ElevenLabs Privacy Policy

This document is ElevenLabs' privacy policy governing the collection, use, and sharing of personal data across its AI-powered voice synthesis platform, operating under a consent and legitimate interests legal basis framework consistent with GDPR and US state privacy law requirements. The policy states that ElevenLabs collects account information, payment data, voice recordings and cloned voice models, usage data, device identifiers, and communications content; the terms authorize sharing this data with service providers, business partners, affiliates, and in the context of corporate transactions such as mergers or acquisitions. Notably, the policy asserts that voice recordings and AI-generated voice models submitted by users may be used to improve ElevenLabs' models, which engages biometric and voice data considerations that several US state laws and the EU GDPR treat with heightened sensitivity; the policy does not explicitly enumerate a prohibition on selling voice data to third parties in all contexts, and the scope of 'business partners' as a sharing category warrants scrutiny. The policy acknowledges GDPR rights for EU/EEA users including access, rectification, erasure, and data portability, and references CCPA rights for California residents including the right to know, delete, and opt out of sale or sharing; compliance obligations under the EU AI Act may also be engaged given the platform's core AI voice generation functionality. Material compliance considerations include the adequacy of consent mechanisms for voice biometric data in Illinois (BIPA), Texas, Washington, and other states with biometric privacy statutes, as well as the need to assess whether the 'business partners' sharing category constitutes a 'sale' or 'sharing' under CCPA.