Understanding Illinois’ Biometric Information Privacy Act (BIPA) and Risks With AI Notetaking Tools

Artificial intelligence (AI) tools, especially notetaking and transcription apps, are becoming increasingly popular in workplaces and organizations. They help capture meeting discussions, create searchable notes, and improve productivity. But for Illinois employers and businesses, these technologies can create serious legal risks under the Illinois Biometric Information Privacy Act (BIPA) if they collect or process biometric data like voiceprints without proper safeguards.

BIPA is considered one of the strictest biometric privacy laws in the nation, and it imposes specific requirements on how biometric data is collected, stored, used, and destroyed.

Here’s what Illinois companies and residents should know about BIPA, AI notetaking tools, and minimizing liability.

What Is the Illinois Biometric Information Privacy Act?

Originally enacted in 2008, BIPA regulates the handling of biometric identifiers and biometric information, unique biological traits such as fingerprints, face scans, and voiceprints. It applies to private entities that collect biometric data from individuals in Illinois, regardless of where the business is located.

Under BIPA, companies must:

• Provide written notice before collecting biometric data;
• Disclose the purpose and duration of data collection;
• Obtain informed, written consent before collecting or storing biometric identifiers;
• Establish and follow written retention and destruction policies for the biometric data they store.

Importantly, BIPA also provides a private right of action, meaning that individuals can sue companies directly for violations and seek statutory damages, even if no actual harm occurred as a result of the collection.

AI Notetaking Tools and Biometric Risks

Many AI transcription platforms analyze audio to distinguish between speakers and create accurate transcripts. In doing so, they may generate voiceprints, digital representations of an individual’s vocal characteristics. Under BIPA, voiceprints are a biometric identifier, and any tool that creates them falls into the scope of the law.

This raises legal concerns whenever an AI app joins virtual meetings or records discussions without ensuring that all participants have provided the necessary written consent under BIPA. Because voiceprints can be collected without participants’ knowledge, this can expose employers and organizations to liability, even if the transcription service was implemented by a third-party vendor.

Best Practices to Minimize BIPA Liability

While AI notetaking tools offer useful features, Illinois employers and other organizations must be proactive to protect privacy and reduce legal risk. Here are practical strategies experts recommend:

1. Conduct a Risk Assessment

Before adopting an AI notetaking solution, determine whether the tool collects or processes biometric data, such as voiceprints, and evaluate how the vendor stores and handles that data.

2. Develop Written Policies

Create clear, written policies that govern AI tool usage — including what tools are approved, how consent will be obtained, and how data retention and destruction will occur.

✍️ 3. Get Informed Written Consent

BIPA compliance requires written consent before collecting biometric data. Employers should ensure ALL Illinois employees and participants provide clear, documented consent before any tool collects voiceprints.

4. Disable Biometric Features

Whenever possible, configure tools to turn off biometric-related features, such as speaker recognition or voice profiling, to avoid generating voiceprints altogether.

5. Control Who Can Enable Tools

Limit the ability to activate AI notetaking tools to trained employees who understand BIPA compliance obligations.

🗑️ 6. Retain and Destroy Data Appropriately

BIPA requires a written retention and destruction policy. Make sure AI-generated recordings and transcripts are stored only as long as necessary and are securely deleted according to your policy.

7. Perform Vendor Due Diligence

Review vendor privacy practices and contracts thoroughly to ensure that data processing and storage comply with BIPA and reflect your regulatory obligations.

8. Train Employees

Employees should be educated on the proper use of AI tools, the need for consent, and how to avoid unauthorized collection of biometric data.

Balancing Innovation with Privacy

AI notetaking and transcription technologies can boost efficiency, improve meeting documentation, and streamline workflows. But in Illinois, using these tools irresponsibly can trigger significant liability under BIPA.

Companies that proactively assess risks, implement robust policies, and ensure transparency and consent can enjoy the benefits of these innovations while protecting employee privacy and minimizing legal exposure.

---

📞 If you have questions about how BIPA applies to your business or need help ensuring compliance with Illinois biometric privacy laws, contact the Law Office of Jonathan W. Cole P.C. at (708) 529-7794 — Your Neighborhood Law Firm.