A voiceprint lawsuit against John Hancock has become a case study in how Illinois’ Biometric Information Privacy Act (BIPA) can fall short for plaintiffs, according to Top Class Actions’ July 20, 2026 report. For an insurer sued over voice-based identity verification, the outcome matters far beyond one company: it signals that BIPA’s private right of action, often cited as the toughest biometric statute in the country, has real boundaries when a defendant is a regulated financial institution.
The relevant limit is BIPA’s long-standing exemption for entities already governed by the Gramm-Leach-Bliley Act, which covers banks, insurers and other financial firms subject to federal privacy oversight. That carve-out has always existed on paper, but rulings applying it to modern voiceprint and voice-authentication tools give financial-sector data teams something concrete to point to when plaintiffs’ firms come calling over call-center biometrics or voice-based fraud screening.
A GLBA exemption that looked theoretical on the statute books is starting to look like an actual litigation defense.
The catch is that this shield is narrow by design. It protects financial institutions already answerable to federal regulators, not retailers, employers, ad-tech vendors, or AI companies harvesting voice data for model training — the population BIPA’s plaintiffs’ bar has targeted most aggressively in recent years. Data companies outside financial services should not read this development as a broader retreat from BIPA liability; if anything, it may push plaintiffs’ lawyers to sharpen their targeting toward defendants who clearly fall outside any statutory exemption.
Watch for how quickly other financial firms cite this reasoning to knock out voiceprint and biometric-authentication suits at the pleading stage, and whether Illinois lawmakers or courts revisit the GLBA carve-out’s scope as voice biometrics become standard in banking, insurance and call-center fraud detection.
John Hancock voiceprint ruling highlights limits of Illinois biometric privacy law
