Is voice cloning with ElevenLabs a privacy problem? Voice can count as biometric data under some privacy laws, and ElevenLabs’ terms put it on you to hold the rights to any voice you upload, which in practice means the speaker’s consent.
Plain-English risk rating: 4 of 5 (Free/Starter/Creator) / 3 of 5 (Pro/Scale) / 2 of 5 (Enterprise with custom DPA)
ElevenLabs sits high on the consumer-AI risk axis for reasons different from any other vendor in this database. Voice can be biometric data: when it is used to identify a person, laws such as the EU GDPR, California's CPRA and Illinois' BIPA treat it as sensitive, and ElevenLabs' own Privacy Policy says it “may be handling biometric or sensitive or special category data under some laws”. When you clone a voice in ElevenLabs, you are generating biometric material that has different legal protections than text or image data.
The second material risk: ElevenLabs' February 2025 Terms of Service update introduced a "perpetual, irrevocable, royalty-free, worldwide license" for voice recordings. ElevenLabs says it will not keep data it generates about your voice for more than 3 years after your last interaction, and the licence ElevenLabs takes in the models and derivatives created from them is perpetual. That licence is a rights question rather than a permanent inability to remove the model: the Terms let you request deletion of a User Voice Model through your account. The third: voice-cloning tools, ElevenLabs among them, can be misused for voice scams (CEO impersonation, vishing), so an ElevenLabs API key held in a form that can be stolen is a substantial business risk.
Recommended for
- Sole proprietor (content creation): Creator plan at $22/month is acceptable for narration, podcast intros, character voices for fiction. Do not upload voice recordings of identifiable third parties without explicit consent.
- Small team (2-10 people): Pro at US$99 a month, or Scale at US$299 a month (3 seats) with strict access controls on API keys. Document who has access and rotate keys quarterly.
- Regulated industry: Enterprise tier only, with a custom Data Processing Addendum, biometric data handling provisions, and explicit no-training contract terms. Voice biometrics in healthcare or finance contexts require legal review under BIPA, GDPR Article 9, or sector-specific regulation.
- The honest answer for most 1-10 employee businesses: Output quality is the main reason businesses choose ElevenLabs. If you need that quality, use Pro or higher with strict key management. Treat any voice recording you upload as biometric material with the legal weight of biometric material, and never clone the voice of a person who has not given explicit, documented consent.
Critical pre-deployment warning (API key management)
This is the most important sentence in this profile: An exposed ElevenLabs API key lets someone else generate cloned speech on your account, at your cost and under your name.
Cloned voices can be used for vishing (voice phishing) and financial fraud. Attackers actively scan for exposed ElevenLabs API keys in GitHub repositories, accidentally-committed environment files, and breached SaaS systems because each key can be used to generate cloned speech, up to the account's limits, for CEO impersonation, supplier-account fraud, and family-emergency scams. ThreatNG and other external attack surface management vendors specifically flag exposed ElevenLabs keys as high-priority remediation.
Mitigations: store API keys in a dedicated secrets manager (1Password, AWS Secrets Manager, HashiCorp Vault), never commit to source control, rotate quarterly, monitor usage logs for unusual activity, and treat any unexpected character billing as potential compromise.
Data retention default
- Free, Starter, Creator: Voice recordings retained while the account is active; generated outputs per standard retention. The published ceiling is three years: ElevenLabs states it will not keep data it generates about your voice longer than 3 years after your last interaction, except as required by law. Note the wording – that covers the data it generates about your voice, the derived Voice Data, which is not identical to the raw recordings you uploaded. Biometric data collected for verification is held until no longer needed or 3 years after the relationship ends, whichever comes first.
- Pro, Scale: Same defaults; configurable retention windows for some data classes
- Enterprise: Custom retention available with appropriate contracting; 30-day post-deletion backup retention per the Trust Center
- Voice clones (cloned voice models): You can request deletion of your User Voice Models through your account – the Terms provide for it, and the privacy policy covers deletion of your account and the Voice Data attached to it. Corrected 20 September 2026: this item previously said the derived model is retained under the February 2025 perpetual licence clause. That overstated the position and contradicted the training section on this same page. What the perpetual licence covers is ElevenLabs' rights in the model, not an inability to have it deleted. See Corrections.
- Raw recordings: ElevenLabs' Terms of Use refer retention of uploaded recordings to the Voice Processing Notice in its Privacy Policy. The published 3-year ceiling covers data generated about your voice; we found no separate period for the raw recordings. Corrected 25 October 2026: this line said raw recordings are deleted after 3 years of inactivity under the February 2025 terms; the current Terms and Privacy Policy (9 October 2026) do not say that. See Corrections.
- What genuinely cannot be undone is the contribution your data already made to ElevenLabs' foundation models before you opted out. The opt-out is prospective only and applies to data provided after it is submitted; deleting a voice model does not reverse that.
Training opt-out
ElevenLabs' Privacy Policy (9 October 2026) describes one training opt-out, with no difference by plan:
- Free, Starter, Creator: training is ON by default. ElevenLabs provides an opt-out, not an opt-in – its privacy policy lists the right to “opt out of our use of your Personal Data for training”, and gives research and development of AI models a legitimate-interest legal basis, falling back to consent only where a law requires it. To turn it off: the ‘Data use’ menu, under ‘Terms and Privacy’ in your account settings.
- Pro, Scale, Business: the same opt-out. The Privacy Policy states no different default for paid plans.
- Enterprise and other business customers with their own contract: ElevenLabs says that “the business customer's contract with us, not this Policy, governs how we use the information”. Check what your contract says about training.
- The opt-out is prospective only. ElevenLabs states plainly that it “will only apply with respect to Personal Data provided or made available following the submission of the opt-out”. Anything already submitted may already sit in a training set, and switching the toggle does not pull it back out. Opt out before you upload, not after.
- What you can and cannot undo. You can delete your voice model – the Terms let you request deletion of User Voice Models through your account, and the privacy policy covers deletion of your account and the Voice Data attached to it. What you cannot reverse is the contribution already made to ElevenLabs’ foundation models before you opted out. Earlier versions of this profile framed this as derivatives being permanently beyond your reach; that overstated it, and the accurate position is the narrower one.
The distinction between "training data" (used to improve ElevenLabs' foundation models) and "derivatives" (the voice clones themselves) matters. The former may have opt-out; the latter is covered by the perpetual licence, which grants ElevenLabs rights in the model rather than preventing you from having the model deleted.
Zero Data Retention availability
- A “Zero Retention Mode” exists. ElevenLabs' Trust Center ties HIPAA coverage for Text to Speech, Speech to Text and ElevenAgents to it being switched on; for ElevenAgents, agent configuration data is still kept. We have not confirmed which plans can turn it on. (Corrected 3 October 2026: this line said zero retention was not offered.)
- Enterprise customers can negotiate custom data handling terms including faster deletion timelines
- The character-based billing model logs per-request metadata that increases compliance surface area at scale, per Deepgram analysis (March 2026)
Plan tiers and pricing (read 24 October 2026; monthly billing, excluding tax)
| Tier | Price (USD) | Voice cloning | Suitable for |
|---|---|---|---|
| Free | $0 | Limited; no commercial use | Personal experimentation only |
| Starter | $6/month | Instant voice cloning; commercial licence | Personal projects |
| Creator | $22/month | Adds professional voice cloning | Individual content creators |
| Pro | $99/month | Higher quotas; 44.1kHz PCM via API | Small businesses with regular voice content needs |
| Scale | $299/month | 3 workspace seats, team collaboration | Small teams |
| Business | $990/month | 10 workspace seats | Mid-size businesses |
| Enterprise | Custom | Custom DPA and SLAs; BAAs for HIPAA customers; custom SSO | Larger organisations needing custom contracts |
Free plans are explicitly restricted to non-commercial purposes per the February 2025 ToS update. Downgrading from a paid plan to a lower tier may cause loss of commercial usage rights for voices created on the higher tier.
Jurisdiction
- Primary processor: Eleven Labs Inc., with its data protection office in New York, USA. For the EEA, UK and Switzerland the controller is ElevenLabs Poland sp. z o.o. (Privacy Policy, 9 October 2026).
- Cloud infrastructure: Multi-cloud (specifics not fully disclosed in primary documentation)
- Data processing locations vary by plan and configuration; EU customers can request EU-resident processing
- Subject to GDPR Article 9 (biometric data) for EU customers, BIPA (Illinois) for Illinois-resident customers, CCPA/CPRA for California-resident customers
- Subprocessors disclosed in the Data Processing Addendum (April 2026 update)
- Outside AI model providers are in the path. ElevenLabs' sub-processor list names Google Cloud (including Gemini and Anthropic models in ElevenAgents via Vertex AI), Anthropic, OpenAI and, if you switch it on, xAI. For the Google and Anthropic entries it says the LLM services “may also be used for research, development, training, and product improvement purposes, to the extent permitted under the applicable agreement with the customer”. (Added 3 October 2026; read on ElevenLabs' Trust Center.)
Breach history (public incidents and structural exposure)
No major direct breach of ElevenLabs infrastructure has been publicly disclosed as of May 2026. This is meaningful, though the platform's most-discussed risk profile is not direct breach but downstream misuse of its technology.
Ongoing 2024-2026 — misuse of voice cloning for fraud
Voice-cloning tools, ElevenLabs among them, are used in voice scams. Reported attack patterns include:
- Executive impersonation (CEO Fraud): Clone a CEO's voice from publicly available recordings (podcast interviews, earnings calls, conference talks) and use the clone to call an accountant authorising an urgent wire transfer
- Family emergency scams: Clone a parent's or child's voice and use it to call relatives requesting bail money or emergency assistance
- Supplier impersonation: Clone a supplier's account manager voice and use it to update banking details for invoice payment
The FBI and equivalent agencies in the UK, Australia, and New Zealand have issued multiple advisories about AI voice scams during 2024-2026. ElevenLabs has implemented detection tools and policy enforcement (the AI Speech Classifier, the No-Go Voices restriction for prominent public figures), but the underlying capability remains broadly accessible.
Source: FBI IC3 advisories; ThreatNG security analysis (October 2025); ongoing media coverage
February 2025 — Terms of Service revision triggering customer migration
The February 28, 2025 ToS update introduced (1) the perpetual derivative-license clause, (2) free-plan commercial restrictions, and (3) downgrade-loses-commercial-rights provisions. Multiple ElevenLabs partner and reseller businesses publicly ended their integrations as a result — Kukarella's March 2025 announcement is one publicly-documented example. The ToS change is not a breach in the security sense but represents a unilateral expansion of rights to customer-generated content that materially changed the privacy/IP posture.
Source: Kukarella partnership termination announcement (March 2025); independent terms analysis
Pattern observation: ElevenLabs API keys are routinely found in exposed GitHub repositories, leaked credential databases, and breached SaaS systems. The combination of (a) high attacker value per key (each can generate cloned speech up to the account's limits) and (b) frequent accidental exposure makes this one of the highest-priority credential classes to manage rigorously.
What this means in plain English for SMB owners
Three honest takeaways:
- Voice is biometric data with different legal protections than text or image data. If you are using ElevenLabs to clone voices for any business purpose, document the consent of the person whose voice you are cloning. For EU customers this is Article 9 GDPR territory; for Illinois customers it is BIPA territory. The legal exposure if you get this wrong is materially larger than if you misuse a text-based AI.
- Your ElevenLabs API key is a high-value credential. Treat it the way you would treat a banking API key. Secrets manager, no source-control commits, quarterly rotation, usage monitoring. An exposed key can be used to generate voice deepfakes that can defraud your accountants, your suppliers, and your family.
- The perpetual derivative license is the structurally important fact about ElevenLabs. The licence ElevenLabs takes in the models trained from your voice recordings is perpetual, and you can request deletion of a User Voice Model through your account. What deletion does not reverse is the contribution your recordings already made to ElevenLabs foundation models before you opted out, because the opt-out applies only to data provided after it is submitted. Corrected 20 September 2026. This may be acceptable for character voices in fiction. It may not be acceptable for your personal voice, your employees' voices, or any voice you have licensed from a third party. Treat the perpetual license as a hard fact when deciding what to upload.
If you publish a voice to the Voice Library
This is a separate decision from cloning, and it carries different consequences. If you make your voice model available in the Voice Library, ElevenLabs shares it with other users to generate synthetic audio, and posts a sample of synthetic audio generated from your voice so others can preview it. Any profile description you add – name, bio, social handles – becomes visible to other users too. For a business, publishing a staff member’s voice is a decision that should never be made by the person operating the account alone.
One clarification worth making, because it is easy to over-read: ElevenLabs discloses that it may “sell” or “share” data for targeted advertising under US state privacy laws, but the categories it lists are online identifiers – IP address and unique identifier. Voice Data is not in that list. The advertising disclosure and the voice-processing question are separate issues and should not be conflated.
Sources
- ElevenLabs Privacy Policy: https://elevenlabs.io/privacy-policy (updated 9 October 2026; read 24 October 2026; previously verified 11 August 2026 against the 20 May 2026 version)
- ElevenLabs pricing: https://elevenlabs.io/pricing (read 24 October 2026)
- ElevenLabs Terms of Use: https://elevenlabs.io/terms-of-use and the EEA version https://elevenlabs.io/terms-of-use-eu (verified 2026-08-11) – the source of the User Voice Model deletion right.
- ElevenLabs Data Processing Addendum: https://elevenlabs.io/dpa (April 2026 version verified 2026-05-24)
- ElevenLabs Trust Center (security documentation portal)
- Deepgram: How ElevenLabs Uses Your Audio Data compliance guide (March 2026)
- Kukarella: Important Changes to Our Voice Cloning Technology partnership termination (March 2025)
- ThreatNG Security: ElevenLabs glossary entry on external attack surface (October 2025)
- Alibaba product insights: Custom Voice Models Privacy Tradeoff analysis (February 2026)
- FBI IC3 voice deepfake fraud advisories (multiple, 2024-2026)
Related on AI Leakage
- Compare all 29 AI tools in the risk directory — see how ElevenLabs stacks up against the rest, tier by tier.
- Take the 5-minute “Am I Leaking?” check — a personalised view of your business’s AI exposure.
- Check a prompt before you paste it — our free Data-Safe Prompt Rewriter.
- Shadow AI vs AI leakage — why even approved tools like ElevenLabs can leak data.
- Get plain-English AI Leakage Alerts — we email you when an AI tool you use changes its data policy or has an incident.
- Get the free AI Acceptable Use Policy template — a plain-English policy with the tool-by-tool risk guide built in.
Compare similar tools: ElevenLabs is one of 6 tools in AI writing, design and voice tools compared, which sets out each one’s rating and what it does with your data, side by side.