Seventh Circuit Affirms BIPA Exemption for Voice-ID Vendor

Seventh Circuit Affirms BIPA Exemption for Voice-ID Vendor

The Seventh Circuit affirmed judgment for Nuance Communications on August 28, 2026, holding that Nuance falls within the Biometric Information Privacy Act's financial-institution exemption because it authenticates Charles Schwab customers' identity using voice-ID technology.

Information last verified on September 8, 2026. This is a developing story; we update it as the record changes.

Status: Decided and issued August 28, 2026. This article describes the panel's opinion in Cisneros v. Nuance Communications, Inc., No. 24-2982 (7th Cir. Aug. 28, 2026). A slip opinion says nothing about a petition for rehearing or a petition for certiorari; this article does not reflect any filing made after August 28, 2026.

Jurisdiction scope: This article addresses a Seventh Circuit interpretation of Illinois's Biometric Information Privacy Act, 740 ILCS 14/1 to 14/99, as applied to a financial-services vendor. It does not address BIPA claims outside the financial-institution context or biometric privacy law in other states. For a broader view of how states regulate biometric data, see biometric privacy laws across all 50 states.

What Happened

Charles Schwab, a broker-dealer, lets customers authenticate telephone requests through voice-ID: the system compares a caller's voice to a stored mathematical representation of the customer's known voice. Schwab contracted with Nuance Communications to provide that service. Norma Cisneros, a Schwab customer, sued Nuance, alleging neither Schwab nor Nuance obtained the written consent BIPA requires and that neither published or followed a retention and deletion schedule. The putative class action reached federal court under 28 U.S.C. 1332(d) (CAFA), with aggregate stakes exceeding $5 million. The Northern District of Illinois, per Judge John J. Tharp, Jr., granted Nuance's motion to dismiss under Federal Rule of Civil Procedure 12(b)(6), a ruling the panel described as judgment on the pleadings. Schwab was never a defendant because, as a regulated broker-dealer, it is independently exempt from BIPA as a financial institution. The appeal was argued on October 27, 2025. On August 28, 2026, a Seventh Circuit panel of Judges Easterbrook, Scudder and Kolar affirmed, in an opinion written by Judge Easterbrook.

What the Law Actually Says

BIPA's section 15(b), 740 ILCS 14/15(b), requires a private entity to obtain a subject's written consent before collecting biometric identifiers such as a voiceprint. Section 25(c), 740 ILCS 14/25(c), exempts "a financial institution or an affiliate of a financial institution that is subject to Title V of the federal Gramm-Leach-Bliley Act of 1999 and the rules promulgated thereunder." The dispute here turned on whether that exemption reaches Nuance, a technology vendor, and not just Schwab.

The court answered yes, through a chain of federal definitions. BIPA borrows Gramm-Leach-Bliley's definition of "financial institution": "any institution the business of which is engaging in financial activities as described in section 1843(k) of title 12," 15 U.S.C. 6809(3)(A). Section 1843(k) sweeps in "any activity that the [Federal Reserve Board] has determined, by order or regulation ..., to be so closely related to banking or managing or controlling banks as to be a proper incident thereto," 12 U.S.C. 1843(k)(4)(F). The Federal Reserve has determined by regulation that "authenticating the identity of persons conducting financial and nonfinancial transactions" is such an activity, 12 C.F.R. 225.86(a)(2)(iii). Judge Easterbrook wrote that "it follows that Nuance is exempt under §25(c) to the extent that it authenticates the identity of Schwab's customers in financial transactions."

That phrase, "to the extent that," scopes the holding to the authentication work Nuance does for Schwab; the opinion does not declare Nuance a financial institution for all purposes or extend the exemption to vendors performing other kinds of work. Illinois already treats biometric data collected by employers, retailers and other private entities differently than data tied to a financial institution's regulated activity, a distinction covered in more depth in Illinois' biometric privacy statute, part of the site's broader look at Illinois data privacy law.

The court also rejected two procedural arguments. First, it found no waiver: Nuance raised section 25(c) while the case was pending, after the Delaware district court issued the opinion later affirmed as McGoveran, citing Margolin v. National Association of Immigration Judges, 608 U.S. 339 (2026), on the party-presentation principle. Second, it held section 25(c) is not an affirmative defense under Federal Rule of Civil Procedure 8(c)(1): "Calling one rule of law an exception to another rule of law does not turn it into an affirmative defense," noting Nuance had not yet filed an answer, having only moved to dismiss under Rule 12(b)(6). The panel cited Reed v. Columbia St. Mary's Hospital, 915 F.3d 473, 477 (7th Cir. 2019), and noted that whether an unpled affirmative defense is forfeited is separately before the Supreme Court in Younge v. Fulton Judicial Circuit District Attorney's Office, No. 25-352 (cert. granted Mar. 30, 2026). It agreed the district judge technically should have used Rule 12(c), since a complaint need not plead around a statutory exception, citing Gomez v. Toledo, 446 U.S. 635 (1980), and Richards v. Mitcheff, 696 F.3d 635 (7th Cir. 2012), but found remanding pointless because the parties had already joined issue on section 25(c) and no factual dispute remained.

What the Court Did Not Decide

The opinion flags, but does not resolve, a standing question. Cisneros never dealt directly with Nuance, and the court noted she does not contend that any of her data has been leaked or that a leak could cause loss. It observed that "the data that Nuance retains can be used to check whether a caller is who she claims to be but cannot be used to imitate that caller's voice," calling one-way systems of that kind "inherently secure." The panel cited Bryant v. Compass Group USA, Inc., 958 F.3d 617, 626 (7th Cir. 2020), which held that plaintiffs lack standing in federal court to sue under BIPA's retention-schedule subsection, section 15(a), along with TransUnion LLC v. Ramirez, 594 U.S. 413 (2021), and Metro-North Commuter R.R. v. Buckley, 521 U.S. 424 (1997), on when unrealized risk supports a justiciable injury.

The court did not decide that question. It held only that Cisneros has standing on at least her written-consent theory under section 15(b), which Bryant permits, so the case could proceed to the merits on that claim. Because that claim failed on the section 25(c) exemption, the panel explained, the retention-schedule claims fell with it and did not need a standing ruling of their own. The court also did not hold that every vendor working with a regulated financial institution is exempt from BIPA; the holding is limited, in the panel's own words, "to the extent that" Nuance performs identity authentication for Schwab's financial transactions.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

This decision adds a second circuit to a reading of BIPA's financial-institution exemption that traces the statute's text through Gramm-Leach-Bliley and a Federal Reserve regulation identifying identity authentication as a bank-related activity. The Seventh Circuit's own framing matters: it reached the same result as the Third Circuit's McGoveran decision partly because departing from it "would need to create a conflict among the circuits on a question of Illinois law," which the court called "not an attractive prospect." That is reasoning aimed at avoiding a split, not an independent declaration that the exemption is the only correct reading of BIPA.

The scope-limiting language in the holding is worth noting. The court exempted Nuance only "to the extent that" it authenticates Schwab customers' identity in financial transactions, leaving open how the exemption would apply to a vendor's other biometric-adjacent work for a financial institution. The standing question for data-retention claims also remains open for a future case where a plaintiff alleges more than the existence of a retention practice. This is a decision about section 25(c)'s reach on these facts, not a comprehensive ruling on vendor liability under BIPA.

How This Affects You

Consumers whose financial institutions use voice, fingerprint or facial biometric authentication should understand that the vendor providing that service may be covered by the same financial-institution exemption that shields the bank or broker-dealer itself, at least for the authentication function. That exemption does not automatically extend to every use a vendor makes of biometric data, and courts have generally required a plaintiff to allege a concrete injury, such as a data leak, to pursue some BIPA claims. Businesses contracting with financial institutions to provide identity-verification services in Illinois should assess whether their specific activity falls within the Federal Reserve's definition of bank-related activities under 12 C.F.R. 225.86, since section 25(c) tracks that federal regulatory line rather than a company's industry generally.

This is general legal information, not legal advice. It covers a federal appellate ruling interpreting Illinois's Biometric Information Privacy Act, binding federal courts in Illinois, Indiana and Wisconsin, and reflects sources verified on September 8, 2026. Laws change and this story is developing; consult a lawyer licensed in your jurisdiction about your specific situation.

---

Last updated: 2026-09-08. This is a developing story; details verified as of 2026-09-08.

Frequently Asked Questions

What did the Seventh Circuit decide in Cisneros v. Nuance Communications?

On August 28, 2026, the court affirmed judgment for Nuance, holding it is exempt from BIPA under 740 ILCS 14/25(c) to the extent it authenticates Charles Schwab customers' identity through voice-ID, because that activity qualifies as a Gramm-Leach-Bliley financial activity under 12 C.F.R. 225.86(a)(2)(iii).

Why isn't Charles Schwab a defendant in this case?

The opinion states that Schwab, a broker-dealer in securities, is subject to federal regulation as a financial institution and is therefore itself exempt from the Act, so Cisneros's claims proceeded only against Nuance, the vendor supplying Schwab's voice-ID system.

Does this ruling mean every company that works with a bank is exempt from BIPA?

No. The Seventh Circuit's holding is limited to the extent Nuance authenticates the identity of Schwab's customers in financial transactions; the court did not hold that vendors serving financial institutions are exempt from BIPA for unrelated activities.

Did the court rule that Norma Cisneros lacked standing to sue?

No. The panel flagged a potential standing problem for BIPA's data-retention claims but did not decide it, holding instead that Cisneros has standing on her written-consent claim under section 15(b), per the Seventh Circuit's 2020 decision in Bryant v. Compass Group USA.

How does this decision relate to the Third Circuit's McGoveran ruling?

The Seventh Circuit reached essentially the same result as the Third Circuit's 2026 decision in McGoveran v. Amazon Web Services, 175 F.4th 434, avoiding a split between the two circuits on how BIPA's financial-institution exemption applies to Illinois law.

Does this decision apply outside Illinois?

The opinion interprets Illinois's Biometric Information Privacy Act and binds federal district courts within the Seventh Circuit, which covers Illinois, Indiana and Wisconsin; it does not bind the Illinois Supreme Court or courts outside the circuit.

Can a company raise BIPA's financial-institution exemption without pleading it as an affirmative defense?

According to the Seventh Circuit, yes. The panel held that section 25(c) is a statutory exception rather than an affirmative defense under Federal Rule of Civil Procedure 8(c)(1), so a defendant can raise it in a motion rather than an answer.

What happens to Cisneros's data-retention claims now?

The court explained that because the written-consent claim failed on the section 25(c) exemption, the retention-schedule claims fell with it and did not require a separate standing ruling.