Voice data and privacy

A voice is not just a way of carrying words. From a recording you can read off who is speaking, their approximate age and sex, their dialect and first language, their emotional state, and in some cases indications of health.

That makes voice data something other than text. And unlike a password, you cannot change your voice once it has leaked.

Two distinct things that are often confused:

• Speaker recognition — who is speaking? (biometrics)
• Speech recognition — what is being said? (transcription)

The first is always sensitive. The second becomes sensitive through its content.

The legal position in the EU. Voice data used to identify a person is biometric data and belongs to the special categories in GDPR Article 9. Processing is as a rule prohibited unless an exception applies — in practice most often explicit consent, which has to be freely given, specific, informed and as easy to withdraw as to give.

If the recording is used only to transcribe what is said it is «ordinary» personal data (Article 6) — but the content can still be sensitive.

The EU AI Act adds: real-time remote identification in public spaces via biometrics is heavily restricted, and emotion recognition in workplaces and in education is prohibited. That last point is directly relevant to learning platforms — a feature that judges a pupil's emotional state from their voice is not a design question but not permitted.

Safeguards that actually make a difference:

Measure	Effect
Transcribe and delete the audio	removes the biometrics entirely
Store an embedding instead of the audio	less reconstructable, but still biometric data
Edge transcription (on the device)	the audio never leaves the device
A short retention time with automatic purging	reduces the exposure
Separate keys and strict access control	limits the damage in a breach

Voice cloning. A few seconds of audio is enough today to generate convincing speech in somebody's voice. The consequences are concrete: fraud against relatives, circumventing voice-based authentication (which should therefore no longer be used alone), defamation and harassment. A voice as the sole authentication factor is no longer defensible.

The countermeasures resemble those for images: watermarking and provenance can establish authenticity, but the absence of a mark proves nothing. The effective protection is procedural — calling back on a known number, an agreed code word within the family, two-factor authentication that is not built on a voice.

Assess a real design. AI-grafen could let pupils practise oral presentation by recording themselves and getting feedback.

Work through the questions in order:

1. What is the purpose? Feedback on content and structure — not identifying who is speaking.
2. Is the audio needed after the transcription? No, for content feedback; yes, if pronunciation is to be assessed.
3. The legal basis? Explicit consent; for children under 13, the guardian's.
4. Storage? The transcript is kept, the audio is deleted after processing — or kept for a maximum of 30 days if pronunciation is to be assessed, with clear information.
5. What is prohibited? Emotion recognition in an educational setting — even if it would be technically easy and «only» used to detect nervousness.
6. What happens if they decline? The pupil must be able to do the same task without recording.

Point 6 is what decides whether the consent is freely given. If there is no way round it, it is not consent.