How to Verify Permission Before Generating Someone's Face or Voice

October 4, 2026

Six checks to run before generating a real person's face or voice: identity, authority, scope, term, currency and proof. Works manually or with an API.

AI RightsIdentityPlatformsDevelopers

Quick answer

Before you generate a real person's face or voice, confirm six things: who the person is, who gave permission, whether that person had authority, whether the permission covers this exact use, whether it is still current, and whether you can prove all of this later. You can do it with email and a signed agreement, or automatically with a consent API. If the person isn't registered with any service, contact them or their representative directly and get specific written consent.

Check 1: Is the permission tied to the right person?

Make sure the consent belongs to the person you're about to depict, not someone with a similar name or a fan account. For consequential uses, confirm identity through a contact method you find independently, not one supplied in the request.

Check 2: Did the person signing have authority?

If a manager, agent, estate or company signs, confirm they actually represent the person for this kind of use. Ask for the document that gives them authority and confirm it with the person or a known contact. For people who have died, check who holds post-mortem rights where they lived; California, New York and Tennessee all recognize such rights. Tracker: post-mortem replica rights

Check 3: Does the permission cover this exact use?

An audiobook is not an ad. A voice license is not automatically permission to train a model. Match the medium, product, purpose and depth: using existing footage, generating new media, or training. Several laws reward specificity. In California (Labor Code §927) and New York (General Obligations Law §5-302), a digital replica clause in a services contract can be unenforceable if it lacks a reasonably specific description of uses and the person had no lawyer or union representation. Tracker: AB 2602 · Tracker: New York

Check 4: Where and for how long does it apply?

Check term and territory. Permission for a 2025 campaign in the US may not cover a 2026 relaunch in Europe. If the proposed federal NO FAKES Act became law in its Senate form, licenses for living people would be capped at 10 years and would need to be written, signed and reasonably specific; as of October 4, 2026 it is not law. Tracker

Check 5: Is it still current?

Confirm the permission hasn't expired or been withdrawn for future uses. Re-check at the moment of generation, not just at signing.

Check 6: Can I prove it later?

Keep the signed agreement, the exact text the person agreed to, the date, and a record of each check: what was asked and what the answer was. If you use an API, store the response or token with the output.

How do I do this manually?

For occasional uses:

  1. Send the person or representative a plain-language description of the intended use.
  2. Get a signed agreement covering use, term, territory, pay, approvals and training.
  3. Confirm identity and authority through an independent contact.
  4. Save the agreement with the project files.
  5. Reconfirm if anything changes.

What if the person isn't registered with any consent service?

That isn't a dead end. Contact them or their authorized representative, verify the contact independently, get specific written consent and store it. You don't need a third-party identity platform to obtain valid permission.

How does an automated check work?

A consent API runs the same checks against structured rules: you send an identifier and the intended use, and get back allow or deny with evidence. Our consent API guide explains the record behind it, and our platform guide covers where checks sit in a pipeline.

Where Royall fits

Royall Herald is one example. For people registered in Royall, your app sends their Asset ID and intended use and gets back ALLOW or BLOCK. On ALLOW, it returns a signed grant that expires in about 15 minutes (no more than an hour), so you re-check at generation time. Each grant tells you whether the person's identity was verified, so you can require it for sensitive uses. Developer docs

Key takeaways

  • Permission is more than a yes: identity, authority, scope, term, currency and proof.
  • Verify representatives through contacts you find yourself.
  • Match the permission to the exact use and depth, including training.
  • Re-check at generation time.
  • Manual clearance remains valid.

FAQ

Is verbal permission enough to clone someone's voice? Written, specific permission is much better evidence for any commercial use.

Do I need permission to depict a public figure? It depends on context and place. Ads and endorsements usually need consent; news, commentary and parody are treated differently. Get legal advice for consequential uses.

What if permission is withdrawn after I've published? Stop new uses and follow the governing agreement for existing material.

Does permission to use someone's recordings include training a model? Not automatically. Treat training as a separate permission and get it in writing.

Sources

Related guides

This is general information, not legal advice.

onwards,
The Royall team