Juan A. Esteban

Contemporary artist and independent researcher.

Illustration of Juan Esteban’s runic monogram rendered in a three-dimensional architectural style within a frame, set against a light background.

Guides

How to protect your voice, your image and your works against cloning with artificial intelligence

Verified on 26 October 2026. This guide refers primarily to Spain and the European Union framework. It offers general information and does not substitute legal analysis of a specific case.

Cloning with artificial intelligence can mean different things: reusing a recording, imitating a performance, fabricating a plausible face or voice, reproducing a protected work or mimicking a recognisable style. There is no single "right against cloning". Each use activates specific rules, with different holders, time limits and avenues, and none alone covers every case.

Protection usually depends on a combination of evidence, contracts, personality rights, data protection, intellectual property and takedown mechanisms. Before choosing a path, one must establish what has been used and how.

What has been used

A real recording. If the content incorporates or transforms an existing audio or video file, there may be reproduction of a recording, a work or a performance. Retain the original and compare fragments, pauses, noises, breaths and intonation. Also ascertain who holds the rights to the recording: producers of phonograms and audiovisual recordings have their own rights, and the master may belong to a record label, a studio or a client, not to the person appearing in it.

A performance. Anyone who sings, recites, acts or performs a work has specific rights over their performance. The Intellectual Property Law requires written authorisation to fix and reproduce it, recognises rights of public communication and distribution and protects the performer's moral right to be identified and to oppose deformations that damage their prestige or reputation.

These rights protect a specific performance. They do not grant a monopoly over any synthetic voice that resembles that of the performer.

A similar synthetic voice. If no reused recording is identified, structure the analysis with these questions:

  • Were real samples used to create the model?
  • Does the result allow a person to be recognised?
  • Are phrases or performances attributed to them that they never performed?
  • Is it presented as authentic?
  • Is there an advertising or commercial purpose?
  • Is it intended to impersonate, deceive or damage reputation?
  • Does it breach an authorisation or a prior contract?

Similarity may carry weight in an assessment, but it does not, in itself, prove an infringement. Organic Law 1/1982 expressly mentions the voice in the context of advertising, commercial, or analogous use. Outside that scope, the case may affect honour, personal data, an interpretation or recording, a contract, unfair competition, or serve as a means for other illicit conduct. It should not be assumed lawful merely because a commercial purpose is absent.

A manipulated image or video. Organic Law 1/1982 considers the capture, reproduction, or publication of a person's image and the use of their name, voice, or image for advertising, commercial, or analogous purposes to be an illegitimate intrusion, subject to applicable limits and exceptions. If the content attributes false facts, ridicules, or exposes private aspects, honour and privacy may also be involved.

Context carries weight. Commercial impersonation, information of public interest, caricature in accordance with social usage, identifiable satire or a work of fiction are not assessed in the same way. Consent must be express and may be revoked, with the appropriate compensation for damages caused. Once the intrusion is proven, the law presumes damage. Actions expire four years from the time they could have been exercised.

Personal data. A photograph, a video or a voice sample is personal data when it allows someone to be identified. They are not always special category biometric data: the GDPR reserves that consideration for the result of specific technical processing that allows or confirms unique identification.

Verify who obtained the samples, for what purpose, what legal basis they invoke, how long they retain them, whether they communicate them to third parties and whether they address rights of access, erasure or objection. As a general rule, the controller must respond within one month, extendable by a further two months when necessary due to the complexity or number of requests.

The AEPD has warned that uploading third-party images to AI systems may lead to a loss of control, retention, non-visible copies, metadata, and persistent reuse even if the result is not published. The GDPR does not apply to exclusively personal or domestic activities, but open publication generally falls outside that exception. Data of deceased persons is also governed by Organic Law 3/2018, which allows for certain actions by family members, heirs, and designated persons.

A specific work. Copyright protects original works and their specific expression. Compare composition, selection and arrangement of elements, texts, characters, forms, fragments, unique details and transformations. "It looks like my work" is too imprecise: identify which original expression appears reproduced or transformed.

In Spain, protection arises with creation. Registration or deposit may reinforce evidence, but it does not create the right. The guide "My work has been copied: how to document it and what avenues exist" develops the comparison between works and the preservation of evidence. The guide on the authorship of works made with AI addresses another question: when an author exists and what part of the result can be protected.

A style. Style, genre, technique or aesthetic vocabulary, considered in the abstract, are not usually the exclusive object of copyright. That does not make every imitation lawful. What is presented as "style imitation" may reproduce the original expression of specific works in a non-literal way, generate confusion, use another person's identity or breach a contract.

A claim gains precision if it identifies the reference works, the original elements reproduced, the proximity between those elements and the result, the possible false attribution, the confusion generated, the commercial purpose and the samples or files used. The thesis that certain stylistic imitations may be non-literal reproductions of protected expression is a recent doctrinal line, not a consolidated jurisprudential rule.

What is in force today and what is in progress

Organic Law 1/1982, the Intellectual Property Law, the GDPR and its Spanish implementing law, the Digital Services Act, and the transparency obligations of Article 50 of the AI Act, applicable from 2 August 2026, are already in force.

As of 26 October 2026, three relevant Spanish initiatives were still in the legislative process:

  • The Organic Bill on civil protection of the rights to honour, personal and family privacy, and one's own image (121/000103), published in the Official Gazette of the Cortes Generales (BOCG) on 27 July 2026, would replace Organic Law 1/1982 and expressly regulate certain uses of voice and image via AI.
  • The Organic Bill for the proper use and governance of artificial intelligence (121/000096), published in the BOCG on 12 June 2026, specifies national authorities, supervision, and sanctions.
  • The Organic Bill for the protection of minors in digital environments (121/000052) proposes introducing a specific criminal response to certain harmful deepfakes.

Until they are approved and published in the Official State Gazette (BOE), they are bills. Their wording may change and they should not be used as if they were already current law.

Regulation (EU) 2026/1744 is already in force and has amended the AI Act. From 2 December 2026, new prohibitions will apply regarding systems and uses intended to generate or manipulate non-consensual intimate material of identifiable persons and child abuse material, within the scope, conditions, and exceptions defined in the regulation. These do not cover all nudity, fiction, or non-realistic representations.

Contracts: separate the recording from the replica

Recording a performance, exploiting that recording and creating a replica capable of producing new performances are distinct operations. Before providing voice, image, master files or samples, specify:

  • Which materials are authorised and for what purpose.
  • In which media, formats and territories, and for how long.
  • Whether training, adjusting, evaluating or testing AI systems is permitted.
  • Whether synthetic voices, avatars or digital replicas may be created.
  • Whether the replica may generate phrases, gestures or performances never previously executed.
  • Which uses require prior approval.
  • Whether exclusivity exists and what remuneration corresponds to each modality.
  • Whether the use may be sub-licensed or the model assigned.
  • Who has access to the model, the derived files and the credentials.
  • How the synthetic content will be identified.
  • What happens to samples, copies and models upon termination of the contract.
  • Which records must be retained for legal or evidentiary reasons.
  • Who assumes responsibility for removal and liability regarding claims.

For works, the Intellectual Property Law limits the assignment to the modalities expressly agreed upon and excludes modalities or media that were non-existent or unknown at the time of signing. This rule refers to exploitation rights over works. Voice and image are also subject to the regime of personality rights, which are inalienable and non-renounceable, and consent may be revoked under the terms provided by law.

Do not rely on a generic authorisation for "all present and future media". If cloning is a concern, name it and regulate each use. Before signing, it may be useful to consult the relevant professional body or association. The guide "How to authorise the reproduction of a work" explains how to delimit modalities, duration, territory, exclusivity and transformations.

Prepare evidence and reserve your rights

Maintain a stable folder for each work, performance or set of samples:

/PRUEBA_DE_OBRA_E_IDENTIDAD/
├── 01_ORIGINALES/
├── 02_VERSIONES/
├── 03_PUBLICACIONES/
├── 04_CONTRATOS/
├── 05_USOS_AUTORIZADOS/
├── 06_RESERVAS_DE_DERECHOS/
├── 07_REGISTROS_Y_DEPOSITOS/
└── 08_INCIDENCIAS/

Keep the original; sketches, takes and versions; date and context of creation; authorship, performance and participants; metadata; contracts and licences; invoices, commissions and correspondence; first publication or broadcast; URL and capture; material delivered to each client; reservations of rights and hashes.

A hash demonstrates that a file has not changed since it was calculated. It does not, in itself, prove who created it or when it existed. A qualified electronic time stamp adds temporal evidence with the evidentiary effects provided for in Article 41 of the eIDAS Regulation.

European regulations allow rights holders to reserve their rights against the text and data mining exception. For content available online, the reservation must be expressed in an appropriate and machine-readable manner. Three layers may be combined:

  1. On the site. Rules or metadata directed at crawlers.
  2. In the file. Metadata or signals incorporated into the resource.
  3. Associated with the work. Identifiers and repositories that link a policy to the content.

Add a comprehensible legal notice and retain proof of when it was published. No technical signal prevents all downloading, materially obliges all crawlers or deletes previous copies. Practical configuration is available in "How to reserve your rights against data mining". The European framework is developed in "Artificial intelligence and copyright in Europe: what is decided in 2026".

When a use appears

A publication may change or disappear as soon as the party responsible receives a notice. Before contacting:

  1. Save the exact URL and note the date, time and time zone.
  2. Capture the full page, including the account, the context and the description.
  3. Download the file when it is lawful and technically possible.
  4. Retain the account identifier, biography and links.
  5. Document views, advertisements, price, sales and calls to action.
  6. Capture the synthetic content label or its absence.
  7. Save related messages, contracts and conversations.
  8. Identify the reference works, recordings, performances or samples.
  9. Calculate hashes and work on copies, without editing the originals.
  10. Archive each notice and each response.

A cropped capture may lose the URL, the account or the context. If the case may end in proceedings, there is significant economic exploitation or the evidence is at risk of disappearing, consider a formal record, expert report or professional assistance first.

Do not demand the immediate destruction of all records if you still need to prove the origin, scope or distribution. Request evidentiary preservation and cessation of use. Before publicly accusing a specific person, verify the attribution: an unfounded allegation may give rise to a further claim.

If there is fraud, threat or immediate harm, notify those who may receive false instructions, publish a denial if necessary, contact the financial institution if payments are requested and change credentials if an account has been compromised. Retain messages and transaction data. A platform removal does not replace a criminal complaint when there are indications of an offence.

On the platform, select the reason that best describes the facts: impersonation, fake account, unauthorised use of image or voice, fraud, copyright infringement, reputational damage, breach of service or lack of labelling. The Digital Services Act requires hosting providers to offer notice-and-action mechanisms. The notification must locate the content, explain why it is considered unlawful and contain a declaration of good faith. "This is made with AI" does not, in itself, identify an infringement.

If the platform restricts or does not remove the content, it must provide reasons for certain decisions and offer, where appropriate, an internal complaint-handling system and access to out-of-court dispute settlement. A complaint may also be filed with the national digital services coordinator, a function performed in Spain by the CNMC.

If personal data is being processed, contact the controller when it is possible and safe to do so. If they do not reply within the time limit or the response is insufficient, you may lodge a complaint with the AEPD. Its Priority Channel is not intended for every instance of cloning: it is limited to particularly sensitive content disseminated unlawfully that generates a serious risk to the affected person.

If there is commercial exploitation or removal is not achieved, it may be necessary to assess actions regarding honour, privacy and own image; data protection; copyright or performer's rights; breach of contract; advertising or unfair competition; fraud or other potential offences. Identifying those responsible, obtaining records or claiming damages may require procedural steps, interim measures or legal action.

Template takedown request

Adapt the text to the facts and do not attach more personal documentation than is necessary.

Asunto: Solicitud de retirada y conservación de evidencias

Identificación del contenido:
[URL, cuenta, identificador, fecha y hora de consulta].

Conducta denunciada:
[Uso no autorizado de imagen, voz, nombre, interpretación u obra;
suplantación; fraude; infracción contractual; otro].

Fundamento:
[Explicación concreta de los derechos o condiciones afectados].

Relación con la persona reclamante:
[Persona afectada, autoría, interpretación, representación o titularidad].

Medidas solicitadas:
1. Retirada o desactivación del contenido.
2. Cese de nuevas publicaciones y usos.
3. Conservación de registros y evidencias relacionados.
4. Confirmación de la decisión adoptada.
5. Información sobre el recurso disponible.

Documentación adjunta:
[Pruebas mínimas de identidad, autoría, interpretación, contrato y publicación].

Declaración de buena fe:
Declaro que la información y las alegaciones de esta comunicación son exactas y completas.

Datos de contacto:
[Nombre y correo electrónico].

Esta comunicación no supone renuncia a otras acciones.

Labelling is not equivalent to authorisation

The AI Regulation defines deepfake as image, audio or video content generated or manipulated by AI that resembles existing persons, objects, places, entities or events and may appear falsely authentic or truthful. The definition does not require proof of a subjective intention to deceive.

From 2 August 2026, two distinct obligations apply. Providers of generative systems must facilitate the marking of their outputs in a machine-readable format. Providers of systems marketed before that date have until 2 December 2026 to adapt such marking. Anyone using a system to generate or manipulate a deepfake must inform of its artificial origin, without that transitional period.

In works that are manifestly artistic, creative, satirical or fictional, the information may be provided in a way that does not hinder their exhibition or enjoyment, but the obligation does not disappear. The provider's technical mark does not replace the information that corresponds to the person publishing or using the content.

The European code of practice is voluntary. It may serve to articulate compliance measures, but adhering to it does not replace the obligations of the Regulation nor does it, in itself, guarantee conformity.

Labelling content does not authorise the use of a third party's voice, image, performance or work. Transparency and authorisation resolve different problems. The guide "Declaring the use of AI in a work: law, calls for entries and contracts" develops this duty of information.

What cannot be guaranteed

  • There is no general property right over style.
  • Resemblance does not, in itself, demonstrate an infringement.
  • Registering a work does not prevent its copying.
  • Registering a sound mark does not grant general control over voice imitations.
  • A reservation against mining does not technically prevent all collection.
  • An AI detector does not offer absolute certainty regarding the origin of content.
  • Removing a publication does not eliminate all its copies.
  • Securing a removal does not guarantee compensation.
  • Labelling a deepfake does not make it lawful.
  • Bills do not produce effects until they are approved and published.
  • Spanish or European regulations may be difficult to enforce against unidentified parties or those located outside the Union.
  • A platform may remove content in accordance with its terms without a court order, or reject a request that may subsequently succeed through another channel.

Useful protection consists of delimiting uses, preserving evidence, acting promptly and choosing the channel that corresponds to the element actually used.

Itinerary

Before publishing or contracting

  1. Identify works, recordings, performances and identity traits.
  2. Preserve originals, versions, contracts and dated publications.
  3. Delimit training, cloning and digital replicas in writing.
  4. Add understandable and machine-readable reservations.
  5. Maintain an official channel from which you can refute an impersonation.
  6. Define who will act when an incident occurs.

When you detect a use

  1. Assess whether there is an immediate risk.
  2. Preserve evidence before requesting removal.
  3. Identify which element has been used.
  4. Separate impersonation, personal data, work, performance and contract.
  5. Notify the platform with the appropriate grounds.
  6. Exercise data protection rights where appropriate.
  7. Escalate the case if there is fraud, threat, serious damage or commercial exploitation.

After removal

  1. Preserve the decision and communications.
  2. Search for copies and republications.
  3. Document damages, expenses and incidents.
  4. Review contracts and reservations.
  5. Update the protocol.
  6. Maintain evidence even if the content is no longer public.

About the open conversation

This guide distinguishes between copyright, the rights of performing artists, image rights, honour, data protection, contracts, and platform mechanisms. It does not determine which action is appropriate for a specific case. If you have utilised any of these avenues or identify an issue that requires updating, you may write to me.

Sources

Regulations and official sources

Academic analysis

Discover more from Juan A. Esteban

Subscribe to receive the latest posts by email.

Español English (UK)