This page explains the general legal landscape around voice cloning in the EU. It is not legal advice. Talk to your own counsel about your specific situation, especially before cloning anyone’s voice for commercial use.
Why consent is required
A voice identifies a person almost as reliably as a fingerprint, and the law treats it accordingly:- It’s personal data. Under the GDPR, a voice recording used to identify someone is biometric data — a special category under Article 9 that may not be processed without a clear legal basis, and in practice that basis is the person’s explicit consent.
- It’s protected by personality rights. In the EU and most other jurisdictions, a person has the right to decide whether their voice is recorded, published, or imitated. Cloning someone’s voice without permission can expose you to injunctions and damages, independent of GDPR.
- Performers have their own rights. If the voice belongs to a professional speaker, actor, or voice performer, their recordings are typically also covered by neighboring/performers’ rights — separate from the personality-rights protection above, and usually running for decades after the recording is made.
- Copyright doesn’t apply to the voice itself. Copyright protects a specific recording or performance, not the sound of a voice in the abstract — so it’s not a substitute for consent, and it doesn’t give you permission to clone a voice just because you own a recording of it.
What valid consent looks like
Consent that will hold up needs to be:Labelling AI-generated audio
Since August 2026, the EU AI Act requires that AI-generated or manipulated audio realistic enough to be mistaken for a real recording of a person — a “deepfake” — is disclosed as artificially generated. In practice, that means telling your customers or audience when they are hearing a cloned voice rather than the person themselves. Two narrow cases soften this: in evidently artistic, creative, satirical, or fictional work the disclosure only has to exist in a way that doesn’t spoil the piece, and the duty doesn’t apply where the use is authorised by law to detect, prevent, investigate, or prosecute criminal offences.Practical consent checklist
1
Get consent before you clone
Have the voice owner (or their guardian, for a minor) agree in writing to the specific purpose, product, and duration of use — before you create the clone, not after.
2
Document and store it safely
Keep the signed consent somewhere durable and access-controlled. You may need to produce it later.
3
Limit the purpose
Use the clone only for what was agreed. A new use case — a new product, a new market, a public campaign — needs its own consent.
4
Make withdrawal easy
Give the person a clear way to withdraw consent, and have a process ready to delete or deactivate the cloned voice when they do.
5
Label the output where required
If the audience could mistake the cloned voice for the real person, disclose that it’s AI-generated.