Voice Cloning Needs Consent, Not Just a Licence

Cloning a voice no longer requires a studio or a research team. GPT-SoVITS, an open model, clones a voice from a five-second sample and improves it with a minute of audio. The technical barrier is gone. What remains is the part that takes longer than five minutes: proving that the person whose voice you copied knew what you would do with it, and being able to show that proof two years later when a client, a donator or a regulator asks. "It was public on YouTube" is not that proof.

This is an explanation of how the rules work in the EU, not legal advice. Take it to a lawyer before you sign a consent form or publish audio.

What a voice is in law

A recording of a person speaking is personal data. GDPR Article 4(1) defines personal data as any information relating to an identified or identifiable natural person, and a voice identifies its owner about as reliably as a face.

There is a second, stricter category. Article 4(14) defines biometric data as personal data resulting from specific technical processing of physical, physiological or behavioural characteristics which allow or confirm unique identification. Article 9 then prohibits processing biometric data to uniquely identify someone unless a narrow exception applies, and the most usable exception is explicit consent for specified purposes. A raw interview file is ordinary personal data. A speaker embedding, the vector a cloning model extracts to represent timbre, is exactly the kind of specific technical processing the definition describes. Whether it counts as biometric data in law depends on what you do with it: a model used to recognise or verify speakers plainly falls under Article 9, while a model that only synthesises new speech leaves room for argument.

What consent has to contain

Consent is "any freely given, specific, informed and unambiguous indication" of a person's wishes, given by a statement or a clear affirmative action (Article 4(11)). Article 7 adds three rules that decide whether a form survives scrutiny. The controller must be able to demonstrate that consent was given. The person may withdraw at any time. Withdrawal must be as easy as giving consent, and it stops future processing without making the earlier processing unlawful.

A signature under a line that says "I agree to AI use of my voice" fails most of those tests. The form we would want in front of a donator names six things:

• Purpose. Narration of the company podcast and product videos, say, not "AI projects". A paid advertisement later is a new purpose and needs a new conversation.
• Scope. Languages, channels, territories, whether clients may use the output, and whether the donator's name is attached to it.
• Duration. A term with a review date. "Perpetual and worldwide" is difficult to call specific, and it turns the withdrawal clause into decoration.
• Withdrawal. How to do it, what stops and by when, and what happens to audio already published.
• Derivative models. The sentence most forms miss. If the donator withdraws, is the trained model deleted, retrained without them, or kept with its output blocked? Decide before training, not after a complaint.
• Money and pressure. Article 7(4) asks whether consent was tied to a service the person needed. An employee asked to lend their voice to the internal assistant is not in the same position as a freelancer paid a fee.

Consent is not the only lawful basis: a contract or a legitimate interest can fit better for some uses. But voice cloning is intrusive enough that explicit consent is the route that survives contact with a regulator, a client's procurement team and the donator's own second thoughts.

Internal narration and a published brand voice

An internal voice reads drafts, meeting summaries and documents that never leave the organisation. It is still personal data and still needs a basis, but the exposure is contained: the model sits on one machine and the audience is colleagues. The common mistake is treating employment as consent. It is not. Consent has to be freely given, and a request from the person who signs your pay review is hard to refuse.

A published voice is a different object. It becomes part of the brand, listeners attach it to a person, and the model turns into an asset that can leak, be copied by a contractor, or be used to say something the donator never said. That changes the contract. You need a defined term, a way out for both sides, a rule for what happens if the donator's public position changes, and a clear answer on who carries the cost of misuse. You also need the model somewhere you control. A local pipeline that never uploads the reference clip is easier to defend than a cloud clone whose retention terms you have not read.

What you owe the audience

Article 50 of the AI Act splits the transparency duty between two roles. Paragraph 2 applies to providers: systems that generate synthetic audio must mark their outputs in a machine-readable format and make them detectable as artificially generated or manipulated, using measures that are effective, interoperable, robust and reliable as far as technically feasible. Paragraph 4 applies to deployers: anyone who generates or manipulates audio amounting to a deepfake must disclose that the content was artificially generated or manipulated.

The definition matters here. Article 3(60) describes a deepfake as AI-generated or manipulated audio that resembles existing persons and that a person would mistake for genuine. A clone of a real donator fits, and the donator's consent does not remove the duty. Consent answers the data protection question. It does not answer the transparency question, which belongs to the audience rather than to the person copied.

Timing: the European Commission's AI Act timeline puts the transparency rules in effect in August 2026, as part of the Act's general application from 2 August 2026. If you publish synthetic audio now, the duty is live.

Which role you occupy depends on what you ship. Running an open model on your own machine and publishing the audio makes you a deployer. Putting the generator in front of clients under your name moves you towards the provider definition in Article 3(3), and paragraph 2 comes with it.

In practice, disclosure belongs in the audio, not only in a footer. A spoken line at the start, or a consistent tag at the end, does more than a sentence buried in a description. Put the same sentence in the show notes, the video description and the file metadata. Machine-readable marking for audio is still uneven across tools, so your own register may be the only complete record of what was generated. And note the shape of the artistic exception: for evidently creative or satirical works, paragraph 4 limits how the disclosure is made, not whether it is made.

The record that answers the question

Four artefacts cover almost every question that arrives later.

• A signed consent form. Versioned, with the exact purpose wording and the date, stored next to the model rather than in a shared drive nobody opens. When the wording changes, the old version stays.
• The source recordings. Keep the original files with a SHA-256 hash and the date of capture, so you can prove which file the model was trained on. Not only the cleaned training set: the original, unedited clip.
• A model register. One row per model, not per project: model identifier, donator identifier, base checkpoint and its licence, training date, hash of the reference clip, who trained it, and which outputs used it.
• A deletion procedure. Who can trigger it, what gets deleted in what order, what happens to backups, who signs off, what the donator is told, and what happens when the model cannot be fully cleaned.

The hash is not bureaucracy. If a donator later says "that is not my voice" or "you used a different recording", the hash settles it. If a client asks whether the voice in an advertisement was authorised, the register answers in a minute.

The part nobody can promise

A trained model does not keep the clip. It keeps weights shaped by it, and there is no reliable way to subtract one voice from those weights. You can retrain without the donator, which costs you the model. You can apply unlearning, which is research-grade and comes without a guarantee. Or you can keep the model and block its use, which is a promise about behaviour rather than about data.

The EDPB has been explicit that this ground is unsettled. Opinion 28/2024, adopted in December 2024, says models trained on personal data cannot in all cases be considered anonymous, and that anonymity requires it to be very unlikely that personal data can be extracted, directly or through queries. A voice clone fails that test by design, because reproducing the voice is the product. The same opinion, discussing remedies for unlawfully processed data, lists erasing part of the dataset or, where that is not possible, erasing the whole model, and refers to post-training techniques that attempt to remove personal data. Attempt is the operative word. The regulator is describing a limit, not a solution.

The honest contract clause follows from that. Withdrawal stops use immediately. Deletion of the source recordings and the register entry happens on a stated timeline. Deletion of the model happens if the donator asks and you can do it. Where the model cannot be cleaned, you delete it rather than keep it. That last sentence is expensive, which is the point: it prices the irreversibility into the decision at the start instead of discovering it during a dispute.

Who you agree to clone

If a model may not be erasable, the question before training is who can carry that risk. Clone people who can renegotiate: a freelancer with a contract, a founder who understands the terms, a client who asked for the clone in writing. Be careful with people who cannot. An employee who depends on you for income, a minor, a public figure whose voice you found online, the archive of someone deceased. In each of those cases the power to refuse is weak or absent, and consent stops being freely given. The deceased actor is the hardest version, because nobody can withdraw and the estate may not understand what it is licensing.

This is also where "it was public" collapses completely. Public availability tells you the file could be downloaded. It tells you nothing about whether the speaker agreed to a synthetic version of themselves saying new sentences in new contexts, forever, in languages they do not speak.

Where this leaves us

We run VoiceSynth Studio locally, for the practical reason that a cloning pipeline which never uploads its reference clip is one less place for a consent record to go missing. If you are putting audio into a product, the paperwork is part of the feature: it is what lets you answer a client's security questionnaire and a donator's email without reconstructing history from memory. For the wider obligations, see what the AI Act asks of a small business and our comparison of local TTS engines.