A routine call to Walmart may have left customers with more than a solved shopping problem: a lawsuit says it may have left behind a biometric voiceprint, too.
Two Illinois residents, Carol J. Krupke and Jeanne Thomas, have filed a proposed class action lawsuit against Walmart Inc., accusing the retail giant of illegally collecting and storing customers’ voiceprints through its customer service phone lines without proper consent under state law.
According to the complaint filed Aug. 4, 2026, in the Northern District of Illinois, an artificial intelligence system allegedly records the audio when customers call a Walmart store and isolates the speaker’s vocal characteristics. The plaintiffs claim the AI measures identifiers including pitch, cadence, tone, and frequency spectra to create a mathematical template of the caller’s voice.
“Walmart creates a voiceprint or biometric identifier which can be used to identify them in the future,” the plaintiffs state in the complaint.
The complaint goes beyond voice matching, alleging that Walmart’s system also performs “emotional tracking” by analyzing speech patterns, modulation, and volume in real time to gauge customer frustration or urgency.
What Walmart told callers and what it didn’t
When consumers call Walmart’s customer service line, they hear an automated message stating: “This call and your voice may be recorded for business purposes, including fraud prevention.”
The plaintiffs argue that generic disclosure falls far short of what Illinois law requires. Walmart’s own privacy policy, updated June 18, 2026, acknowledges the company collects “biometric information such as voiceprints” when customers request customer service. The policy further states that “[w]here required by law, Walmart only processes this Sensitive Personal Information with your consent.”
The plaintiffs allege that Walmart did not obtain the written release BIPA requires before collecting their voiceprints. Under BIPA, a written release may include an electronic release rather than requiring a handwritten signature.
“Despite having her voiceprint taken, Defendant never informed [plaintiffs] of the specific limited purposes for which it collected, stored, or used her biometric identifier, other than to play the automatic message that her voice could be taken for business purposes, including fraud prevention,” the complaint reads.
More must-read AI coverage
The Illinois law at stake
The lawsuit centers on the Illinois Biometric Information Privacy Act (BIPA), a 2008 law that regulates how companies collect and use biometric identifiers like fingerprints, retina scans, and voiceprints.
Under BIPA, companies must:
- Inform individuals in writing that biometric information is being collected
- Explain the specific purpose and length of time the data will be stored
- Obtain a written release before collection begins
- Maintain a publicly available retention and destruction schedule
The plaintiffs allege Walmart violated all these requirements. Krupke, who called Walmart’s Freeport, Illinois store on three occasions between February 2025 and May 2026, and Thomas, who called stores in Vandalia and Effingham, say they never signed a written release or received proper disclosure about how their voiceprints would be used.
“Defendant’s collection and storage of biometric identifiers and/or biometric information exposes consumers to serious and irreversible privacy risks,” the complaint states. Unlike exposed credentials that organizations can revoke or replace, compromised biometric identifiers cannot be easily changed.
A unique privacy paradox
BIPA expressly identifies voiceprints as protected biometric identifiers. For businesses, the important distinction is not simply whether a customer service call is recorded but whether software extracts vocal characteristics to create a template capable of identifying the caller.
That distinction matters as companies deploy AI tools to transcribe calls, detect sentiment, flag potential fraud, and assist customer service agents. A standard call-recording notice may not satisfy biometric privacy requirements if the system also creates and stores an identifying voiceprint.
The complaint says Walmart told callers that their voices could be recorded for business purposes, including fraud prevention, but did not provide the specific purpose, retention period, and written release that the plaintiffs argue BIPA requires.
The plaintiffs are seeking class certification, injunctive relief, attorneys’ fees, and statutory damages. BIPA allows damages of $1,000 for negligent violations and $5,000 for intentional or reckless violations, although Illinois law limits repeated collections involving the same person through the same method to a single violation.
For organizations using AI-powered voice analytics, the case highlights a practical compliance risk: telling callers that a conversation may be recorded is not necessarily the same as obtaining consent to create and retain a biometric identifier.
Read more: Plaud’s AI earbuds show how newer tools can record, analyze, and act on workplace conversations, raising broader questions about consent and the handling of voice data.
