Hearing your own voice come out of a machine you never authorized does something strange to you. That odd feeling of being stripped of your working tool, the one you thought French law protected.
That is what happened to me in May 2026 on Fish Audio, a voice cloning platform, where my voice had been cloned on two different accounts.
Here is the full story. The exact procedure that got these models removed in under a day, step by step. And above all what I found out afterwards, when the platform swore to me in writing that everything had been erased, while my voice was still generating fresh audio right in front of me.
As a French voice over artist, I work from public demos, which is most likely how the clone was built in the first place.
Finding Out My Voice Had Been Stolen
Emma Harvey, a voice over agent in the United Kingdom, found voices she represents on Fish Audio, cloned without permission. Her LinkedIn post in mid May tipped me off, and I went to check my own right away.
It was there, on two different pirate accounts, one of which had literally named the clone after me, Estelle Hubert, spelled out in full. Sloppy work, and one telling detail: the listing under my name had barely been used, while the other, anonymous one, already counted more than 250 generations. The counter is not the real issue. What is disturbing is seeing your voice on a self service shelf, ready to say anything to anyone, without a single person ever asking me.
From listening to the whole catalogue to check whether my voice was hiding elsewhere, I recognized a good dozen colleagues, all alerted right away. And then I came across my daughter Florine’s voice, cloned under a pseudonym, with almost 14,000 generations.
You do not need to be famous to end up there. You run into politicians, news anchors from French prime time TV, heavily followed YouTubers, but also far more discreet colleagues who make a living from their voice and their work, robbed in exactly the same way. Qualified theft, on a massive scale.
How do all these voices end up there? Scraped, most likely, from sites and demos that are freely accessible. A few months earlier, my site had taken an abnormal traffic spike, close to 18,000 loads in a single day, the typical fingerprint of a bot vacuuming up everything in its path. A single sample is then enough to build a clone.
What the Law Actually Says
Cloning a voice without consent is no grey area. Several texts frame it. I am not a lawyer, so I put the precise references at the bottom of the page.
The most useful lever sits on the data protection side, and it works the same across the whole European Union. A voice is biometric data under the GDPR (Article 9), and on that basis it opens a right to erasure (Article 17). Remember that word, erasure, we will come back to it, because it is the whole knot of this story.
The fastest lever in practice is reporting. A platform hosting manifestly unlawful content is required to take it down as soon as it is notified, under the European Digital Services Act (Article 16 of the DSA). That is exactly what brought my clones down.
In France, on top of that, the criminal layer is real. Since the SREN law, publishing AI generated fake audio that reproduces a person’s voice without consent is an offence, up to two years in prison and 45,000 euros when it is put online (Article 226-8 of the Criminal Code). A performer’s voice is also a performance protected by neighbouring rights, and reproducing it without authorization can amount to infringement. If you are outside France, look up the equivalent in your own jurisdiction, but the GDPR and the DSA already cover you anywhere in the EU.
The deeper problem lies elsewhere. Today, the burden is on the victim to prove they never gave consent. The burden of proof is reversed. A bill passed by the French Senate in April 2026 wants to flip that logic onto AI providers, but it is not yet enacted.
Removing a Cloned Voice From Fish Audio, Step by Step
A plain email to Fish Audio support had gone unanswered for a week. What unlocked everything was their official claim procedure, the one that actually triggers a takedown. Less than a day, after that, for the reported models.
Here is exactly where to click and what to fill in.
1. Open the cloned model’s page. On the model page, find the three dot menu, top right.
2. Click “Report model”. A “Contact support” window opens.
3. Change the request type. This is the trap to avoid. By default, the type is set to “Report model”. You have to switch it to “Copyright complaint”. That option, and only that one, opens the real takedown procedure for rights infringement.
4. Write the description, in English. That is their support language. Firm and factual: who you are, the model at issue, the absence of consent, the legal framework, the clear demand for permanent removal. Here is the text I used, to adapt to your situation and paste into the description field:
Hello,
I am [your name], a professional voice actor. The model "[model name / ID]" reproduces my voice without my consent. I never authorized the creation, upload or use of any voice model based on my voice. My voice is a protected performance and personal biometric data. This is an unlawful use under EU law (GDPR and the Digital Services Act) and French law. I formally request the immediate and permanent removal of this model. My public demo pages, where my real voice can be verified, are available at: [your website / demo URLs]. Contact: [your email].5. Enter your contact details and references. Give a contact email and the address of your public demo pages. They are used to verify the voice is really yours.
6. Attach an audio proof if you have one. It is not strictly mandatory, but it is the most convincing piece: an excerpt of the original production, the one whose voice fed the clone. And it is often easy to find. The text shown on the model page, the default sample, draws heavily on a public production: a demo, a commercial, a documentary. In my case, I recognized excerpts taken from my own site.
And even without that audio, the platform has everything it needs to decide. Comparing an original voiceprint with a cloned model, checking that the curves line up, that is their core business. A stolen voice leaves a signature, and they know perfectly well how to read it. That is why they ignore vague claims like “it sounds like my voice”, but act fast on a documented case they can verify internally.
7. Send. An acknowledgement arrives immediately, with a case number. For me, the models came down the same day.
Fish Audio support, June 1: “the flagged model has been successfully taken down from our platform. (…) Broadly scanning our platform or monitoring private user data for ‘similar’ content is legally and technically unfeasible, as it would violate user privacy and exceed our obligations as a service provider.”
Savour the asymmetry. To clone my voice, nobody had to prove a thing. To get it removed, the burden is on me to supply the exact links, the evidence, and to comb back through the whole catalogue, clone by clone. They search for nothing, they take down what you point at, and nothing else. The thief walks in without a key, the victim has to show her papers.
At this stage, you think you are in the clear. That is where my story takes a turn.
The Removal Worked. It All Went Wrong After
Here is the part nobody tells, and it changes everything.
Once the listings were down, I wanted to be sure. Not just to make the models unfindable, but to obtain their actual erasure. So I demanded full deletion.
The answer came back, in black and white: each model was “completely and permanently disabled”, access “revoked for all accounts” including those who had favorited it, the system “entirely non functional”, nobody could use it anymore.
The Fish Audio Team, June 2: “When a model is taken down due to a copyright or data protection request on our platform, it is completely and permanently deactivated. (…) The takedown process automatically and immediately revokes, severs, and blocks access for all accounts across the entire platform. (…) The model becomes entirely non-functional system-wide, and no one can use it anymore.”
That same day, I tested from my own account. My voice and my daughter’s were still generating fresh audio, without the slightest hitch, from my favorites. The written statement was false. I documented everything: dated audio files, time stamped screenshots.
Faced with the evidence, the platform eventually spoke of a “technical synchronization bug” that had let the favorite links bypass the deactivation. They announce a fix, and this time access really is cut.
The Fish Audio Team, June 3: “We discovered a technical synchronization bug that caused certain bookmarked links to temporarily bypass the deactivation protocol. We have now deployed a permanent fix for this bug. (…) if you discover that any of these models can still be accessed or utilized in any way whatsoever, please notify us immediately.”
The best part is the end of their message: they thank me. Thanks to my report, they found a bug on their side. So I spent my evenings proving that my voice was still running, only to end up as the unpaid customer support of the platform that hosts it.
Read the sequence carefully. You are told in writing that everything is dead. You prove the opposite in minutes. You are told it was a bug. The lesson fits in one sentence: their word is worth nothing until it is verified, and cutting access is still not erasing.
Removal, Deactivation, Erasure: Three Different Things
This is the most important nuance in the whole article, so let me state it plainly.
Removal takes down the public listing. You no longer stumble on it, you can no longer call it up online. The shop window is shut.
Deactivation cuts access to the model. Better, but the model itself is still sleeping on their servers. One bug, one restore, one transfer, and it is back. That is exactly what happened to me.
Erasure is the only thing that truly counts: the permanent deletion of the model, of the source sample, of the training data and of every backup. That is what the GDPR sets out in black and white, and that is what you have to demand.
Until I have written confirmation of that real erasure, I consider that my voice is still sleeping somewhere on their servers. To this day, I do not have it.
How to Demand Erasure, the Email to Send
Removal goes through the platform form. Erasure goes through their legal team. The address exists, here it is: legal@fish.audio.
That is the email most people forget, and it is the one that changes everything. Once the listing is down, write to them demanding erasure under Article 17 of the GDPR. Here is a template, to adapt, in English like their team:
Dear Fish Audio Legal Team,
I am [your name], a professional voice actor based in the EU. My voice is personal data concerning me, including biometric data under Article 9 of the GDPR.
A voice model reproducing my voice was created on your platform without my consent (case reference: [your case number]). The public page has been removed, but removing or deactivating a model is not erasing it. As long as the model and its associated data remain stored on your systems, a bug, a restore or a transfer can make it operational again.
Under Article 17 of the GDPR, I formally require:
1. The actual, complete and irreversible erasure of the voice model and of all associated data, including vector embeddings, training data, derived files and all backups.
2. The revocation of any remaining access for every account that had saved, favorited or used this model.
3. Written confirmation of the effective erasure, distinct from a statement of deactivation, specifying the method, the date, and the systems and backups covered, attesting that no copy or backup remains and that the model cannot be restored, signed by a named person.
Please also provide the contact details of your EU representative under Article 27 of the GDPR.
Failing written confirmation within a reasonable deadline, I reserve the right to lodge a complaint with the relevant data protection authority.
Sincerely,
[your name]Three demands never to let go of: real and irreversible erasure, revocation of any remaining access, and written confirmation, dated and signed, distinct from a simple “deactivation”. Without that confirmation, you have obtained nothing definitive.
Why I Didn’t Press Charges
This is not resignation. I took advice, and the lawyer who defends the class action of French dubbing actors against these platforms was ready to represent me. I chose not to go there, with full knowledge of the facts.
My direct loss amounts to a few dozen generations, where an intellectual property lawsuit against an international company runs into thousands of euros and years of proceedings. Since I have always worked as an independent, without performer’s residuals, I do not have access to the collective funding that would absorb those costs. At the scale of a single person, the maths does not hold.
Above all, and this is the real point, a lawsuit would not solve the heart of the matter: erasure. What I want is for my data to be gone for good, and the fastest lever for that is the right to erasure and collective pressure, not an endless individual procedure.
The judicial route keeps all its meaning in two cases: a massive, demonstrable loss, or a well structured class action that pools the costs. That is exactly what Maitre Elkaim’s team and the trade organizations are carrying, and their fight is only beginning. If you are affected and the loss is heavy, that is the way to go.
Cloned Voice: What You Can Do Right Now
If you make a living from your voice, go and check, and not just by typing your name. Many clones carry none, or hide under a pseudonym. I found colleagues whose voice was running without the slightest mention of their identity, and my own most used clone did not carry my name either. Dig, listen to the French voices in your register, hunt for your own inflections.
Do not trust the quality. These clones are often crude, you barely recognize yourself, but they sound close enough to fool a rushed ear and do harm. If you find yours, you now know how to react: the procedure in this article takes a listing down in under a day, and the email to legal@fish.audio sets off the rest.
Document everything, even if you do not attack: screenshots, dates, audio. And test for yourself after each reply from the platform, rather than taking their word for it. My strongest file is the proof that their erasure statement was false. A ready file is a strength the day you need it. And if you recognize a colleague’s voice, warn them. Word of mouth between us is still our best alarm.
But the real issue is wider, and it makes my blood boil. Today, for lack of a law that is truly enforced, our only alarm is ourselves: it falls on us to comb the catalogues, to recognize one another’s voices, to warn one another between peers. We fend for ourselves to defend work that is being stolen, while the law drags. In France, dubbing actors have their unions, their class action, their lawyers. We, the independents of voice over, are represented by no one. As long as we stay isolated, we will report our clones one by one while the platforms churn out a thousand more.
Band together around a voice over association? That is a full time job. And me, I am a French voice over artist.
Frequently Asked Questions
Go and listen on the mainstream voice cloning platforms: Fish Audio, ElevenLabs, PlayHT and others. Search your name, but above all dig and listen, because many clones are anonymous or under a pseudonym. A French voice that picks up your inflections is already a signal.
On the model page, open the three dot menu, choose “Report model”, then the type “Copyright complaint”. Write a firm description in English and attach an excerpt of your original production. Removal usually lands within 24 to 48 hours.
No. Removal takes down the listing, and even an announced “deactivation” guarantees nothing: in my case, the platform stated in writing that everything was deactivated while I was still generating fresh audio the same day. For real deletion, you must demand the erasure provided by Article 17 of the GDPR, in writing, from their legal team (legal@fish.audio).
Deactivation cuts access, but the model stays stored on the servers and can become active again after a bug or a restore. Erasure permanently deletes the model, the source sample, the training data and the backups. Only erasure ends the risk.
Yes. A voice is biometric data under the GDPR, which gives you a right to erasure. In France, publishing AI generated fake audio that reproduces your voice without consent is also a criminal offence, up to two years in prison and 45,000 euros when it is put online (Article 226-8 of the Criminal Code). Your voice is further protected by neighbouring rights.
No. The reporting procedure and the GDPR erasure request are free and require no lawyer. The judicial option only becomes relevant for a heavy loss, and preferably through a class action that pools the costs.
Once the file is properly submitted, with the right request type and an audio proof, count from a few hours to 48 hours. A plain email to support, on the other hand, can go unanswered. Full erasure, however, can take several follow ups.
Sources and Useful Links
Legal framework
- Right to erasure, GDPR Article 17 (official EU text): EUR-Lex
- Digital Services Act, Article 16 (notice and takedown by the host): EUR-Lex
- France, Article 226-8 of the Criminal Code (SREN law of 21 May 2024): Legifrance
- France, neighbouring rights of the performer, Article L.335-4 of the Intellectual Property Code: Legifrance
Take action
- Fish Audio terms and DMCA policy: fish.audio
- Fish Audio legal team for GDPR erasure: legal@fish.audio
- Find your EU data protection authority: European Data Protection Board
- France, file a complaint with the CNIL: cnil.fr
- United Kingdom, report to the ICO: ico.org.uk
- Report a cloned voice to NAVA (North American Voice Actors): navavoices.org
The collective fight
- United Voice Artists: unitedvoiceartists.com
- LesVoix.fr, on AI voice cloning: lesvoix.fr
- France, class action of dubbing actors (Maitre Jonathan Elkaim, Hiro Avocats): hiro-avocats.com