Is voice cloning legal in Europe
Yes. Cloning a voice is lawful in the European Union when the person consented. What the law regulates is consent, the handling of biometric data, and disclosure that the result is artificial — the three things MemoriesBox is built around.
Facts on this page verified
The short answer
No European law bans voice cloning. A set of laws decides when a particular clone is lawful, and the answer turns almost entirely on one question: did the person whose voice it is agree, knowing what they were agreeing to.
Cloning your own voice, or a consenting parent's, is lawful across the European Union. Cloning a stranger's voice from a podcast, or a dead person's from old family videos, is where it goes wrong.
What has to be true for it to be lawful
| Requirement | Where it comes from | What it means at a kitchen table |
|---|---|---|
| A lawful basis for processing | GDPR Article 6 | For a family archive, that basis is the person's consent under Article 6(1)(a) |
| Consent that is freely given, specific, informed and demonstrable | GDPR Article 7 | A real explanation, not a pre-ticked box, and a record of when it was given |
| Explicit consent where the data is special category | GDPR Article 9(2)(a) | A separate, unmistakable yes for the voice model itself |
| The right to withdraw, as easily as it was given | GDPR Article 7(3) | Stopping has to be as simple as starting |
| Information about what happens to the data | GDPR Articles 13 and 14 | Told at the time, in plain language |
| Disclosure that the output is AI | EU AI Act Article 50 | Since 2 August 2026, every session says so |
One requirement is missing from that table on purpose. GDPR Article 35 asks for a data protection impact assessment before new technology is applied to sensitive material, and a voice model is exactly that. We have not completed one. It is being written, and the date it is finished will replace this paragraph; until then the honest table has no row for it. We have not appointed a data protection officer either — Article 37 does not require one of a company this size — and privacy@memoriesbox.org reaches the people who answer for the data.
When a voice becomes biometric data
This is the part most articles on this subject get wrong in one direction or the other.
Biometric data, under GDPR Article 4(14), is personal data resulting from specific technical processing relating to a person's physical, physiological or behavioural characteristics, which allows or confirms their unique identification. A recording of someone talking is always personal data under Article 4(1). It becomes special-category biometric data under Article 9(1) when it is processed for the purpose of uniquely identifying that person, which is what a voiceprint used for authentication does.
A voice model built to speak, rather than to identify, does not obviously fall inside Article 9 on a literal reading. Regulators and commentators do not entirely agree, and there is no settled case law. We will not pretend the argument is closed in whichever direction suits us.
So we work to the higher standard regardless: explicit consent, in the Article 9(2)(a) sense, before a voice model is built. If the strict reading is right, we are compliant. If the looser one is, nobody has lost anything by being asked properly.
What changed on 2 August 2026
Article 50 of the EU AI Act, Regulation (EU) 2024/1689, became applicable. Since that date, any AI system placed on the EU market that talks to people has to say it is AI, and synthetic audio has to be marked in a machine-readable format so it can be detected as artificially generated. A synthesised voice of a real person meets the Article 3(60) definition of a deep fake, so the deployer disclosure duty in Article 50(4) applies too.
Non-compliance carries administrative fines of up to EUR 15,000,000 or 3% of worldwide annual turnover, whichever is higher, under Article 99(4)(g). For small and medium-sized enterprises, Article 99(6) makes it whichever is lower. The full plain-language explainer is on /trust/eu-ai-act-article-50.
Where national law adds more
Data protection is harmonised across the Union. Personality rights are not, and they are the reason a lawful clone in one member state can still be actionable in another.
| Country | What it adds |
|---|---|
| Germany | The voice is protected by the general right of personality under Articles 2(1) and 1(1) of the Basic Law. Commercial aspects are inheritable for 10 years after death, following the Federal Court of Justice in Marlene Dietrich (1999) |
| France | Article 9 of the Civil Code protects private life, including voice and image. Article 85 of Loi n° 78-17 lets a person leave binding directives about their data after death |
| Spain | Article 7.6 of Organic Law 1/1982 makes using a person's name, voice or image for advertising or commercial purposes an unlawful interference with their rights |
| Italy | Article 2-terdecies of Legislative Decree 196/2003 sets out who may exercise a deceased person's data protection rights |
| Denmark | Data protection law applies to a deceased person's data for 10 years after death, under section 2(5) of the Danish Data Protection Act |
What is not lawful
- Building a voice clone of someone who did not agree, including someone who has died and left no permission. That is the single clearest line, and it is why /trust/consent exists.
- Using a person's voice for advertising or commercial promotion without their consent. Explicit in Spain under Organic Law 1/1982, and reachable through personality rights elsewhere.
- Using a synthetic voice to impersonate someone in order to obtain money or access. That is fraud in every member state, whatever tool produced it.
- Publishing synthetic audio of a real person without disclosing that it is artificial, since 2 August 2026.
- Recording a conversation where your member state requires the other party's knowledge or agreement. The rules on recording calls vary by country. Check before recording a phone call rather than after.
What we can't promise
- We cannot give you legal advice. This page was verified on 17 August 2026 by the people who have to comply with these rules, not by your lawyer.
- We cannot promise the Article 9 question stays where it is. If a regulator or a court decides that all voice models are biometric processing, the analysis on this page needs rewriting.
- We cannot promise national law is uniform. There are 27 member states, and personality law differs in every one.
- We cannot promise enforcement is predictable. Article 50 has been applicable for fifteen days at the time of writing, so nobody has a body of enforcement practice yet.
- We cannot police the wider internet. If a recording of someone exists in public, the law gives them rights, but it does not give us the ability to stop a third party misusing it.
What the law says
- GDPR Articles 4(14), 6, 7, 9, 13, 14 and 35: Regulation (EU) 2016/679
- EU AI Act Article 50, transparency obligations: artificialintelligenceact.eu/article/50
- EU AI Act Article 3(60), the deep fake definition: artificialintelligenceact.eu/article/3
- EU AI Act Article 99, penalties: artificialintelligenceact.eu/article/99
Questions people ask
Is it legal to clone your own voice in the EU?
Yes. Your own voice, with your own consent, processed by a service that tells people the output is AI, is lawful across the European Union.
Is it legal to clone a dead person's voice?
Only if that person consented while alive. The GDPR does not apply to the personal data of deceased people under Recital 27, but national personality law often does, and there is no consent to rely on once someone has died. MemoriesBox will not build a voice from a person who never recorded with us.
Do I need explicit consent under GDPR Article 9?
Whether Article 9 strictly applies to a voice model built for speech rather than identification is unsettled. We ask for explicit consent regardless, which is the safe answer in either reading.
Is voice cloning legal without permission for personal use?
No safe version of this exists in Europe. Even where no money changes hands, personality rights, data protection and, since 2 August 2026, the disclosure duties of AI Act Article 50 all still apply.
Why does any of this matter for a family recording?
Because 47% of Americans regret not recording or documenting a conversation with someone who has since died, and 59% have never done it at all (YouGov, June 2022, n=6,090). Most people who intend to do this never start, and the law is not the reason. Doing it properly, with consent, while the person can still take part, is both the lawful route and the only one that produces something worth keeping.
Related: The EU AI Act, Article 50, explained · Who owns a cloned voice · How the voice clone is built · Where your data lives · Every other way to keep a voice · The full comparison table
MemoriesBox is $139 a year, hosted in the EU, first 14 days free. Start here.