Written by Rajat Singh,
Lex Lumen Research Journal Summer Intern,
June 2026
The machine that stole her voice:
In May 2024, Scarlett Johansson heard her own voice come out of a machine she had already refused to work with. OpenAI launched a ChatGPT voice assistant called Sky that month trained on her films, her interviews, her performances reassembled into a commercial product without her consent, her contract, or her credit. She objected publicly. OpenAI paused the voice. No court acted. No compensation was paid. No statute called it theft. Her voice had built a billion-dollar product and she received nothing in return. The machine moved on.[1]
That same pattern played out differently in October 2023. A dental clinic ran an AI-generated advertisement featuring Tom Hanks endorsing their services. He had never filmed it. He warned his own Instagram followers because no legal mechanism existed to pull the advertisement before it had already spread.[2] Sitting in the corridors of the Bombay High Court Nagpur Bench, one observes exactly this gap at work by the time a plaint reaches a judge, a thousand products have already been sold using another’s face.
What is actually happening:
Voice cloning reconstructs a person’s full vocal pattern from a few seconds of audio. Deepfake technology places a person’s face onto video they never recorded. Facial scraping harvests images at scale to build biometric databases without consent. Over 95,820 deepfake videos were detected online in 2023 alone. AI tools now clone a voice from as little as three seconds of audio.[3] Between 2020 and 2023, Clearview AI scraped thirty billion facial images from social media, selling database access to law enforcement agencies across five countries before facing regulatory bans and fines in the United States, United Kingdom, Australia, Italy, and Canada.[4] In April 2023, an AI-generated track titled Heart on My Sleeve used Drake’s voice without copying any single existing recording. The AI had learned his vocal pattern absorbed it, rebuilt it from music he had publicly released over years. The track reached millions of streams before its removal. No copyright was technically infringed because copyright protects copies, not patterns. The law had no answer. The law was built for a world where stealing meant taking something away. AI does something different it learns from you, replicates you, profits from you, and returns nothing. The person whose voice built the product owns nothing. The company that processed it owns everything. That is the injustice the law has not solved.
Indian law failure, three layers of silence:
The first statutory gap sits inside the Information Technology Act, 2000. Section 43A creates a right to compensation where a company fails to protect sensitive personal data.[5] But the Sensitive Personal Data Rules, 2011 list protected categories exhaustively and voice prints, facial geometry, and biometric replicas appear nowhere in that list.[6] Passwords are protected. Financial records are protected. Your face is not a protected category under Indian statute.
The second gap is in the Digital Personal Data Protection Act, 2023, passed in August 2023. The Act acknowledges biometric data broadly, but its implementing rules remain pending as of 2025. Nowhere in its text is there any provision addressing AI-generated replicas of a person’s voice or face. No deepfake liability clause exists anywhere in the Act. This is not a drafting oversight it is a failure of legislative imagination at a moment when the technology was already operating at scale.
The third gap is in judicial remedy itself. In 2023, the Delhi High Court granted an injunction protecting Anil Kapoor’s name, image, voice, and likeness from AI-based commercial misuse India’s first recognition that personality rights extend to AI exploitation of identity.[7] The court grounded this right in Article 21, read with the nine-judge Constitution Bench ruling in Justice K.S. Puttaswamy v. Union of India, (2017) 10 SCC 1, which unanimously held privacy to be a fundamental right.[8] But a court order is not a statute. It protects those who can afford to litigate and no one else. A schoolteacher whose face appears in a fake advertisement, a voice actor whose vocal pattern is cloned without a contract neither receives any remedy under this precedent.
The Copyright Act, 1957 offers no rescue either.[9] It protects a recorded performance, not the performer’s voice itself. When an AI absorbs a vocal pattern without copying any specific recording, no infringement occurs. Copyright protects the song, not the singer’s soul.
What other countries built:
California’s Civil Code Section 3344, enacted in 1971, gives every individual not just public figures the right to prevent commercial use of their name, voice, or likeness without written consent.[10] Tennessee went further in March 2024 with the ELVIS Act, the first US state law specifically prohibiting AI voice replication without consent.[11]
The European Union approached the same problem through two instruments. The EU AI Act, adopted in 2024, classifies biometric categorisation systems as high-risk and bans real-time facial recognition in public spaces. GDPR Article 9, in force since May 2018, treats biometric data as a special category requiring explicit consent before any processing begins.[12] The architecture is proactive: harm is prevented before it occurs, not compensated after. India has none of this no Right of Publicity statute, no deepfake-specific provision, no biometric protection equivalent to GDPR Article 9. The only path available is reading Article 21 broadly through expensive constitutional litigation a route most ordinary people cannot sustain.
The legal reform India needs:
Three reforms would close the gap. First, a statutory Right of Publicity one that makes every person’s name, voice, face, and digital likeness a default property right, available to every citizen regardless of fame or the ability to fund litigation. The Anil Kapoor judgment of 2023 is a useful beginning, but a court order is not a legislature. A statute would protect the schoolteacher and the voice actor, not just those who can afford senior counsel at the Delhi High Court.
Second, the DPDP Act, 2023 must be amended through implementing rules to explicitly classify AI generated biometric replicas voice clones, deepfake faces, reconstructed facial geometry as sensitive personal data requiring prior written consent before any commercial processing. The Act already uses the language of consent. It needs only the will to extend that language to the forms of exploitation currently falling outside it.
Third, a strict liability clause must make companies that commercially exploit AI-cloned identities liable without requiring the victim to prove fault or intent. A deepfake victim rarely knows who built the tool, who trained it, or which company profited. The burden must sit with the company that controls the technology, not the person whose identity was stripped from them.
Conclusion
The law was built for a world where stealing meant taking something away. AI takes you, copies you, profits from you, and returns nothing. Clearview AI built a surveillance database from thirty billion faces that never consented to be catalogued. Drake’s voice sold millions of streams for a track he never recorded. Scarlett Johansson’s voice sold a product she had explicitly refused to endorse. Tom Hanks sold dental insurance he knew nothing about. Until India legislates a statutory Right of Publicity, your voice and your face remain legally ownerless the moment a machine learns from them. The question is not whether this is wrong. The question is how much longer the law will look away.
References
[1] OpenAI, Scarlett Johansson and OpenAI, Statement by Scarlett Johansson (May 2024).
[2] Deeptrace Labs, The State of Deepfakes 2023, Deeptrace Report 1, 4 (2023).
[3] ElevenLabs, Voice Cloning Technology (2023).
[4] FTC v. Clearview AI, FTC File No. 202 3136; see also ICO Penalty Notice, Clearview AI Inc., UK Information Commissioner’s Office (2022).
[5] Information Technology Act, 2000, No. 21, Acts of Parliament, S. 43A (India
[6] Information Technology (Sensitive Personal Data or Information) Rules, 2011, Rule 3 (India).
[7] Anil Kapoor v. Simply Life India & Ors., CS(COMM) 389/2023 (Del. H.C. 2023).
[8] Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1.
[9] Copyright Act, 1957, No. 14, Acts of Parliament, S. 57 (India).
[10] Cal. Civ. Code S. 3344 (West 1971).
[11] Ensuring Likeness Voice and Image Security (ELVIS) Act, Tenn. Code Ann. S. 47-25-1101 et seq. (2024).
[12] Regulation (EU) 2024/1689, European Parliament (EU AI Act), 2024 O.J. (L 1689); A.B. 602, 2019 Cal. Stat. ch. 491 (codified at Cal. Civ. Code S. 1708.86) (2019).
