Walmart's AI Voice System Allegedly Collected Illinois Callers' Biometric Voiceprints Without Consent

A proposed class action alleges that Walmart's AI voice system captured biometric voiceprints from Illinois residents who called local stores without first obtaining meaningful consent or explaining how the biometric data would be retained and deleted. Plaintiff Amber Smith said the system captured her voiceprint during two calls in December 2025 and one in July 2026.

Risk classification

• Primary risk domain: 2 Privacy & Security
• Primary risk subdomain: 2.1 Compromise of privacy by obtaining, leaking or correctly inferring sensitive information

The incident involves an AI system capturing and storing sensitive, non-public biometric voiceprints of callers without their explicit consent or knowledge.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The privacy risk was caused by Walmart's intentional corporate decision to deploy the AI voice system to collect biometric data without obtaining proper user consent.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The system is an automated AI voice assistant (chatbot) which carries transparency obligations to inform users they are interacting with an AI, which Walmart allegedly failed to do.

AI system and alleged parties

• AI system: Walmart AI voice system
• AI purpose: AI Voice Assistant; Voice Recognition
• Behaviour type: Assistant
• Alleged developer: Biometric identity verification technology developers
• Alleged deployer: Walmart
• Alleged harmed parties: Walmart customers, Privacy, General public of Illinois, General public, Biometric data subjects, Amber Smith

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Substantial. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Substantial, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Privacy

Reported: The report explicitly describes privacy violations concerning the unlawful collection and storage of biometric voiceprints without consent.

Directly caused: Walmart's AI voice system captured and stored the biometric voiceprints of Illinois consumers who called their stores without providing proper notice or obtaining consent, violating BIPA.

Inferred additional harm: It is likely that thousands of Illinois residents had their biometric voiceprints unlawfully collected and stored by Walmart's system without their knowledge.

People affected

• Occurrences reported: 1
• People reportedly harmed: 1
• People reportedly exposed: 1

Potential causes

Management

• Prioritizing Fraud Reduction: Management deployed the AI voice system to reduce fraud without compliance.
• Inadequate Risk Assessment: Failure to properly assess legal risks of biometric data collection.

Technology

• Automated AI Voice System: AI system automatically captures and processes voice data during phone calls.
• Voiceprint Extraction Tech: Technology extracts unique biometric voiceprints from user speech.

Data Inputs

• Biometric Voiceprint Data: Sensitive biometric identifiers are collected directly from caller audio.
• Unfiltered Voice Capture: System captures voice data without pre-filtering for biometric consent.

Human Factors

• Unaware Consumers: Callers are unaware that their voiceprints are being captured and stored.
• Involuntary Data Surrender: Customers are forced to unknowingly surrender private biometric data.

Process and Methods

• Inadequate Disclosure Process: Privacy policy disclosure is insufficient for proper notice and consent.
• No Consent Mechanism: System lacks a process to obtain active consent before voice collection.
• Missing Retention Schedule: No written policy exists detailing the retention and deletion of voiceprints.

Regulatory Environment

• Strict BIPA Requirements: Illinois law mandates strict notice, consent, and retention schedules.
• Inadequate Legal Compliance: Walmart's practices failed to comply with state biometric privacy laws.

Information quality

• Classification confidence: High
• Reason for confidence: The legal complaint clearly outlines the mechanism of the AI voice system, the specific biometric data collected, and the regulatory framework (BIPA) being violated. There is little ambiguity regarding the core privacy allegations.
• Ambiguities identified: The exact technical specifications of the AI voice system and the precise number of affected callers are not detailed.

Walmart faces a class action lawsuit in Illinois for allegedly collecting customer biometric voiceprints without proper consent via its AI customer service voice system. The incident represents a domestic corporate privacy and regulatory compliance issue with negligible implications for national security.

• Overall national security impact: Minor
• Scope: Single nation
• Primary target: United States
• Alleged perpetrator: Walmart

Threat characteristics

• Imminence: Long-term. The issue is a slow-moving legal class action lawsuit regarding corporate data practices rather than an active, fast-escalating national security crisis.
• Autonomy: Human-supervised. The AI voice system operates automatically to process customer calls and collect data, but under the strict operational parameters and oversight of Walmart.
• Novelty: Established threat. Lawsuits under the Illinois Biometric Information Privacy Act (BIPA) regarding unauthorized corporate biometric collection are highly common and established.

Impact by dimension

• Physical security: Negligible. No physical threats, kinetic attacks, or critical infrastructure compromise are reported or indicated in the incident details.
• Information security: Negligible. No information warfare, state-sponsored intelligence compromise, or systematic disinformation campaigns are associated with this incident.
• Sovereignty: Negligible. The incident does not impact state authority, electoral processes, or core government functions, remaining a domestic corporate legal dispute.
• Economic security: Negligible. While involving potential liabilities for a major retailer, the incident does not threaten national economic stability, strategic industries, or tech competitive advantage.
• Societal stability: Minor. Involves unauthorized biometric data collection of Illinois citizens, raising localized privacy and civil rights concerns under BIPA, but lacks national-scale societal disruption.