AI Avatars and Voice Cloning in Marketing: Consent to Require

AI Avatars and Voice Cloning in Marketing: Consent to Require

To clone someone's voice or build their avatar with AI in marketing, a company needs three things: written, specific and revocable consent for image and voice; a contract that says where, for how long and in which content the synthetic material can be used; and a clear notice to the audience that the content was generated or altered by AI. Without all three, the legal and reputational risk lands on the brand. This is the core of AI avatars and voice cloning in marketing consent. This article is editorial guidance and does not replace advice from a lawyer.

Key takeaways

• A generic image release does not, on its own, cover creating an avatar or a synthetic voice. The consent must mention cloning and AI generation.
• The contract should define scope, term, media, territories, prohibited uses and what happens to the voice or face model when the contract ends.
• Voice and image are personal data. When they are used to identify a person, they may call for extra care under LGPD (Brazil's data protection law), and vendors abroad raise the question of international data transfer.
• Labeling synthetic content protects both the audience and the brand. The notice belongs in the piece itself, not buried in a footer.
• Start with one small workflow, a list of permitted uses, an approval log and a named internal owner, before spreading avatars across every campaign.

Why voice and image need their own care

A person's image and voice are part of their identity. In Brazil, the Federal Constitution protects image (Article 5, item X), and the Civil Code provides that using someone's image for commercial purposes depends on their authorization (Article 20). Voice is usually treated in a similar way, and performers have related rights under the Copyright Law. In practice, nobody should assume they can simulate a person just because they hold a recording of them.

LGPD adds another layer. Voice and image are personal data, and when they are used to uniquely identify a person, they can be treated as biometric data, a category the law classifies as sensitive. The conclusion for each case depends on the use and should be validated by whoever is legally accountable for your company. The practical point is that cloning creates a new asset, the voice or face model, and that asset needs an owner, rules and an expiry date.

Cloning also changes the risk compared with an ordinary recording. A recording is limited to what was said. A voice model can say anything, including things the person would never say. That is why the consent must limit what the avatar can say, not only where it appears.

What the image and voice consent must say

A traditional image release usually talks about photos and videos from one campaign. For an avatar or synthetic voice, it has to go further. As a checklist, confirm that the document includes:

• Identification of the person, the company and, where applicable, the production company or tool vendor.
• An explicit statement that voice and image will be captured to create a synthetic model (voice clone, avatar, digital face).
• A list of permitted uses: types of campaign, channels (social media, website, ads, WhatsApp audio, customer service), languages and formats.
• A list of prohibited uses: political, religious or adult content, competitor products, statements about health or finance, and any line the person has not approved.
• The term of the consent and what happens afterward: deletion of the model, end of new content generation and the fate of what has already been published.
• Territories and languages, because an avatar speaking another language is a new use.
• The right to revoke, with a procedure and a deadline for the company to stop generating new content.
• The approval method: whether each new piece needs the person's review or whether a pre-approved base script exists.
• Information on where the data is stored and whether it is sent to vendors outside Brazil.

Avoid clauses such as "unlimited use, in any medium, forever." Besides being hard to defend, they strip the person of any control and increase the risk of a challenge.

What to require in contracts with presenters, actors and voice talent

The contract with the person lending their voice or face is the most important document in the project. A few points deserve special attention.

• Nature of the payment: separate payment for the recording session from payment for the right to generate new content with the model, so the two are not confused.
• Ownership of the model: state clearly who owns the voice or face model, who may use it and whether an agency, production company or other client can reuse it. The safest default is that they cannot.
• Limited assignment: if rights are assigned, bound them by scope, term and media.
• Exclusivity and conflicts: what the person may or may not do with other brands, and what the company may not do with their voice after the contract ends.
• A right of veto over sensitive lines and over the context of use, with a contact channel for questions.
• Audit and records: the company keeps a log of which content was generated, when and with what approval.
• Termination: a deadline to delete the model, the raw training data and any copies held by vendors, confirmed in writing.
• Minors: they require authorization from their guardians and extra caution, and it is worth asking whether cloning is really necessary.
• Deceased persons: these depend on whoever holds the rights, usually heirs, and tend to cause disputes. Treat them as an exception, with legal guidance.

Also review the contract with the tool vendor. Ask whether the vendor uses the recordings to train other models, where it stores the data, how it deletes it and who counts as the processor under LGPD.

Which legal basis to use and what to tell people about their data

When processing voice and image to create a clone, the clearest route tends to be consent that is free, informed and tied to a specific purpose, or performance of a contract when the person is hired for exactly that. Legitimate interest is usually a weak basis here, because the person rarely expects their voice to be replicated and the impact on them is high. If someone on your team proposes it, ask for the balancing test in writing.

Consent has to be specific. That means the agreement cannot be mixed in with the general terms of an engagement, and the person must be able to revoke it. If the contract is with a professional who depends on it to work, ask your legal team whether the consent is truly free, or whether another basis describes the situation better.

If the cloning tool runs on servers outside the country, the question of international data transfer comes in. The person should be told that their data may go to vendors abroad. The ANPD, Brazil's data protection authority, is the official source for guidance on processing personal data and biometric data.

Also document the life cycle: where the original recordings are kept, who can access the model, how long both are retained and how deletion is carried out. Without that, the promise to honor a revocation does not hold up.

How to label synthetic content

Labeling answers a simple question: can the audience tell that they are seeing or hearing something generated by AI? In advertising, remember that Brazil's Consumer Protection Code requires advertising to be identifiable as such, and platforms usually have their own rules for disclosing altered or synthetic content. Check each channel's current rules before publishing, because they change.

As a good-practice reference, the European AI Act treats transparency about synthetic content as a principle. It does not apply in Brazil, but it helps frame what audiences expect. The Brazilian regulatory debate is still under way, and it is worth following what the AI legal framework may mean for your company.

Practical labeling rules:

• Notice inside the piece: in video, a visible label for the whole time it plays. In audio, a spoken sentence at the very start.
• Plain language: "Voice generated by artificial intelligence with the presenter's permission" works better than a technical term.
• The same standard on every channel: if synthetic audio is sent over WhatsApp, the notice has to be there too, alongside the opt-in and outbound message rules.
• No deception about identity: the avatar should not pass as a real person in a context where the audience believes they are talking to that person.
• No synthetic testimonial presented as real: an AI-created "customer" cannot be shown as a real person.
• Keep a record of which piece was labeled, how and when.

Illustrative scenario

Imagine a chain of dental clinics that wants an avatar of its on-screen presenter for short guidance videos and appointment reminder audio. This is an illustrative scenario, not a real case.

Before any recording, the company defines which lines the avatar may say: general hygiene tips and appointment reminders. Anything about diagnosis, treatment results or price promotions is off limits without the presenter's review. The contract includes a revocation clause, a deadline to delete the model when the partnership ends and a ban on reusing the voice through another agency. Every video carries a notice that the content was generated by AI with permission. The reminder audio files open with a short sentence saying the same. One person at the company keeps the record of approved scripts.

When the presenter decides to end the partnership, the process is already written down: the company stops generating new content, confirms deletion of the model with the vendor and decides what to do with published videos, as the contract provides.

A four-step plan to start safely

The method we use in AI projects fits well here: map, limit, pilot and hand over. It is not a promise of results, it is a way to reduce improvisation.

• Map: list where synthetic voice and image would be used, who the people involved are, which tools and vendors would come in and what data would be processed. Also check which rules on AI use at the company already exist and whether they cover this case.
• Limit: define what the avatar can and cannot say, on which channels it appears and who approves each piece. Restrict access to the model to a few people.
• Pilot: choose a single real workflow, for example a series of short videos, with an approval log, labeling applied and one agreed metric, such as production time or number of revisions. Also assess the reaction of the audience and of the person who was cloned.
• Hand over: give the team the consent checklist, the contract template reviewed by legal and the revocation procedure. Then decide whether to expand, adjust or end the use.

To structure risks and responsibilities, the NIST AI Risk Management Framework is a useful public reference for organizing governance thinking, even though it is not a Brazilian standard.

Common mistakes to avoid

• Using an old event or podcast recording to train a voice without specific consent.
• Hiring an impersonator or actor to sound "similar" to a well-known person and publishing it as if it were them.
• Letting the agency or production company keep the model with no term and no deletion rule.
• Hiding the AI notice in the description, where almost nobody reads it.
• Waiting for a problem to happen before thinking about how to revoke consent.

Frequently asked questions

Can I clone the voice of an employee who already appears in company videos? Only with specific consent for cloning, even if they have already authorized the use of their image in videos. An employment relationship does not replace consent, and the employee must be able to say no, or revoke later, without consequences for their job. Record everything in writing.

Does the image release we already have cover the avatar? Generally, no. Older releases talk about photos and videos, and creating a synthetic model that can generate new content is a different use. Update the document to mention voice, avatar, AI, term, channels and revocation.

Do I need to disclose that content was generated by AI even when the presenter has agreed? Yes, it is the safest practice. The presenter's consent settles their own rights but does not settle transparency with the audience. The notice keeps viewers from being misled and protects the brand's reputation.

Who is responsible if the avatar says something wrong or offensive? In practice, the company that publishes answers to the audience and to the presenter, and may have to repair the harm. That is why the workflow should include an approved script, review before publication and a contract that defines responsibilities among the company, the agency and the tool vendor. Take this point to your lawyer before you start.

Sources

• ANPD: Autoridade Nacional de Proteção de Dados
• EU Artificial Intelligence Act overview
• NIST AI Risk Management Framework