New Appellate Opinion in Amazon Biometric Data Case May Signal ‘Narrowing’ Scope of BIPA Litigation, Experts Say

The U.S. Court of Appeals for the Third Circuit recently affirmed a win for Amazon Web Services (AWS), upholding the dismissal of a proposed class action under the Illinois Biometric Information Privacy Act (BIPA). The case centered on claims that AWS and Pindrop Security unlawfully collected users’ voiceprints through cloud-based authentication technology, but the court found that key limitations—including BIPA’s financial-institution exemption and the doctrine of extraterritoriality—barred the claims. 

The court agreed that Pindrop’s services qualified for the statute’s financial-institution exemption and determined that BIPA did not apply because the relevant data processing occurred outside Illinois. This reflects a broader trend of courts narrowing the scope of BIPA litigation, particularly in cases involving nationwide technology providers. 

Finnegan partner Lynn Parker Dupree said the decision provides practical guidance for companies navigating compliance obligations. “This provides a framework for the tech industry to build a compliance program that ensures that they're not directing their activities specifically towards activities in the state [of Illinois].” 

She also emphasized the importance of where data is processed in the court’s analysis. “So, in this instance, Amazon servers were in Virginia, they were processing the data there as opposed to Illinois, and that made a difference in the court's analysis,” she said. “They didn't then engage in any other activities that then redirected the nexus of activity back to Illinois.” 

She added, “I will say, this Third Circuit opinion gives greater clarity to the understanding of what is sufficient to have a connection to the state of Illinois. Having the Third Circuit weigh in here, I think, gives some clear direction on how these extraterritoriality adoptions should be interpreted." 

From a broader perspective, the ruling clarifies how courts evaluate connections to Illinois in BIPA cases and highlights how jurisdictional limits and statutory interpretation are increasingly shaping and restricting the reach of biometric privacy litigation.