Is it legal to clone a voice or use someone’s face with AI?

What does the law protect when it protects a “likeness”?

Your ‘likeness’ is what makes you recognisable: your face, your voice, your name, sometimes your signature style or catchphrase. Many countries give people some control over commercial use of these features. In the US this is called the ‘right of publicity’. In India and parts of Europe it is called ‘personality rights’.

Data protection law adds a second layer. Under the EU and UK GDPR, a recording of your face or voice is ‘personal data’, information about an identifiable person. When it is processed with technology that can uniquely identify you, such as a voiceprint or face template, it becomes ‘biometric data’, a special category that generally needs explicit consent or another narrow legal basis.

Other laws fill the gaps. Using a famous face to sell a product can be ‘passing off’ or false endorsement. Putting false words in someone’s mouth can be defamation. Fake explicit images can be a crime. So the question is rarely “is this deepfake legal?” but “which of these rules does my use touch?”

Can I use a celebrity’s voice or face in the US?

Usually not for commercial purposes without permission. Most US states protect the right of publicity by statute or court decision, and several have updated those laws specifically for AI. There is still no federal right of publicity.

Tennessee moved first. Its ELVIS Act, signed in March 2024 and in force since 1 July 2024, added voice to the state’s likeness protection. It also creates liability for anyone who distributes a tool whose primary purpose is producing someone’s voice or likeness without authorisation. California followed with two laws in force from 1 January 2025. AB 2602 makes contract terms allowing a ‘digital replica’ (an AI recreation of a performer) unenforceable unless the intended uses are reasonably specific and the performer had a lawyer or union representing them. AB 1836 restricts digital replicas of deceased personalities without their estate’s consent.

New York has a similar contract rule for digital replicas and, since 9 June 2026, requires advertisers to conspicuously disclose any AI-generated ‘synthetic performer’ in an ad. Penalties are $1,000 for a first violation and $5,000 after that.

At federal level, the NO FAKES Act would create a nationwide right over your voice and visual likeness, with a notice-and-takedown process for platforms. The 2026 version was introduced in May 2026 and cleared the Senate Judiciary Committee in June 2026. As of October 2026 it still needs a full Senate vote and House approval, so it is not law.

How do India, the EU, the UK and Asia protect likeness?

India has no likeness statute, but its courts have become some of the fastest-moving in the world. The Delhi High Court protected actor Anil Kapoor against AI and face-morphing misuse in September 2023, and Jackie Shroff in May 2024. The Bombay High Court protected singer Arijit Singh against AI voice cloning in July 2024. In September 2025 the Delhi High Court granted Aishwarya Rai Bachchan an order against AI-generated and morphed content, with Abhishek Bachchan obtaining similar protection days later. Separately, India’s amended IT Rules have required platforms to label synthetic content since February 2026.

The EU has no single likeness right. Member states protect image rights in different ways, and GDPR applies to face and voice data everywhere. The AI Act’s Article 50(4), applying since 2 August 2026, requires anyone who deploys AI to create a deepfake to disclose that it is artificial. Denmark has gone further with a proposed copyright-style right over your own face, voice and body. A bill was put to the Danish parliament in October 2026 with a target start date of 1 January 2027, so treat it as proposed until passed.

The UK has no general image right either. Celebrities rely on passing off, data protection, harassment and defamation law. Asia is mixed: China protects portrait and voice under its Civil Code, and Japan’s courts recognise a publicity right for famous people.

Can I clone my employees’ voices or faces?

Yes, with care. Turning a staff member into an AI avatar for training videos or customer service is lawful in most markets if you have their genuine, informed consent and a clear contract. The difficulty is that consent at work is rarely ‘freely given’ in the GDPR sense, because employees may feel they cannot say no.

Treat it as a separate, optional agreement rather than a clause buried in the employment contract. Spell out what will be created, where it will be used, for how long, whether the person is paid for it, and what happens when they leave. California’s AB 2602 and the entertainment industry show where the market is heading: SAG-AFTRA’s 2023 film and TV agreement and its 2025 video game agreement both require informed consent and a description of intended uses before a performer’s digital replica is made.

If your staff are in the EU or UK, a voice or face model is likely to involve biometric data. That usually means explicit consent, a data protection impact assessment (a documented risk review) and a real option to refuse without consequences.

Is it legal to use ElevenLabs, HeyGen or Synthesia for marketing?

Yes, if you use voices and faces you have the right to use. These tools are legal products, and their terms generally require you to have permission to clone any voice or face you upload. If you break those terms, the risk falls on you, not the tool provider.

The safest options are your own voice and face, the vendor’s licensed stock avatars and voices, or a person who has signed a specific release. A ‘sound-alike’ that imitates a famous voice without naming them is still risky. US courts have treated imitations of distinctive celebrity voices in ads as infringing for decades.

Then think about disclosure. The EU requires deepfakes to be disclosed, New York requires synthetic performers in ads to be flagged, and consumer protection law in most markets forbids misleading people about who is endorsing a product. Our synthetic media labelling guide covers the mechanics.

Phone calls need extra care. In February 2024 the US Federal Communications Commission ruled that AI-generated voices count as ‘artificial’ voices under the Telephone Consumer Protection Act. AI voice calls to US consumers therefore generally need prior consent, just like robocalls.

Voice-clone fraud and political deepfakes

The most expensive deepfakes so far have been frauds. In early 2024 a finance employee in engineering firm Arup’s Hong Kong office joined a video call in which the company’s CFO and colleagues were AI recreations. The employee made transfers totalling HK$200 million, about US$25 million. Arup confirmed it was the victim in May 2024.

Election deepfakes have drawn fast enforcement. Days before the January 2024 New Hampshire primary, voters received robocalls using an AI clone of President Biden’s voice. The FCC fined the political consultant behind them, Steve Kramer, $6 million, and the carrier Lingo Telecom agreed to pay $1 million. A New Hampshire jury acquitted Kramer of the state criminal charges in June 2025.

Are sexual deepfakes illegal?

Yes, in a growing number of countries, and this is where the law is strictest. In the US, the TAKE IT DOWN Act, signed in May 2025, made it a federal crime to publish non-consensual intimate images, including AI ‘digital forgeries’. Since 19 May 2026, covered platforms must remove reported images, and known copies, within 48 hours of a valid request, and the Federal Trade Commission is enforcing that duty.

In England and Wales, sharing intimate deepfakes has been an offence since January 2024. Since 6 February 2026, creating one of an adult without consent, or asking someone else to, is also a crime under changes made by the Data (Use and Access) Act 2025. The Crime and Policing Act 2026 goes further by targeting tools built to ‘nudify’ images. South Korea in 2024 made it a crime even to possess or view sexual deepfakes, with prison terms of up to three years, and raised the maximum for making them to seven years.

Platforms are in the frame too. The EU’s AI Act amendments ban systems that generate non-consensual intimate imagery from 2 December 2026, and the UK regulator Ofcom opened an Online Safety Act investigation into X in January 2026 over sexualised images made with its Grok chatbot. That investigation was ongoing as of October 2026.

I’ve been deepfaked. What should I do?

Act quickly, but in the right order. Evidence disappears once content is removed, and you may need it later for the police, a court or an insurer.

Most major platforms have dedicated reporting routes for impersonation and intimate imagery, and the fastest removals usually come from using the exact category that fits.

• Preserve evidence: screenshot the content, the account, the date and the URL, and save copies before you report anything.
• Report to the platform using its impersonation, privacy or intimate image route, and keep the reference numbers.
• Use hash-matching services such as StopNCII.org for intimate images, which help participating platforms block re-uploads without you sharing the image.
• Send legal takedown requests where they apply: TAKE IT DOWN requests in the US, data protection erasure requests in the EU and UK, and IT Rules grievances in India.
• Report crimes to the police, or in India through the national cybercrime portal, especially for sexual content, extortion or fraud.
• Ask a court for an injunction where content keeps reappearing; Indian courts in particular have issued broad orders covering unknown defendants.
• Warn your contacts, customers or staff if the deepfake could be used to defraud them.

What is happening in the market right now?

Synthetic media tools went mainstream between 2024 and 2026. Voice cloning, talking-head avatars and video generators moved from specialist products into everyday marketing, training and customer service. OpenAI’s Sora app made ‘cameos’ of real people a consumer feature in 2025, and quickly faced complaints about likenesses of deceased public figures.

Regulators have answered on three fronts. First, consent and ownership: the ELVIS Act, California and New York laws, Indian court orders and Denmark’s bill. Second, transparency: the EU AI Act, India’s IT Rules and China’s labelling rules. Third, the worst harms: criminal laws on sexual deepfakes and fast takedown duties for platforms.

The direction is clear even where details differ. Expect more countries to treat face and voice as something you own, more contract clauses about digital replicas, and more platform tools that let people find and remove AI copies of themselves. For businesses, a documented consent process is fast becoming as routine as a photo release.