Hollywood Has a Voice Problem. SAG-AFTRA Cannot Fix It Alone.

Consent protections exist. Technical enforcement does not.

In April 2026, twenty-five French dubbing actors found out a platform called Fish Audio had been hosting AI clones of their voices. The French voices of Julia Roberts, Richard Gere, Harrison Ford. Nobody asked. Nobody paid. The clones were live, available to anyone with a browser.

They won their case. The 47 models were taken down. But nobody talked about what happened during the proceedings. Their lawyers had no technical proof those voices belonged to those actors. No cryptographic fingerprint, no chain of custody, nothing resembling a timestamp. They argued perceptual similarity. People listening and testifying "yeah, that sounds like him." A French judge bought it. That won't hold once generators improve, and it won't fly in most other jurisdictions.

I build voice forensics for a living. Three years, over 3,000 detection engines, each targeting different artifacts left behind by neural vocoders. The real problem isn't what we miss. It's that detection alone was never going to be enough.

The consent gap is an infrastructure gap

SAG-AFTRA fought eleven months for consent requirements. California passed AB 2602. Mexico is legislating against AI dubbing without authorization. The EU AI Act kicks in August 2026.

But in every case I've reviewed, the same question stalls everything: how do you prove it? How do you prove a voice belongs to someone, and how do you show a recording is synthetic?

The legal text exists. What doesn't exist is any technical mechanism to enforce it at scale.

Scarlett Johansson had to publicly fight OpenAI over a voice that resembled hers. She has unlimited resources and global name recognition. A dubbing artist earning scale doesn't have a PR team or a direct line to the New York Times.

Three seconds

McAfee showed in 2023 that three seconds of clean audio gives an 85% voice match with current tools. Three seconds. Less than a station ID.

Most cloning platforms now need under thirty seconds. Some need ten.

A working actor has audition tapes on casting platforms, demo reels on agency sites, ADR sessions in studios with inconsistent cybersecurity. Every minute of clean audio is potential training material.

The Mercor breach in April 2026: 4TB stolen from an AI hiring platform, including voice recordings from 40,000 people paired with government IDs. Voice data has resale value now.

Most performers have no idea how exposed they are. No one flagged this for them.

What's missing

Detection barely exists at scale. When something suspicious surfaces, you need to know: human or vocoder? That's what I spend my days on. We don't catch everything. New synthesis methods outrun detection regularly. But we catch the vast majority of commercial clones, and that's what performers will actually run into.

What's almost entirely missing: watermarking before audio leaves the studio, and a chain-of-custody layer that says who recorded this, when, under what license.

I built a watermarking tool called VoiceSign because nobody else shipped one. A performer signs a recording in a browser, it generates a verification page, anyone can confirm authenticity by drag and drop. No account needed, nothing to install. A researcher working on W3C Verifiable Credentials cited it as trust infrastructure, not a detection tool. He's right. The question isn't "is this fake." It's "is this proven real."

The third layer that still doesn't exist: a verifiable credential for voice chain of custody. W3C already handles this pattern for diplomas and licenses. Voice should have been next in line years ago, and frankly the entertainment industry should be pushing harder than anyone for it. They're not. They spent eleven months negotiating legal text while the cloners were shipping APIs. SAG-AFTRA is a war behind.

What to do now

• Record a reference sample. Thirty seconds, studio quality, single speaker. Timestamp it with something that doesn't depend on a company staying alive. Blockchain-anchored timestamps work. So does a notarized USB.
• Watermark every demo reel before it leaves the building. This is the one most people skip. Every recording your agent sends out, every self-tape, every ADR session that gets emailed as a WAV. All of it should carry a signature tied to your identity. If it doesn't, you're handing out free training data.
• Then do something uncomfortable: search your own name on YouTube, casting sites, agency portfolios. Count how many hours of your voice are sitting on public servers right now. That number is your attack surface.

The twenty-five French actors won because they were organized, they had name recognition, and they were in a jurisdiction that took it seriously. Most performers have none of that going for them.

I've listened to thousands of voice samples over three years. The ones that stick with me aren't the fakes. They're the real recordings from people who have no way to prove it.