The Drive-Thru Recognized a Regular. That's a Biometric Identifier.
"Welcome back — the usual?" is the demo line every AI ordering vendor leads with. It is also the single sentence that proves the system stored a representation of a customer's voice, and that nobody signed anything before it did.
Illinois BIPA treats a voiceprint as a biometric identifier. A private entity may not collect, capture or otherwise obtain one without first informing the subject in writing that it is being collected and stored, informing them in writing of the specific purpose and length of term, and obtaining a written release. It must also maintain a publicly available retention and destruction policy. Damages are liquidated at $1,000 per negligent and $5,000 per intentional or reckless violation, with fees. None of it turns on whether the business considered the voice data to be an identifier.
Transcription Is Not the Problem. Recognition Is.
Restaurant operators tend to hear "voice AI" as one thing. Legally it is two, and the boundary between them is sharp: converting sound into words is not biometric processing, while deriving a template of how a specific person sounds is. Nearly every feature that makes an AI ordering system worth its price sits on the wrong side of that line, because personalisation requires knowing who is speaking.
The Consent Problem Is a Sequencing Problem
Most biometric compliance advice assumes a moment before collection in which consent can be obtained — an employee onboarding form, a signup screen, a kiosk enrolment. A drive-thru has no such moment. The customer's first act is to speak, and speaking is the collection event. Everything a compliance programme would normally do has to happen before a stranger in a car says three words.
No interaction yet. Any consent architecture has to be complete before this point, because the next event is collection.
The customer speaks to order. If the stack does speaker recognition, capture has occurred and no release has been executed.
The system compares against stored templates to greet, personalise or flag. This is the step that converts a transcript into an identification.
Voice-derived data joins the POS record, loyalty profile and payment token. Biometric data is now inside systems with different retention rules.
Audio and templates persist under vendor defaults, often indefinitely, without a published destruction schedule.
Templates transfer with the system. Disclosure of biometric identifiers without consent is separately actionable.
The Retention Policy Violation Nobody Litigates Around
Arguments about whether a particular voice feature produces a "voiceprint" are technical and contestable. The written-policy requirement is neither. A private entity in possession of biometric identifiers must maintain a publicly available written policy setting a retention schedule and destruction guidelines. Whether one exists can be determined by loading a website. For a chain that has deployed voice ordering across hundreds of locations without publishing anything, that is a claim that requires no discovery to plead — which is precisely why it tends to be the first count.
Franchise Systems Concentrate the Risk in the Wrong Place
Quick-service brands roll out ordering technology through the franchise agreement: approved vendor, mandated configuration, brand-standard timeline. The operator installs what it is told to install and has no ability to disable a recognition module that the brand negotiated as a headline feature. Then the collection happens at the operator's store, to the operator's customers, through the operator's staff.
Plaintiffs name both, and the indemnity language in most franchise agreements runs toward the franchisor. An operator being asked to deploy voice ordering has one moment of leverage — before signing the technology addendum — to require that liability follow control. Most systems have never been asked.
Six Controls Worth Having
Ask one question of the vendor and require a contractual answer: does the system derive, store or compare any speaker-specific representation of voice? A yes changes the entire compliance posture. A verbal no from a sales engineer is not a document you can produce later.
Returning-customer greeting and voice-linked loyalty are usually optional modules sold as differentiators. Turning them off at the pilot stage costs a feature; turning them off after a demand letter arrives concedes that they were on.
BIPA requires a written, publicly available policy with a retention schedule and destruction guidelines. Its absence is an independent violation that does not require anyone to prove harm — and it is the first thing plaintiffs' counsel checks, because it is checkable from outside.
Model-improvement clauses in voice vendor agreements routinely grant broad rights to retain and use recordings. Negotiate retention to a fixed short window with contractual destruction, and require deletion certification on termination.
A brand-mandated system should carry a brand indemnity. If a franchise agreement obliges an operator to deploy specified technology, the operator has no configuration control and should not carry the statutory damages for how it behaves.
Order-ahead phone lines, in-store kiosks with voice input and app voice search run the same stack under different branding. Compliance decisions made for the drive-thru rarely propagate to them, which is how a chain ends up with one compliant surface and four that are not.
Related Reading
- Voice biometrics and BIPA in call centers — the same voiceprint analysis where an authentication use case makes it explicit.
- Texas CUBI and AI systems — Attorney General enforcement at up to $25,000 per violation, no class action needed.
- What BIPA class actions have actually settled for — how class size, not per-person damages, sets the number.
Start With What Your Own Site Admits
Before the vendor answers anything, your marketing pages have already described the feature set — "recognises returning guests", "knows your usual", "voice-activated loyalty". Those sentences are exhibits.
See what your public pages are claiming in one pass. Run a free scan and reconcile every personalisation claim against your consent flow and retention policy.
This article is general information and not legal advice. Biometric privacy statutes differ substantially by state in scope, consent mechanics, enforcement and damages, and the technical question of what constitutes a voiceprint is fact-specific. Consult qualified counsel before deploying or continuing to operate voice-recognition systems.