Can Data Protection Law Shield the Human Voice? Evaluating the Role of the UK GDPR in Regulating Artificial Intelligence Voice Cloning

Minna Liu

doi:10.54254/2753-7048/2026.37389

Article Information

Received: 1 September 2026

Published: 29 September 2026

DOI: https://doi.org/10.54254/2753-7048/2026.37389

Article Type: Research Article

Cite this article

Liu,M. (2026). Can Data Protection Law Shield the Human Voice? Evaluating the Role of the UK GDPR in Regulating Artificial Intelligence Voice Cloning. Lecture Notes in Education Psychology and Public Media,156,71-81.

Data availability

The datasets used and/or analyzed during the current study will be available from the authors upon reasonable request.

Disclaimer/Publisher's Note

The statements, opinions and data contained in all publications are solely those of the individual author(s) and contributor(s) and not of EWA Publishing and/or the editor(s). EWA Publishing and/or the editor(s) disclaim responsibility for any injury to people or property resulting from any ideas, methods, instructions or products referred to in the content.

About this Volume

Volume Title: LNEP Vol.156

Part of Series: Lecture Notes in Education Psychology and Public Media

ISSN: 2753-7048 (Print) / 2753-7056 (Online)

Copyright & License

[1]UK Finance. (2026, June 15).Fraud remains a national security threat as criminals steal almost £1.3 billion.https://www.ukfinance.org.uk/news-and-insight/press-release/fraud-report-2026-press-release

[2]Home Office. (2026, March 9). National assessment centre fraud assessment 2025.GOV.UK. https://www.gov.uk/government/publications/national-assessment-centre-fraud-assessment-2025

[3]Starling Bank. (2024, September 18).AI voice cloning scams could catch millions out: With over a quarter of UK adults targeted in the past year.https://www.starlingbank.com/news/starling-bank-launches-safe-phrases-campaign/

[4]Jia, Y., Zhang, Y., Weiss, R. J., Wang, Q., Shen, J., Ren, F., Chen, Z., Nguyen, P., Pang, R., Lopez-Moreno, I., & Wu, Y. (2018). Transfer learning from speaker verification to multispeaker text-to-speech synthesis.Advances in Neural Information Processing Systems, 31, 4485-4495. https://proceedings.neurips.cc/paper/2018/hash/6832a7b24bc06775d02b7406880b93fc-Abstract.html

[5]Arik, S. O., Chen, J., Peng, K., Ping, W., & Zhou, Y. (2018). Neural voice cloning with a few samples.Advances in Neural Information Processing Systems, 31, 10040-10050. https://papers.nips.cc/paper_files/paper/2018/hash/4559912e7a94a9c32b09d894f2bc3c82-Abstract.html

[6]McGettigan, C., Bloch, S., Bowles, C., Dinkar, T., Lavan, N., Reus, J. C., & Rosi, V. (2025). Voice conversion and cloning: Psychological and ethical implications of intentionally synthesising familiar voice identities.Journal of the British Academy, 13(3), Article a31. https://doi.org/10.5871/jba/013.a31

[7]Copyright, Designs and Patents Act 1988, c. 48 (UK). https://www.legislation.gov.uk/ukpga/1988/48/contents

[8]Irvine v Talksport Ltd [2003] EWCA Civ 423. https://www.bailii.org/ew/cases/EWCA/Civ/2003/423.html

[9]Regulation (EU) 2016/679 (General Data Protection Regulation), as retained and amended in UK law. https://www.legislation.gov.uk/eur/2016/679/contents

[10]Purtova, N. (2018). The law of everything: Broad concept of personal data and future of EU data protection law.Law, Innovation and Technology, 10(1), 40-81. https://doi.org/10.1080/17579961.2018.1452176

[11]Data Protection Act 2018, c. 12 (UK). https://www.legislation.gov.uk/ukpga/2018/12/contents

[12]Data (Use and Access) Act 2025, c. 18 (UK). https://www.legislation.gov.uk/ukpga/2025/18/contents

[13]Information Commissioner's Office. (2026, June 19). The data use and access act 2025 (DUAA): Summary of the changes to data protection law.Information Commissioner's Office. https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-duaa-summary-of-the-changes/

[14]Nowak v Data Protection Commissioner, Case C-434/16, ECLI:EU:C:2017:994 (2017). https://curia.europa.eu/juris/liste.jsf?num=C-434/16

[15]Breyer v Bundesrepublik Deutschland, Case C-582/14, ECLI:EU:C:2016:779 (2016). https://curia.europa.eu/juris/liste.jsf?num=C-582/14

[16]Information Commissioner's Office. (n.d.). Key data protection concepts.Information Commissioner's Office. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/biometric-data-guidance-biometric-recognition/key-data-protection-concepts/

[17]Information Commissioner's Office. (n.d.). Information Commissioner's Office response to the consultation series on generative AI.Information Commissioner's Office. https://ico.org.uk/about-the-ico/what-we-do/our-work-on-artificial-intelligence/response-to-the-consultation-series-on-generative-ai/

[18]Kindt, E. J. (2018). Having yes, using no? About the new legal regime for biometric data.Computer Law & Security Review, 34(3), 523-538. https://doi.org/10.1016/j.clsr.2017.11.004

[19]European Data Protection Board. (2024, December 18). Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models. https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-282024-on-certain-data-protection-aspects-related-to_en

[20]Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). https://eur-lex.europa.eu/eli/reg/2024/1689/oj?locale=en

[21]Holtz, H. M., & Ledendal, J. (2026). AI data governance: Overlaps between the AI Act and the GDPR.Law, Innovation and Technology, 18(1), 380-409. https://doi.org/10.1080/17579961.2026.2633677

[22]Department for Science, Innovation and Technology. (2024, February 6). A pro-innovation approach to AI regulation: Government response.GOV.UK. https://www.gov.uk/government/consultations/ai-regulation-a-pro-innovation-approach-policy-proposals/outcome/a-pro-innovation-approach-to-ai-regulation-government-response

[23]Ostridge, H. (2026, May 20). AI regulation in the UK: Debate on the need for cross-sector legislation.House of Lords Library. https://lordslibrary.parliament.uk/ai-regulation-in-the-uk-debate-on-the-need-for-cross-sector-legislation/

[24]Information Commissioner's Office. (n.d.).Guidance on AI and data protection.https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/

[25]Information Commissioner's Office. (n.d.).What about fairness, bias and discrimination?https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/how-do-we-ensure-fairness-in-ai/what-about-fairness-bias-and-discrimination/

[26]European Commission. (2026, June 10).Code of practice on transparency of AI-generated content.https://digital-strategy.ec.europa.eu/en/policies/code-practice-ai-generated-content

[27]Information Commissioner v Clearview AI Incorporated [2025] UKUT 319 (AAC). https://caselaw.nationalarchives.gov.uk/ukut/aac/2025/319

[28]R (Bridges) v Chief Constable of South Wales Police [2020] EWCA Civ 1058. https://www.judiciary.uk/judgments/r-bridges-v-cc-south-wales/

[29]Garante per la protezione dei dati personali. (2026, July 23). Provvedimento n. 577 (doc. web n. 10281021), reported in Rijo, L. (2026, August 7), Mediaset faces 30-day deadline after Italy bans Mentana deepfakes.PPC Land. https://ppc.land/mediaset-faces-30-day-deadline-after-italy-bans-mentana-deepfakes/

[30]Cross-Border Data Forum. (2026, March 19).Generative AI and GDPR enforcement in Europe: A lot of noise, one fine, zero survivors.https://www.crossborderdataforum.org/generative-ai-and-gdpr-enforcement-in-europe-a-lot-of-noise-one-fine-zero-survivors/

[31]Meta Platforms Inc v Bundeskartellamt, Case C-252/21, ECLI:EU:C:2023:537 (2023). https://curia.europa.eu/juris/liste.jsf?num=C-252/21

[32]Schrems v Meta Platforms Ireland Ltd, Case C-446/21, ECLI:EU:C:2024:834 (2024). https://curia.europa.eu/juris/liste.jsf?num=C-446/21