recordings were collected and used to train AI systems without the required consent under Illinois' Biometric Information Privacy Act, commonly known as BIPA. The companies dispute the allegations.

The cases are important because Illinois law specifically includes a voiceprint within its definition of a biometric identifier.

So what exactly does U.S. law protect, and when could using someone's voice become a privacy violation?

What Is a Voiceprint?

A voiceprint is not simply an audio recording.

It refers to information derived from characteristics of a person's voice that can potentially be used to identify or authenticate that person.

This distinction matters because modern AI systems can analyze speech at a much deeper level than simply storing an audio file.

For example, an AI system may process characteristics associated with:

Pitch
Tone
Speech patterns
Cadence
Pronunciation
Vocal characteristics
Other identifying features of a person's voice

Illinois' BIPA expressly lists a voiceprint as a biometric identifier, alongside fingerprints, retina or iris scans, and certain facial or hand geometry scans.

That gives voice data a much stronger privacy dimension than an ordinary recording in circumstances covered by the statute.

What Is the Illinois Biometric Information Privacy Act?

The Illinois Biometric Information Privacy Act (BIPA) is one of the most significant U.S. state laws governing biometric information.

Its purpose is to regulate the collection, use, storage, handling and destruction of biometric identifiers and biometric information.

Under the statute, a voiceprint falls within the definition of a biometric identifier.

BIPA contains important requirements concerning informed written consent and disclosures before covered biometric information is collected or used.

That is why the law has become particularly important as companies increasingly use voice technology, artificial intelligence and automated identity systems.

The basic concern is simple:

People should know when highly sensitive biological or behavioral identifiers are being collected and how those identifiers will be used.

Why Are Voice and AI Becoming a Major Legal Issue?

Artificial intelligence has dramatically increased what can be done with ordinary recordings.

A voice recording that once might have been useful only for listening can now potentially become training material for sophisticated machine-learning systems.

AI voice technology can be used for legitimate purposes, including accessibility tools and restoring communication abilities for people who have lost their voices. The Federal Trade Commission has recognized these potential benefits while also warning about fraud, impersonation and misuse of voice data.

The same technology, however, can create serious privacy concerns.

A person's voice might potentially be:

Analyzed by an AI system
Stored for future processing
Used to develop or improve technology
Used for authentication
Replicated through voice-cloning technology
Used in synthetic speech
Combined with other personal information

That raises a fundamental legal question:

Does giving a company access to your voice automatically give it permission to analyze and reuse the biometric characteristics contained in that voice?

The answer can depend on the applicable law, the facts, the consent given, and how the information was collected and used.

The 2026 Voice-Data Lawsuits Against Major Tech Companies

The issue has become particularly important because of lawsuits filed in Illinois.

Reuters reported on August 20, 2026, that journalists, podcasters and audiobook narrators are among plaintiffs alleging that major technology companies collected human voices and used them in AI-related systems without the consent required by Illinois law. The cases involve allegations under BIPA as well as other legal theories.

The defendants reportedly include major companies such as:

Apple
Amazon
Meta
Microsoft
Nvidia
Samsung

These are allegations, not final findings of liability. The companies have disputed the claims, including arguments concerning whether Illinois law can apply to the conduct at issue.

That distinction is extremely important.

A lawsuit means that plaintiffs are asking a court to decide whether the defendants violated the law. It does not mean that the allegations have already been proven.

Courts Are Already Dealing With Voiceprint BIPA Cases

The legal issue is not limited to AI training.

In McGoveran v. Amazon Web Services, the Third Circuit considered allegations involving voiceprint authentication technology used during telephone calls. The plaintiffs alleged that Amazon and Pindrop collected biometric information from their voices without the consent required by BIPA.

That case demonstrates how voiceprints can become legally significant even when the technology is being used for authentication rather than AI model training.

The underlying legal question is often about what information was actually collected and whether the applicable statutory requirements were satisfied.

This is one reason the AI debate is becoming increasingly important: the same underlying voice technology can be used for authentication, personalization, training, fraud prevention or synthetic voice generation.

What Does BIPA Require?

BIPA imposes specific obligations on covered private entities dealing with biometric identifiers and biometric information.

The statute's definition expressly includes voiceprints.

Among other requirements, the law addresses informed written consent and disclosures concerning biometric information.

BIPA also provides statutory damages for violations. The statute currently specifies $1,000 for a negligent violation and $5,000 for an intentional or reckless violation, subject to the statute's requirements and applicable judicial interpretation.

This is one reason biometric litigation can become financially significant.

A dispute involving a large number of people or repeated alleged violations can potentially create substantial exposure.

However, the actual amount recoverable in a particular case depends on the facts, the legal claims, the applicable interpretation of BIPA and the court's rulings.

Does Recording Your Voice Automatically Violate Privacy Law?

No.

This is where online discussions about AI and privacy can become misleading.

Not every recording of a person's voice is automatically a BIPA violation.

The legal analysis may depend on questions such as:

What exactly was collected?
Was a biometric identifier created or obtained?
Was the information used to identify an individual?
Who collected it?
Where did the relevant conduct occur?
What disclosures were provided?
Was informed written consent obtained?
What did the company's privacy policy say?
How was the information stored or used?
Does a statutory exemption apply?
Which state's law governs the conduct?

These questions can make apparently similar situations legally very different.

What If a Company Says It Only Collected Audio?

That may not end the legal analysis.

An ordinary audio recording and a biometric voiceprint are not necessarily the same thing.

If technology processes a person's speech and creates information based on unique characteristics capable of identifying that person, the resulting information may raise different legal questions from simply storing an ordinary recording.

BIPA's statutory definition is therefore particularly important because Illinois expressly includes voiceprints within its biometric-identifier framework.

Whether a particular system actually creates or collects a legally protected voiceprint, however, is a fact-specific question.

Can AI Clone Your Voice?

Yes.

Modern voice-cloning technology can reproduce speech that sounds remarkably similar to a real person's voice.

The FTC has warned that AI-enabled voice cloning can be used for scams and impersonation. It has specifically highlighted scenarios involving criminals impersonating family members, businesses and other individuals.

The problem is therefore broader than AI training.

A person's voice can potentially become part of a much larger digital identity.

If someone can convincingly reproduce your voice, another person could potentially use it to make fraudulent calls, impersonate you or create misleading audio.

That is why biometric privacy and AI regulation are increasingly overlapping.

What Is the FTC Doing About AI Voice Cloning?

The Federal Trade Commission has been examining AI voice-cloning risks for several years.

Its Voice Cloning Challenge explored technological and policy approaches for preventing, detecting and responding to harmful voice cloning. The FTC identified risks involving fraud, misuse of biometric data and unauthorized use of creative content.

The FTC has also emphasized that existing consumer-protection laws can apply to deceptive AI-related conduct.

In 2026, the FTC reported that consumers lost $3.5 billion to imposter scams in 2025, showing the broader scale of impersonation-related fraud in the United States.

AI-generated or cloned voices can make such scams more convincing.

Is There One Federal U.S. Law Protecting Everyone's Voice?

Not in the same straightforward way as Illinois BIPA.

The United States currently has a complicated legal landscape involving federal laws, state biometric privacy laws, consumer-protection laws, publicity rights and other legal theories.

The federal government has also been developing broader AI policy.

In March 2026, the White House released a national AI legislative framework that addressed issues including AI-enabled scams, consumer protection, federalism and the relationship between federal and state AI regulation.

That means the legal environment is still developing.

A person in Illinois may have protections that differ significantly from those available to someone in another state.

Why State Law Matters So Much

AI operates across state borders.

A company may be headquartered in one state, operate servers in another, develop software somewhere else and provide services to users throughout the United States.

That creates difficult jurisdictional questions.

Illinois is especially important because BIPA provides explicit protection for voiceprints. Other states have adopted their own biometric, privacy or digital-replica laws, but the protections are not identical.

The result is a growing patchwork of state rules.

The White House's 2026 AI framework specifically addressed the tension between federal AI policy and state regulation, including proposals concerning federal preemption and the traditional authority of states to enforce generally applicable laws.

This federal-versus-state debate could become one of the most important legal issues surrounding AI over the next several years.

What Could These Lawsuits Mean for Ordinary People?

The significance goes beyond the companies involved.

If courts ultimately recognize strong protections for voice data in AI-related contexts, companies may need to become more careful about:

How they collect voice recordings
Whether voiceprints are created
What consent they obtain
How long biometric information is retained
How information is shared
Whether voice data is used for AI training
How users are informed about secondary uses

For consumers, the cases could reinforce a simple principle:

Your voice may be more than content—it can also be part of your identity.

What Can You Do to Protect Your Voice Data?

Consumers cannot always control what happens to their data, but there are practical steps worth considering.

Check Privacy Policies

Look for information about voice recordings, biometric identifiers, voiceprints, AI training and data retention.

Review Device Permissions

Check which apps and devices have access to your microphone.

Be Careful With Voice Samples

Avoid unnecessarily providing long, clear voice recordings to unknown services.

Understand AI Features

If a service offers voice cloning, voice personalization or voice authentication, find out how your recordings will be stored and used.

Watch for Suspicious Calls

If someone calls using a familiar voice and asks for money or sensitive information, verify the person's identity through another trusted method.

The FTC specifically recommends independently contacting the supposed caller using a phone number you already know rather than relying on the incoming call itself.

What If Your Voice Was Used Without Permission?

The answer depends heavily on the facts and the law applicable to your situation.

Important questions may include:

Which state was involved?
Who collected the recording?
Was a voiceprint generated?
Was consent requested?
What did the consent actually say?
Was the data used for AI training?
Was the information shared with another company?
How was the data obtained?
What evidence exists showing how the information was used?

A person should preserve relevant privacy notices, consent screens, communications and other records before making legal assumptions.

Because biometric privacy litigation can involve complicated jurisdictional and technical questions, a qualified attorney should evaluate the specific circumstances.

The Bigger Legal Question: Who Owns Your Voice Data?

The law does not always reduce this issue to a simple question of “ownership.”

Instead, different legal regimes may protect different interests.

One law may address biometric privacy.

Another may address deceptive conduct.

Another may concern publicity or identity rights.

The U.S. Copyright Office has separately examined digital replicas and described them as digitally created or manipulated audio, video or images that realistically depict an individual. Its report recognizes both beneficial uses and potential harms associated with digital replicas.

That means the future legal battle over AI-generated voices may involve several different areas of law rather than one single rule.

Frequently Asked Questions

Can an AI company legally use my voice without permission?

It depends on the applicable law and the circumstances. Some state laws impose specific requirements concerning biometric information, including voiceprints. Illinois BIPA is one prominent example.

Is a voice recording automatically a biometric identifier?

Not necessarily. An ordinary recording and a legally protected biometric voiceprint can involve different concepts. The exact technology and use of the information matter.

Does Illinois BIPA protect voiceprints?

Yes. Illinois' statutory definition of “biometric identifier” expressly includes a voiceprint.

Can AI clone someone's voice?

Yes. Voice-cloning technology can reproduce speech that resembles a real person's voice. The FTC has recognized both legitimate uses and significant risks involving fraud and impersonation.

Are the 2026 lawsuits against technology companies already proven?

No. The allegations reported in the current litigation remain allegations unless and until courts make findings on the relevant claims. Reuters reported that the companies involved dispute the allegations.

Can companies use voices to train AI without violating any law?

Potentially, depending on the circumstances and applicable law. The legal question can depend on consent, the nature of the data, the purpose of collection, the location of the conduct and the specific statutory requirements involved.

Does the United States have one nationwide biometric privacy law?

The U.S. legal framework is not a single uniform biometric-privacy regime. State laws play an important role, and federal laws may apply depending on the conduct.

Conclusion

AI has changed the legal meaning of a voice.

What once looked like an ordinary audio recording can now be processed into information capable of identifying, authenticating or reproducing a person.

That is why the 2026 lawsuits involving voice data and major technology companies are attracting so much attention. Illinois BIPA specifically recognizes voiceprints as biometric identifiers, while federal agencies such as the FTC continue to address the growing risks of AI-enabled voice cloning and impersonation.

But it is important not to jump to the conclusion that every AI use of a voice is automatically illegal.

The real legal questions are more specific: what was collected, how it was processed, whether it became biometric information, what consent was obtained, where the conduct occurred, and which law applies.

As AI systems become better at understanding and reproducing human voices, those questions are likely to become increasingly important.

For ordinary users, the lesson is simple: your voice is increasingly part of your digital identity and understanding how companies collect and use it may become just as important as understanding how they handle your other personal information.

Disclaimer

This article is for general educational and informational purposes only and does not constitute legal advice. Privacy, biometric-data, AI, consumer-protection and digital-replica laws vary by state and may change. The 2026 litigation discussed above involves allegations that have not necessarily been finally decided. Consult a qualified attorney for advice about your specific circumstances.