In Cisneros v. Nuance Communications, Inc., Case No. 24-2982 (7th Cir. August 28, 2026), the Plaintiff filed a lawsuit alleging violations of the Illinois Biometric Information Privacy Act (BIPA) after her financial planning institution contracted with a third party, Nuance, to provide voice-ID technology. Plaintiff alleged that the defendant contractor did not obtain the written consent required under the Act. The district court granted summary judgment on the pleadings to defendant and plaintiff appealed.
BIPA Section 25(c) exempts financial institutions that are subject to the federal Gramm-Leach-Bliley Act (GLBA). While Charles Schwab is a financial institution, Nuance is a technology vendor. The Seventh Circuit held that third-party technology vendors providing authentication services to financial institutions are protected by the financial exemption under BIPA. It affirmed the lower court’s dismissal, noting that the statutory exemption extends to service providers whose authentication work is directly integrated into and tied to a financial institution’s operations. The Seventh Circuit thus affirmed, finding that defendant was exempt from the requirements of the Act.
The plaintiff did not sue the company itself, recognizing it was exempt under GLBA. She argued, instead, that the exemption should not extend to the financial institution’s vendor. The court disagreed. It found that Nuance was confirming identity as part of a proper banking activity, and as such was engaging in a GLBA activity. As such, its activities were subject to the GLBA exemption. The court pointed to a similar conclusion reached by the Third Circuit. The decision prevents a major workaround to BIPA’s financial exemption, confirming that plaintiffs cannot bypass the exemption by suing the vendor instead of the bank or broker-dealer.