Do job photos and call recordings trigger biometric privacy laws?

When does a job photo or call recording become biometric data?#

A job photo or call recording generally becomes a biometric concern when someone, or some software, uses it to measure a person's face or voice in a way that can identify them. A photo of a condensing unit with a homeowner in the background is a photo. A system that scans that face to match it against other images is creating biometric data.

Biometric statutes usually define their scope around identifiers such as face geometry, voiceprints, fingerprints and retina or iris scans, and information derived from them. Illinois's statute, for example, lists retina or iris scans, fingerprints, voiceprints and scans of hand or face geometry, and expressly excludes photographs. Courts have still been asked whether face geometry extracted from a photo is covered, which is why your counsel's reading matters more than any general rule.

Which laws may apply to a home services company?#

Several kinds of law may apply to biometric data in a home services company, and which ones do depends on where your customers and employees are. Illinois's Biometric Information Privacy Act is the statute most often cited in biometric class actions. Texas and Washington have their own biometric statutes, and comprehensive state privacy laws, such as the Texas Data Privacy and Security Act, generally treat biometric data as sensitive data with added obligations.

Illinois explains why owners take this seriously. Under 740 ILCS 14/20, a prevailing party may recover liquidated damages of $1,000 per negligent violation or $5,000 per intentional or reckless violation, or actual damages if greater. In Rosenbach v. Six Flags, decided January 25, 2019, the Illinois Supreme Court held that a person need not show actual injury beyond the violation to sue. An amendment signed August 2, 2024 limits recovery to a single violation per person when the same identifier is collected repeatedly by the same method, but exposure can still be significant.

Call recordings raise a separate question: whether everyone on the call agreed to be recorded. Some states require consent from all parties and others from one. That rule governs the recording itself, before any biometric question arises, and it also shapes whether recordings can be reused later.

Each of these is assessed deal by deal with counsel. The same photo archive can raise different questions for a contractor working in one state than for one with branches in several.

Job photos: where faces and identity creep in#

Faces creep into job photos more often than owners expect. Technicians photograph a water heater and catch the homeowner in a doorway, a child in the hallway or family pictures on a shelf. Crew photos for marketing and safety records show employees on purpose.

The photos themselves are usually handled as personal data, and the practical risk comes from what tools do with them. Some photo management and marketing tools offer face grouping or tagging. Driver-facing cameras in service vans may offer driver identification. Check which features are on, because a default setting can create exactly the data you meant to avoid.

Blurring a copy does not change the original. The unblurred image still sits in the field service app, on the technician's phone and in any shared drive it was synced to, so retention rules for originals matter as much as preparation of copies. Decide which copy is the record and how long the others are kept.

Call recordings: voice, consent and voiceprints#

Call recordings carry a voice, but a recording is not the same thing as a voiceprint. A voiceprint is a model of someone's voice characteristics built to recognize them, which is what voice authentication and some speaker identification tools produce.

Call tracking and call scoring platforms used by many home services companies transcribe calls, score booking rates and flag missed opportunities. Most of that work runs on the words, not the voice. Before enabling features described as caller recognition, voice verification or speaker identification, ask the vendor whether they create and store voice templates and how those are deleted.

For any use outside the company, transcripts with names, addresses and payment details removed are often a cleaner option than audio. Whether audio can be used at all depends on how consent was collected when the calls were recorded.

Steps that keep raw records from becoming biometric data#

The steps that keep raw records from becoming biometric data are mostly about settings and process, not new software. Most can be done by the office manager and whoever administers your field service and call tracking tools.

• 1Inventory where photos, video and recordings live: field service app, phones, shared drives, call tracking and fleet cameras.
• 2Turn off face recognition, face grouping, driver identification and voice authentication features you do not need.
• 3If you use fingerprint or face timeclocks, confirm employee notice and consent practices with counsel.
• 4Ask technicians to frame photos on equipment and keep people out where they can.
• 5Blur faces and family photos before any image leaves the company.
• 6Prefer redacted transcripts over audio when records are used outside the company.
• 7Write down what was removed and why, so the decision can be explained later.

Illustrative: a restoration company reviews photos and calls before an AI project#

Illustrative: a fictional water and fire restoration company with branches in more than one state keeps large photo sets for every loss, plus recorded calls with homeowners and adjusters. It is considering an AI project and asks counsel to review the records first.

The review finds that the company's photo app had face grouping turned on by default, and that its call tracking tool offered a caller recognition feature nobody used. Both are switched off. Counsel advises screening existing photo sets, with faces and personal items blurred, before any use outside the company.

For calls, the company decides to use only redacted transcripts from states where its consent practice is documented, and to leave audio out entirely. The decisions and the reasons are filed with the project records.

How SourceX handles photos and recordings#

SourceX handles photos and recordings in the Rights and Preparation steps of the SourceX five-step transaction. Faces and identifying details are removed or blurred, preparation is designed so that no face templates or voiceprints are created, and recordings are excluded or converted to redacted transcripts where consent and counsel's review allow.

Those decisions are documented in the privacy record of the SourceX Evidence Packet, alongside provenance, licensing rights, permitted use and release authorization. The supplier approves what is included before anything is delivered.