Federal Administrative Court ·
Voice recognition: explicit consent is needed, carrying on talking is not enough
By Advisorn · guidance, not advice
In brief
The Federal Administrative Court has confirmed that PostFinance must obtain explicit consent before creating a customer's voiceprint. Carrying on talking after the recorded notice is not explicit consent; without consent the voiceprint must be deleted.
What happened
In 2025 the FDPIC had ordered PostFinance to ask for explicit consent for voice authentication and to delete the voiceprints created without it. PostFinance had appealed.
In two judgments of 13 October 2026 (A-4467/2025 and A-6813/2025) the Court found in favour of the FDPIC. A voiceprint is sensitive personal data: creating it without explicit consent violates privacy, and no ground for justification saves it. PostFinance has until mid-February 2027 to collect the missing consents.
What it means for an SME
If you use voice, fingerprint or face to recognise customers or staff, ask for explicit and separate consent before the processing, and keep a record of it.
A notice that the person "accepts" by continuing to use the service is not enough for these data.
Source: FDPIC communication of 21 October 2026. General information summarised from the source, not advice on your case: for your case, the text of the decision or the law is what counts.