Voice cloning consent and the law

Consent is the foundation, not a formality

Every clone created here starts with one sentence. Before the create button works, you confirm: "This is my voice, or I have the speaker's permission to clone it. I understand cloned voices I create are mine to use and mine to answer for."

That sentence is not decoration. It is the legal hinge the whole feature turns on, and most of the law described on this page is, one way or another, the consequence of skipping it. This guide covers the landscape for living adults; public figures, deceased speakers, and children each get their own page, because the law treats each differently.

The right of publicity: a voice is part of a person

In the United States, the right of publicity is state law that stops others from commercially exploiting your name, likeness, or other recognizable parts of your persona without authorization. Courts have long treated a distinctive voice as part of that persona, and newer statutes now say the word voice outright.

The practical reading is simple: a recognizable voice belongs to its speaker, even in a recording you legally own. Owning audio of someone is not owning their voice.

Voiceprint statutes with real damages

Illinois goes furthest. The Biometric Information Privacy Act (740 ILCS 14) names the voiceprint as a biometric identifier and requires written notice, a written release, and a published retention and destruction schedule before one is collected. Damages are fixed: $1,000 per negligent violation, $5,000 per reckless or intentional one, with a private right of action.

In Rosenbach v. Six Flags (2019), the Illinois Supreme Court held that the violation itself is the injury: a plaintiff does not have to prove any further harm to collect. The case was about a teenager's thumbprint at a theme park; the principle applies to voiceprints the same way.

Texas has its own version, the Capture or Use of Biometric Identifier Act (Bus. & Com. Code 503.001): voiceprints again, consent required before capture, enforced by the state attorney general at up to $25,000 per violation.

Europe: a voice that identifies you is biometric data

Under the GDPR, voice data processed to uniquely identify a person is biometric data, and biometric data used for identification is special-category data under Article 9: processing is prohibited unless a narrow exception applies. For voice cloning, the workable exception is explicit consent from the speaker.

Notice the convergence. Two very different legal systems, built on different theories, arrive at the same operational rule: get the speaker's clear permission first, in a form you can prove.

Where the law is heading

Congress keeps circling a federal version. The NO FAKES Act (S. 1367, reintroduced April 2025) would create a federal right against unauthorized digital replicas of a person's voice and likeness. It has not passed as of this writing, and we will update this page if that changes. The direction of every draft, every state bill, and every enacted statute is the same: more protection for the speaker, not less.

Disclosure rules are tightening in parallel; that side of the landscape lives in deepfake disclosure laws.

What real permission looks like

If you clone anyone but yourself, "I have the speaker's permission" should be true in a way you could show someone. In practice that means:

• Written, not remembered. A signed note or an email thread beats a recollection of a conversation.
• Specific. The speaker knows a clone is being made and what you will use it for, not just that you have a recording.
• Aware it can end. The speaker knows they can withdraw, and you know that withdrawing means deleting the voice, which Cantari makes a one-click reality.

What this means on Cantari

The attestation quoted at the top is enforced by the server: the create call is refused without it, and the time you gave it is stored with the voice. Cloning requires a signed-in account, so there is no anonymous path. Deleting a voice removes it from your account, from the cloning engine, and from stored reference audio, which is what makes revocable consent honest here.

Cloning a voice without permission breaches the terms and such voices are removed when found. The definitional short version of all this lives in the consent glossary entry, and the full create flow is in the voice cloning guide.