Your voice, your data: Why continuing the conversation does not constitute consent | HÄRTING Rechtsanwälte

A brief prompt over the phone, after which the call continues – but is a company allowed to create a digital voiceprint from this? In the PostFinance case, the Federal Administrative Court has drawn a clear line: anyone who simply continues speaking does not expressly consent to the processing of their biometric data. The ruling has implications far beyond telephone banking and raises fundamental questions for companies regarding the use of voice recognition, facial scans and other biometric authentication methods.

29. October 2026

Federal Administrative Court sets limits on voice recognition

Biometric authentication methods promise security and convenience: instead of a password or a security question, one’s own voice is sufficient to identify oneself to a company. However, what appears technically straightforward poses significant challenges under data protection law. This is because a voice can be used to generate a permanently usable identification feature.

In its judgement A-4467/2025 of 13 October 2026, the Federal Administrative Court (BVGer) ruled that PostFinance AG requires the explicit consent of the data subjects to create such voice prints. Merely continuing a telephone conversation after receiving a relevant notice is not sufficient.

The ruling makes it clear that transparent information about data processing must not be equated with consent to such processing. At the same time, it sets out the conditions under which a company’s security and efficiency interests may justify the processing of biometric data.

The PostFinance case: When silence is taken as consent

PostFinance had been using a voice recognition authentication procedure since September 2018. A voiceprint was generally created for customers calling from Switzerland, provided they did not object to it being stored. Customers were informed at the start of the telephone call about the recording and the creation of a voiceprint. Anyone who did not wish to use voice recognition had to inform their customer adviser or deactivate the function via the website. PostFinance thus relied on a so-called ‘opt-out’ procedure: data processing was the default setting, whilst the data subject had to take action themselves to prevent it.

The Federal Data Protection and Information Commissioner (FDPIC) objected to this approach and, by order of 16 May 2025, required PostFinance to obtain explicit consent and to delete voiceprints without such consent. PostFinance challenged the order. The Federal Administrative Court upheld the substantive requirements set out by the FDPIC, but granted the company an extended deadline to obtain explicit consent retrospectively. The key question was therefore: may a company interpret the mere act of continuing a conversation following a data protection notice as consent to biometric identification?

Why a voiceprint is subject to special protection

The Swiss Data Protection Act distinguishes between ordinary personal data and personal data requiring special protection. According to Article 5(c)(4) of the Data Protection Act (DSG), biometric data that uniquely identifies a natural person falls within the category of personal data requiring special protection.

A voiceprint is not the same as an ordinary audio recording. In biometric voice recognition, characteristic features of the voice are technically analysed and processed into a digital reference profile. This makes it possible to match the voice against the stored profile during subsequent interactions. The difference therefore lies in particular in the purpose and the technical processing. Not every voice recording is automatically considered biometric data requiring special protection. However, if it is processed to uniquely identify a person on the basis of individual voice characteristics or to confirm their identity, the profile derived from it falls under the special protection of the Data Protection Act (DSG).

This entails specific risks: biometric characteristics are closely linked to physical identity and cannot be easily replaced. If a biometric profile falls into the wrong hands or is used for purposes other than those for which it was intended, this can have long-term adverse effects on the data subject. The Federal Administrative Court therefore attaches particular importance to control over one’s own biometric data, transparency and protection against subsequent misuse.

Explicit consent: information alone is not sufficient

The legal requirements for consent are set out in Article 6(6) and (7) of the Data Protection Act (DSG). Where consent is required, it must be given voluntarily, following the provision of appropriate information, and must relate to one or more specific data processing operations. Where consent relates to personal data requiring special protection, Article 6(7)(a) of the DSG additionally requires that it be given expressly. The distinction between express and implied consent is crucial in this regard.

Implied consent is inferred from a person’s behaviour. For example, a person who continues a telephone call after being informed about voice recognition could thereby indicate that they wish to continue the conversation. However, it does not follow from this that the same person also expressly consents to the creation and storage of a biometric identification profile.

It is precisely this distinction that the Federal Administrative Court emphasises in the grounds for its judgement. Continuing to speak does not constitute an active declaration of intent clearly aimed at the creation of a voiceprint. Even prior information about the data processing cannot compensate for the lack of express consent. The consequence is that an opt-out procedure is not a sufficient basis if the specific data processing requires explicit consent.

For businesses, this means that the data subject must actively and unambiguously express their will. In the case of telephone authentication, for example, a specific question requiring a clear affirmative answer may be considered. Similarly, appropriately designed digital consent options are conceivable. The DSG does not generally prescribe a specific technical form of consent. Rather, what is decisive is that consent is given voluntarily, that sufficient information is provided, that the consent is specific, and that it is unambiguous in relation to the specific data processing.

Can security interests replace the lack of consent?

The ruling is particularly relevant because the Federal Administrative Court does not confine itself to finding that consent was insufficient. Under Article 30 of the DSG, the processing of personal data in breach of the principles governing processing may constitute an infringement of personal rights. However, pursuant to Article 31(1) of the FADP, such an infringement is not unlawful if it is justified by the consent of the data subject, an overriding private or public interest, or by law. Swiss data protection law therefore does not require consent without exception for every instance of processing of personal data requiring special protection. If no valid consent exists, other possible grounds for justification must be examined independently.

PostFinance cited, in particular, the security of customer accounts, the prevention of misuse and the more efficient handling of customer enquiries by telephone. The Federal Administrative Court recognised that combating attempts at fraud and ensuring secure financial services may constitute compelling interests. Economic efficiency considerations may also, in principle, be taken into account when weighing up interests. However, these interests do not automatically justify every intrusion into a person’s privacy. A key factor was, in particular, that PostFinance did not provide any concrete evidence that the voice recognition system used would ensure a significantly higher level of security than alternative authentication methods. In this regard, the court referred, amongst other things, to security issues, PIN procedures and multi-factor authentication.

This is set against the significant intrusion involved in the creation of a permanent biometric identifier. Furthermore, PostFinance had previously used an opt-in procedure on a temporary basis, but later reverted to the economically more advantageous opt-out solution for its domestic customers. In weighing up the interests involved, the court therefore concluded that the private interests cited did not justify the infringement of personal rights. What is noteworthy here is the nuanced reasoning: the Federal Administrative Court does not declare biometric voice recognition to be fundamentally unlawful. Rather, it rejects the specific implementation without explicit consent and without sufficient alternative grounds for justification.

Voiceprints already stored: obtain consent retrospectively or delete them

The ruling also has implications for existing biometric data sets. Pursuant to Article 51(1) of the Data Protection Act (DSG), processing that contravenes data protection regulations may result in supervisory measures, including the deletion of the personal data concerned.

In this specific case, the Federal Administrative Court confirmed PostFinance’s obligation to delete fingerprints without explicit consent. However, for reasons of proportionality, it granted the company a deadline of 15 February 2027 to obtain the necessary consent retrospectively. If no evidence of such consent is available by that date, the voting records in question must be deleted immediately. This transitional period is a court order specific to this particular case. No general right can be inferred from this for other companies to continue using biometric profiles created unlawfully for the time being and to legitimise them retrospectively at a later date.

The ruling makes it clear that data protection compliance is not limited to the design of future consent processes. Companies must also assess whether their existing data sets are based on a sound legal foundation.

What does the ruling mean for banks, insurance companies and employers?

The legal considerations set out by the Federal Administrative Court are not limited to the financial sector. They are also relevant to companies that use facial recognition, fingerprint systems or other biometric authentication methods. For banks and insurance companies, the key question is whether existing identification procedures in customer service require active consent or merely allow for the right to object.

Providers of authentication software must bear in mind that compliance with data protection regulations does not depend solely on the technical security of their systems. Equally important are the specific procedures for providing information and obtaining consent, as well as the options for deleting biometric profiles.

Particular caution is also warranted in the context of employment relationships. Where fingerprints or facial scans are used, for example, for access control or time-recording systems, the restrictions on data processing under employment law must be observed in addition to the requirements of the Data Protection Act (DSG). In particular, the voluntary nature of consent in an employment relationship may be questionable due to the existing relationship of dependency. Express consent alone does not render processing that is disproportionate or unlawful under employment law lawful.

Recommendations for practice

Organisations that use or wish to introduce biometric authentication procedures should review their processes in light of the following questions:

What data is actually being processed? It must be clarified whether only audio or video recordings are stored, or whether biometric identification features are derived from them.
Is there a sound legal basis? Is explicit consent required, or, following careful assessment, might another justification apply?
Is consent given actively and in full knowledge of the facts? The consent process should clearly set out the specific purpose of the biometric processing and enable a clear decision to be made.
Is there a reasonable alternative? Particularly in the case of voluntary services, it should be assessed whether customers or staff can access the relevant service without biometric identification.
Is the data adequately protected? Access restrictions, appropriate retention periods, deletion processes and, where necessary, a data protection impact assessment must be taken into account at an early stage.
How are existing profiles handled? If there is no sound legal basis, it must be assessed whether data processing should be discontinued and existing biometric profiles deleted.

It is also important that organisations document the consents given in a transparent manner. This makes it possible to demonstrate compliance with legal requirements in the event of a dispute.

Conclusion: Biometric security requires a conscious decision

Judgment A-4467/2025 sets an important limit on the use of biometric authentication procedures: the mere continuation of a service does not constitute express consent to the creation of a biometric identification profile.

At the same time, the ruling confirms that the interests of fraud prevention, data security and efficient business processes are legally relevant. However, they must be balanced against the data subjects’ personal rights and cannot automatically compensate for a lack of consent. For businesses, the practical challenge therefore lies not in avoiding biometric procedures altogether, but in designing them to comply with data protection regulations from the outset.

The judgement may still be appealed to the Federal Supreme Court. Regardless of its future procedural outcome, it already demonstrates that companies should scrutinise the legal basis of their biometric systems just as carefully as their technical performance.