A voice recording is personal data and a biometric identifier at once. The Illinois Biometric Information Privacy Act (BIPA) names voiceprint in its definition, and European regulators treat voice as biometric. Keeping the audio on infrastructure you control removes the second private entity that consent duties attach to. That choice lives in your architecture rather than your privacy policy.
Key Takeaways
- Illinois BIPA names voiceprint by statute, and it carries a private right of action.
- Copyright claims over AI voice clones failed, so plaintiffs used biometric law instead.
- Bring your own key moves the contract, and the audio still leaves.
This post is part of our guide to Running Voice AI on Local, Self-Hosted Models. Here we go deeper on why compliance teams ask for local models, and how keeping call audio on your own servers works in Dograh, the open-source, self-hostable AI voice agent platform we build.
A call carries more personal data than most databases
One support call can hand over more identifying detail than a breached database table.
A caller reads out a full name, a date of birth, an address and the last four digits of a card. Then they say why they are calling, which is where the money trouble or the medical detail arrives. It arrives as audio, so it gets filed as a recording and never as a record.
That audio is worth stealing, and the 2025 numbers say so. The FBI's 2025 Internet Crime Report carried its first section on artificial intelligence, covering 22,364 complaints and nearly $893 million in losses, and it names voice clones among the tools scammers use. Over the same year the Identity Theft Resource Center tracked 3,322 data compromises, a record, with financial services the most breached industry at 739 and healthcare next at 534. Those two sectors are where customers read account numbers and medical details out loud every day.
Your customer's voice is itself a biometric identifier
Voice sits in a different legal class from the rest of the call.
BIPA names voice in its own text. Its definition of a "biometric identifier" lists a retina or iris scan, a fingerprint, a voiceprint, and a scan of hand or face geometry.
The same section carves out health care. Biometric identifiers do not include information taken from a patient in a health care setting, or information collected, used or stored for health care treatment, payment or operations under HIPAA. Generally that means HIPAA governs the provider call, while BIPA governs the bank, the retailer and the consumer device. Merging the two is the most common error here.
Europe draws its line by purpose. The GDPR's definitions cover biometric data, and its rule on special categories of data prohibits processing it to uniquely identify a natural person without a derogation. In most cases, running speech to text on a call is not special-category processing. Voice authentication generally is.
The European Data Protection Board went further in its guidelines on virtual voice assistants. It says voice data is "inherently biometric personal data". So when voice data is processed to uniquely identify a person, or is special category data by nature or by finding, the processing needs a valid legal basis under the GDPR and an exception from its ban on special-category processing.
Voice is biometric personal data all the time. The heavier special-category duties switch on when your purpose becomes identification.
Open Source Alternative to Vapi / Retell
Self-hosted voice agent platform — no per-minute fees
dograh-hq/dograh
Star on GitHub
Why voice claims moved from copyright to biometric law
Voice actors tried protecting their voice through copyright first, and the courts did not accept it. Copyright protects an actual recording, not the abstract sound of someone's voice, so an AI clone that merely imitates a voice is not infringing the way a stolen recording would be.
That is why plaintiffs pivoted to biometric privacy law instead. BIPA treats voice as a protected biometric identifier, and the pivot has already worked at real scale. A case against Amazon over voice data collected through Alexa was certified as a class action covering roughly 1.2 million Illinois residents, and separate lawsuits from voice professionals against several major AI and technology companies are working through the courts.
The one honest limit worth naming: every case that has actually succeeded so far involves a company's own device or its own customer-facing product collecting the voice data directly. No court has yet ruled on a business that simply sends call audio out to a third-party model provider over an API. That scenario remains untested.
That gap is exactly the ambiguity a self-hosted voice agent removes. If the audio never leaves your own infrastructure to begin with, there is no third-party API relationship for a future court to eventually have to rule on. We make the fuller business case for this in our case for keeping enterprise voice AI on-prem.
Where the audio goes is an architecture decision
Both of the facts these statutes turn on get settled in your deployment config.
Possession and purpose
The first is possession. BIPA reaches a private entity that will "collect, capture, purchase, receive through trade, or otherwise obtain" a biometric identifier, under BIPA's consent rule. When your agent posts call audio to a model provider, a second private entity comes into possession of it. Generally that widens the set of parties an obligation can attach to. No court has ruled on that path, which is reason to design around it.
The second is purpose. Whether your agent identifies a caller by voice is a product decision made in a sprint planning session. In most cases that decision, more than the transcription itself, moves a call into special-category territory. A feature flag draws the compliance boundary.
Where the models run
Self-hosting keeps the recordings and transcripts on your own servers. The live call audio can still leave your servers, though, whenever a model outside your network hears the caller. Dograh is the orchestration layer that holds the workflow, the turn-taking, the tool calls, the telephony and the call lifecycle. It is not a model. Inference is a separate layer you choose, so the audio goes wherever those models run. You can fill that layer with the models the platform provides, with a third-party provider through your own key, or with open-weight models on hardware you own. Bring your own key moves the commercial contract and leaves the data path where it was. The provider still receives the recording.
New accounts start on Dograh's managed models. To keep call audio off them, go to the Models page in the dashboard sidebar, set the Organization default to BYOK with your own providers (or local models), and check that no agent has its own model override. Only the third option, open-weight models on hardware you own, keeps the audio inside. Building a voice agent on fully local open-source models shows what the fully local setup looks like in practice.
Which calls need full self-hosting
Our test for whether a workload must be fully self-hosted is whether the obligation is contractually delegable, rather than how sensitive the data feels. HIPAA has the business associate agreement. Attorney-client privilege has no equivalent, which is why legal intake forces full self-hosting. A biometric written release runs from the speaker, and no vendor contract creates one for you.
Retention points the same way, since you cannot delete what you never held. Calls like first notice of loss intake bite first, and enterprise on-prem voice AI is the buyer-facing version of this argument.
None of this is legal advice, so confirm your own position with counsel before you commit to an architecture.
Join the Dograh Community
Dograh is an OSS alternative to Vapi. Join our Slack community for queries, releases, best practices & community interactions.
Glossary
- Voiceprint
- A mathematical template derived from the characteristics of a person's speech that can tell one speaker from another. BIPA lists it beside fingerprints and iris scans, which is what separates it legally from an ordinary audio recording.
- Special-category data
- The GDPR class of data whose processing is prohibited without a specific derogation. Voice enters it under Article 9(1) when the processing purpose is uniquely identifying a person, so the trigger is your purpose and not the audio by itself.
- Private right of action
- A statutory provision letting an individual sue directly instead of waiting for a regulator to act. Illinois BIPA has one and the Texas equivalent does not, and that single difference explains why almost every voiceprint class action is filed in Illinois.
- Data residency
- A requirement that data stay inside a defined boundary, whether that boundary is a national border or your own rack. For voice, residency is settled by where inference runs, since that is the point at which audio leaves your network.
A boundary drawn in architecture is cheap to move before launch and expensive afterwards. Decide where inference runs while that is still a configuration change, and write down whether anything on your roadmap identifies a caller by voice. That answer changes which rules apply to the whole call. Take both to counsel.
