Third Circuit Rules It Official: Pindrop Qualifies as a Financial Institution Under the Illinois Biometric Privacy Act

A precedential federal appellate opinion places Pindrop’s authentication services under the same federal regulatory framework as the financial institutions it protects — the first voice authentication technology company to receive that validation at the federal appellate level, giving banks and insurers greater clarity as they modernize authentication

ATLANTA, Aug. 19, 2026 (GLOBE NEWSWIRE) -- Pindrop, a global leader in voice security, deepfake detection and fraud prevention, today announced that the U.S. Court of Appeals for the Third Circuit has issued a precedential opinion, affirming that Pindrop qualifies as a “financial institution” under the Illinois Biometric Information Privacy Act (BIPA), which incorporates the definition of that term from the federal Gramm-Leach-Bliley Act (GLBA). The court held that voice authentication services supporting financial transactions are “financial activities” that exempt Pindrop from BIPA.

The opinion is precedential — binding legal authority, not a favorable outcome in a single case. Pindrop is the first voice authentication technology company to receive this validation at the federal appellate level.

What the Court Decided

The case arose under the Illinois Biometric Information Privacy Act, among the strictest biometric privacy laws in the country. BIPA requires consent before a company collects biometric data — including voiceprints — and can expose violators to significant class-action liability. Plaintiffs alleged that Pindrop violated BIPA by using their voiceprints to authenticate calls to John Hancock without first obtaining consent.

In a published, precedential opinion, the Third Circuit affirmed the dismissal of all claims against Pindrop. The court applied BIPA’s financial-institution exemption, which incorporates the definition of “financial institution” from the Gramm-Leach-Bliley Act. Because federal regulation treats authenticating the identity of persons conducting financial transactions as an activity closely related to banking, the court concluded that Pindrop’s authentication services are “financial activities” under GLBA’s regulations — and that Pindrop therefore qualifies as a financial institution exempt from BIPA.

Why It Matters for Financial Institutions

As banks and insurers confront increasingly sophisticated AI-generated voices, synthetic identity attacks and voice cloning, authentication has become foundational security infrastructure — not simply biometric data collection. For institutions modernizing authentication, the question is no longer only whether a technology can establish identity accurately, but whether the provider delivering it operates within a trusted regulatory framework. The Third Circuit’s opinion answers that question. Indeed, the district court decision affirmed by the Third Circuit held that Pindrop is a financial institution under GLBA and subject to its consumer privacy and security regulations.

Rather than operating adjacent to the financial services ecosystem, Pindrop operates within the same federal privacy and security framework that governs the institutions it protects. For compliance and legal teams evaluating authentication as part of broader fraud-prevention and identity-modernization initiatives, that alignment provides a definitive answer on the rules that govern their authentication infrastructure.

A Statement From Pindrop’s Chief Legal Officer

“The Third Circuit’s ruling reflects what Pindrop has built from the beginning. When Pindrop authenticates a voice for a financial transaction, that is not a technology service operating at the edge of financial services — the court confirmed it falls squarely within the federal framework governing financial activities. Pindrop operates under GLBA’s comprehensive privacy and security standards — the same standards our financial institution customers are bound by. For the compliance and legal teams at financial institutions making infrastructure decisions, that alignment is not incidental. That is the point. Our customers do not need to wonder what rules govern us. They already know — because they follow them too.”

— Clarissa Cerda, Chief Legal Officer, Pindrop

A Defining Moment for Authentication

As AI-generated voices grow more convincing, organizations face two questions at once: is the person requesting access the legitimate account holder and does the infrastructure making that determination operate within a trusted regulatory and security framework? Pindrop’s court-validated standing, combined with its purpose-built authentication and liveness detection, positions it to answer both.

Authentication built for regulated industries does not sit adjacent to the financial security framework. It operates inside it.

Learn More

Read Chief Legal Officer Clarissa Cerda’s perspective on the decision: “Authentication Is Financial Infrastructure”

About Pindrop

Pindrop provides the Real Human + Right Human™ Platform for the AI era. As AI-driven fraud and deepfakes erode trust in digital communication, Pindrop^® solutions deliver continuous identity verification and deepfake detection across voice, video and digital interactions in real time. Enterprises rely on Pindrop to secure billions of high-risk customer interactions each year, including some of the top 10 U.S. banks, leading insurers and healthcare providers. Powered by models trained on more than 5 billion real-world interactions and protected by 300+ patents, Pindrop restores trust while reducing fraud, lowering operational costs and improving customer experience. Recognized in 2026 as one of Time100’s Top 10 most influential software companies. Learn more at pindrop.com.

Media contact: media@pindrop.com

Note for media: The Third Circuit’s opinion in McGovern et al. v. Amazon Web Services, Inc., No. 24-3215, was issued May 12, 2026. Coverage was published by Law360 on May 12, 2026.