Walmart Sued Over Alleged Unlawful Collection of Voiceprints in Illinois
Walmart faces lawsuit for allegedly collecting customers' voiceprints without consent under Illinois law.
Why it matters: This lawsuit highlights growing scrutiny of biometric data practices, posing risks for retail and privacy compliance professionals. Illinois' strict Biometric Information Privacy Act enforces significant penalties for violations, reshaping how companies must handle sensitive biometric data.
- Walmart is accused of collecting and storing customer voiceprints without written consent, violating Illinois' BIPA.
- BIPA requires private entities to inform and get consent before collecting biometric data such as voiceprints, enacted in 2008.
- Illinois Supreme Court ruled in Cothron v. White Castle that each biometric data scan or disclosure is a separate violation, increasing potential damages significantly.
- 2024's S.B. 2979 caps BIPA violations to a single instance, but its retroactive application remains under review by the Seventh Circuit.
Walmart is the latest major retailer to face a lawsuit alleging it collected and stored customers' voiceprints without obtaining proper consent, violating the Illinois Biometric Information Privacy Act (BIPA). Enacted in 2008, BIPA mandates that private entities inform individuals in writing and secure their consent before collecting biometric identifiers, including voiceprints.
The legal implications intensified following the Illinois Supreme Court's ruling in Cothron v. White Castle System, Inc., which held that each collection or disclosure of biometric data represents a separate violation of BIPA. According to legal experts Zachary Watters and Joseph Strubbe, this ruling "is likely to have a profound impact on both the ability of plaintiffs to file BIPA claims and the calculation of liquidated damages." This approach opens the door to potentially "punitive, crippling liability" for companies, with White Castle facing damages exceeding $17 billion under this framework.
However, to curb this expansive liability, the Illinois legislature passed S.B. 2979 in August 2024. This law limits BIPA violations to a single instance per case, regardless of how many times biometric data is scanned or transmitted. The U.S. Court of Appeals for the Seventh Circuit is currently considering whether this reform applies retroactively to lawsuits like Walmart's that were filed before the law’s enactment.
The Walmart litigation underscores the increasing legal and compliance risks associated with biometric data. With BIPA prescribing statutory damages of $1,000 per violation – or $5,000 if intentional or reckless – retailers and other private entities must exercise caution in biometric data collection and storage to avoid costly consequences.
By the numbers:
- $1,000 per BIPA violation — standard statutory damages
- $5,000 per violation — if violation is intentional or reckless
- $17 billion+ potential damages — White Castle case under Cothron precedent
Yes, but: S.B. 2979 limits BIPA liability to a single violation, but its retroactive effect is unsettled, injecting uncertainty into ongoing lawsuits like Walmart's.
What's next: The Seventh Circuit's decision on the retroactivity of S.B. 2979 will shape the potential damages and litigation risk for biometric privacy cases in Illinois.