Definitions and comparisons
Is a recorded customer call biometric data?
By SourceX Editorial · Reviewed by Noah Loul ·
Short answer
A recorded customer call is not automatically biometric data. Biometric privacy laws generally focus on voiceprints, meaning measurements of a voice used to identify a specific person. A plain recording raises biometric risk when someone runs speaker identification, voice authentication or voice modeling on it, which is why de-identified transcripts are usually the lower-risk package to license.
Key takeaways
- A call recording is audio; a voiceprint is a measurement of a voice used to recognize someone, and biometric laws generally target the second.
- Speaker identification, voice authentication and voice cloning are the uses that turn recordings into biometric questions.
- Illinois BIPA allows private lawsuits with statutory damages, so call archives that touch Illinois deserve extra care.
- Recording consent and biometric status are separate questions with separate rules.
- Licensing de-identified transcripts linked to job outcomes avoids most biometric exposure.
Is a call recording a voiceprint?#
A call recording is not a voiceprint by itself. A recording captures sound; a voiceprint is a template or set of measurements derived from a voice and used to recognize a particular speaker. Biometric privacy laws such as the Illinois Biometric Information Privacy Act (BIPA) are generally aimed at that kind of identifier, not at every audio file a business keeps.
The line is not purely technical, though. A raw recording contains everything needed to create a voiceprint, and processing recordings with voice analysis tools can create biometric data even when the business never set out to identify anyone. So the question shifts from what the file is to what anyone does with it.
For a home services company, the recordings in question are usually booking calls, dispatch calls and follow-ups captured by a call tracking tool or a phone system connected to ServiceTitan, Housecall Pro or a similar platform.
When does a recorded call become biometric data?#
A recorded call becomes a biometric question when it is used, or could be used, to recognize who is speaking. The table compares common uses. State laws define their terms differently, so treat the risk levels as general guidance to confirm with counsel.
| Use of the recording | Biometric concern | Practical handling |
|---|---|---|
| Stored audio for quality review by managers | Low on its own; no voice template is created | Keep under the retention policy and restrict access |
| Speech-to-text transcription | Generally low; the output is words, not voice measurements | Remove names, addresses and phone numbers from transcripts |
| Speaker separation that labels who spoke when | Usually low if it does not recognize people across calls | Confirm the tool does not build persistent speaker profiles |
| Voice authentication for returning callers | High; enrolls callers' voiceprints by design | Separate consent process and retention schedule |
| Speaker identification matched to customer or employee records | High; creates identifiers tied to named people | Exclude from any licensed package |
| Training a synthetic voice on CSR recordings | High; uses the voice characteristics of specific people | Likely needs explicit agreement from those people |
| Licensing raw audio to an AI developer | Elevated; the buyer could extract voice features | Prefer transcripts, or ban voice identification in the license |
- 01Your work records
- 02Personal details removed
- 03You approve the release
- 04Licensed to AI developers
Why BIPA shapes the conversation#
BIPA shapes the biometric conversation because it lets private plaintiffs sue and sets statutory damages. Under 740 ILCS 14/20, a prevailing party can recover liquidated damages of $1,000 per negligent violation or $5,000 per intentional or reckless violation, or actual damages if greater.
Two later developments shape the exposure. In Rosenbach v. Six Flags, decided in January 2019, the Illinois Supreme Court held that a person need not show actual injury beyond a violation of their BIPA rights to sue. An amendment signed in August 2024 limits recovery to a single violation per person when the same biometric identifier is collected repeatedly by the same method. Exposure may still be significant when an archive covers many people.
Other states have biometric statutes of their own, and several comprehensive privacy laws treat biometric data as sensitive information with extra notice or consent rules. A company with callers or staff in several states should map where its recordings come from before deciding what to license.
Recording consent is a separate question#
Recording consent is a separate question from biometric status. Call recording laws decide whether a call could be recorded at all, and they differ by state: some allow recording with one party's consent, while others expect every party to agree. A lawfully made recording is still not automatically licensable.
The familiar line that a call may be recorded for quality and training purposes was written for internal coaching. Whether it reaches licensing to an outside AI developer is a judgment for counsel, and the answer often points toward de-identified transcripts rather than raw audio.
Customer service representatives are on every call too. Their voices are employee data, and in California the CCPA's temporary exemptions for employee and business-to-business information expired on January 1, 2023, so CSR recordings held by a covered business are personal information there.
Lower-risk ways to license a call archive#
The lower-risk way to license a call archive is to license the words and the outcomes, not the voices. AI developers building booking, dispatch and customer service tools usually care most about what was said and what happened next.
Transcripts are also easier to check. A reviewer can read a de-identified transcript line by line before release, while confirming that audio carries no identifying details needs specialist tools, and a voice itself remains identifying however well names are bleeped out.
- Transcribe calls and remove names, phone numbers, street addresses, payment details and account numbers.
- Replace customer and agent names with role labels such as caller and CSR.
- Link each transcript to the job outcome in the field service system: booked, cancelled, rescheduled, sold or warranty callback.
- Exclude calls from any voice authentication system and any recordings under dispute or legal hold.
- If audio is truly required, confirm consent records, consider voice alteration, and ban speaker identification and voice cloning in the license.
- Document which states the callers and employees in the archive are located in.
Illustrative: an HVAC company with years of booking calls#
Illustrative: a fictional HVAC and plumbing company runs a central call center that books jobs into ServiceTitan. Its call tracking tool has stored recordings of inbound booking calls for many years, and it operates a branch in Illinois alongside branches in neighboring states.
An AI developer is interested in booking conversations linked to whether each job was booked, upsold or lost. The company's counsel reviews its recording disclosures, confirms the call center never used voice authentication, and recommends against releasing any audio.
The company licenses de-identified transcripts tied to job outcome codes, and the license bans any attempt to identify speakers or reconstruct audio. Raw recordings stay in the company's own systems under its existing retention policy. The company also documents which branches each call came from, so the privacy record shows the state footprint of the licensed package.
How SourceX handles call recordings#
SourceX reviews call recordings in the Rights step of the SourceX five-step transaction: Supply, Rights, Preparation, Approval and Delivery. The review looks at recording disclosures, the state footprint of callers and staff, and any voice analysis features in the phone system.
Preparation removes personal details before anything is shared, and the SourceX Evidence Packet records the privacy record and permitted use, including any ban on speaker identification. Which laws may apply to a given archive is assessed deal by deal with the company's counsel.
Frequently asked questions
Does transcribing calls with speech-to-text create biometric data?
Generally, transcription converts speech into words and does not create a voiceprint. Some transcription tools also offer speaker recognition features, so check the settings and vendor documentation. If the tool builds persistent speaker profiles, treat that output as potential biometric data and keep it out of any licensed package.
Are CSRs' and technicians' voices treated differently from customers' voices?
Employee voices raise the same biometric question plus employment considerations, such as workplace notice rules and any union or employment agreements. In California, employee information is covered by the CCPA, so employee recordings deserve the same preparation as customer recordings.
What about voicemails and recorded estimate walkthroughs?
They are recordings like any other, and they often hold more personal detail because callers leave names, addresses and callback numbers. Run them through the same transcription and redaction process, or leave them out of the licensed package.
Should we delete old call recordings instead of licensing them?
That depends on your retention policy, legal holds and customer commitments. Deleting recordings you no longer need can reduce risk. If you may license later, decide first which records to keep, transcribe and de-identify, then delete the audio on your normal schedule.
Can an AI developer license only our CSRs' voices for voice training?
Training on the voice characteristics of specific people is the clearest biometric use, so it is likely to need explicit, documented agreement from each person whose voice is used. Most home services companies are better served licensing transcripts and outcomes than staff voices.
Sources
- BIPA (740 ILCS 14/20) lets a prevailing party recover liquidated damages of $1,000 per negligent violation or $5,000 per intentional or reckless violation, or actual damages if greater; SB 2979, signed August 2, 2024, limits recovery to a single violation per person when the same identifier is collected repeatedly by the same method. Source
- In Rosenbach v. Six Flags Entertainment Corp., decided January 25, 2019, the Illinois Supreme Court held that a person need not allege actual injury beyond a violation of their BIPA rights to sue. Source
- The California legislature did not extend the CCPA employee and business-to-business personal information exemptions, so they expired on January 1, 2023. Source
Related resources
See if your company qualifies
A short company assessment. No data uploads are needed.