1. Introduction: What Is AI Voice Cloning?
Advancements in artificial intelligence have made it possible to digitally imitate and reproduce human voices with increasing accuracy. Known as voice cloning, this technology uses recordings of an individual’s voice to generate artificial speech that replicates their speaking style, tone, intonation, and distinctive vocal characteristics.
Today, voice cloning technology is used across various industries, including advertising, entertainment, digital content production, and customer service. However, its misuse raises significant legal concerns. Copying someone’s voice without their knowledge or consent, attributing statements to them that they never made, or using their voice for fraudulent purposes may pose serious risks to personality rights and personal data protection.
In particular, the ability to generate realistic voice imitations from relatively short audio recordings makes such violations increasingly difficult to detect and prevent. This creates new areas of legal responsibility not only for individuals but also for companies, public institutions, and digital platforms.
Against this background, a fundamental legal question arises: Who can be held legally responsible, and on what grounds, when an individual’s voice is unlawfully copied and used through artificial intelligence?
2. Voice Cloning and the Protection of Personality Rights
An individual’s voice is a distinctive personal characteristic that contributes to their identification and recognition. Accordingly, the unauthorized imitation or use of someone’s voice may, depending on the circumstances, constitute an unlawful interference with their personality rights.
Under Turkish law, the primary provisions governing the protection of personality rights are Articles 24 and 25 of the Turkish Civil Code No. 4721. Article 24 provides protection against unlawful interference with personality rights, while Article 25 allows individuals to seek remedies such as the prevention, cessation, and determination of unlawful interference.
Within this legal framework, the unauthorized cloning of an individual’s voice for commercial purposes, its publication in a manner that damages their reputation, or the attribution of statements to them that they never made may give rise to legal claims.
For example, the unauthorized imitation of a public figure’s voice in an advertisement may create the false impression that the individual endorses a particular product. Similarly, using an ordinary person’s cloned voice to request money from their family members may have consequences under both personality rights law and criminal law.
Where an infringement of personality rights occurs, the affected individual may, depending on the circumstances, seek the prevention or cessation of the infringement and claim material or non-pecuniary damages. Relevant considerations include how the voice was obtained, the purpose for which it was used, the audience reached by the content, and the nature of the harm suffered.
3. Voice Cloning Under Personal Data Protection Law
One of the key legal dimensions of voice cloning concerns personal data protection. Audio recordings that directly or indirectly identify an individual may qualify as personal data.
In Türkiye, the principal legislation governing the processing of personal data is the Law on the Protection of Personal Data No. 6698 (Turkish DPL or KVKK). Article 4 establishes fundamental principles governing data processing, including compliance with law and principles of fairness, processing for specific and legitimate purposes, and ensuring that data processing is relevant, limited, and proportionate to those purposes.
The processing of an individual’s voice recording to train an artificial intelligence model, imitate their voice, or use the generated voice for commercial purposes may fall within the scope of the Turkish DPL, depending on the circumstances.
An important distinction must be made: Not every voice recording automatically qualifies as biometric data or special category personal data. However, where a voice is subjected to specific technical processing for the purpose of uniquely identifying an individual, it may qualify as biometric data. In such cases, the requirements under Article 6 of the Turkish DPL concerning special categories of personal data must also be examined.
Furthermore, it would be inaccurate to suggest that explicit consent is required for every instance of personal data processing. The legal grounds set out in Articles 5 and 6 of the Turkish DPL must be assessed individually in each case. Nevertheless, transferring an individual’s voice into AI systems without authorization and using it for different purposes may constitute unlawful processing where no applicable legal basis exists.
Companies providing voice cloning services should therefore clearly disclose the purposes for which users’ voice recordings are processed, how long they are retained, and whether they are shared with third parties.
4. Criminal Law Implications of AI Voice Cloning
The imitation of a human voice through artificial intelligence does not, by itself, automatically constitute a criminal offence. However, where this technology is used as a means of committing specific offences, provisions of the Turkish Criminal Code may become applicable.
For example, impersonating an individual through voice cloning to request money from family members or colleagues may constitute fraud, depending on the circumstances. Where the offence is committed through the use of information systems as a means of execution, the aggravated fraud provisions under Article 158 of the Turkish Criminal Code may be relevant.
Furthermore, Articles 133 and 134 may become applicable where audio recordings are unlawfully obtained or recordings relating to private life are secretly made and disclosed. Articles 135 and 136 may also be relevant where personal data is unlawfully recorded, obtained, transferred to another person, or disclosed, depending on the circumstances.
It is important to emphasize that not every voice cloning incident can be assessed under the same criminal law provisions. For instance, imitating a voice using a publicly available speech recording is legally different from secretly recording a private conversation and using that recording to create a voice model.
Accordingly, determining criminal liability requires an assessment of how the voice was obtained, the purpose for which it was used, the conduct involved, and the resulting consequences.
5. Legal Liability of Companies and Technology Providers
The increasing use of voice cloning technology raises questions not only about the liability of individuals who misuse these tools but also about the responsibilities of companies that develop and provide AI systems as services.
Where a company enables users to imitate the voices of third parties, issues such as data security, user verification, consent mechanisms, and safeguards against misuse become particularly important.
Nevertheless, developers and providers of AI systems cannot automatically be held liable for every harm resulting from the misuse of their technology. Determining liability requires an examination of the company’s legal position, the obligations it has undertaken, its fault, the causal connection between its conduct and the damage, and the applicable legal framework.
For example, the unauthorized cloning of a public figure’s voice by an advertising agency for a commercial campaign cannot necessarily be assessed under the same liability framework as the development of a general-purpose voice generation tool by a technology provider.
Therefore, technology providers should focus not only on technical development but also on legal compliance, data security, and measures designed to reduce the risks of misuse.
6. The EU Artificial Intelligence Act and International Regulations
The growing use of AI-generated fake voices and other synthetic content has prompted regulatory developments at the international level. One of the most significant legal instruments in this area is the European Union’s Artificial Intelligence Act (Regulation (EU) 2024/1689).
Article 50 of the Regulation establishes transparency obligations for certain AI systems. In particular, it introduces obligations for providers to ensure that outputs generated or manipulated by AI systems, including audio, image, and video content, are marked in a machine-readable format and can be identified as artificially generated or manipulated.
The Regulation also introduces disclosure obligations for individuals who use AI-generated or manipulated content that qualifies as a deepfake. Such individuals must disclose that the content has been artificially generated or manipulated. Specific provisions address the manner in which these obligations apply to artistic, creative, satirical, and fictional works.
These transparency obligations became applicable on 2 August 2026. However, certain obligations concerning the marking of AI-generated content are subject to a transitional period until 2 December 2026 for providers of certain AI systems placed on the market before 2 August 2026.
The purpose of these requirements is to improve the distinguishability of AI-generated content from authentic recordings and ensure that users are informed about the nature of the content they encounter.
The territorial scope of the EU Artificial Intelligence Act is also significant. The Regulation may apply to systems placed on the EU market or put into service within the EU, as well as to certain activities of entities established outside the EU. Consequently, companies operating in Türkiye cannot automatically assume that they fall outside the scope of the Regulation simply because they are established outside the European Union.
7. Legal Remedies Available to Victims of Voice Cloning
The legal remedies available to individuals whose voices have been cloned and used without authorization depend on the nature and circumstances of the infringement.
First, victims may contact the relevant digital platforms to request the removal of the content and the cessation of unauthorized use of their voices. In addition, under Articles 24 and 25 of the Turkish Civil Code, they may seek the prevention or cessation of interference with their personality rights and request a determination that the interference is unlawful.
Where material or non-pecuniary damage has occurred, claims for compensation may also be brought under the relevant provisions of the Turkish Code of Obligations.
In cases involving unlawful processing of personal data, the data subject may submit an application to the data controller under the Turkish DPL and, subject to the statutory requirements, lodge a complaint with the Turkish Personal Data Protection Board.
Furthermore, where the conduct may constitute a criminal offence, victims may file a criminal complaint with the Office of the Chief Public Prosecutor.
Preserving digital evidence is particularly important throughout these proceedings. Links to unauthorized audio recordings, screenshots, publication dates, user information, and relevant correspondence should be retained, as they may serve as important evidence in subsequent legal proceedings.
8. Conclusion: The Importance of Legal Protection in the Face of Technological Advancements
AI voice cloning technology offers significant opportunities for communication and digital content production. At the same time, it creates new risks concerning personality rights, personal data protection, and criminal liability.
The unauthorized reproduction of an individual’s voice may result in the misuse of their identity and reputation and may also facilitate fraud and other unlawful activities.
The absence of a specific legislative framework in Turkish law that comprehensively regulates AI voice cloning as an independent legal category means that such incidents must currently be assessed under existing provisions of civil law, the law of obligations, criminal law, and personal data protection legislation.
International regulations, particularly the EU Artificial Intelligence Act, provide an important legal framework for transparency in synthetic content and the responsible use of artificial intelligence systems.
Ultimately, legal protection against the misuse of voice cloning technology should not be limited to remedies available only after an infringement has occurred. Preventive measures by technology providers, lawful data processing practices by companies, and stronger mechanisms for protecting individuals’ digital identities are essential to ensuring legal certainty and effective protection in this rapidly evolving field.
No Responses