Amazon class action over voice data collection escapes dismissal

(Oct. 22, 2020)

A class action lawsuit against Amazon Web Services challenges its voiceprint technology used in customer service centers, claiming it violates Illinois data privacy law.  

The plaintiffs say Amazon Web Services houses these unique voiceprints on servers without consent and profits from their use, all prohibited under the state’s Biometric Information Privacy Act (BIPA).

All named plaintiffs live in Illinois. They learned their voiceprints were being used in lieu of a traditional personal identification number to gain access to their John Hancock financial accounts. 

John Hancock partners with Amazon Web Services under the brand Amazon Connect to provide customer service, according to the complaint.

A selling point for Amazon Connect, the plaintiffs contend, is a software program called Pindrop. Pindrop uses a person’s voiceprint to “create a distinctive identifier for each caller” to avoid using traditional passwords and PINs. 

In published guides, Pindrop says the technology can “authenticate callers” by “extracting . . . intelligence from every call encountered,” according to the complaint. 

The plaintiffs explain further: Pindrop “match[es] callers, based on their voice biometrics, with other personally identifiable information, including location.”  

While using this technology may make it easier to get access, the plaintiffs say Amazon Web Services violates Illinois’ Biometric Information Privacy Act by failing to meet key requirements. 

First, according to the class action lawsuit, Amazon Web Services fails to inform the consumer in writing their voiceprints are being stored or even obtain consent to collect.

Second, consumers are never alerted, in writing, of the voiceprint’s purpose or the length of time they’ll be stored.

And last, the plaintiffs say they were never advised about Amazon Web Services’ policy on the destruction of that data. 

“BIPA requires a private entity in possession of biometric data to actually destroy biometric data pursuant to its policies,” the class action lawsuit asserts.

“Defendants, at all relevant times, knew that they were extracting biometric information from calls,” the plaintiffs said in the complaint, but failed to meet BIPA requirements.

The plaintiffs also take issue with how their voiceprints and other biometric data are stored.

The class action lawsuit references the “cloud-based” nature of Pindrops’ servers and claims the defendants “disclose, redisclose, and disseminate” these voiceprints, another alleged violation of Illinois’ BIPA. 

Furthermore, according to the class action lawsuit, Amazon Web Services profits from these voiceprints “by selling Pindrop’s biometric data analysis and software as a service.”

Not only does Amazon Web Services promote Pindrop as a selling point, it also brings in revenue collecting and storing voiceprints, the plaintiffs allege.

“BIPA forbids any private entity in possession of a biometric identifier or biometric information from “profit[ing]” from that data.” 

Even more, the plaintiffs contend “stolen biometric identifiers . . . can be used to impersonate consumers” in the complaint, adding the voiceprint biometric market is projected to bring in $2.8 billion by 2024. 

“These unique and permanent biometric identifiers, once exposed, leave victims with no means to prevent identity theft and unauthorized tracking,” the class action lawsuit says. 

“[T]hey can get your name, they can find your social networking account, and they can find and track you in the street, in the stores that you visit, the . . . buildings you enter, and the photos your friends post online,” the plaintiffs said, adding these voiceprints and face IDs and other biometric data cannot be easily changed like a password or PIN.  

The complaint references two widely reported instances of massive private data breaches as a warning.

Fingerprints, logins and face scans of over 1 million people were found sitting on an unprotected third-party database in the U.K., The Guardian reported last year. 

In 2016, Australian researchers found a set of data “anonymized” and released by the government could actually be cross-referenced to reveal entire medical histories on individuals, according to The Guardian. 

The plaintiffs say there’s “a growing skepticism in the field of data protection and privacy law that biometric data can never truly be deidentified or anonymized.”

Has your voiceprint been used by Amazon Web Services? Let us know in the comments below. 

Counsel representing the plaintiffs in the Amazon Web Services class action lawsuit are Andrew D. Schlichter, Joel Rohlf, Alexander L. Braitberg of Schlichter Bogard & Denton LLP; and Stephen B. Brauerman and Ronald P. Golden III of Bayard PA.

The Amazon Web Services Class Action Lawsuit is McGoveran, et al. v. Amazon Web Services, Inc., et al., Case No. 1:20-cv-01399-UNA, in the U.S. District Court in the District of Delaware.