Meta loses bid to end BIPA voiceprint suit as case moves forward

A federal judge in California rejected Meta Platforms’ attempt to end a biometric privacy lawsuit over voice recordings collected through Facebook and Messenger, finding that evidence about Meta’s own voice processing technologies and its ability to connect audio files with user accounts creates a factual dispute over whether the recordings could be used to identify people. Illinois resident Natalie Delgado, who brought the lawsuit in 2023 under the state’s Biometric Information Privacy Act (BIPA), filed a motion August 21 asking U.S. District Judge Susan Illston of the Northern District of California to certify an Illinois class. A hearing on class certification is scheduled for December 18.

BIPA expressly protects “voiceprints” as biometric identifiers, along with fingerprints, retina or iris scans and scans of hand or face geometry. But the statute does not define what makes recorded speech a voiceprint rather than simply an audio recording.

Meta argued that distinction should end Delgado’s case.

According to the company, the audio files it received through Facebook and Messenger were merely voice recordings. To identify a speaker, Meta argued, a recording would first have to be processed into different data representing characteristics of the speaker’s voice, which it called an “Output Representation.”

That representation would then have to be compared with data linking it to a known person. Meta said it had not created such representations from Delgado’s recordings and did not possess information linking the voices in her uploaded recordings to her identity.

Illston concluded the evidence was not that simple.

The central question under BIPA, she said, was not whether Meta had used Delgado’s voice recordings to identify her. Citing a 2024 Ninth Circuit ruling involving Meta’s facial recognition technology, she said the relevant issue is whether the biometric data can identify a person. As Illston put it, “BIPA applies if it could.”

Delgado’s expert, Carnegie Mellon University professor Rita Singh, presented evidence about Meta’s internal capabilities that Illston found sufficient to create a genuine dispute for trial.

Singh said Meta uses technical pipelines to process audio received through Facebook and Messenger, converts the data into standardized formats suitable for speech analysis, stores voice data in interconnected systems associated with user accounts and maintains the data in formats compatible with speaker-identification and verification technologies.

Singh also cited Meta research and technologies that she said showed the company possessed and had used systems capable of identifying individuals from digital voice data.

Evidence provided to the court showed that voice recordings uploaded through Facebook and Messenger can be associated with a Facebook user ID or account identifier, which can in turn be associated with information about the account holder that can include a name, email address, hometown, date of birth, employer, IP address and other personal information.

Singh also described methods through which voice data could be associated with an individual using direct account links or statistical and probabilistic techniques.

In one experiment described in the court record, Singh analyzed 10 Messenger voice messages sent from Delgado’s account and used statistical comparisons of the voices to demonstrate how the most frequently occurring speaker could be associated with the account holder.

Meta disputed the significance of the experiment and maintained that a user can upload recordings containing someone else’s voice, multiple voices or no human voice at all.

Illston found that those competing interpretations underscored why summary judgment was inappropriate.

The judge said Delgado had produced admissible evidence that Meta possessed proprietary technologies and internal systems capable of processing a voice recording and connecting it with a user account and the personally identifiable information associated with that account.

Singh also pointed to Meta’s previous research and speaker identification work in concluding that the company’s capabilities went beyond a merely theoretical ability to identify speakers.

Meta warned that accepting Delgado’s theory could make virtually anyone possessing a voicemail and having access to readily available speaker identification software potentially liable under BIPA.

Illston rejected that characterization, saying her decision “does not open the floodgates.”

Just as importantly, however, Illston did not decide that a voice recording itself is necessarily a voiceprint and explicitly declined to draw a precise line at which ordinary voice data becomes a BIPA-protected voiceprint.

She ruled that Delgado had produced enough evidence to create a genuine dispute over whether Meta collected biometric data capable of identifying her using technology the company possessed.

The judge’s June decision was not a finding that Meta violated BIPA. Delgado still must prove her claims, and no class has yet been certified.

Delgado alleges that she used Facebook and Messenger voice functions on multiple occasions in 2022 and 2023, including sending voice messages and making audio calls. She contends that Meta created, collected or stored voiceprints and related biometric information without satisfying BIPA’s requirements.

Delgado’s surviving claims invoke two portions of the Illinois law, Section 15(a) and Section 15(b).

Section 15(a) requires companies possessing biometric identifiers or biometric information to maintain a publicly available retention schedule and destruction guidelines.

Section 15(b) generally requires companies to provide written notice and obtain a written release before collecting or obtaining a person’s biometric identifier or biometric information.

Delgado alleges Meta failed to comply with those requirements.

The complaint also points to evidence predating the lawsuit that Meta had explored voice-based identification.

Delgado cited a Meta privacy disclosure stating that voice recordings could be collected and could be used to identify users, as well as a Facebook patent issued in 2020 titled “User identification with voiceprints on online social networks.”

The patent describes comparing audio from an unknown speaker against stored voiceprints of candidate social-network users and assigning probability scores to identify the speaker.

The June ruling marked another turn in the fight over Singh’s role in the case.

Meta previously sought to have Singh disqualified after Delgado retained her as an expert, arguing that attorneys for the company had discussed the litigation with her in 2024 while considering whether to hire her themselves.

Illston denied that motion in November 2025, finding Meta had no retainer or confidentiality agreement with Singh, had not paid her and had not established the kind of confidential relationship that would justify barring her from working for Delgado.

Singh’s analysis subsequently became central to the evidence Illston relied upon in refusing to grant Meta summary judgment.

Meta attempted after the ruling to obtain permission for an immediate appeal to the Ninth Circuit appeals court, arguing that whether the voice recordings at issue qualify as “voiceprints” under BIPA presented a legal issue appropriate for appellate review.

The litigation continues in the district court and has moved into class certification proceedings.

Article Topics

biometric identifiers  |  Biometric Information Privacy Act (BIPA)  |  biometrics  |  data privacy  |  lawsuits  |  Meta  |  voice biometrics  |  voiceprints