The question teams actually ask is not "is voice cloning legal" but "what do we need in place before we ship this". The answer is that no single statute governs voice cloning. A commercial voice project can touch right of publicity, biometric privacy, data protection, contract law, consumer protection and AI transparency rules simultaneously, and which ones apply depends on whose voice it is, where they live, where you operate and what the synthetic voice will say.
What follows is the 2026 landscape for the jurisdictions most voice AI teams operate in, and then the part that does the actual work: what a voice consent document has to contain to survive contact with any of them. This is general information for planning purposes, not legal advice, and the status of pending legislation changes.
The short version
A speaker's documented permission matters, but it does not by itself settle copyright in a recording, contractual limits, data-protection duties or restrictions on generated output. Assess those issues for the actual person, source material, purpose and jurisdictions rather than treating a signed release as a general legal clearance.
Keep the input and output assessments separate: which recordings and uses are permitted, who controls personal-data processing, and which disclosure or marking duties apply to the system and its output. Obtain project-specific advice where the applicable rights or duties are uncertain.
United States: a state-by-state patchwork
Right of publicity, including the old cases that still bite
Most US states recognise a right of publicity, and several name voice explicitly. California Civil Code § 3344 has covered voice alongside name, signature, photograph and likeness for decades.
Two Ninth Circuit cases matter more than their age suggests, because both involved imitation rather than copying. In Midler v. Ford Motor Co. (1988), Ford hired a backup singer to imitate Bette Midler for an advertisement after Midler declined. In Waits v. Frito-Lay (1992), a sound-alike was used for a Doritos advertisement, and Tom Waits was awarded a multi-million dollar verdict. Neither defendant used the artist’s recordings at all. The relevance to voice cloning is direct: a model trained on somebody else’s data that nevertheless produces a recognisable imitation of a distinctive professional voice is squarely in the territory these cases created.
Tennessee’s ELVIS Act
Tennessee's Governor signed the Ensuring Likeness Voice and Image Security Act on 21 March 2024. The official signing announcement describes adding voice to the state's personal-rights protections to address unauthorized AI cloning and impersonation. Check the statute's actual elements, exceptions and remedies for the proposed use rather than assuming all synthetic speech is covered in the same way.
California AB 2602 and AB 1836
Signed in September 2024, these are the two provisions most likely to invalidate a contract you already have.
AB 2602 addresses specified contract provisions allowing a digital replica of a person's voice or likeness. The California Governor's official summary describes intended-use specificity and absent legal or union representation as combined conditions, subject to the law's scope. Do not treat a broad release, a specific-use clause or representation alone as a universal answer; have the actual agreement assessed under the provision and its exceptions.
AB 1836 addresses digital replicas of a deceased personality's voice or likeness in expressive audiovisual works or sound recordings without the specified prior consent, subject to exceptions. The California Senate Judiciary analysis summarizes the enacted law and its damages provision; assess its actual scope rather than assuming every use or remedy is identical.
The NO FAKES Act: still a bill
The NO FAKES Act of 2026, S. 4591, is proposed federal legislation concerning digital replicas of voice and visual likeness. The Senate Judiciary Committee's 18 June 2026 results record a favorable voice vote on a substitute, with the manager's amendment adopted by unanimous consent.
As checked on 15 October 2026, the official sponsor listing shows Senate calendar placement, not enactment. The 30 September Congressional Record also records an objection to a request for immediate passage. Treat proposed terms as proposals and re-check the official bill status before relying on a federal digital-replica right.
Biometric privacy, and a distinction teams get wrong
Illinois’ Biometric Information Privacy Act names "voiceprint" explicitly, requires written notice and release before collection, and carries a private right of action with statutory damages, which is why it generates the litigation it does. Texas and Washington have comparable statutes without the same private right of action.
Under the GDPR the distinction is sharper than most summaries allow. Article 4(14) defines biometric data as data resulting from specific technical processing allowing or confirming the unique identification of a person. A recording can be personal data when it relates to an identified or identifiable person, consistent with the European Commission's explanation. Whether technical processing produces biometric data, and whether Article 9 applies to its use for unique identification, are separate questions.
Assess the actual processing rather than deciding from the product label "TTS" or "verification" alone. The EDPB's voice-assistant guidance distinguishes voice processing from biometric identification and describes the additional requirements for identification uses. Document the purpose, technical processing, lawful basis and any applicable Article 9 condition. Our speech data licensing guide covers the contract and records side.
EU AI Act Article 50: now in force
Article 50’s transparency obligations have applied since 2 August 2026, and they attach to the output rather than the training data.
- Providers of systems generating synthetic audio must mark outputs in a machine-readable format detectable as artificially generated. The Commission's Article 50 FAQ specifies a limited 2 December 2026 deadline for the Article 50(2) marking and detection obligations of qualifying systems placed on the market before 2 August 2026.
- Deployers generating deepfake content, meaning audio resembling a real person, must disclose that it is artificially generated. The Commission’s draft guidelines of 8 May 2026 indicate this applies even without intent to deceive.
The official Article 50 text distinguishes provider marking duties from deployer disclosure duties, with scope and exceptions that need checking for the actual system and content. Speaker permission does not by itself settle those duties; a generic disclosure placed somewhere on a site is not a substitute for assessing the required timing and form. The EU AI Act and speech data guide covers the obligations attaching to training data and governance.
Elsewhere, briefly
United Kingdom. No standalone right of publicity. Protection runs through passing off, UK GDPR and, for well-known voices, trade mark and advertising rules. The practical driver is UK GDPR plus contract.
Denmark. The Danish government has advanced an amendment to copyright law giving people a copyright-style right over their own likeness and voice against deepfakes, an unusual approach in Europe and one worth watching if you operate in the Nordics.
China. The deep synthesis provisions require consent from the subject whose voice or likeness is synthesised, plus conspicuous labelling of synthetic output. A Beijing Internet Court decision in 2024 found for a voice actor whose recordings were used to build a TTS voice without permission.
Union agreements. Not law, but binding where they apply: SAG-AFTRA’s television, theatrical and interactive media agreements require consent and compensation for digital replicas. If your speakers are union members, the agreement may impose more than the statute does.
What a valid voice consent actually contains
The following fields are a discussion checklist for the actual agreement. Including them does not establish compliance with every applicable law, and a recording licence, data-protection consent and synthetic-voice permission should not be treated as interchangeable.
| Clause | What it has to say | Why |
|---|---|---|
| Synthetic-voice grant | That a model may be trained on the recordings to generate new speech, named explicitly and separately from the recording licence | The single most common gap. A session release does not imply it. |
| Specific intended uses | Products, contexts and categories of content the voice will speak in | Intended-use specificity is one of the conditions assessed under California AB 2602 |
| Prohibited uses | Named exclusions: political content, adult content, endorsements, defamatory speech, whatever the speaker will not agree to | Protects the speaker and is the clause that keeps them willing to come back |
| Territory and term | Where, for how long, and what happens at expiry to both the model and the recordings | Open-ended grants attract scrutiny and are what speakers most often later dispute |
| Compensation | The basis: session fee, usage-based, buyout, or a combination, stated plainly | Union agreements require it and unpaid replicas are the industry’s live grievance |
| Sublicensing and transfer | Whether the voice can move to a parent company, an acquirer, or a customer | Decides what happens to the voice in an acquisition, which nobody thinks about until it happens |
| Withdrawal | What the speaker can revoke, what that obliges you to do, and what is not reversible | GDPR consent is withdrawable; be honest that a trained model cannot always be unbaked |
| Retention and deletion | How long recordings, embeddings and checkpoints are kept, and how deletion is evidenced | Data protection duties attach to the derivatives, not only the WAV files |
| Disclosure | That outputs may be marked and labelled as synthetic | Article 50 requires it; agreeing it up front avoids renegotiation later |
Two failure modes are worth naming because they are so common. Retro-fitting: collecting first and papering it afterwards does not cure the original processing, and a speaker who has since become unreachable cannot sign anything. Consent inherited through a vendor: if a supplier collected the audio, the grant has to reach you, and it has to cover what you specifically intend to do. Ask to see the actual speaker-facing document, not a summary of it. The buying AI training data guide covers that diligence more broadly.
A pre-launch checklist
- Signed consent naming the synthetic-voice grant, specific uses, prohibited uses, territory, term and compensation, for every speaker in the training set.
- A documented lawful basis, and a decision on record about whether Article 9 applies to what you are building.
- Output watermarking and a disclosure surface, if you serve EU users.
- A retention and deletion schedule covering recordings, embeddings and model checkpoints.
- Evidence of the source chain for any licensed or vendor-supplied audio, including the speaker-facing consent text.
- A named owner for re-checking status of pending legislation, NO FAKES foremost.
