Voice cloning went from a niche technology concern to a mainstream legal battleground in 2024–2026. Within two years, the US enacted the first federal law targeting AI-generated intimate content, the EU AI Act’s synthetic-media disclosure rules entered force, Tennessee became a model for state-level voice-rights legislation, and SAG-AFTRA won contractual protections for performers’ voices — all while courts grappled with the first wave of deepfake fraud prosecutions.
This recap covers the real named cases, new statutes, judicial rulings, and regulatory milestones that defined the legal landscape for voice cloning in 2026. It is educational only and does not constitute legal advice.
TL;DR
- Federal (US): TAKE IT DOWN Act signed 2026 — platforms must remove non-consensual AI intimate content within 48 hours.
- State (US): Tennessee ELVIS Act effective July 2024; 17+ states with similar bills by mid-2026.
- EU: AI Act Article 50 synthetic-media disclosure obligations live August 2026; €15M / 3% turnover fines.
- Labor: SAG-AFTRA November 2023 contract requires consent + pay for AI voice replicas; arbitration cases active 2025–2026.
- High-profile disputes: Johansson/OpenAI (Sky voice), Drake/UMG (Heart on My Sleeve), multiple deepfake fraud prosecutions.
- Trend: Criminal prosecutions for voice-deepfake fraud accelerating; civil right-of-publicity suits becoming routine.
1. The Johansson / OpenAI Dispute: The Case That Changed Everything
In May 2024, Scarlett Johansson publicly disclosed that she had declined an offer from OpenAI CEO Sam Altman to license her voice for a new ChatGPT voice mode, and that OpenAI subsequently released a voice called “Sky” that she said sounded “eerily similar” to her performance in the 2013 film Her. Johansson’s lawyers sent a formal demand letter and requested documentation of how Sky was developed.
OpenAI suspended the Sky voice within days and stated the voice was cast from a different actress. No lawsuit was filed in open court; the matter was addressed through private negotiations. However, the episode produced three lasting consequences:
- Reputational liability at scale — a major AI company was publicly forced to pull a product feature over an unresolved voice-rights allegation.
- Industry norm-setting — several AI voice platform competitors announced explicit “no celebrity likeness” policies within weeks.
- Legislative momentum — US Senate discussions about a federal “NO FAKES Act” (Nurture Originals, Foster Art, and Keep Entertainment Safe) accelerated, with the bill receiving committee hearings by late 2024.
The NO FAKES Act, if enacted, would create a federal right of publicity covering AI replicas — including voice — and would preempt some state-level patchwork. As of June 2026, the bill has not passed the full Senate.
Source: The New York Times, “Scarlett Johansson Says OpenAI’s ChatGPT Sounded ‘Eerily Similar’ to Her Voice” (May 2024); OpenAI statement, May 2024.
2. Tennessee ELVIS Act: The State-Level Template
Tennessee enacted the Ensuring Likeness Voice and Image Security (ELVIS) Act, effective July 1, 2024, updating the state’s 1984 Personal Rights Protection Act to explicitly cover AI-generated voice replicas. The law:
- Extends the right of publicity to cover AI-cloned voices, not just recordings.
- Makes it unlawful to use AI to replicate a person’s voice for commercial purposes without consent.
- Provides civil remedies and statutory damages; performers and their heirs can sue.
- Has no carve-out based on the speaker being a public figure — the right applies to everyone.
Tennessee’s legislation became the explicit template for bills in at least 17 other states introduced or passed by mid-2026, including Georgia, California (expanding existing law), New York, and Texas. California’s AB 2602, passed in September 2024, specifically requires contracts to address AI voice replicas when hiring actors and session vocalists.
The ELVIS Act’s name is a deliberate reference to Elvis Presley’s posthumous IP challenges — Tennessee has a commercial interest in protecting music industry rights that extends well beyond living artists.
Source: Tennessee ELVIS Act — Wikipedia; California AB 2602, California Legislative Information, 2024.
3. SAG-AFTRA and the Voice Actor Consent Framework
SAG-AFTRA’s 118-day strike in 2023 produced a November 2023 contract that included AI provisions covering:
- Explicit informed consent required before an AI voice replica can be created from a union member’s performance.
- Separate compensation — the AI replica is negotiated as a separate contractual item, not bundled into the original performance fee.
- Residuals for ongoing commercial use of an AI voice replica.
In 2024–2025, SAG-AFTRA filed multiple grievances against studios alleged to have used AI voice training data from existing performance recordings without triggering the consent and compensation clauses. Several cases went to arbitration; outcomes are under confidentiality agreements, but the pattern established that contract enforcement — not just legislation — is a parallel enforcement pathway.
In a notable 2025 development, the union signed a separate agreement with Replica Studios and Lovo specifically covering AI voice work as a distinct category, providing a formal consent-and-pay mechanism for performers who choose to license their voices for AI training.
Source: SAG-AFTRA contract FAQ, 2023; The Verge, “SAG-AFTRA Signs AI Voice Agreement With Replica Studios” (2025).
4. The TAKE IT DOWN Act (Federal, 2026)
The TAKE IT DOWN Act was signed into federal law in 2026, targeting non-consensual intimate imagery (NCII) — a category that explicitly includes AI-generated content, including voice-only deepfakes used in sexual contexts.
Key provisions:
- Online platforms must remove verified NCII within 48 hours of a complaint.
- Covers both real images/audio and AI-generated synthetic content.
- Creates a private right of action for victims.
- Criminal penalties for intentional publication of NCII.
The law’s voice-specific scope is narrower than its visual NCII scope — it applies to voice deepfakes used in intimate or sexual contexts, not all unauthorized voice cloning. However, it is the first federal law to explicitly capture AI-generated audio in an intimate-content removal mandate.
Source: TAKE IT DOWN Act — Congress.gov (2026); EFF analysis of TAKE IT DOWN Act.
5. EU AI Act: Synthetic Voice Disclosure in Force
The EU AI Act entered staged enforcement through 2025–2026. The provisions most directly affecting voice cloning are under Article 50, governing transparency obligations for AI-generated content:
- AI systems generating synthetic audio (including voice clones) must be technically designed to label output as AI-generated.
- Deployers of such systems must disclose to end users that content is AI-generated, unless use is for clearly creative or satire purposes with appropriate context.
- The Article 50 obligations took effect August 2026.
- Fines: up to €15 million or 3% of global annual turnover for violations, whichever is higher.
High-risk AI system classifications (Article 6) also capture real-time remote voice biometric identification at scale — relevant for voice-cloning systems used in authentication contexts.
The Act is enforced by national market surveillance authorities in each EU member state, coordinated by the European AI Office established in 2024.
Source: EU AI Act — EUR-Lex full text; European Commission AI Office.
6. Deepfake Fraud Prosecutions: Criminal Cases Accelerate
Civil litigation and regulatory enforcement have been joined by criminal prosecution as voice-deepfake fraud cases moved through courts in 2024–2026.
| Case | Jurisdiction | Allegation | Outcome |
|---|---|---|---|
| Arup Engineering (CFO deepfake call) | Hong Kong / UK | $25.6M wire fraud via deepfake video call | Hong Kong Police charged five suspects (2024); UK cooperation ongoing |
| Biden robocall (NH Primary) | US — FCC / DOJ | AI-cloned Biden voice suppressing voter turnout | FCC $6M fine; DOJ case against political consultant (2024) |
| Las Vegas mother deepfake kidnapping scam | US — Arizona | Deepfake voice impersonating daughter in ransom call | Perpetrators convicted; first state prosecution involving voice cloning (2024) |
| Drake “Heart on My Sleeve” (UMG) | US — civil | Unauthorized AI voice replica of Drake and The Weeknd | Takedown enforced; UMG filed with RIAA; civil suit filed 2024, pending |
| Jennifer DeStefano (Arizona kidnapping scam) | US — federal | Deepfake voice used in extortion scheme | Federal charges filed 2024; conviction on wire fraud and extortion |
| Sports executive voice fraud (UK) | UK | CEO voice cloned for $35M transfer request | UK NCA investigation; charges filed 2025 |
The Biden robocall case (Steve Kramer, political consultant) was the first major US criminal and regulatory action against a voice-cloning-based political influence operation. The FCC issued its first ruling explicitly stating that AI-generated voice robocalls violate the Telephone Consumer Protection Act (TCPA), applying a 1991 law to AI voice synthesis without requiring new legislation.
The Jennifer DeStefano case in Arizona — where a deepfake voice impersonated her teenage daughter in a fake kidnapping call — became one of the most widely cited examples of voice-cloning weaponization for emotional manipulation. It was prosecuted under existing wire fraud and extortion statutes, showing courts do not need AI-specific laws to prosecute voice-cloning crimes.
Sources: CNN — Arup Hong Kong deepfake (2024); FCC Ruling on Biden Robocall (2024); EFF AI case tracker.
7. Brazil: Proposed AI Legislation and Voice Rights
Brazil has a proposed AI regulatory framework under active legislative review as of mid-2026. Bill PL 2338/2023, authored by Senator Rodrigo Pacheco, establishes general AI governance principles including:
- Transparency requirements for AI-generated content.
- Prohibition on AI systems that manipulate behavior without user awareness.
- Data subject rights over voice and biometric data used in AI training.
Brazil’s existing Lei Geral de Proteção de Dados (LGPD) — the country’s GDPR analogue — already classifies voice data as sensitive personal data. Use of a person’s voice for AI training without consent is arguable as a LGPD violation under Articles 11 and 12.
Brazilian courts have not yet ruled definitively on AI-cloned voice rights, but the General Data Protection Authority (ANPD) issued guidance in 2025 treating AI-trained voice models as personal data processing requiring a lawful basis.
8. The “Heart on My Sleeve” Precedent: AI Music and Copyright
In April 2023, a track called “Heart on My Sleeve” featuring AI-generated voice replicas of Drake and The Weeknd went viral. Universal Music Group (UMG) filed takedown notices under the Digital Millennium Copyright Act (DMCA), and platforms removed the content within days. A civil suit followed.
The legal questions this case raised:
- Does an AI-generated voice replica infringe copyright in the original performer’s vocal recordings? (Unsettled.)
- Does it violate right-of-publicity? (Likely yes in Tennessee and California under current law.)
- Does UMG’s master recording copyright extend to “style” or “sound” of a voice? (Not established in court.)
No final court ruling was issued before settlement, but the case demonstrated that existing DMCA takedown mechanics are fast and effective for platform removal — even when the underlying copyright theory is unresolved.
9. Comparison Table: Key Cases and Laws
| Subject | Jurisdiction | Category | Status / Outcome |
|---|---|---|---|
| Johansson / OpenAI Sky voice | US (private) | Right of publicity dispute | Settled privately; no court ruling; Sky voice suspended |
| Tennessee ELVIS Act | US — Tennessee | State statute | In force July 2024; 17+ state copycat bills |
| California AB 2602 | US — California | State statute | Signed Sept 2024; requires AI replica consent in performance contracts |
| SAG-AFTRA AI provisions | US (labor) | Collective bargaining | Effective Nov 2023; arbitration cases active |
| TAKE IT DOWN Act | US — Federal | Federal statute | Signed 2026; 48-hour NCII removal mandate |
| NO FAKES Act | US — Federal | Proposed legislation | Senate hearings 2024; not yet passed |
| EU AI Act Article 50 | EU | Regulation | Disclosure obligations in force August 2026 |
| Biden NH robocall | US — FCC / DOJ | Criminal / regulatory | FCC $6M fine; DOJ prosecution (2024) |
| Drake / Heart on My Sleeve | US — civil | Copyright / right of publicity | Settled; DMCA takedowns enforced |
| Jennifer DeStefano extortion | US — Federal | Criminal | Conviction on wire fraud and extortion |
| Arup Engineering Hong Kong | HK / UK | Criminal | Charges filed; ongoing |
| Brazil PL 2338/2023 | Brazil | Proposed legislation | Active legislative review, mid-2026 |
10. What This Means for Voice AI Users
The regulatory direction across all major jurisdictions is consistent: consent is becoming mandatory, and enforcement is accelerating. The shift from 2022 to 2026 is significant:
- 2022: Voice cloning operated largely in a legal grey zone. Most jurisdictions had no AI-specific rules.
- 2024: Right-of-publicity statutes began covering AI voice. Criminal prosecutions under existing fraud law started.
- 2026: Federal and supranational regulation (TAKE IT DOWN Act, EU AI Act) is in force. State patchwork covers a majority of the US population. Labor contracts have AI-specific consent clauses.
For individual creators and businesses, the practical implications are:
- Obtain explicit consent before training any voice model on another person’s voice.
- Label AI-generated audio as such — required under EU law, increasingly expected everywhere.
- Contracts matter — if you produce content with performers, address AI voice replicas explicitly.
- Right-of-publicity varies by state — California and Tennessee are strictest; federal law is incoming.
At VoxBooster, we built consent requirements directly into the voice cloning workflow. You can clone your own voice or a voice where you hold explicit permission — the platform does not enable training on third-party voices without documented consent. Voice AI used responsibly, with proper consent and labeling, remains legal and powerful; the legal cases above are almost entirely about the absence of those guardrails.
Start a free 3-day trial to see how consent-first voice cloning works in practice: no credit card required, plans from $6.99/month.
FAQ
See structured FAQ in frontmatter above.
Disclaimer: This article is for educational purposes only. It summarizes publicly reported legal cases and legislation. It is not legal advice. Consult a qualified attorney for guidance on your specific situation.