Obtain specific, informed, recorded consent for the synthetic model, inputs, uses, channels, territories, duration, disclosure and revocation process.

Short answer: answer: Obtain separate, informed and specific written consent that identifies the person, source recordings, model or service, generated identity, permitted messages and products, actors, channels, territories, term, compensation, disclosure, security, revocation and post-termination handling. Do not infer synthetic-replica permission from ordinary content-editing or reposting rights. Platform disclosure is an additional obligation; it does not supply the creator's consent.

The tempting shortcut is to treat a cloned voice as another edit of a licensed video. It is not just a file change: a reusable model can generate new performances the creator never made, at scale and after the original asset expires.

The other shortcut is a broad name, image and likeness clause. Whether it reaches a particular replica is a legal question that varies by contract and jurisdiction. CDM's position is categorical: synthetic identity requires its own consent event, use boundary and revocation plan, even when a general clause might arguably be broad enough.

The Synthetic Identity Consent Stack

The Synthetic Identity Consent Stack has nine layers: identity, inputs, model, generation, use, disclosure, safeguards, duration and exit. Approval is valid operationally only when every layer is recorded and consistent.

Layer 1: verify the person and authority

Identify the creator by legal name and verified contact, and confirm who can consent. An agent's commercial mandate may not include licensing a digital replica. Record the contracting entities, authorized representatives, jurisdiction review and signature evidence.

If multiple people are recognizable, each needs analysis. Copyright permission for footage is separate from voice, likeness, privacy, publicity, performer and labor rights. The U.S. Copyright Office's digital-replicas report documents gaps and differing state approaches; its recommendation for federal protection is policy analysis, not proof that one national permission rule governs every use.

Layer 2: define the source inputs

List every recording, photograph, scan, transcript and biometric-like reference used to build or prompt the system. State who supplies it, where it is stored, whether it may be augmented, and whether other campaign material can be added later. A license to publish a podcast does not necessarily authorize using its audio to train or condition a voice model.

Prohibit undisclosed scraping of public creator content. Capture consent to input use separately from consent to output use. The creator may allow one finished dub without allowing the vendor to retain a reusable voice profile.

Layer 3: identify the model and vendors

Record service provider, model or product name, version where available, account owner, hosting region, subprocessors, retention settings and whether inputs or outputs may be used to improve a general model. Attach the vendor terms and data settings in force at approval.

Marketing cannot promise deletion or isolation that the service does not support. Security and privacy reviewers should test access, export and deletion controls before ingesting the source material. If the model changes materially, re-run approval rather than treating a vendor name as a stable system.

Layer 4: bound what may be generated

Define allowed language, script, emotion, performance style, length, product and context. State prohibited content—politics, adult products, medical advice, financial promises, defamation, sensitive behavior and competitor endorsements are common examples, but the list should reflect creator and campaign risk.

Require versioned scripts and rendered-output approval. A creator consenting to Spanish dubbing of an existing sentence has not necessarily agreed to newly written Spanish endorsements. Ban autonomous generation outside approved inputs and record whether the creator can reject outputs that misrepresent tone or belief.

Layer 5: license the exact commercial use

Specify organic or paid use, platform, account, format, audience, territory, language, edits, sublicensing and reuse. Name affiliates and agencies rather than granting access to an undefined ecosystem. Link every output asset to this consent record.

Do not collapse compensation into a production fee without confirming what it buys. Model creation, each generation, media use and renewal can be priced differently. The commercial arrangement is negotiable; transparency about reuse makes the decision informed.

Layer 6: satisfy disclosure and platform rules

State what the audience will be told, in what language and placement. In the EU, Article 50 of the AI Act includes transparency duties for certain deepfake deployments, with qualifications and exceptions in the text. This is a disclosure regime, not a creator-consent grant.

YouTube requires disclosure of realistic, meaningfully altered or synthetic content and lists cloning someone else's voice as an example requiring disclosure. Its settings and privacy complaint process do not replace contracts or local law. Sponsorship disclosure is separate again: one label explains synthetic production; another may need to explain the brand relationship.

Layer 7: install safeguards and an incident route

Limit model and source access to named roles with multifactor authentication. Log generations, approvals, exports and deletions. Watermark or add Content Credentials when supported, while recognizing that provenance is not permission and can be stripped by unsupported workflows.

Create an incident route for unauthorized output, account compromise, creator complaint, vendor breach or misleading publication. The immediate control should stop generation and distribution, preserve evidence and notify the assigned legal, security and creator-relationship owners. Do not wait for a platform takedown process.

Layer 8: set term, review and withdrawal mechanics

Record start, end, renewal and what withdrawal can affect under the contract and applicable law. Consent may be revoked is incomplete without notice method, response time, treatment of already-booked media, cached copies, model checkpoints and archival records.

Some rights may be nonwaivable or subject to specific statutory conditions. Tennessee's 2024 ELVIS Act added voice-focused protections to state personal-rights law; California has provisions addressing some digital-replica terms in personal or professional services agreements. Those are examples of a jurisdictional patchwork, not a complete legal survey. Use qualified counsel for the relevant person, work and markets.

Layer 9: prove the exit

At termination, stop ads and scheduled publication, revoke users and API keys, inventory every output, apply removal decisions and request vendor deletion where required. Record what was deleted, retained, legally held or technically not removable. Test that former users can no longer generate or retrieve outputs.

The creator should receive the closure result promised by the agreement. A certificate from the brand cannot attest to a vendor action it did not verify; report limitations precisely.

Reader asset: synthetic identity consent record

``yaml consent_id: SIC-019 person: {legal_name: "", verified_at: "", representative: ""} inputs: [{asset_id: "", permitted_for_modeling: true, retention: ""}] system: {vendor: "", product: "", model_version: "", account: ""} generation: {languages: [], approved_scripts_only: true, prohibited_contexts: []} use: {actors: [], products: [], channels: [], territories: [], paid: false} approval: {script_required: true, final_render_required: true, approver: ""} disclosures: {synthetic_label: "", sponsorship_label: "", local_review: ""} security: {roles: [], logging: true, export_control: "", incident_owner: ""} term: {starts_at: "", ends_at: "", renewal: ""} withdrawal: {notice_route: "", stop_sla: "", existing_use_rule: ""} exit: {delete_inputs: "", delete_model: "", output_inventory: "", verifier: ""} ``

The signed consent or negotiated contract remains authoritative. This record makes its instructions executable and should link to the clause and legal reviewer. Unknown values block modeling or publication.

Related guides

Frequently asked questions

Is ordinary creator content permission enough for an AI voice clone?

Do not assume it is. Reposting or editing existing content is materially different from creating a reusable model that can produce new speech. Obtain specific reviewed permission for the inputs, modeling activity and generated outputs, with clear contexts and duration.

Applicable publicity, privacy, performer, labor, contract and copyright law varies by jurisdiction, so only qualified counsel can interpret an existing clause. CDM recommends a separate consent record even if counsel believes broad language applies, because it creates informed expectations and operational stop controls.

Does labeling a synthetic video make the use legal?

No. A label can satisfy or support a transparency duty, but it does not grant permission, substantiate product claims, license copyrighted inputs or cure deception. YouTube's altered-content setting is a platform requirement for specified realistic alterations; EU AI Act provisions address certain disclosures.

Obtain creator consent and all other rights separately, then apply the required labels and sponsorship disclosure. The caveat is that duties and exceptions depend on jurisdiction, content and platform, so one global label is not guaranteed to satisfy every rule.

Can a creator revoke consent after a synthetic campaign starts?

The answer depends on the contract and applicable law, which may provide withdrawal or nonwaivable rights. The consent record should state notice, response time, effects on future generation, booked media, live assets, stored inputs, model copies and legal archives.

Operationally, build a kill path even where withdrawal is limited: it lets authorized owners stop high-risk use quickly. A promise of instant deletion is unsafe if vendors, backups or lawful retention prevent it; specify what can actually be stopped, deleted or isolated and verify the result.

Who should be allowed to generate with a creator model?

Only named, trained users who need the capability, through a controlled brand or vendor account with strong authentication and logs. Separate generation from final approval, restrict exports and prohibit personal accounts or shared passwords. Agencies and localization vendors should receive time-limited scope rather than inheriting broad access.

A small team may combine roles, but a second person should approve high-risk outputs. The caveat is that access control cannot replace contractual permission or output review; an authorized user can still generate an unauthorized message.

What should happen when the AI vendor changes its model or terms?

Pause new production until the owner checks whether the change affects retention, training use, subprocessors, output rights, security, quality or disclosure. Version the system record and run a small approved-output comparison. Material changes may require renewed creator consent or an amendment, depending on the agreement and law.

Do not silently treat a vendor brand as the same processing environment over time. The caveat is proportionality: a documented minor patch may not warrant full renegotiation, but the authorized reviewer—not production—should make that decision.

Should synthetic creator assets carry Content Credentials?

Use them when the workflow and destination support them, because tamper-evident provenance can record origin and transformations. But C2PA itself says provenance does not decide whether content is true, and unsupported tools can break the chain. A credential is not consent, a license or a disclosure guaranteed to reach viewers. Keep the internal consent and lineage records even when embedding provenance.

The caveat is platform behavior: test whether the exact export and upload preserve or display credentials, and never interpret missing credentials as proof that an asset is synthetic.

Next decision: Track every derivative version of a creator asset

Related reading: Manage creator rights across languages and edits · Check disclosure in the final rendered post · Offboard a creator partnership completely

Sources and research notes

Research limitation: digital-replica law is rapidly changing and highly jurisdiction-specific. This consent stack is a CDM governance recommendation, not a representation that a particular clause is valid, sufficient or revocable.

CDM Editorial

This article is editorial guidance. Apply the principles in proportion to your market, evidence, and responsibilities.