Hey Siri, Do You Have My Voiceprint? Biometric Data May be “Well-Suited for Class Actions,” but Notice and Consent Requirements Should Always be Complied With
In Zaluda, et al. v. Apple Inc, Case No. 2019 CH 11771 (Cook County, IL Jan, 29, 2026), Apple is accused of capturing “biometric feature vectors” and/or “voiceprints” when users talk to Siri through their Apple devices without giving users notice and obtaining consent as required under the Illinois Biometric Information Privacy Act (BIPA), 740 ILCS 14/1 et seq. Plaintiffs contend Siri uses speaker and speech recognition software to understand and answer questions in a uniform manner for all users, and that such information is capable of identifying a speaker by computing acoustic and numeric speech vectors. As a result, assert plaintiffs, biometric information unique to the speaker’s voice can be used to identify the speaker without the proper notice and consent. Apple disputes that BIPA applies to voiceprints.
The Court denied Apple’s motion to dismiss the case in 2020 and continued Apple’s motion for summary judgment in July 2025, which is still pending. On January 29, 2026, the Court entered an order granting the plaintiffs’ motion for certification and certifying the following class:
"All Illinois residents who used the Siri function on any Apple device and had their voiceprints or biometric feature vectors capable of identifying them computed from their voice and/or raw audio collected, captured, possessed and/or disseminated by Apple, Inc. from September 19, 2014 to the present."
The plaintiffs seek statutory damages ranging from $1,000-$5,000 for each individual user whose voiceprint was captured in violation of BIPA, and the class is believed to have more than 3,000,000 members.
In determining that common issues predominate over individual issues, the Court noted that “BIPA cases involving the use of biometric software templates are particularly well-suited for class treatment.” Siri “involves speaker and speech recognition software processes applied in a uniform matter for all Siri users.” The Court rejected Apple’s arguments that individualized issues, such as users activating Siri differently or using different Siri functions, predominated over common issues, noting that plaintiffs’ allegation that, regardless of certain individual issues, “Siri’s ASR process results in the creation of feature vectors that are capable of identifying an individual for all user utterances.” To the Court, the predominating issue is the uniform application of the biometric technology and Apple’s privacy policies to all users.
Importantly, the Court disregarded Apple’s contention that Apple does not maintain records of Siri users that would permit identification for class membership and therefore individualized proof of class membership would be required, noting that is a case management issue that can be addressed post-class certification. Likewise, the Court determined that whether a class member was an Illinois resident and used Siri in Illinois were case management not class membership issues, as the Court explained: “Class members can, if Apple’s liability is established, submit claim-affidavits establishing their use of Siri in Illinois that can be cross-checked against their Apple IDs, home addresses, IP addresses and geolocation data.”
The Zaluda class certification decision builds on a body of biometric data harvesting cases certified as class actions because of alleged violations of BIPA, see, e.g., In re Facebook Biometric Info. Privacy Litig., 326 F.R.D 535, 545 (N.D. Cal. 2018), aff’d sub nom. Patel v. Facebook Inc., 932 F.3d 1264 (9th Cir. 2019); Svoboda v. Amazon.com, Inc., No. 21 C 5336, 2024 WL 1363718 (N.D. Ill. Mar. 30 2024), and demonstrates how biometric recognition and artificial intelligence software and related use and privacy policies applied uniformly to all users, even where users may interact with the technology differently, are particularly well-suited for class actions. However, whether deployed on a widescale, like Siri, or in a smaller setting, like a new app, companies using biometric software need to be aware of state laws requiring notice and consent to capture biometric information.
The information contained in this article is not legal advice and has not been updated to include changes in the law since this article was originally published.