Unauthorized voice cloning, which employs generative artificial intelligence (AI) to replicate a person’s voice without consent, represents an emerging concern in privacy law. However, current state privacy laws offer potential avenues for combatting this issue. One significant piece of legislation in this arena is Illinois’ Biometric Information Privacy Act (BIPA).
BIPA provides a private right of action, allowing individuals to sue for unauthorized use of their biometric data. The extensive case law developed under BIPA, while not explicitly addressing voice cloning, provides insights into how biometric protections could apply. For instance, in Carpenter v. McDonald’s Corp., the judge ruled that AI-extracted voice characteristics were not a “voiceprint” because they couldn’t uniquely identify the individual.
The nuances of BIPA further reveal that how an AI system processes biometric data—whether it uses uniquely identifiable characteristics—is crucial. This principle was demonstrated in In re Facebook Biometric Information Privacy Litigation, where the court determined that the issue of whether Facebook’s AI system collected protected biometric data required jury deliberation.
State privacy laws beyond Illinois also present potential for addressing unauthorized voice cloning. Washington’s My Health My Data Act, for instance, explicitly includes biometric data in its definition of consumer health data and prohibits its collection without consent. This act’s provisions align with BIPA’s principles, suggesting its applicability to voice cloning cases.
On the other hand, certain state laws may pose challenges. Vermont’s Data Privacy Act excludes data generated from audio recordings unless it is specifically used to identify an individual, presenting a potential barrier for voice cloning claims. The newness of Vermont’s law leaves unclear how this exclusion will be interpreted in practice.
Supplementing privacy laws, other state measures like Tennessee’s ELVIS Act offer protections against unauthorized use of voices for recording artists. These laws, however, often have limitations in scope and applicability. Therefore, additional legal frameworks may be necessary to fully address the complexities introduced by voice cloning technologies.
While the legal landscape remains fragmented, state privacy laws such as BIPA and Washington’s My Health My Data Act show promise in providing remedies for victims of unauthorized voice cloning. These regulations may serve as critical tools in ensuring biometric data protection amid the rising capabilities of AI technologies.
For further detailed insights, the full article is available on Bloomberg Law.