Privacy policy clauses for ElevenLabs
ElevenLabs is an AI text-to-speech platform that converts written text into natural-sounding audio using machine learning. Websites integrate ElevenLabs to provide automated voice synthesis, audio content generation, or voice cloning capabilities to users.
Free scan · No signup · Results in 60 seconds
What data ElevenLabs collects
Your privacy policy must disclose each of the following data types when you use ElevenLabs.
When does ElevenLabs trigger privacy obligations?
Installation Triggers Immediate Obligations
The moment you integrate ElevenLabs API into your site or app, text inputs and voice samples begin flowing to ElevenLabs servers in the United States. This triggers GDPR Article 6 (lawful basis) and Article 28 (processor obligations) immediately if any user is in the EU. You must have a signed Data Processing Agreement (DPA) with ElevenLabs before processing begins—not after launch.
Voice Cloning = Biometric Data = Heightened Consent
If your feature uses voice cloning, you are processing biometric data under GDPR Article 4(14). This requires explicit consent under GDPR Article 9(2)(a), *not* the soft opt-in model used for regular analytics. Additionally, voice biometric laws in California (CCPA Section 1798.100 + regulations), Illinois (BIPA), Texas (DTPA), and other states require affirmative, informed written consent *before* any voice sample is collected or stored. Simply embedding consent in your general terms is insufficient.
