Speaker Consent Form for Voice Data Collection: Template and Checklist

Last updat­ed: Octo­ber 2026

A speak­er con­sent form tem­plate is the doc­u­ment a per­son uses to agree, by sig­na­ture or anoth­er clear action, to hav­ing their voice record­ed and used to train AI. Most tem­plates online are media releas­es writ­ten for pod­casts and events.

They rarely men­tion mod­el train­ing, syn­thet­ic voic­es, or what hap­pens when some­one changes their mind. This guide gives voice-AI teams a check­list of what the form must include and plain-Eng­lish sam­ple claus­es. It also cov­ers minors, with­draw­al, and stor­ing con­sent records that will stand up to an audit.

Need an editable ver­sion? Ask us for the editable speak­er con­sent tem­plate and we will send it with review notes for your coun­sel.

Why does voice data need explicit consent?

Voice data needs explic­it con­sent because a record­ing is per­son­al data when­ev­er the speak­er can be iden­ti­fied. AI train­ing is also a use most peo­ple would not expect. Con­sent is often the clear­est legal basis for col­lect­ing it. Under GDPR it must be freely giv­en, spe­cif­ic, informed and unam­bigu­ous, and the col­lec­tor must be able to prove it.

GDPR Arti­cle 4(11) defines con­sent as a state­ment or “clear affir­ma­tive action” that sig­nals agree­ment. Arti­cle 7 adds three duties that shape every voice data con­sent form. You must be able to demon­strate con­sent. The request must be clear­ly sep­a­rate from oth­er terms and writ­ten in plain lan­guage. And it must be as easy to with­draw con­sent as to give it.

Is a voice recording biometric data?

Not auto­mat­i­cal­ly, and pre­ci­sion mat­ters here. Arti­cle 4(14) defines bio­met­ric data as per­son­al data from spe­cif­ic tech­ni­cal pro­cess­ing that allows or con­firms the unique iden­ti­fi­ca­tion of a per­son. Arti­cle 9 lists bio­met­ric data as a spe­cial cat­e­go­ry only when used “for the pur­pose of unique­ly iden­ti­fy­ing a nat­ur­al per­son.”

So a read-speech record­ing col­lect­ed for speech recog­ni­tion is per­son­al data, but usu­al­ly not spe­cial-cat­e­go­ry data. If you extract voice­prints for speak­er ver­i­fi­ca­tion, the same audio moves into Arti­cle 9, and you gen­er­al­ly need explic­it con­sent. Con­tent can also trig­ger Arti­cle 9. A cor­pus of speech from peo­ple with a health con­di­tion reveals health data.

What India and Illinois add

Indi­a’s Dig­i­tal Per­son­al Data Pro­tec­tion (DPDP) Act, 2023 sets its own bar in Sec­tion 6(1). Con­sent must be “free, spe­cif­ic, informed, uncon­di­tion­al and unam­bigu­ous with a clear affir­ma­tive action.” It must also be lim­it­ed to the data need­ed for the stat­ed pur­pose. For a fuller view of the Indi­an rules, read our guide to DPDP Act oblig­a­tions for AI train­ing data.

In the US, Illi­nois’s Bio­met­ric Infor­ma­tion Pri­va­cy Act lists voice­prints as bio­met­ric iden­ti­fiers. Sec­tion 15 (740 ILCS 14/15) requires writ­ten notice of the pur­pose and length of use, plus a writ­ten release, before col­lec­tion. It also requires a pub­lic reten­tion and destruc­tion sched­ule.

In short: treat every record­ing as per­son­al data, treat voice­prints as sen­si­tive, and write con­sent that you can prove lat­er.

How the speaker consent lifecycle works

Con­sent is not a sin­gle sig­na­ture. It is a record that has to fol­low the audio from first con­tact to final dele­tion. A speak­er con­sent form tem­plate is only the sec­ond of five stages.

1. Notice. Give the speak­er a stand­alone, plain-lan­guage notice in their own lan­guage before any­thing is record­ed.
2. Con­sent. Col­lect a clear affir­ma­tive action, such as a sig­na­ture or an unticked box the speak­er ticks. Record each option­al use sep­a­rate­ly.
3. Cap­ture. Tag every ses­sion and audio file with the speak­er’s con­sent ID, so scope trav­els with the data.
4. Stor­age. Keep con­sent records apart from the audio, with access lim­it­ed to the peo­ple who need them.
5. With­draw­al and dele­tion. Stop use, delete the files you hold, noti­fy down­stream clients, and log the request.

Indi­a’s DPDP Rules, 2025 make the notice stage con­crete. Rule 3 says the notice must be under­stand­able on its own, with­out ref­er­ence to oth­er doc­u­ments. It must give an item­ized descrip­tion of the per­son­al data and the spec­i­fied pur­pose. It must also give a link and oth­er means to with­draw con­sent, exer­cise rights, and com­plain to the Data Pro­tec­tion Board.

The Rules were pub­lished in the Gazette on 13 Novem­ber 2025 and announced by the Press Infor­ma­tion Bureau on 14 Novem­ber 2025. As of Octo­ber 2026, Rule 3 is not yet in force. It applies eigh­teen months after pub­li­ca­tion, so from May 2027. Build­ing to it now saves a redesign lat­er.

What must a speaker consent form template include?

A speak­er con­sent form tem­plate must iden­ti­fy who is col­lect­ing the data, list every item col­lect­ed, and state each pur­pose, includ­ing AI train­ing. It must also say who receives the data, how long it is kept, and how to with­draw. Option­al uses need sep­a­rate, unticked opt-ins, and the form must be in a lan­guage the speak­er reads.

We call this the 10-point speak­er con­sent check­list. Use it to review any par­tic­i­pant con­sent AI dataset form, whether you write it your­self or receive it from a ven­dor.

1. Who is col­lect­ing. Legal enti­ty name, con­tact details, and a data pro­tec­tion con­tact.
2. Item­ized data list. Audio, tran­scripts, and each meta­da­ta field, such as age range, gen­der, first lan­guage, region, and device.
3. Spe­cif­ic pur­pos­es. Name each one: train­ing speech mod­els, test­ing them, and any syn­thet­ic voice use.
4. Who receives the data. Clients, proces­sors, and any cross-bor­der trans­fer.
5. Reten­tion peri­od. How long audio and meta­da­ta are kept, and when they are delet­ed.
6. Sep­a­rate opt-ins. One unticked box per option­al use. Nev­er bun­dle them into the main agree­ment.
7. Vol­un­tary and paid fair­ly. State that pay­ment does not depend on agree­ing to option­al uses.
8. Easy with­draw­al. The same chan­nel and effort as giv­ing con­sent, plus a plain note on what can­not be undone.
9. Speak­er rights. Access, cor­rec­tion, era­sure, and how to com­plain to a reg­u­la­tor.
10. Lan­guage and record. The speak­er’s own lan­guage, a copy for them, and time­stamped proof for you.

Point 7 is the one most often missed. Under GDPR Arti­cle 7(4) and the “uncon­di­tion­al” test in DPDP Sec­tion 6(1), tying pay to extra con­sent can under­mine whether that con­sent was freely giv­en.

Plan­ning a voice col­lec­tion? Ask us for the editable speak­er con­sent tem­plate, or see how our con­sent-first data col­lec­tion ser­vices run par­tic­i­pant onboard­ing end to end.

Sample clauses in plain English

Below is orig­i­nal sam­ple word­ing for audio record­ing con­sent for AI train­ing. Sam­ple word­ing — have your coun­sel review. This is not legal advice. Adapt it to your juris­dic­tion, your clients, and your actu­al prac­tices.

What we record

“We will record your voice while you read sen­tences and answer short ques­tions. We will also keep a writ­ten tran­script and these details: your age range, gen­der, first lan­guage, home region, and the device you used. Your name will not appear in the audio file names.”

Why we record

“We will use your record­ings to train and test com­put­er sys­tems that rec­og­nize or pro­duce speech. These sys­tems may be built into prod­ucts made by us or by the com­pa­nies we work for.”

Synthetic voice (separate opt-in)

“Option­al. Tick this box only if you agree that your record­ings may be used to cre­ate a com­put­er-gen­er­at­ed voice that sounds like you. If you leave it blank, we will not use your record­ings this way. Your pay­ment is the same either way.”

Sharing and transfers

“We will share your record­ings only with the com­pa­nies that hire us to build speech sys­tems, and with ser­vice providers who store or check the data for us. They may use them only for the pur­pos­es on this form. Your data may be stored out­side your coun­try, and we will tell you where.”

Choice and payment

“Tak­ing part is your choice. You will be paid as set out in your task sheet. Say­ing no to any option­al use will not change your pay­ment.”

Withdrawal

“You can with­draw at any time using the same app or link you used to sign up, or by email­ing our data pro­tec­tion con­tact. We will stop using your record­ings, delete the files we hold, and ask the com­pa­nies we shared them with to delete their copies. We can­not remove what a com­put­er sys­tem has already learned from your record­ings before you with­drew.”

Retention

“We will keep your record­ings only as long as the pur­pos­es above need them, and no longer than the peri­od shown on this form. We keep a record of your con­sent for longer, so we can show that you agreed.”

Note the dif­fer­ence from a mod­el release for voice. A media release grants rights to pub­lish a record­ing. A data con­sent form cov­ers how per­son­al data is processed. Voice AI projects usu­al­ly need both, often in one doc­u­ment with clear­ly sep­a­rate sec­tions.

How should you handle minors and sensitive data?

Treat minors and sen­si­tive data as sep­a­rate, stricter tracks. In India, any­one under 18 is a child, and you need ver­i­fi­able con­sent from a par­ent or law­ful guardian before pro­cess­ing. Avoid scripts that draw out health, reli­gion, or oth­er sen­si­tive details unless the project tru­ly needs them and has explic­it con­sent.

The DPDP Act defines a child as under 18 in Sec­tion 2(f). Sec­tion 9(1) requires ver­i­fi­able parental or guardian con­sent before pro­cess­ing a child’s data. The same rule cov­ers a per­son with a dis­abil­i­ty who has a law­ful guardian. Sec­tion 9(3) bars track­ing, behav­ioral mon­i­tor­ing, and tar­get­ed adver­tis­ing aimed at chil­dren. The DPDP Rules, 2025 set out how ver­i­fi­able con­sent is obtained.

GDPR Arti­cle 8 sets 16 as the age of con­sent for online ser­vices offered direct­ly to chil­dren. Mem­ber States may low­er it, but not below 13. Con­trollers must make rea­son­able efforts to ver­i­fy parental con­sent. A sim­ple, con­ser­v­a­tive rule for glob­al projects is to require a guardian’s con­sent for every speak­er under 18.

Good prac­tice for chil­dren’s speech data:

• Get the guardian’s con­sent and the child’s own agree­ment, explained in age-appro­pri­ate words.
• Record the method used to ver­i­fy the guardian, not copies of their iden­ti­ty doc­u­ments.
• Keep school names, full names, and loca­tions out of prompts and meta­da­ta.
• Have a super­vis­ing adult present dur­ing record­ing ses­sions.

What happens when a speaker withdraws consent?

When a speak­er with­draws, you must stop pro­cess­ing their data for con­sent-based pur­pos­es and delete or anonymize what you hold. Pro­cess­ing done before with­draw­al stays law­ful under both GDPR and the DPDP Act. Revo­ca­ble con­sent only works if the form explains, upfront, which steps can be reversed and which can­not.

DPDP Sec­tion 6(6) requires the Data Fidu­cia­ry to stop pro­cess­ing with­in a rea­son­able time and to make its proces­sors stop too. The PIB release on the 2025 Rules notes that rights requests must be answered with­in a max­i­mum of 90 days. Use this with­draw­al deci­sion table to plan each case.

Where the data is	What you do	What the speak­er hears
Raw audio, not yet deliv­ered	Delete audio, tran­scripts, and meta­da­ta. Log the dele­tion.	“Your record­ings have been delet­ed.”
Deliv­ered to a client dataset	Send the con­sent ID and file list to the client with a dele­tion request. Track con­fir­ma­tion.	“We have asked our client to delete your record­ings.”
Derived data (labels, fea­tures)	Delete or anonymize records linked to the con­sent ID.	“Relat­ed labels have been removed.”
Mod­el already trained	Exclude the files from future train­ing runs.	“Future ver­sions will not use your audio. Past train­ing can­not be reversed.”
The con­sent record itself	Mark it with­drawn and keep it as proof, per your coun­sel’s reten­tion advice.	“We keep a record that you agreed and lat­er with­drew.”

How should you store consent records?

Store each con­sent record as its own entry, sep­a­rate from the audio. Give it a unique con­sent ID and write that ID into every file’s meta­da­ta. Cap­ture the form ver­sion, lan­guage, time­stamp, method, and each opt-in. Restrict access and keep an unchange­able change log. Retain the record while you hold the data, plus any peri­od your coun­sel advis­es.

Field	Why it mat­ters	Exam­ple
Con­sent ID	Links the speak­er’s choic­es to every file	Ran­dom code, not a name
Form ver­sion and lan­guage	Proves what the speak­er actu­al­ly read	v3, Hin­di
Time­stamp and method	Shows when and how con­sent was giv­en	App check­box, e‑signature
Opt-ins cho­sen	Lim­its each file to agreed uses	Train­ing yes, syn­thet­ic voice no
Ver­i­fi­ca­tion method	Sup­ports age and guardian checks	Guardian ver­i­fied by phone OTP
With­draw­al sta­tus	Dri­ves dele­tion and client notices	With­drawn, dele­tion con­firmed

Two habits make audits eas­i­er. Ver­sion every speak­er con­sent form tem­plate and nev­er edit a live one. And run a month­ly check that every audio file maps to an active con­sent ID.

How Graveiens AI approaches speaker consent

Con­sent is built into how we run voice and speech data col­lec­tion. Every project fol­lows the same four steps: par­tic­i­pant onboard­ing with explic­it con­sent, record­ing man­age­ment, meta­da­ta tag­ging, and QA. Con­sent IDs trav­el with each file through all four.

• Explic­it-con­sent onboard­ing in the speak­er’s lan­guage, across 25+ lan­guages with deep Indic cov­er­age.
• Meta­da­ta tag­ging that ties every record­ing to its con­sent scope.
• A pay-for-approved-deliv­er­ables work­flow, so you pay only for files that pass your review.
• ISO 9001 cer­ti­fied qual­i­ty man­age­ment.

Con­sent word­ing varies by coun­try, client, and use case, so we scope this with you and your coun­sel. For lan­guage-spe­cif­ic plan­ning, see our guide to Indic speech data col­lec­tion.

Get the editable speaker consent template

We share an editable speak­er con­sent form tem­plate on request. It fol­lows the 10-point check­list above, with the sam­ple claus­es laid out as sep­a­rate sec­tions and opt-ins. Ask us for the editable speak­er con­sent tem­plate through our con­tact form. Have your coun­sel review it before use.

Frequently asked questions

Sources

1. Reg­u­la­tion (EU) 2016/679 (Gen­er­al Data Pro­tec­tion Reg­u­la­tion), Arti­cles 4, 7, 8 and 9, EUR-Lex
2. The Dig­i­tal Per­son­al Data Pro­tec­tion Act, 2023 (No. 22 of 2023), Min­istry of Elec­tron­ics and Infor­ma­tion Tech­nol­o­gy
3. Dig­i­tal Per­son­al Data Pro­tec­tion Rules, 2025, G.S.R. 846(E), Gazette of India, 13 Novem­ber 2025
4. Gov­ern­ment noti­fies DPDP Rules to empow­er cit­i­zens and pro­tect pri­va­cy, Press Infor­ma­tion Bureau, 14 Novem­ber 2025

This arti­cle is gen­er­al infor­ma­tion, not legal advice. Illi­nois BIPA ref­er­ences are to 740 ILCS 14/15 as pub­lished by the Illi­nois Gen­er­al Assem­bly.

About the author

Graveiens AI Edi­to­r­i­al Team. We write about con­sent-backed data col­lec­tion, speech and voice datasets, and human-in-the-loop data for AI teams.