Judge denies Meta summary judgment in privacy class action over unauthorized voiceprint collection

SAN FRANCISCO (CN) — A federal judge unsealed an order Thursday advancing privacy claims against Meta brought by a class of Illinois consumers who say Meta took their voiceprints without permission in violation of an Illinois biometric privacy law.

In the order, originally filed on May 20, U.S. District Judge Susan Illston denied Meta’s motion for summary judgment, finding the plaintiff provided enough evidence to create a genuine issue of material fact as to whether Meta collected her voiceprint.

The judge, a Bill Clinton appointee, concluded the plaintiff had shown there were disputed facts regarding whether Meta had collected the plaintiff’s voice recording in a way the tech company could identify the plaintiff. She also found that there was enough evidence that Meta possesses the technology to process a voice recording and link it to a user’s account and personally identifiable data, such as name, birthday and address, that Meta associates with their account.

“Today’s decision need not and does not attempt to precisely delineate at what point voice data transforms from a ‘mere voice recording,’ as Meta puts it, into a ‘voiceprint’ under BIPA,” she wrote in the 12-page order. “For today, it is enough that there is a dispute of material fact regarding whether Meta has collected biometric data that is capable of identifying an individual using technology Meta possesses.”

The named plaintiff, Natalie Delgado, is an Illinois citizen who says Meta took her voiceprint — a digital representation of a person’s unique voice characteristics — without complying with the requirements of Illinois’ Biometric Information Privacy Act.

Delgado claims Meta uses the audio input into Facebook or Messenger to create encoded data of the speaker’s voice, and that data is then processed with an acoustical model that is then trained and further refined using the voice of a particular speaker, such that the acoustical model can be used to recognize that user by voice.

In its motion for summary judgment, Meta argued Illinois biometric privacy law did not apply to “mere voice recordings” alone, nor did it apply to the plaintiff’s voice recordings at issue because they do not enable Meta to identify her.

In Thursday’s order, Illston wrote it did not matter whether Meta actually used the plaintiff’s voice data to identify her; it only mattered that the company could. The judge heavily relied on the testimony of the plaintiff’s expert, Dr. Singh, who described how Meta had the in-house capabilities to identify speakers using uploaded voice recordings.

“In concluding that the digital voice data Meta collects from Facebook and Messenger is data unique to an individual that could be used to identify someone, Dr. Singh points to Meta’s in-house capabilities, prior research projects, and success rates of its speaker identification features,” Illston wrote, adding that Singh “opines” that Meta “has gone beyond theoretical capability to actual implementation.”

She continued: “Thus, plaintiff has at least raised a disputed question of fact as to whether Meta has the capabilities to identify plaintiff using her uploaded voice recordings. Meta’s argument that there is no evidence that Meta actually identified plaintiff using her voice recordings misses the point.”

The judge also pushed back on Meta’s argument that a ruling in favor of the plaintiff would expand Illinois biometric privacy law “beyond recognition,” creating potential liability for anyone who has an individual’s voice recording and access to speaker-identification technology.

“This order does not open the floodgates,” she wrote. “This order simply holds that plaintiff has forwarded sufficient evidence to create a genuine issue of material fact as to whether Meta has collected plaintiff’s voiceprint.”

Illston added that she would rule separately on pending motions to seal.

Representatives for either party did not immediately respond to a request for comment.

Delgado first sued in federal court in California in August 2023 on behalf of herself and a putative class consisting of all natural persons in Illinois from whom Meta created, collected, captured, received, obtained or stored digital voice data, voice characteristics and/or a voice profile. Delgado, on behalf of the proposed class, seeks statutory damages under the act, an injunction and attorneys’ fees and costs.

In February 2024, Illston denied Meta’s motion to dismiss in part, finding the plaintiff didn’t need to prove Meta actually used the voiceprint to show the company violated the law.

“The court disagrees with defendant that plaintiffs must specifically allege that defendant, in fact, ‘used’ their biometric data to determine their identities. Instead, plaintiffs must allege that defendant’s collection of their biometric data made defendant capable of determining their identities,” she wrote.

However, Illston did toss class claims that Meta does not properly protect private data once collected and leaves the data open to cyberattacks because the class has not put forward any evidence that ties to how Meta stores their biometric information, ill-gotten or otherwise, violating a section of the act that requires companies protect biometric information from disclosure.

Follow @mhattridge_