Can you use AI voice tools with Illinois customers?

Illinois is the state that changes this answer, and it changes it through a statute written well before any current tool existed. Its biometric privacy law lists a voiceprint among biometric identifiers, and it requires a private entity to inform the subject in writing that biometric information is being collected, to state the purpose and the retention period, and to obtain a written release, before collection. It also requires a published retention and destruction schedule. None of that is unusual in the abstract; what makes Illinois different is that individuals may sue for violations directly, which is why the case law here is far ahead of anywhere else.

The trigger is the analysis, not the recording, and this is the distinction most businesses get wrong in both directions. A call recording is governed by the state's recording consent rules and is a separate question. What the biometric statute reaches is the extraction of the characteristics of a voice in order to identify or distinguish a person — which is precisely what speaker identification, voice authentication, and the speaker separation inside many transcription and meeting tools perform. A tool that transcribes without distinguishing speakers is in a different position from one that labels who said what.

Which means the practical question is technical and specific: does this product build a representation of the speaker's voice, and does it use it to identify or distinguish. That is a question for the vendor's technical documentation, and it is answerable. It is not answered by the vendor's assurance that the product is compliant, by the absence of the word biometric in the marketing, or by the fact that audio is not retained — a voiceprint derived and discarded within the session has still been collected.

Coverage follows the individual rather than the business, which is the part that catches companies with no Illinois presence at all. A contact centre in another state taking calls from Illinois residents, a meeting tool joining a call with an Illinois participant, or a receptionist product answering an Illinois customer are all reaching people the statute protects. Where the business happens to be located is not the question the statute asks.

The compliant path exists and it is procedural rather than technical. Written notice before collection stating purpose and retention, a written release, a published schedule for destruction, and a record that the release was obtained. For an inbound call that is genuinely awkward, which is why several businesses take the other route: disable speaker identification for Illinois numbers, or select a product that does not perform it, and treat the feature as one that has a jurisdictional cost.

The wider point is worth taking from this case rather than only the Illinois answer. Several states have biometric provisions inside broader privacy statutes, and the direction of travel is that voice is treated as sensitive data requiring consent rather than notice. A business designing a voice product now is better served by making speaker analysis a feature that can be switched off per jurisdiction than by establishing whether it is currently permitted in each.