GDPR and voice AI: what the law requires in 2026

Putting an AI on the phone raises a real legal question: you record a voice, transcribe a conversation, store a name, a number, sometimes an address. All of this falls under the GDPR (General Data Protection Regulation) and the guidance of France's CNIL. Handled badly, it can lead to a fine of up to 4% of annual turnover.

This article walks through the concrete obligations: what you must tell the caller, where to host the data, how long to keep it, how to handle a deletion request. No pointless legal jargon, just what a professional needs to know to stay compliant when setting up a callbot or an AI phone answering service.

What GDPR obligations apply to a voice AI?

A voice AI that answers calls must meet four major GDPR obligations: inform the caller from the start of the conversation that the call is handled by an AI and recorded, collect only the data that is necessary (the minimisation principle), host the data in the EU with a compliant processor, and allow deletion at any time at the person's request. Penalties for breaches: up to 20 million euros or 4% of worldwide annual turnover.

The data processed by a voice AI

When an AI answers a phone call, it handles several categories of personal data:

• The audio recording of the conversation (a voice is potentially biometric data if used to identify the person)
• The text transcription of what was said (the text equivalent of the audio)
• The declared identity: first and last name (often collected at the start of the call)
• Contact details: phone number (already known from the incoming call), email, postal address if requested
• The reason for the call: nature of the request, level of urgency, sometimes sensitive personal context (health, family, finances)
• Metadata: date, time, duration, caller number, approximate geolocation tied to the carrier

All of this data falls within the scope of the GDPR. The data controller is the professional who uses the AI (you), not the callbot provider (who is a processor within the meaning of Article 28).

Obligation 1: inform the caller as soon as the call connects

Article 13 of the GDPR requires informing the person of several things as soon as their data is collected: who is collecting it, why, on what legal basis, for how long, who will have access, and how to exercise their rights. For a phone call, the 2022 CNIL recommendation on voicebots sets out the expectations.

In practice, the welcome message must include, within the first few seconds:

1. A statement that the call is handled by an AI and not a human ("You are speaking with the voice assistant for [professional's name]")
2. Notice that the call is recorded and transcribed
3. The purpose ("to qualify your request and arrange a callback")
4. The option to ask for a human or to hang up (implicit option)

These statements can be brief (10-15 seconds max) so as not to weigh the call down. The detailed information (retention, rights) points to a privacy policy accessible on the professional's website.

Obligation 2: data minimisation

The GDPR prohibits collecting more than necessary. In concrete terms for a voice AI:

• Don't ask for a date of birth if it isn't essential
• Don't store the audio recording if the transcription is enough
• Don't keep completed conversations once the appointment is booked and the summary sent
• Don't ask for a social security number, bank details or detailed medical information over the phone (switch to a secure written channel or an in-person meeting)

The CNIL sanctioned several companies in 2023 and 2024 for collecting data "by default" beyond the strict operational need.

Obligation 3: hosting and transfers

The data collected must be hosted within the European Union, or in an adequate country recognised by the European Commission. Transferring data to the United States has become legally risky since the Schrems II ruling (2020) and remains constrained despite the 2023 Data Privacy Framework.

For a voice AI, several components must be European:

• The main hosting (web servers, database)
• The speech-to-text (STT) transcription service
• The LLM where possible (European Mistral vs American OpenAI/Anthropic)
• The text-to-speech (TTS) synthesis service
• The sending of notification emails and SMS

Accueil IA is hosted 100% in France (OVHcloud servers and in-house hosting in Lyon), with STT and TTS running locally on a dedicated server. The LLM can be configured on Anthropic Claude (USA, subject to the DPF) or on Mistral (FR/EU) depending on the client's requirements. This is documented in the DPA (Data Processing Agreement) signed between Accueil IA and each client professional.

Obligation 4: retention period

The GDPR requires a limited and proportionate retention period. For phone recordings, the CNIL recommends:

Beyond these periods, the data must be deleted automatically or anonymised (removal of identifying elements). A scheduled automatic purge is best practice. Accueil IA automatically purges audio recordings after 30 days and anonymises transcriptions after 1 year, unless the professional explicitly requests longer retention (with documented justification).

Obligation 5: individuals' rights

Any caller can exercise several rights over the data concerning them:

• Right of access: obtain a copy of the stored data concerning them
• Right to rectification: correct inaccurate data
• Right to erasure: deletion (except where legally required to retain)
• Right to portability: retrieve their data in a reusable format
• Right to object: refuse certain processing

The client professional must have a process to respond to these requests within one month. A dedicated email address (dpo@... or rgpd@...) is standard. The callbot tool must provide a fast export and deletion function.

Penalties and recent case law

Beyond the CNIL, a caller can also bring a civil claim in the event of harm (invasion of privacy). GDPR class actions have been multiplying since 2023.

How Accueil IA handles GDPR

• Notice in the greeting message ("voice assistant", "call recorded")
• Hosting 100% in France (OVH servers + dedicated server in Lyon)
• Audio purged at 30 days, transcription anonymised at 1 year
• DPA provided to each client professional (controller / processor)
• Export and deletion by the professional from their dashboard, in one click
• Auditable access logs, ISO 27001 compliance targeted for 2026

To go further: the CNIL voicebots fact sheet, how a callbot works technically, voice cloning and its legal implications.

To hear the Accueil IA greeting and check that it properly includes the GDPR notice, call 09 72 10 55 19. And to try it out, create a free account.