Music deepfakes: protect your voice and catalogue

More than 260,000 AI-generated tracks designed to impersonate real artists: that is the number of recordings Sony Music said it had asked digital platforms to remove by the end of September 2026. Six months earlier, the figure was above 135,000. It nearly doubled, but this is no longer a problem limited to major labels and international stars.

An online catalogue, a recognisable voice and an established artist identity can now be enough for someone to manufacture a fake collaboration, attach a track to the wrong profile, clone a singer’s voice or use a name and image to make an unauthorised project appear genuine.

The question is no longer whether an independent artist is famous enough to be impersonated. It is whether they have the evidence, metadata and procedures needed to respond when it happens.

Transparency note: the cover image is an AI-generated representation of Roberto Mantovani, created with his consent.

What actually happened with Sony’s 260,000 reported tracks

According to figures Sony Music supplied to the Financial Times and reported by Music Business Worldwide, by the end of September 2026 the company had asked platforms to remove more than 260,000 AI-generated tracks impersonating its artists’ voices or identities without permission. The total reported in March 2026 was above 135,000.

Precision matters: these were takedown requests, not 260,000 confirmed removals. The report did not disclose how many tracks were removed, how quickly platforms responded or which services received the notices. That distinction shows why enforcement is difficult when the same content can be re-uploaded with new metadata, artwork or distributors.

Not every use of AI in music is a deepfake

Using software to clean a recording, separate stems, suggest an arrangement or assist a creative stage does not automatically impersonate an artist. Treating every use of AI as the same issue creates confusion and weakens legitimate claims.

In my work, I separate at least five situations:

AI as a creative tool: the artist controls the process and authorises the use of their materials.
Unauthorised voice cloning: a new recording replicates a recognisable voice without consent.
False attribution: a track is attached to a real artist’s profile through incorrect names, identifiers or metadata.
Copying works or recordings: synthetic content reproduces protected elements of a master, composition, lyrics or sample.
Streaming fraud: mass-produced tracks receive artificial plays intended to capture royalty revenue.

Each situation calls for different evidence and remedies. Voice cloning may engage identity, likeness and personality rights; copying a master may support copyright or neighbouring-rights claims; a false artist-profile release also requires metadata and catalogue associations to be corrected by platforms and distributors.

Why this is not only a copyright issue

A voice in the abstract does not always qualify as a copyrighted work. A sound recording, composition, lyric, photograph and trademark follow different rules. Music cloning therefore sits at the intersection of copyright, performers’ rights, name and likeness, privacy, unfair competition, consumer deception and platform contracts.

WIPO examined singer Arijit Singh’s case as an example of the relationship between voice cloning, intellectual property and personality rights. Different countries may reach different legal outcomes. A strong claim must identify the right involved, the relevant territory and the person entitled to enforce it.

Platforms are responding, but artists still need to report

Spotify says it will remove music that impersonates another artist’s voice without permission, whether AI voice cloning or another method was used. The policy also covers releases that omit the impersonated artist’s name from metadata but contain vocals clearly recognisable as that artist’s voice.

Spotify also explains the operational limit: it cannot know whether a vocal is a cleared sample or an authorised collaboration. It needs a claim from the artist or someone acting on their behalf through its legal form.

The company has also launched Artist Profile Protection in beta, giving participating artists more control over releases attached to their name. It is useful, but it does not monitor every service or replace evidence preservation.

The volume of AI music has changed the scale

Deezer reported receiving an average of about 60,000 fully AI-generated tracks per day in January 2026, roughly 39% of daily deliveries. It also said that up to 85% of streams on detected AI music were fraudulent, demonetised and removed from the royalty pool.

This does not mean that 85% of all music produced with AI tools is fraudulent. The figure concerns streams of AI music detected on Deezer. How a track was made and whether accounts fraudulently manipulated its plays are separate questions.

In September 2026, Sony and a broad group of music businesses backed IFPI’s Streaming Integrity Initiative. Its commitments include identity and rights verification, content vetting, action against repeat offenders, lawful intelligence sharing and continuous improvement of anti-fraud systems.

The EU AI Act helps, but it does not solve everything

Article 50 transparency duties under the EU AI Act have applied since 2 August 2026. The European Commission guidelines address detectable marking of synthetic content and disclosure of deepfakes.

Transparency matters, but an “AI-generated” label is not automatically a licence to use someone else’s voice, name, image, composition or master. Nor does it allocate compensation or royalties. Consent, credit, payment and scope still require coherent rights, contracts and platform procedures.

What to do in the first 24 hours

Preserve evidence: URLs, screenshots, date and time, audio, artwork, profile, ISRC, UPC, credits, playlists, visible distributor and available counters.
Classify the incident: cloned voice, wrong profile, copied master, reproduced composition, unauthorised identity or suspicious streaming.
Reconstruct the rights: contracts, registrations, splits, licences, original files, release dates and authorised parties.
File the correct claim: legal form, content-mismatch procedure, distributor, label or relevant partner rather than a generic complaint.
Check every platform: removal from one service does not remove the track elsewhere or stop a new upload.
Measure the impact: fan confusion, commercial use, reach, revenue, reputation and potentially diverted royalties.

Evidence that strengthens a claim

original master, stems and session files with verifiable dates;
ISRCs, UPCs, work identifiers and rightsholder information;
contracts with producers, performers, labels, publishers and distributors;
documented use or registration of the artist name and distinctive signs;
verified access to official profiles and links to authentic channels;
a history of notices, responses and repeat uploads;
statements that allow uses, territories and periods to be compared.

AI clauses music contracts should now address

New agreements should state whether recordings, stems, voice, image and other assets may train models; who may authorise a synthetic voice; the works, territory, purpose and term of consent; approval before release; credits and compensation; sublicensing; data and model retention or destruction; cooperation on detection and takedowns; reporting, audit, revocation and breach.

A general permission for “promotional uses” is inadequate when one source file can become the basis for an unlimited number of new recordings.

Music deepfake questions

If the composition is new but the voice is cloned, is the track lawful?

The composition alone does not answer the question. Using a recognisable voice without consent may engage identity, platform policies and other rights that vary by jurisdiction. The source, presentation and exploitation of the voice must be examined.

Does writing “AI cover” make it acceptable?

No. A label may reduce deception, but it does not replace consent or cure unauthorised use of works, recordings, voice, name or likeness.

Do platforms automatically detect every fake?

No. Detection is improving, but Spotify expressly relies on a claim from an artist or representative when assessing unauthorised voice impersonation. Active monitoring remains necessary.

Can a deepfake divert royalties?

It can redirect attention, corrupt catalogue associations or support artificial streaming. A financial claim still needs data and a documented link between the conduct and the lost payment.

Should AI be banned from music?

No. AI can be a useful creative tool when human control, consent and attribution are present. The problem is replacing a person’s identity, using materials without permission or deceiving audiences and payment systems.

Protecting music rights takes a method

A takedown can stop one upload. A protection strategy must cover voice, name, likeness, masters, compositions, metadata, profiles and revenue, while anticipating that the same content may reappear under another title or distributor.

If music has appeared under your name, a voice is impersonating you, content is using your image, or you want stronger AI clauses in your contracts, book an online meeting with me. We will examine the incident, available evidence and the steps needed to protect your music rights.

You can also read my guide to recovering unpaid royalties and my review of how to check whether every royalty has been reported.

Sources

Back to the Journal