Swiss court: PostFinance needs express consent before taking voiceprints

Swiss court: PostFinance needs express consent before taking voiceprints

21 October 2026: Switzerland's Federal Administrative Court has ruled that PostFinance must obtain express consent before it creates a voiceprint of a caller, upholding the Federal Data Protection and Information Commissioner (FDPIC). Customers who only kept talking after being told the call was recorded and a voiceprint was being made did not consent, the court found, so PostFinance has until mid-February 2027 to get explicit consent for existing voiceprints and must delete the rest immediately.

What the court decided

In case A-4467/2025, decided on 13 October 2026, the court treated a voiceprint as personal data requiring special protection under Swiss law, whose processing "requires the express consent of the affected individual". Being informed at the start of a call and carrying on does not meet that bar: people who do so "do not thereby give their express consent". Creating voiceprints without it infringes their personal rights, and the court found no justification that would excuse the practice.

A second judgment the same day, A-6813/2025, confirmed that the commissioner may publish its original decision of 16 May 2025, which ordered PostFinance to obtain consent before creating voiceprints and to delete those made without it. The commissioner will publish that decision once the publication ruling is final. PostFinance had appealed both the decision and its publication after the commissioner closed its investigation in August 2025.

Why every voice authentication rollout should read it

Voice biometrics are sold to banks, insurers and telecoms as a way to cut call-centre handling time: the caller speaks, the system matches the voice and skips the security questions. The convenient way to enrol customers is passively, from calls they make anyway, with a recorded notice at the start. The ruling closes that route in Switzerland. Enrolment needs an explicit yes, which in practice means an opt-in step in the call, the app or a signed form, and a record of it, plus a way to delete prints for those who say no.

The same logic matters well beyond PostFinance. The EU GDPR also treats biometric data used to identify a person as a special category that generally needs explicit consent, so firms using the same vendors across Switzerland and the EU face the same design question. Contact centres buying authentication as part of a platform should ask how enrolment consent is captured and evidenced, and whether existing prints can be traced to it. Our call centre software category lists six products.

The deadline

The deadline for PostFinance's existing voiceprints is 15 February 2027, as the judgment sets it: by then each needs explicit consent or must be deleted, and the FDPIC can no longer extend it. The judgment can still be appealed to the Federal Supreme Court within 30 days of notification. The commissioner's summary gives no count of how many customers are affected.

Related on TrustList:

• Brazil makes facial biometric checks mandatory for mobile phone lines
• ICASA drafts biometric checks for every SIM activation and swap
• Hamburg makes its privacy regulator the AI Act watchdog for city agencies

Sources

• FDPIC: Authentication by means of voice recognition, FAC upholds the FDPIC position, 21 October 2026
• Federal Administrative Court: Creation of voiceprints requires explicit consent of affected individuals, 21 October 2026
• Federal Administrative Court: Judgment A-4467/2025 (PDF), 13 October 2026