Christine McGoveran v. Amazon Web Services Inc

── Christine McGoveran v. Amazon Web Services Inc ── Court: Court of Appeals for the Third Circuit Date: May 12, 2026 Category: General U.S. COURT OF APPEALS FOR THE THIRD CIRCUIT No. 24-3215 CHRISTINE MCGOVERAN; JOSEPH VALENTINE; AMELIA RODRIGUEZ; RICHARD DRESSER; FRED SPAGAT; DONNA WINANDY; MICHELLE WHALEN; STEVEN TALMONTAS; ALIKI MARINOS; JEFFREY WHALEN; TRACI THOMPSON; ROBERT RITTER, on behalf of themselves and all other persons similarly situated, known and unknown, Appellants v. AMAZON WEB SERVICES, INC.; PINDROP SECURITY, INC. _____________________________ Appeal from the U.S. District Court, D. Del. Judge Stephanos Bibas, No. 1:20-cv-01399 Before: PORTER, MONTGOMERY-REEVES, and BOVE, Circuit Judges Submitted Apr. 7, 2026; Decided May 12, 2026 _____________________________ OPINION OF THE COURT PORTER, Circuit Judge. Plaintiffs are Illinois citizens who called the financial services company John Hancock, which routed their calls through Amazon Connect, a product of Amazon Web Services. Pindrop Security then used cloud-based biometric technology to authenticate those callers using their voiceprints. They allege that Amazon and Pindrop violated the Illinois Biometric Information Privacy Act, 740 ILCS 14/1 et seq. (“BIPA”), by collecting the callers’ biometric voiceprints without consent. On appeal, Plaintiffs challenge the District Court’s resolution of several dispositive motions, discovery motions, and a volun- tary dismissal motion. For the reasons below, we will affirm the District Court. I A BIPA is a 2008 Illinois law that protects consumer bio- metric data, subject to exemptions for certain industries. Designed to address “[t]he use of biometrics” in “financial transactions and security screenings,” BIPA “regulat[es] the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information” by private entities in Illinois.1 Id. 14/5(a), (g). Section 15(a) requires applicable private entities to “develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers 1 “Biometric identifier” and “biometric information” are terms of art defined by BIPA. See 740 ILCS 14/10. “Biometrics” and “biometric data” are broader terms that encompass both biometric identifiers and information. See id. 14/5(a). 2 and biometric information.” 14/15(a). These private entities may not “collect” biometric data without first getting written informed consent. 14/15(b). They also may not “sell, lease, trade, or otherwise profit from” biometric data. 14/15(c). Nor may they “disclose, redisclose, or otherwise disseminate a per- son’s or a customer’s biometric identifier or biometric infor- mation.” 14/15(d). Section 25(c) exempts from BIPA any “financial institution that is subject to Title V of the federal Gramm-Leach-Bliley Act of 1999 [and its associated regula- tions].” 14/25(c). B In 2019, Plaintiffs filed a putative class action lawsuit against Amazon in Illinois state court, alleging violations of BIPA Sections 15(a)–(d). They allege that Plaintiffs individu- ally called John Hancock to discuss their retirement accounts, and that John Hancock routed the calls through Amazon for processing. In turn, Amazon employed technology from Pindrop to authenticate the callers using their voiceprints. Amazon’s voiceprint authentication, according to Plaintiffs, occurred without their consent, in violation of BIPA. Amazon removed the case to federal court, and the United States District Court for the Southern District of Illinois dismissed it for lack of personal jurisdiction because the only activity occurring in Illinois was Plaintiffs’ use of their phones. McGoveran v. Amazon Web Servs