Case Law
Lowe's: Illinois BIPA Voiceprint Class Action Alleges Secret Data Collection
On Thursday, an Illinois consumer filed a class action lawsuit in the Circuit Court of Cook County against home improvement giant Lowe's, alleging the company is secretly collecting callers’ voiceprints and sharing their biometric data without consent.
This action highlights the increasing scrutiny of biometric data collection practices, particularly under stringent state laws like Illinois' Biometric Information Privacy Act (BIPA). It signals a growing trend of litigation against companies that handle sensitive personal data, impacting how businesses design and implement customer service technologies. The potential for significant statutory damages under BIPA makes such lawsuits a substantial financial risk for corporations, compelling them to re-evaluate their privacy compliance frameworks and data handling protocols.
The core of this lawsuit is the Illinois Biometric Information Privacy Act (740 ILCS 14/1 et seq.), commonly known as BIPA. Enacted in 2008, BIPA is one of the strictest biometric privacy laws in the United States, requiring private entities to obtain informed written consent before collecting, capturing, purchasing, receiving through trade, or otherwise obtaining a person's biometric identifier or biometric information. It also mandates specific data retention and destruction policies and prohibits the sale or disclosure of biometric data without consent. Crucially, BIPA provides a private right of action, allowing individuals to sue for statutory damages of $1,000 for each negligent violation and $5,000 for each intentional or reckless violation, per violation. The Circuit Court of Cook County is a trial court of general jurisdiction in Illinois, where such class actions are typically initiated. The mention of a similar class action against Walmart suggests a pattern of enforcement and interpretation of BIPA against large retailers.
The lead plaintiff is Rosemarie Perkins, an Illinois resident, representing a proposed class of all Illinois residents who called Lowe’s customer service lines and had their voice-derived biometric information captured without notice. The defendant is Lowe's, a major home improvement retailer. The court involved is the Circuit Court of Cook County, Illinois. Third-party tech vendors are also implicated as recipients of the alleged data, raising questions about data flow and contractual obligations.
Attorneys advising businesses, especially those operating customer service centers or utilizing voice analysis technology, must immediately review their data collection practices for compliance with BIPA and similar state biometric privacy laws. This includes ensuring explicit, informed written consent is obtained before collecting any biometric data, establishing clear data retention and destruction policies, and scrutinizing agreements with third-party vendors regarding data sharing. Companies should conduct internal audits of their call center technologies and privacy policies, particularly if they use voice authentication, speaker recognition, or voice analysis tools. The outcome of this specific case is not yet reported, but the filing itself serves as a strong warning about the litigation risks associated with non-compliance.
