Most people think of Siri as a helpful voice that sets timers and plays music. A Cook County judge just cleared the way for as many as 3 million Apple device users in Illinois to be included in a class action lawsuit accusing Apple of violating Illinois' stringent biometrics privacy law by allegedly recording people using their Siri A.I. assistant for over a decade, putting potentially millions of dollars at stake.

On January 29, 2026, Judge Michael T. Mullen of the Cook County Circuit Court granted class certification in Zaluda v. Apple, clearing the way for what could become one of the largest biometric privacy lawsuits in U.S. history. The certified class includes all Illinois residents who used Siri on any Apple device since September 2014 — a group estimated at between 2.6 and 3.9 million people.

The case — originally filed in 2019 by Deborah Zaluda, Catherine Cooke, David Cooke, James Cooke, Lori Cooke, Savanna Cooke, and Paul Darby — allege that Apple violated Illinois' Biometric Information Privacy Act (BIPA). The law requires companies to obtain written authorization before collecting or storing biometric identifiers, maintain a publicly available data retention policy, and provide users with a right to know how their biometric data is used.

According to the complaint, Siri works by automatically computing what Apple internally calls "biometric feature vectors" from every user utterance. These feature vectors — derived from the raw audio of a person's voice — are capable of identifying a speaker. The process happens uniformly across all Apple devices, from iPhones to iPads to Macs, with no meaningful distinction in how the system captures and processes user voice data.

The plaintiffs argue that during the entire relevant class period, Apple's privacy policies for Siri users contained none of the disclosures BIPA requires. Apple, they allege, collected voiceprints without consent, failed to notify users about how long their data would be retained, and never provided a mechanism for users to access or request deletion of their biometric information.

Judge Mullen's certification order is notable for what it rejected. Apple argued that individual issues — differences in how users interacted with Siri, what device they used, and what data was actually captured — were too varied to support a class. The judge disagreed, finding that the technical process underlying Siri operates uniformly across all devices. Because the alleged BIPA violations stem from a common, automated process rather than individualized conduct, common legal questions predominate. The judge also concluded that a class action was the most efficient and fair method of adjudication, noting that requiring millions of individual BIPA lawsuits would impose an unreasonable burden on the court system.

BIPA has real financial teeth. Under the statute, prevailing plaintiffs can recover $1,000 for each negligent violation or $5,000 for each intentional or reckless violation plus attorneys' fees. The critical question for calculating exposure is what counts as a "violation." If each voice interaction constitutes a separate scan, the aggregate liability for a class of 3 million users could reach into the hundreds of billions of dollars.

The answer to that question is not yet settled. Illinois lawmakers amended BIPA in 2025 to clarify that violations should be counted as the first time a person's biometric data is captured, not each subsequent interaction. But courts have not definitively ruled on whether that amendment applies retroactively to suits filed before 2025 — meaning the case could still proceed under the older, per-scan interpretation if the courts so decide.

This case is separate from a federal class action Apple settled for $95 million in early 2025 over allegations that Siri accidentally captured private conversations. That case involved different legal theories and different remedies. The Illinois litigation focuses squarely on whether Siri's routine, intentional voice-processing constitutes a BIPA violation; a question the federal settlement never answered.

Similar BIPA-based suits have already reached Google (which settled for $68 million over Google Home) and Amazon (over Alexa). The class certification in Zaluda extends this pattern to Apple and sends a clear signal:

voice assistants are biometric data collection systems, and the companies operating them bear legal obligations under state privacy law.

For any organization that deploys voice-activated AI, whether in consumer products, enterprise software, or customer service applications, this case is a reminder that "passive listening" is not legally passive. Voice data processed by AI for identification or personalization purposes may trigger biometric privacy obligations regardless of how the technology is marketed.