Who owns a cloned face or voice?

Deepfakes, the AI Act, image rights and the DSA are colliding this month — and the answer is starting to matter commercially, not just academically.

Diego H. López 3 August 2026 · 5 min read

Yesterday, 2 August 2026, the transparency obligations under Article 50 of the EU AI Act became enforceable. If your content touches an EU audience — a synthetic voiceover, a face-swapped ad, a chatbot fronting your customer service — the question “is this disclosed as AI?” stopped being a nice-to-have and became a compliance question with a price tag attached.

For an industry built on faces and voices — media, OTT, and above all the creator economy — that's not a footnote. It's the ground shifting under the product.

What actually changed on 2 August

Article 50 imposes four separate duties, and they can stack on a single piece of content. Providers of interactive AI systems must make it obvious a person is dealing with a machine. Providers of generative AI must mark synthetic audio, image, video and text so it's detectable as artificially generated. Deployers of emotion-recognition or biometric systems must disclose that to the people exposed to them. And deployers of deepfakes — or AI-generated text published on matters of public interest — must label the content as such.

There's one piece of near-term relief: the marking duty specifically for AI-generated content (Article 50(2)) gets a grace period to 2 December 2026 for systems already on the market before 2 August — part of the Digital Omnibus package agreed by EU co-legislators in May. But the core disclosure and deepfake-labelling duties are live now, and they apply regardless of where the provider or deployer is based, as long as the output reaches someone in the EU.

The European Commission's draft guidance is useful on one point in particular: a disclosure buried in terms and conditions, or a watermark in metadata nobody sees, doesn't satisfy the duty. The label has to be perceivable at the point of interaction. That rules out a lot of what currently passes for "AI disclosure" in marketing content.

Spain moves in parallel, on image rights

On 7 July 2026, Spain's Council of Ministers sent to Congress the new Ley Orgánica de protección civil del derecho al honor, a la intimidad personal y familiar y a la propia imagen — the law that will replace the 1982 original. For the first time, it explicitly treats the commercial or advertising use of someone's voice or image via AI or similar technology, without authorisation, as illegitimate. It adds specific protection for minors and strengthens civil remedies for repairing reputational and moral harm.

This sits on top of, not instead of, the AI Act. A brand running a synthetic-voice ad campaign in Spain will soon need to clear both bars: EU-level transparency labelling, and Spanish-level consent for using someone's likeness commercially at all.

The DSA closes the loop on platforms

The AI Act governs who has to disclose. The Digital Services Act governs what platforms have to do once illegal or manipulated content is flagged. Under the DSA, Very Large Online Platforms have to act on illegal deepfakes once notified, label manipulated content, and cooperate with fact-checkers and researchers. Meta has already committed to better labelling of AI-generated deepfakes on Facebook and Instagram in response to DSA pressure. That's the enforcement layer that turns Article 50 from a paper obligation into something that actually gets a video taken down or flagged in a feed.

The precedent already running: Young v. NeoCortext

Outside the EU, the direction of travel is the same. Reality TV personality Kyland Young sued NeoCortext, maker of the face-swap app Reface, for using his likeness without authorisation to sell subscriptions. NeoCortext tried to get the case dismissed on copyright preemption and First Amendment grounds — twice — and lost both times, including at the Ninth Circuit. Courts are treating a synthetic face as someone's face for right-of-publicity purposes, not as a transformed, protected work. That's the same logic Spain and the EU are now writing into statute.

What this means if you work in media, OTT or the creator economy

Three things stop being optional. First, any contract with a creator, host or on-air talent now needs an explicit clause on AI likeness and voice use — who can clone it, for what, and for how long, because "we own the footage" no longer settles the question of who owns the synthetic version. Second, any promotional content using synthetic voice or likeness needs a visible disclosure baked into the creative, not buried in a description field, before the 2 December marking deadline closes the current grace period. Third, distribution partners and platforms are about to get stricter about labelling and takedowns under the DSA, which means content that isn't clearly marked risks friction it didn't have six months ago.

Vott's thesis has always been that distribution is the product and creators are the distribution layer. That thesis has a legal precondition nobody had to think about until now: the layer has to actually consent to being cloned. The companies that write that into contracts and creative workflows this quarter will spend less time explaining themselves to regulators next year than the ones that wait for a fine or a lawsuit to make the point for them.

Independent analysis for informational purposes. This is not legal advice; consult qualified counsel before acting on it. NeoCortext, Reface, Meta, Facebook and Instagram are referenced for commentary; all marks belong to their respective owners.