Walmart Sued Under Illinois Biometric Law Over AI Phone System That Allegedly Captures Callers' Voiceprints

Walmart Sued Under Illinois Biometric Law Over AI Phone System That Allegedly Captures Callers' Voiceprints

An Illinois resident filed a proposed class action against Walmart on July 28, 2026, in the U.S. District Court for the Northern District of Illinois, alleging the retailer's AI-powered phone system captures callers' voiceprints without the written consent or public retention policy the Illinois Biometric Information Privacy Act (BIPA) requires.

Information last verified on July 29, 2026. This is a developing story; we update it as the record changes. The allegations below are claims in a complaint and have not been proven in court.

Jurisdiction scope: This article addresses a lawsuit under Illinois's Biometric Information Privacy Act, 740 ILCS 14, filed in federal court in Illinois. It does not address biometric laws in other states, which differ. For that context, see our guide to biometric privacy laws by state.

What Happened

On July 28, 2026, Amber Smith filed a proposed class action against Walmart Inc. in the U.S. District Court for the Northern District of Illinois. The complaint alleges that when a customer calls a Walmart store, the call is routed through an automated, AI-powered interactive voice response (IVR) system that collects, stores, and uses the caller's voiceprint without the disclosures or consent BIPA requires.

According to the filing, the system captures a caller's voiceprint purportedly to reduce the risk of fraud, by matching a caller to a stored voiceprint template, and also to perform what the complaint describes as "emotional tracking" of the caller. The complaint alleges Walmart does not publish a data-retention and deletion schedule for the voiceprints, in what it calls "direct contravention" of BIPA.

Smith says she called an Illinois Walmart store in December 2025 and again in July 2026, and that at no point was she told her voiceprint would be collected or given a chance to agree in writing. The proposed class covers Illinois residents whose biometric identifiers, including voiceprints, Walmart allegedly collected, captured, or obtained.

The case is one of at least two filed over the same practice. A separate class action was filed against Walmart in Illinois state court by a different plaintiff, raising related claims and adding an allegation that Walmart disclosed biometric information to third parties. Walmart has not yet filed a response in the federal case, and no court has ruled on the merits. The claims described here are unproven allegations.

What the Law Actually Says

Illinois's Biometric Information Privacy Act, 740 ILCS 14, is often described as one of the strictest biometric-privacy statutes in the country, in part because it gives individuals a private right to sue, which most state biometric laws do not. The Act defines a "biometric identifier" to include a "voiceprint" at 740 ILCS 14/10, so a voice-based identifier falls squarely within its scope.

Section 15 sets out the core duties. Under 740 ILCS 14/15(b), a private entity may not collect a person's biometric identifier unless it first informs the person in writing that the identifier is being collected, states the purpose and length of collection, and obtains a written release. Under 740 ILCS 14/15(a), an entity in possession of biometric identifiers must maintain a written, publicly available policy setting a retention schedule and guidelines for permanent destruction, and must destroy the data when the initial purpose has been satisfied or within three years of the person's last interaction, whichever comes first. The complaint's central theory is that Walmart did neither before collecting callers' voiceprints.

BIPA is enforced through private lawsuits. Under 740 ILCS 14/20, a prevailing party can recover liquidated damages of $1,000 for each negligent violation and $5,000 for each reckless or intentional violation, along with attorneys' fees. In 2024, the Illinois legislature amended the Act so that repeated collections from the same person generally give rise to a single claim rather than one per scan, which changed how exposure is calculated but left the consent and retention duties intact. For how those numbers work in practice, see our explainer on BIPA damages and the overview at BIPA explained. Readers weighing whether a voice or face scan may be covered can start with whether they have a BIPA claim.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

The Walmart complaint reflects the newest front in BIPA litigation: AI-driven phone systems. For years, most consumer voiceprint cases targeted call centers and voice-authentication vendors. As retailers and service providers route more calls through AI systems that analyze a caller's voice, the same statutory question follows the technology. If a system builds a template from a caller's voice to identify or assess that caller, Illinois law treats that template as a biometric identifier, and the consent and retention rules apply regardless of how advanced the underlying model is.

What makes voiceprint cases legally distinct from a plain call-recording dispute is the theory of harm. A recording-consent claim asks whether the call itself could be recorded. A BIPA claim asks a narrower question: whether a biometric template was created from the voice and whether the company met the statute's written-consent and retention requirements before doing so. Those are separate legal duties, which is why a company can comply with call-recording notice rules and still face a BIPA claim.

It is worth stating plainly what has and has not happened. A complaint is an allegation, not a finding. Walmart has not answered, and some courts have dismissed BIPA claims where a plaintiff could not show that a true biometric identifier, rather than a mere audio recording, was created. The filing signals where this area of law is heading; it does not resolve it.

How This Affects You

This section describes general legal principles, not advice about any specific situation. Under BIPA, the key questions in a voiceprint case are usually whether the company created a biometric template from the voice, whether it obtained written consent beforehand, and whether it published a retention and destruction schedule. Courts have generally focused on whether the technology extracts a unique biometric identifier rather than simply recording audio.

If you live in Illinois and interact with an AI phone system, the law does not require you to prove technical details to have a concern, but a claim turns on facts about how the system works. BIPA claims are also subject to a five-year statute of limitations under Illinois Supreme Court precedent. Anyone weighing a claim should consult a lawyer licensed in Illinois about their specific facts.

This is general legal information, not legal advice. It summarizes a proposed class action filed in the U.S. District Court for the Northern District of Illinois on July 28, 2026, and the text of the Illinois Biometric Information Privacy Act, as verified on July 29, 2026. It covers Illinois law, describes unproven allegations, and does not address your individual situation or create an attorney-client relationship. Laws change and this case is developing; consult a lawyer licensed in Illinois about your specific circumstances.

Last updated: 2026-07-29. This is a developing story; details verified as of 2026-07-29.

Frequently Asked Questions

What does the Walmart voiceprint lawsuit allege?

Filed July 28, 2026 in the Northern District of Illinois, the proposed class action alleges Walmart's AI-powered interactive voice response phone system collected, stored, and used callers' voiceprints without the written consent or public retention policy required by the Illinois Biometric Information Privacy Act (740 ILCS 14). The claims are unproven allegations.

Is a voiceprint covered by the Illinois biometric law?

Yes. BIPA's definition of a biometric identifier at 740 ILCS 14/10 expressly includes a voiceprint. That is why a voice-based template built by a phone system can fall under the statute's consent and retention rules.

What does BIPA require before a company collects a voiceprint?

Under 740 ILCS 14/15(b), the company must first tell the person in writing that a biometric identifier is being collected, state the purpose and length of collection, and get a written release. Under 740 ILCS 14/15(a), it must also keep a written, publicly available retention and destruction schedule.

How much can a BIPA violation be worth?

Under 740 ILCS 14/20, a prevailing party can recover $1,000 for each negligent violation and $5,000 for each reckless or intentional violation, plus attorneys' fees. A 2024 amendment generally limits repeated collections from the same person to a single claim rather than one per scan.

Does this lawsuit mean Walmart broke the law?

No. A complaint is a set of allegations, not a court finding. Walmart has not yet responded in the federal case, and no court has ruled. Companies have defeated BIPA claims where the plaintiff could not show a true biometric identifier was created rather than a plain audio recording.

How is a BIPA voiceprint claim different from a call-recording claim?

A call-recording claim asks whether the call could be recorded at all. A BIPA claim asks the narrower question of whether a biometric template was created from the voice and whether the company met BIPA's written-consent and retention duties. They are separate legal issues.

How long do you have to bring a BIPA claim in Illinois?

The Illinois Supreme Court has held that a five-year statute of limitations applies to BIPA claims. The exact accrual date can depend on the facts, so timing questions should be reviewed with an Illinois lawyer.