By Nick French · Founder, StackSwap · 10yrs B2B SaaS GTM (BDR → AE → Head of Revenue) · Methodology →
Affiliate link · StackSwap earns a commission if you sign up for ElevenLabs via this page (no extra cost to you). We only partner with tools we'd recommend anyway. · Editorial standards →

Operator analysis · ElevenLabs BIPA voice-AI suits · consent & provenance · 2026

ElevenLabs Is Facing a Voice-Cloning Lawsuit — What It Changes for Anyone Using Voice AI in GTM

In mid-May 2026, nine separate class-action lawsuits were filed in Chicago federal court under Illinois's Biometric Information Privacy Act (BIPA), each naming one major tech company — ElevenLabs among them, alongside Amazon, Apple, Google, Meta, Microsoft, Nvidia, Adobe, and Samsung. The plaintiffs, seven Illinois residents including journalists and audiobook narrators, allege their voiceprints were captured and used to train voice-cloning models without written consent. BIPA carries statutory damages of $1,000 (negligent) to $5,000 (intentional) per violation, per person.

First, the discipline this topic demands: these are allegations, not findings. The suits were just filed, no defendant has answered in court, and ElevenLabs did not respond to reporters' requests for comment — which is silence, not a denial. I'm not here to tell you ElevenLabs did anything wrong; a court hasn't decided that. I'm here for the only buyer question this actually moves: if you run synthetic voice in your go-to-market — AI SDR calls, IVR, voicemail drops — whose voice is it, and can you prove consent?

StackSwap is an ElevenLabs affiliate, which is why this page exists — and why I'm going to give you the diligence checklist instead of a reflexive "drop it" or a reflexive "it's fine." The honest read for an operator who has run a lot of outbound: voice AI is still worth using; the news changes your contract and your compliance map, not necessarily your vendor.

What was actually filed

Nine lawsuits, filed separately the week of May 11, 2026, in the federal court in Chicago, each targeting one company under BIPA. ElevenLabs has its own suit; it was not lumped into a single complaint with the others, though the same group of seven Illinois plaintiffs brought the related cases. The core accusation is identical across defendants: that the companies collected plaintiffs' voiceprints and used them to train commercial voice-cloning models without the notice, written release, and retention policy BIPA requires. The plaintiffs include working journalists (Carol Marin, Phil Rogers) and professional narrators and podcasters — people whose recorded voices are abundant and commercially valuable, which is precisely the profile that makes a voiceprint-training claim concrete.

Why BIPA, and why Illinois? Because BIPA is the only U.S. biometric statute with a robust private right of action and fixed statutory damages — $1,000 per negligent violation, $5,000 per intentional or reckless one, per person. At class scale, the math gets large fast, which is why Illinois is where biometric cases land. The plaintiffs' firm, Loevy & Loevy, framed it as potentially one of the largest biometric-privacy violations ever — their words, and the kind of opening characterization every plaintiff's filing makes. Nothing here is proven. What's real is that voice-AI training data is now being litigated under a statute with teeth.

Why a training-data lawsuit is your problem, not just ElevenLabs'

It's tempting to file this under "big-tech legal drama, not my circus." But voice AI moved into go-to-market faster than the compliance conversation did. If you've sent enough outbound to have scars — I've made north of 100,000 cold calls — you know the 2026 version: AI SDR agents that call, voicemail-drop tools in a synthetic voice, IVR and qualification bots, localized voice for outbound at scale. Every one of those takes a generated voice and points it at a human, often across state lines, frequently recorded.

That is the exposure surface. The lawsuit is about how the model was trained; your risk is about how you deploy the output into regulated territory — biometric states and two-party-consent recording states. The two aren't the same claim, but they rhyme, and the headline is a free reminder that "the voice sounds great" was never the whole diligence question. The real one: whose voice is it, on what consent, disclosed how, into which states?

The compliance map, by use case

Not every voice-AI use carries the same risk. Here's the honest read by how you're actually deploying it.

How you use voice AIRisk profileYour move
Outbound AI SDR calling / voicemail drops into IL, CA, WA, FL, PAHighest — biometric + two-party recording law both in playCounsel review, recording disclosure in script, consent/provenance clause; treat state targeting as a compliance decision
Cloning a specific person's voice (founder, rep) for outreachElevated — you are the one creating a voiceprintDocument written consent from the person cloned; keep records; confirm vendor consent tooling
Inbound IVR / support bot in a stock synthetic voiceModerate — mostly disclosure + recording rulesDisclose AI voice where required; standard call-recording compliance
Internal content: demos, training videos, draft narrationLow — no third party on the lineKeep using it; just don't clone a real person without consent

The pattern: risk scales with how directly you point a generated voice at a non-consenting human in a regulated state. Internal and stock-voice uses are largely fine; cloned-voice outbound into two-party states is where you want a lawyer before you scale, regardless of which vendor you picked.

What to actually do before you buy (any) voice AI

This is the part that survives the lawsuit's outcome either way. Run the same four-point diligence on every voice vendor:

For the GTM-specific edge of this — where AI voice meets outbound and why the AI-SDR calling wave is messier than the demo — see our read on why AI SDRs are failing in 2026.

The honest caveats

Three, and they cut toward fairness. One: nothing is proven. These are freshly filed complaints reflecting one side; defendants haven't answered, and the cases may turn on whether the voiceprints are even "identifiable" under BIPA. Don't treat an allegation as a verdict. Two: ElevenLabs didn't comment — that's not an admission, and it's not a denial; it's a company not litigating in the press. Three: the suit is about training data, not your usage of the output, so it does not, by itself, make your existing voice workflows unlawful. The reason to act is forward-looking procurement hygiene, not panic.

And the genuinely fair point for the vendor: voice AI is one of the most useful primitives to land in GTM in years, and ElevenLabs is the category leader for a reason. The lawsuit doesn't change that. It changes the maturity of the buyer — from "does it sound human?" to "can I stand behind where this voice came from?" That is a better question to be asking anyway.

Want to try ElevenLabs?

Evaluating voice AI for GTM? Buy it like a grown-up: with a consent-and-provenance clause and a state-by-state compliance map.

ElevenLabs is the category leader, and voice AI is genuinely useful for outbound, IVR, and content. The May 2026 BIPA suits are unproven allegations about training data — not a verdict and not about your usage. The right response isn't avoidance; it's diligence: provenance clause, target-state law, disclosure, documented consent for any cloned voice. Evaluate it with eyes open, and hold every voice vendor to the same standard.

Evaluate ElevenLabs →Affiliate link — StackSwap earns a commission if you sign up for ElevenLabs. We only partner with tools we'd recommend anyway.

FAQ

Yes. ElevenLabs is one of nine technology companies each named in its own separate class-action lawsuit filed in Chicago federal court in mid-May 2026 (the week of May 11). The suits — brought under Illinois's Biometric Information Privacy Act (BIPA) — also separately name Amazon, Apple, Google, Meta, Microsoft, Nvidia, Adobe, and Samsung. Important framing: these are allegations, not findings. The cases were just filed, no defendant has answered in court, and a judge has made no ruling. ElevenLabs did not respond to reporters' requests for comment — note that is silence, not a denial. Treat everything below as what plaintiffs claim, not as established fact.

The plaintiffs — seven Illinois residents, including journalists Carol Marin and Phil Rogers and audiobook narrators and podcasters — allege that the companies captured their voiceprints, stored them, and fed them into voice-cloning model training without ever obtaining the written consent BIPA requires. A voiceprint, in the complaints' framing, is a digital fingerprint of the human voice. BIPA is the sharpest biometric-privacy statute in the U.S. because it carries a private right of action and statutory damages: $1,000 per negligent violation and $5,000 per intentional or reckless violation, per person. The plaintiffs' firm, Loevy & Loevy, called it potentially one of the largest violations of biometric privacy ever committed — again, their characterization, unproven.

Yes, but it was a different kind of case — don't conflate them. In 2024, voice actors brought Vacker v. Eleven Labs in Delaware federal court, and the parties reached a settlement on undisclosed terms in 2025. That case was about copyright, right of publicity, and the DMCA — misappropriation of specific performers' voices — not biometric privacy. The May 2026 suits are BIPA claims about training-data consent under Illinois law. So while ElevenLabs has faced voice-related litigation before, this is a new and legally distinct theory, not a continuation of the old one.

Not necessarily — but it should change how you buy it. The allegations are unproven and target how the models were trained, not your particular use of the output. The real implication is procurement risk: if you pipe synthetic voice into outbound calls, IVR, voicemail drops, or an AI SDR's calling, you are operating in territory where biometric-privacy and call-consent law is active and damages are statutory. The right response is not a reflexive vendor swap; it is a consent-and-provenance clause in your contract, knowing your target states' law, and disclosing synthetic voice where required. That discipline applies to every voice-AI vendor, not just the one in the headline.

Illinois is the one with teeth: BIPA's private right of action and $1,000–$5,000 per-violation damages are why Illinois drives most U.S. biometric litigation. Texas (CUBI) and Washington also regulate biometric identifiers including voiceprints, but enforcement runs through the state attorney general rather than private suits, so the litigation risk profile is lower. Separately, if your voice AI places or records calls, two-party (all-party) consent recording states — California, Illinois, Florida, Pennsylvania, Washington, and others — govern whether and how you must disclose recording. If your outbound motion dials into any of these, get counsel and build disclosure into the script before you scale.

Run a four-point diligence pass on any voice vendor, ElevenLabs included. One: put a data-provenance and consent clause in the contract — the vendor warrants its training data was lawfully obtained and indemnifies you against third-party voiceprint claims. Two: know the biometric and call-consent law in the states your campaigns target. Three: disclose synthetic or AI voice where law or platform rules require it, and keep records of consent for any voice you clone. Four: prefer vendors with transparent data sourcing, opt-out mechanisms, and a clear stance on consent. None of this is exotic — it is the same provenance discipline that should already govern your data vendors; voice just made it loud.

Related reading

Canonical URL: https://stackswap.ai/elevenlabs-voice-ai-lawsuit. Sources: plaintiffs' firm Loevy & Loevy's announcement of the suits; CBS Chicago and Capitol News Illinois reporting (nine separate suits, defendant list, "no comment"); Biometric Update on the BIPA/voiceprint mechanics; CourtListener docket for the prior, distinct Vacker v. Eleven Labs (2024, Delaware) copyright case. BIPA damages per 740 ILCS 14/20. Everything attributed to the complaints is an unproven allegation; no court has ruled, and ElevenLabs has not responded to requests for comment. Nothing here is legal advice — consult counsel for your jurisdictions. Disclosure: StackSwap is an ElevenLabs affiliate. The read above is the same one we'd give a friend evaluating voice AI — including the diligence that applies no matter which vendor wins. We earn the same disclosed commission across the voice vendors we cover, so the logic isn't shaped by who pays us.