A voice recording is personal data and a biometric identifier at the same time. The Illinois Biometric Information Privacy Act (BIPA) names voiceprint in its statutory definition, and European regulators treat voice as inherently biometric. Keeping the audio on infrastructure you control removes the second private entity that biometric consent duties attach to. That choice lives in your architecture rather than your privacy policy.
Key Takeaways
- Illinois BIPA names voiceprint by statute, and it carries a private right of action.
- Copyright claims over AI voice clones failed, so plaintiffs used biometric law instead.
- Bring your own key moves the contract, and the audio still leaves.
This post is part of our guide to Running Voice AI on Local, Self-Hosted Models. The pillar covers which models to run. This one covers why your compliance team will ask you to run them locally. We build Dograh, an open-source voice agent orchestrator, and this is the question our users raise most.
A phone call carries more personal data than most databases
One support call can hand over more identifying detail than a breached database table.
A caller reads out a full name, a date of birth, an address and the last four digits of a card. Then they say why they are calling, which is where the money trouble or the medical detail arrives. It arrives as audio, so it gets filed as a recording and never as a record.
That audio is worth stealing, and the 2025 numbers say so. The FBI's 2025 Internet Crime Report carried its first section on artificial intelligence, covering 22,364 complaints and nearly $893 million in losses, and it names voice clones among the tools scammers use. Over the same year the Identity Theft Resource Center tracked 3,322 data compromises, a record, with financial services the most breached industry at 739 and healthcare next at 534. Those two sectors are where customers read account numbers and medical details out loud every day.
Your customer's voice is itself a biometric identifier
Voice sits in a different legal class from the rest of the call.
BIPA puts it in statutory text, at 740 ILCS 14/10:
"Biometric identifier" means a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.
The same section carves out health care. Biometric identifiers do not include "information captured from a patient in a health care setting or information collected, used, or stored for health care treatment, payment, or operations under" HIPAA. Generally that means HIPAA governs the provider call, while BIPA governs the bank, the retailer and the consumer device. Merging the two is the most common error here.
Europe draws its line by purpose. GDPR Article 4(14) defines biometric data, and Article 9(1) prohibits processing it for the purpose of uniquely identifying a natural person without a derogation. In most cases, running speech to text on a call is not Article 9 processing. Voice authentication generally is.
The European Data Protection Board went further in its guidelines on virtual voice assistants:
The EDPB recalls that voice data is inherently biometric personal data. As a result, when such data is processed for the purpose of uniquely identifying a natural person or is inherently or determined to be special category personal data, the processing must have a valid legal basis in Article 6 and be accompanied by a derogation from Article 9 GDPR.
Voice is biometric personal data all the time. The heavier Article 9 duties switch on when your purpose becomes identification.
One recording, two categories that travel with the audio and a third that does not. The words and the voice are both in the call no matter what you do. Whether the heavier Article 9 duties apply is settled by the switch on the right.
Open Source Alternative to Vapi / Retell
Self-hosted voice agent platform — no per-minute fees
dograh-hq/dograh
Star on GitHub
Copyright failed to protect voice, so the claims moved to biometric law
Voice actors tried protecting their voice through copyright first, and the courts did not accept it. Copyright protects an actual recording, not the abstract sound of someone's voice, so an AI clone that merely imitates a voice is not infringing the way a stolen recording would be.
That is why plaintiffs pivoted to biometric privacy law instead. BIPA treats voice as a protected biometric identifier, and the pivot has already worked at real scale. A case against Amazon over voice data collected through Alexa was certified as a class action covering roughly 1.2 million Illinois residents, and separate lawsuits from voice professionals against several major AI and technology companies are working through the courts.
The one honest limit worth naming: every case that has actually succeeded so far involves a company's own device or its own customer-facing product collecting the voice data directly. No court has yet ruled on a business that simply sends call audio out to a third-party model provider over an API. That scenario remains untested.
That gap is exactly the ambiguity a self-hosted voice agent removes. If the audio never leaves your own infrastructure to begin with, there is no third-party API relationship for a future court to eventually have to rule on. We make the fuller business case for this in our case for keeping enterprise voice AI on-prem.
Where the audio goes is an architecture decision
Both of the facts these statutes turn on get settled in your deployment config.
The first is possession. BIPA reaches a private entity that will "collect, capture, purchase, receive through trade, or otherwise obtain" a biometric identifier, at 740 ILCS 14/15(b). When your agent posts call audio to a model provider, a second private entity comes into possession of it. Generally that widens the set of parties an obligation can attach to. No court has ruled on that path, which is reason to design around it.
The second is purpose. Whether your agent identifies a caller by voice is a product decision made in a sprint planning session. In most cases that decision, more than the transcription itself, moves a call into special-category territory. A feature flag draws the compliance boundary.
Dograh is an orchestrator. It holds the workflow, the turn-taking, the tool calls, the telephony and the call lifecycle. It is not a model. Inference is a separate layer, and you can fill it with the models Dograh provides or with a third-party provider through your own key. The third option is open-weight models on hardware you own, and only that one keeps the audio inside. Building a voice agent on fully local open-source models is what that looks like in practice. Bring your own key moves the commercial contract and leaves the data path where it was. The provider still receives the recording.
Our test for whether a workload must be fully self-hosted is whether the obligation is contractually delegable, rather than how sensitive the data feels. HIPAA has the business associate agreement. Attorney-client privilege has no equivalent, which is why legal intake forces full self-hosting. A biometric written release runs from the speaker, and no vendor contract creates one for you.
Retention points the same way, since you cannot delete what you never held. Calls like first notice of loss intake bite first, and enterprise on-prem voice AI is the buyer-facing version of this argument.
None of this is legal advice, so confirm your own position with counsel before you commit to an architecture.
Join the Dograh Community
Dograh is an OSS alternative to Vapi. Join our Slack community for queries, releases, best practices & community interactions.
Glossary
- Voiceprint
- A mathematical template derived from the characteristics of a person's speech that can tell one speaker from another. BIPA lists it beside fingerprints and iris scans, which is what separates it legally from an ordinary audio recording.
- Special-category data
- The GDPR class of data whose processing is prohibited without a specific derogation. Voice enters it under Article 9(1) when the processing purpose is uniquely identifying a person, so the trigger is your purpose and not the audio by itself.
- Private right of action
- A statutory provision letting an individual sue directly instead of waiting for a regulator to act. Illinois BIPA has one and the Texas equivalent does not, and that single difference explains why almost every voiceprint class action is filed in Illinois.
- Data residency
- A requirement that data stay inside a defined boundary, whether that boundary is a national border or your own rack. For voice, residency is settled by where inference runs, since that is the point at which audio leaves your network.
A boundary drawn in architecture is cheap to move before launch and expensive afterwards. Decide where inference runs while that is still a configuration change, and write down whether anything on your roadmap identifies a caller by voice. That answer changes which rules apply to the whole call. Take both to counsel.
