Can a Company Use Your Voice or Face in AI Without Consent? EU and US Rights Compared
Can a Company Use Your Voice or Face in AI Without Consent?
EU and US rights compared — GDPR, ELVIS Act, EU AI Act Art. 50, California AB 2602, and New York digital replica law. Know what the law requires before your likeness becomes a dataset.
Your voice and face are biometric identifiers. When a company trains an AI model on recordings of you, synthesizes your voice, or generates images of your face, it is processing data that belongs to you — data that cannot be changed, cannot be reassigned, and once encoded into a generative model, cannot be meaningfully deleted. Whether that processing is lawful depends on where you are, who the company is, and what consent — if any — was ever obtained.
The legal landscape is fragmented but rapidly converging toward one answer: no, a company cannot use your voice or face in AI without your consent. GDPR has required explicit consent for biometric data processing since 2018. The US is catching up through state performer laws, biometric privacy statutes, and the pending NO FAKES Act. WCR Legal’s AI Likeness practice advises clients on both sides of the Atlantic across all active regimes.
The Legal Framework: 6 Laws That Govern Your Voice and Face in AI
Six active or imminent legal instruments create consent requirements, disclosure obligations, and enforcement rights around AI use of voice and likeness. Three are EU-origin, three are US-origin. Together they cover most professional and private individuals in either market.
Voiceprints, facial geometry, and other biometric data used to uniquely identify a natural person are special category data under GDPR Art. 9. Processing is prohibited unless one of ten narrow Art. 9(2) bases applies. The only practically available basis for commercial AI is explicit consent — specific, informed, opt-in, and revocable at any time. Legitimate interests cannot override the Art. 9 prohibition. GDPR applies extraterritorially under Art. 3: any company anywhere that processes the biometric data of EU residents is covered.
EU member states recognize personality rights protecting individuals from unauthorized commercial use of their name, voice, image, and likeness. Protection is strongest in Germany (allgemeines Persönlichkeitsrecht), France (droit à l’image), and Italy, but baseline protection exists across all member states. These rights operate in parallel with GDPR. AI-generated voice cloning or face synthesis that creates a recognizable association with a real person triggers these rights regardless of technical transformation. Moral rights components cannot be waived by contract in most EU jurisdictions.
Article 50 mandates machine-readable disclosure for AI-generated or AI-manipulated content including synthetic voice, face deepfakes, and any audio-visual media where a real person is shown saying or doing things they did not. Providers of AI systems generating such content must embed technical markers enabling automated detection. Deployers of emotion recognition or biometric categorization systems must inform individuals. This obligation applies independently of GDPR — a company can violate both simultaneously or comply with both simultaneously.
The ELVIS Act (signed March 2024, effective July 2024) creates a statutory property right protecting every individual — not only professional performers — against the unauthorized use of their voice or likeness in AI-generated content. Unlike traditional right of publicity statutes, ELVIS is not limited to commercial exploitation. Unauthorized AI vocal synthesis violates the Act regardless of purpose. Penalties include injunction, actual damages, or $500 per violation plus attorney’s fees. Platform liability for distributing AI-cloned content is explicitly included — not only the creator.
California AB 2602 (effective January 2024) voids any entertainment contract provision authorizing a company to create a digital replica of a performer’s voice or likeness using AI unless the performer had independent legal representation during negotiation. New York’s digital replica law (S9237-A, effective November 2024) extends protections to deceased performers’ estates for 70 years post-mortem and creates a private right of action for any New Yorker whose digital likeness is used in AI-generated content without consent. Both operate alongside right of publicity statutes and federal copyright.
The Nurture Originals, Foster Art, and Keep Entertainment Safe Act was reintroduced in 2024 and is pending in the US Senate. If enacted, it creates a federal property right in every individual’s voice and visual likeness against unauthorized AI-generated replicas, regardless of state. The bill includes a DMCA-style notice-and-takedown mechanism, a 10-year retroactive liability period, and minimum $5,000 per-violation damages. It would preempt state laws only to the extent they provide lesser protections — ELVIS Act and California AB 2602 would remain operative.
EU vs US: Six Parameters Compared
The two regimes differ in architecture but converge in outcome: unauthorized AI use of voice or face is increasingly unlawful in both jurisdictions. The key distinctions are where the obligation lies, what triggers it, and how enforcement works.
Your Rights Selector: Who Are You × Your Jurisdiction
Select who you are and your primary jurisdiction to see the specific rights and enforcement actions that apply to you. Nine result panels cover every combination.
You receive the strongest dual-layer protection available: GDPR Art. 9 special category consent requirements plus EU personality rights. Any company using your voice or face in AI without explicit, granular consent is in breach of both regimes simultaneously. Your rights are not contingent on professional performer status — they apply to any individual whose biometric data is processed.
Federal law is incomplete, but Tennessee’s ELVIS Act (July 2024) and California’s AB 2602 create meaningful performer-specific protections. If you are in Tennessee, any AI voice clone requires your consent — including non-commercial use. If you are in California, digital replica contracts in entertainment are voidable if you lacked independent legal counsel at signing.
You hold overlapping rights in two of the world’s strictest jurisdictions for AI likeness protection. GDPR Art. 9 protects you wherever your voice or face is processed by entities targeting EU residents. US performer laws protect you in Tennessee, California, and New York. Together they create a strong bi-jurisdictional enforcement position against any company operating in both markets.
You have full GDPR Art. 9 protection even without being a performer. If your employer or any company has used your voice recordings or photographs to train AI, create synthetic content, or build an avatar without explicit biometric consent, they are in breach of GDPR regardless of any employment contract provisions. An employment contract cannot substitute for GDPR Art. 9 consent.
US protection for non-performers is uneven. If you are in Illinois, BIPA protects any employee whose biometric data was collected without written notice and consent — including collection for AI training purposes. California and Washington provide limited protections. No federal law currently creates a general right against unauthorized AI use of your voice or face if you are not a performer in a covered state.
Cross-border exposure gives you parallel enforcement options. GDPR provides strong biometric consent and access rights wherever you are in the EU. In the US, BIPA (Illinois) is the most powerful individual protection currently available. Coordinating complaints across both regimes maximizes pressure on violating companies and creates concurrent enforcement obligations that are difficult for companies to manage.
If your AI product processes the voice or face of any EU resident, GDPR Art. 9 compliance is non-negotiable. You need explicit consent for each individual whose biometric data you process — including data embedded in training datasets. EU AI Act Art. 50 requires machine-readable labeling of all synthetic voice and face outputs starting 2 August 2026. Non-compliance exposes you to DPA fines of up to 4% of global annual turnover plus civil claims from data subjects.
US compliance obligations are state-law driven. If you collect biometric data from Illinois residents, BIPA applies regardless of your company’s location. If you use performer voices or likenesses in AI outputs, the ELVIS Act (TN), AB 2602 (CA), and NY digital replica laws create state-level consent and licensing requirements. The NO FAKES Act, if enacted, will create federal obligations applicable everywhere you operate.
Dual-jurisdiction compliance is the highest burden in this space. GDPR requires explicit biometric consent and DPIA across all EU data subjects. US state laws layer performer-specific protections and biometric consent requirements on top. An AI product with voice or face synthesis capability requires legal review in both jurisdictions before launch — retrofitting compliance post-launch is significantly more expensive than building it in.
If Your Voice or Face Was Used in AI Without Your Consent
Five steps to assess your position and enforce your rights. Sequence matters: documentation and jurisdiction identification come first — enforcement options depend on what you can prove and which laws apply to you.
No. Public availability of your voice does not constitute consent to its AI use. Under GDPR, processing a voiceprint for the purpose of identification is special category data processing under Art. 9 — it requires explicit consent regardless of whether the source recording was publicly accessible. Under the ELVIS Act (Tennessee), creating an AI-generated version of your voice without consent is unlawful regardless of the source material used. Publishing a song, podcast, or video does not grant any platform a license to clone your voice for AI synthesis purposes. The distinction between “publicly available” and “consented to AI use” is foundational to both regimes — courts and regulators treat them as entirely separate questions.
A valid consent instrument for AI biometric use must: (1) be separate from general terms of service — it cannot be buried in a ToS click-through; (2) explicitly identify AI-generated voice or likeness synthesis as a specific use purpose, not “any commercial purpose”; (3) state the retention period for the underlying biometric data; (4) be obtained before the first biometric capture or AI use event; and (5) under GDPR, be revocable at any time with the same ease as giving it. Under California AB 2602, contracts for digital replicas in entertainment are voidable if the performer lacked independent legal counsel during negotiation, even if the consent instrument itself is otherwise valid.
Article 50 creates a disclosure and labeling obligation on providers and deployers of AI systems — it requires them to mark synthetic voice and face content as AI-generated using machine-readable technical standards. It does not independently create a right to demand removal of existing content. The right to demand removal comes from GDPR Art. 17 (right to erasure) where your biometric data was processed without valid Art. 9 consent, or from personality rights law in your EU member state. Think of Art. 50 as establishing the transparency floor — the right to object and demand removal is built on GDPR and national personality rights, which operate independently of and prior to the AI Act.
In the EU, personality rights of deceased individuals are protected for varying periods under member state law: 10 years post-mortem in France, up to 70 years in Germany for significant cultural figures. GDPR does not apply after death, but national laws frequently provide estate-level remedies. In the US, New York’s digital replica law extends protections for 70 years post-mortem and is enforceable by the estate. Tennessee’s ELVIS Act does not expire on death — the right survives in the estate. California’s right of publicity survives 70 years post-mortem for commercially significant individuals. The NO FAKES Act, if enacted, would apply post-mortem across all US states.
Right of publicity (a US-origin concept) protects individuals from the unauthorized commercial exploitation of their name, image, likeness, and voice — it is a property right that can be licensed and monetized. GDPR biometric rights are a data protection framework focused on how biometric data is collected, stored, and processed — they require lawful basis regardless of whether the intended use is commercial. The practical difference: right of publicity is triggered by commercial exploitation without permission; GDPR is triggered by biometric data processing without a lawful basis. Crucially, both can be violated by the same AI use of your voice or face, and both remedies can be pursued simultaneously — a GDPR complaint and a civil right of publicity claim are not mutually exclusive.
Know Your Rights Before a Violation Occurs.
WCR Legal advises performers, creators, employees, and companies on AI voice and likeness rights — GDPR biometric consent, ELVIS Act, California AB 2602, EU AI Act Art. 50, and NO FAKES Act readiness. EU and US jurisdictions.
Post Comment