Concept renderSpeaker identification can fall under biometric privacy laws. Texas lists voiceprint as a biometric identifier and requires notice and consent before capture for a commercial purpose. Washington lists voiceprint but excludes audio recordings, and triggers on database enrollment. As of October 31, 2026, a named voice profile is the case to review first with counsel. Not legal advice.
If your device recognizes who is speaking, it may create the kind of data that state biometric laws regulate. If it only records and transcribes, the answer can differ. This guide lays the quoted statute text for Texas and Washington next to common voice features, so a product manager can see which words in each statute touch which voice features, and what to ask counsel.
This is the engineering team's compilation of public statute text. It is not legal advice. Please have a lawyer confirm each point. We restate what the statutes say and link to the originals. We do not conclude that any design is legal or illegal. We also did not retrieve the Illinois Biometric Information Privacy Act text, so this page makes no statement about Illinois. Read that statute directly and ask counsel about it.
What do the Texas and Washington statutes say?
Both statutes name the voiceprint. They differ on what triggers the duty and on recordings. Text is paraphrased from the official pages as of October 31, 2026. Texas section 503.001 was amended by HB 149, effective January 1, 2026, and statutes can change again.
| Question | Texas (Bus. & Com. Code 503.001) | Washington (RCW chapter 19.375) |
|---|---|---|
| What the law calls the data | Biometric identifier includes a voiceprint, among other items. Source, Oct 31, 2026 | Biometric identifier is data generated by automatic measurements of biological characteristics, such as a voiceprint, that is used to identify a specific individual. It does not include a photograph, or a video or audio recording or data generated from them. Source, Oct 31, 2026 |
| What triggers the duty | Capturing a biometric identifier of an individual for a commercial purpose. Source, Oct 31, 2026 | Enrolling a biometric identifier in a database for a commercial purpose. Source, Oct 31, 2026 |
| What you must do first | Inform the individual before capture and receive their consent. Source, Oct 31, 2026 | Provide notice, obtain consent, or provide a mechanism to prevent later commercial use of the identifier. Source, Oct 31, 2026 |
| Penalty as published | Civil penalty of not more than $25,000 for each violation. Source, Oct 31, 2026 | A violation is an unfair or deceptive act under the Consumer Protection Act. The pages we read give no dollar figure. Source, Oct 31, 2026 |
| Who enforces | The attorney general may bring an action to recover the civil penalty. Source, Oct 31, 2026 | May be enforced solely by the attorney general under the Consumer Protection Act. We saw no private right of action in the text. Source, Oct 31, 2026 |
The Texas amendment also adds exceptions. Subsection (e)(2) says the section does not apply to the training, processing or storage of biometric identifiers involved in developing, training, evaluating, disseminating or otherwise offering artificial intelligence models or systems, unless a system is used or deployed for the purpose of uniquely identifying a specific individual (source, as of October 31, 2026). Subsection (e) contains other exceptions that we have not analyzed here. Read the full text with counsel.
Statutory ceiling, as a formula
The only computable number in the sources is the Texas ceiling. Formula: maximum civil penalty exposure = V × $25,000, where V is the number of violations. How a court or the attorney general would count one violation is not settled in the sources we read, so V is a variable your lawyer sets. It could be one per person, one per capture or something else. We give no worked example, because any number we chose for V would be a guess. Source: Texas statute text, as of October 31, 2026. The statute says "not more than", so $25,000 is a ceiling and not a typical amount.
Which voice features sit closest to the statutes?
This table is an engineering sort of voice features by how close they sit to the quoted definitions. It is not a legal classification. The last column lists what to prepare for the counsel conversation. Statute text as of October 31, 2026 (Texas, Washington).
| Design | What the quoted text says | What to prepare |
|---|---|---|
| Raw audio recorded and sent to a transcription service, no speaker-linked data kept | Washington: its definition excludes audio recordings and data generated from them. Texas: the definition sentence has no such exclusion, so ask counsel whether capture of the recording alone is in scope. | Notice and consent text that matches what you really record. Retention limit for the audio. |
| Diarization labels (Speaker 1, Speaker 2) that reset every session | Statute text does not settle it. No stored template links the label to a person, which is the question to put to counsel. | A written description of exactly what is stored, for how long, and whether labels can ever be linked across sessions. |
| Wake word detection that only checks the phrase, with no speaker check | Statute text does not settle it. The detector decides whether the phrase was said and does not need to say whose voice it was. | Confirm in firmware and logs that no speaker embedding is computed or stored. |
| Speaker verification or a named voice profile (enrollment: "this is Maria") | This is the design whose data flow matches the phrases in the statute text: a voice template tied to a person sits next to Washington's "enroll a biometric identifier in a database" and the Texas wording about a system "used or deployed for the purpose of uniquely identifying a specific individual". That match is an engineering reading for counsel to confirm, not a legal conclusion. | Texas text requires informing the individual and receiving consent before capture. Washington text requires notice, consent, or a mechanism to prevent later commercial use before enrollment. Ask counsel which applies and whether a withdrawal flow is needed. |
Which states do you ship to?
Work through this list once per state you sell into. It sorts states by whether this page has quoted text for them. It does not say what any state requires of your product.
- Texas: read the capture and consent wording in the table above, and the Texas (e)(2) wording on AI systems. Put your data flow in front of counsel against those sentences.
- Washington: read the enrollment wording and the audio recording exclusion in the table above. Put your data flow in front of counsel against those sentences.
- Any other state, including Illinois: this page quotes nothing for it. Read that state's statute from a primary source and ask counsel before you sell there.
What are the pitfalls?
These points follow from the statute text above. They are engineering reasoning, not accounts of any company's real incident, and they are not legal conclusions.
- The recording and the template are different objects. Washington's definition excludes audio recordings and data generated from them, but lists voiceprint. A pipeline that turns a recording into a speaker embedding creates the second kind of object. Check whether yours does (source).
- An AI exception in Texas has a limit. The (e)(2) exception stops applying when a system is used to uniquely identify a specific individual. A feature that names the speaker is the case that sentence points at (source).
- Texas looks at capture and Washington at enrollment. Consent given after the first capture is later than the Texas text says: inform and receive consent before capture. Washington asks for notice, consent or a mechanism to prevent later use before enrollment in a database (Texas, Washington).
- Deletion needs a timer. Texas text sets destruction no later than one year after the purpose of collection expires. Backups and cloud copies need to be on that same clock (source).
- The unit of penalty is unclear. Texas states $25,000 for each violation and the sources we read do not define the unit. Do not assume one enrollment equals one violation.
- A statute can change under you. The Texas section changed effective January 1, 2026. Record the date you checked the text and re-check before each release.
- Settings can undo a good design. If a firmware update, a companion app or a cloud feature starts storing a per-person voice profile that the original design did not, the review above no longer matches the product.
What should you test on your own board?
The legal question belongs to counsel. The facts counsel needs come from your hardware and backend. Run each test on production-like firmware and report the inventory, not a legal opinion. We have not run these on your product, and this page reports no results.
| Measure | How | Where to set the pass line |
|---|---|---|
| What the device and cloud store | Capture every outbound request and every file written on the device and in your backend during a scripted session. List each field. Mark any embedding, template or per-person profile. | Pass line is yours to set from counsel's advice: the inventory must match the data map you gave counsel, with zero unlisted voice-derived fields. |
| Whether labels link across sessions | Run the same speaker through several sessions on a device. Compare the diarization label or embedding ID for each session. | If a stable ID appears, treat the design as a stored voice template and review it as such. If IDs differ every session, record that as an observation for counsel. |
| Whether wake word runs speaker checks | Inspect the model files and runtime logs for speaker embeddings. Test with several voices saying the wake phrase and confirm the output has no person-level field. | Pass line: no per-person output in logs or storage. The team owns this one because it is a pure engineering fact. |
| Consent before first capture | With a fresh device, trace the first-run flow and log the timestamp of the consent action and of the first microphone capture or enrollment. | Consent timestamp must come before capture in every run. Decide the number of runs from your release process. |
| Withdrawal and deletion | Enroll a test profile, withdraw, then search device storage, backend storage and backups for any voice-derived data. | Zero remaining records at the time limit your counsel sets. Texas text says destruction is due no later than one year after the collection purpose expires, so check that limit against yours. |
| On-device versus cloud processing | Switch the product between on-device and cloud processing, then repeat the storage inventory. | Record where each voice-derived field lives in each mode so counsel can see both. |
What should you ask before you commit?
Take this list to your counsel, your firmware team or any team building the product for you, including us.
- Does the product ever store a voice template, embedding or per-person profile, on the device or in the cloud?
- Does any feature say who is speaking, or does it only separate speakers?
- Which states will you sell into, and has a lawyer reviewed each state's biometric statute, including Illinois?
- When does the user see notice and give consent, relative to the first capture or enrollment?
- How does a user withdraw, and what is deleted on the device, in the backend and in backups?
- What is the retention clock, and who owns the timer?
- Who else in the pipeline touches voice data, and what do their terms say about it?
- Who watches for statute changes, and how often is the review repeated?
Questions about voiceprints and biometric privacy laws
Is a recording of someone talking a voiceprint?
The statutes we read treat them differently. Washington's definition of biometric identifier lists voiceprint and says it does not include an audio recording or data generated from one. Texas lists voiceprint in its definition, and the sentence we captured has no recording exclusion. Whether a stored recording alone counts under Texas is a question for your lawyer. As of October 31, 2026. RCW 19.375.010, Tex. Bus. & Com. Code 503.001.
Does anonymous speaker labeling (Speaker 1, Speaker 2) trigger these laws?
The statute text does not answer this directly. Both statutes are about a biometric identifier tied to identifying a specific individual or to capture or enrollment. Labels that reset with every recording and never link to a person are a different design from a stored template that names someone. Where your design falls is a legal question, so put the exact data flow in front of counsel. This is the engineering team's reading, not legal advice.
What does Texas say about AI systems?
Texas amended section 503.001 through HB 149, effective January 1, 2026. Subsection (e)(2) says the section does not apply to the training, processing or storage of biometric identifiers involved in developing, training, evaluating, disseminating or otherwise offering AI models or systems, unless a system is used or deployed to uniquely identify a specific individual. A feature that recognizes who is speaking sits next to that exception, so review it with counsel. As of October 31, 2026. Texas statute text.
Who enforces the Texas and Washington rules?
Texas: the statute says the attorney general may bring an action to recover the civil penalty, up to $25,000 for each violation. Washington: RCW 19.375.030 says the chapter may be enforced solely by the attorney general under the Consumer Protection Act. We did not retrieve Illinois text, so we make no statement about who can sue there. As of October 31, 2026. Texas, Washington.
Does this page tell me my device is compliant?
No. It restates statute text, links to it and lists engineering questions. It does not apply the law to your product and does not predict how any court or regulator would read it. Have a lawyer who handles privacy law confirm each point, and re-read the statutes before launch because they change.
Scoping a voice product and want the data flow mapped before you brief counsel? Tell us about your device. For how the engineering gates run, see our engineering approach.
Primary sources
All pages below were accessed on 2026-10-31. Statutes change, so confirm text on the live pages. This is not legal advice.
- Texas Business & Commerce Code, section 503.001 (tcss.legis.texas.gov), accessed 2026-10-31.
- RCW 19.375.010, Definitions (app.leg.wa.gov), accessed 2026-10-31.
- RCW 19.375.020, Enrollment of biometric identifiers (app.leg.wa.gov), accessed 2026-10-31.
- RCW 19.375.030, Enforcement (app.leg.wa.gov), accessed 2026-10-31.
Planning a device like this? Tell us what it needs to do. A Duobay engineer replies within 1 business day. Send a project brief →