Before speaker verification existed, anyone holding a senior’s phone could ask Ellie about her private history, and anything they said was stored as her memory. The fix is to recognise her voice: if the speaker does not match, the reply includes no private memories and writes none.
It runs on our own machine, costs nothing per check, and no audio or voiceprint leaves the server for it. As a privacy control it is genuinely good. It also required us to start holding biometric data about elderly people, which is a sentence worth sitting with.
Asking an eighty-year-old to enrol
Deliberate enrolment means a settings screen, a passphrase and three recordings. For this audience that is three chances to give up. So there is a second path: she talks to Ellie, and after the service has heard the same person across three separate sessions, the voiceprint simply appears. No screen, nothing to learn.
It is also better data. Verification happens on ordinary conversation, so enrolling on ordinary conversation matches the condition — where three repetitions of one memorised sentence is the narrowest sample available.
Invisible is the problem
Illinois names "voiceprint" explicitly in its biometric privacy law. It requires written notice and a written release before collection, and a publicly published retention and destruction schedule. There is a private right of action attached to it.
The feature is designed to be invisible to the person it collects from. That is exactly the property the statute exists to prohibit.
We have the deletion half — a control that removes the voiceprint, the recordings behind it and the flags that depend on it, without touching the account. What we do not have is the consent step or the retention schedule, and we are not going to pretend the notice and the release are the same thing.
What we did about it
Wrote it down, on the public privacy policy, in the section about voice: that the voiceprint can be built from ordinary conversation, that there is no separate release, and that no retention schedule has been decided. A test now fails if any of those three admissions is quietly removed.
That does not make it compliant. It makes the gap published and specific instead of being a 404, which is the difference between a problem somebody can act on and one nobody can see. The compliant version needs a decision about retention, and a decision is not something a web page can make.