Voice assistants and smart speakers

• Regulation (EU) 2016/679 — GDPR, Articles 9 and 27
• Directive 2002/58/EC — ePrivacy for terminal equipment
• Directive 2014/53/EU — Radio Equipment
• Regulation (EU) 2024/2847 — CRA
• Regulation (EU) 2024/1689 — AI Act transparency

Who has to appoint one

Manufacturers outside the Union placing voice-enabled devices on the EU market. Voice recordings are personal data and can be biometric data where used to identify the speaker, and bystanders who never consented are routinely captured.

Thresholds and exemptions

None. Voice profiles used to distinguish individual household members are biometric data for identification purposes, triggering Article 9.

What must appear on the label

CE marking, manufacturer and EU representative details, model and serial number, radio parameters, WEEE symbol, and a physical microphone indicator. The privacy notice names the Article 27 representative and explains retention of recordings.

Marketplace fields

Authorities across the Union investigated human review of voice recordings, which led to design changes across the industry. Devices without a hardware mute have been criticised.

Documentation you must hold

EU declaration of conformity, technical file, radio and cybersecurity documentation, and on the data side the Article 30 record, the Article 27 designation, a data protection impact assessment, retention rules for recordings and transcripts, and documentation of any human review with its legal basis.

Standards and testing

Radio, EMC and safety testing, EN 18031 for the cybersecurity requirements, and false-wake measurement, since accidental activations are the source of the most sensitive recordings.

Language requirements

Device instructions in the national language and voice service information in the language of the users.

When it applies

Before placing on the market, and the representative before the voice service processes EU users' data.

How long records are kept

Recordings only as long as necessary, with defaults set to short retention and deletion tools available. Indefinite storage of voice clips has been the subject of enforcement.

What happens if you do not comply

Up to €20 million or 4% of turnover. Human review of recordings without transparency was found unlawful in several investigations, and the resulting orders changed how the industry operates.

Who enforces it

Data protection authorities, market surveillance and radio regulators, and CSIRTs for CRA reporting.

Where the boundary lies

Accidental activations capture conversations nobody intended to record, including those of guests and children, and the controller has no consent from them. Voice profiles for speaker recognition are biometric data requiring an Article 9 condition.

Questions we are asked

Can we use recordings to improve the model?

Only with a documented basis and transparency, and after the enforcement wave over human review, with explicit opt-in in practice.

Is a voice profile biometric data?

Where it is used to uniquely identify a speaker, yes, which brings Article 9 and the higher standard that follows.