Open-weights speech models are unusually treacherous to license, four incompatible labelling regimes are now in force worldwide, and the market ships almost none of what they require. Informational only — this is not legal advice. Verify against primary sources and qualified counsel before relying on any of it.
A speech project licenses its code and its model weights separately. MIT or Apache-2.0 code paired with non-commercial weights is extremely common, because the weights inherit restrictions from whatever the model was trained on.
The GitHub badge tells you about the code. Check the model card, and check it for the specific checkpoint you intend to ship — sibling models in one repository sometimes carry different licences. Three claims you will see everywhere and that are all wrong: Fish Audio S2 Pro is not MIT, IndexTTS 2 is not Apache-2.0, and F5-TTS's released checkpoints are not MIT.
European Union. AI Act Article 50 has applied since 2 August 2026. Providers of systems generating synthetic audio must mark outputs in a machine-readable format detectable as artificially generated; deployers publishing a deepfake must disclose it perceivably. A cloned voice that plausibly appears authentic counts, and the duty applies even without intent to deceive. Penalties reach €15 million or 3% of worldwide annual turnover. The regulation names no technical standard, so vendors are guessing between provenance metadata and watermarking.
China has the strictest and most technically prescriptive regime: a human-perceptible label and machine-readable metadata to a named national standard, in force since September 2025. India requires audio disclosures plus permanent provenance metadata, with takedown clocks measured in hours. South Korea requires visible or machine-readable labels for synthetic sounds. The UK, US federal law and Japan have no synthetic-audio labelling mandate at all.
The practical consequence: a single global product cannot satisfy all four in-force regimes with one implementation.
Against those requirements, the market's actual behaviour is stark. Most major commercial vendors disclose no audio watermark. One leading vendor's own detection classifier explicitly does not reliably identify audio from its own flagship model, and analyses only the first minute of a clip.
The most reliably watermarked synthetic speech available right now comes from an MIT-licensed open model. Chatterbox embeds a watermark in every generation and ships the extraction code so anyone can verify it. For everything else, the practical retrofit is an open watermarking library with permissive weights, applied as a post-generation pipeline step.
Two caveats that apply to every scheme. All of them are proactive — they mark at generation time, so the absence of a watermark proves nothing. And published robustness figures are measured against benign edits like compression and re-encoding, not against a motivated adversary.
This varies enormously, and it is a procurement question rather than a feature. At the strict end, one hyperscaler requires a recorded verbal consent statement in a fixed script plus a biometric match between that statement and the training audio, and gates the whole capability behind account-team approval. In the middle, vendors require the speaker to read a consent statement with no verification that it is the same person. At the loose end sit vendors that accept a checkbox — and open-weights models, which have no gate whatsoever.
If deepfake liability matters to you, this dimension should outrank price. And note that self-hosting exempts you from nothing: if you place a self-hosted system on the EU market, you are the provider under Article 50.
Several major TTS vendors train on customer content by default, with an opt-out buried in account settings that is not retroactive. At least two take a perpetual, irrevocable, sublicensable licence over your input with no opt-out identified at all — difficult to reconcile with data-subject rights under GDPR.
Others do not train by default and say so plainly; one exposes a per-request parameter to disable it, which is the most auditable control found anywhere in the segment. Retention and training policy could not be verified from primary sources for most vendors. Speech inputs routinely contain personal data — get these terms contractually rather than assuming.
Copyright does not protect a voice. The leading 2025 case held that copyright covers the fixed sound recording, not the abstract qualities of a voice nor a new recording that imitates one. Trademark generally fails too. What survives is state right-of-publicity law, state consumer-protection law, and breach of contract — and the question of whether training on scraped recordings infringes was left open rather than decided.
The fastest-moving US exposure is not publicity but biometric privacy. Illinois's statute enumerates voiceprints and carries a private right of action; a wave of class actions filed in May 2026 named nine major technology companies over voiceprints allegedly extracted from public recordings to train commercial voice models. The unresolved doctrinal question — whether a generative voice model is a "voiceprint" — will determine exposure for the entire industry.
There is no binding law anywhere governing memorial voices or digital-afterlife services. The only articulated guidance is academic: consent from the person before death, consent from heirs and from the mourners who will interact, adult users only, easy opt-out, and defined retirement protocols for a dignified shutdown.
The nearest binding constraints are indirect — post-mortem publicity rights, and estate consent under performers'-union agreements. In most of Europe, data-protection law does not apply to the deceased at all. The result is an inversion worth stating plainly: the law protects the commercial value of a dead celebrity's voice far better than it protects an ordinary family from an unwanted synthetic parent.