Swiss court: PostFinance needs express consent before taking voiceprints

Swiss court: PostFinance needs express consent before taking voiceprints

21 October 2026: Switzerland's Federal Administrative Court has ruled that PostFinance must obtain express consent before it creates a voiceprint of a caller, upholding the Federal Data Protection and Information Commissioner (FDPIC). Customers who only kept talking after being told the call was recorded and a voiceprint was being made did not consent, the court found, so PostFinance has until mid-February 2027 to get explicit consent for existing voiceprints and must delete the rest immediately.

Not yet independently verified. We read the commissioner's summary, not the judgments themselves, and it does not say whether PostFinance can still appeal the main ruling. We will update this when it can be confirmed, and remove this note.

What the court decided

In case A-4467/2025, decided on 13 October 2026, the court treated a voiceprint as personal data requiring special protection under Swiss law, whose processing "requires the express consent of the affected individual". Being informed at the start of a call and carrying on does not meet that bar: people who do so "do not thereby give their express consent". Creating voiceprints without it infringes their personal rights, and the court found no justification that would excuse the practice.

A second judgment the same day, A-6813/2025, confirmed that the commissioner may publish its original decision of 16 May 2025, which ordered PostFinance to obtain consent before creating voiceprints and to delete those made without it. The commissioner will publish that decision once the publication ruling is final. PostFinance had appealed both the decision and its publication after the commissioner closed its investigation in August 2025.

Why every voice authentication rollout should read it

Voice biometrics are sold to banks, insurers and telecoms as a way to cut call-centre handling time: the caller speaks, the system matches the voice and skips the security questions. The convenient way to enrol customers is passively, from calls they make anyway, with a recorded notice at the start. The ruling closes that route in Switzerland. Enrolment needs an explicit yes, which in practice means an opt-in step in the call, the app or a signed form, and a record of it, plus a way to delete prints for those who say no.

The same logic matters well beyond PostFinance. The EU GDPR also treats biometric data used to identify a person as a special category that generally needs explicit consent, so firms using the same vendors across Switzerland and the EU face the same design question. Contact centres buying authentication as part of a platform should ask how enrolment consent is captured and evidenced, and whether existing prints can be traced to it. Our call centre software category lists six products.

The deadline

The mid-February 2027 date applies to PostFinance's existing voiceprints: by then each needs explicit consent or must be gone. The commissioner's summary gives no count of how many customers are affected.

Related on TrustList:

• Hamburg makes its privacy regulator the AI Act watchdog for city agencies

Sources

• FDPIC: Authentication by means of voice recognition, FAC upholds the FDPIC position, 21 October 2026