Voiceprints at PostFinance: carrying on speaking is not explicit consent

Source: This article is based on the communication of the Federal Data Protection and Information Commissioner (FDPIC) of 21 October 2026, «Authentication by means of voice recognition: Federal Administrative Court upholds the FDPIC’s position on obtaining explicit consent», on the media release of the Federal Administrative Court of the same day and on judgment A-4467/2025 of 13 October 2026 (PDF, in German). Quotations from the judgment, which is only available in German, are our own translations; «consid.» refers to the considerations of the judgment. The assessment is our own and is no substitute for legal advice. All sources are listed at the end of the article.

From September 2018, PostFinance AG created a voiceprint of customers who called it, so that it could recognise them by their voice on later calls. On their first call, they heard this announcement:

«This conversation is being recorded for security and recognition purposes. PostFinance creates a voiceprint from the recording in order to verify your identity by your voice on every call. If you do not wish to have a voiceprint, please tell the customer adviser.»

Anyone who said nothing and simply carried on speaking was given a voiceprint. The Federal Administrative Court has now ruled that this is not explicit consent. The reasoning extends far beyond a bank's call centre, because it establishes what «explicit» means in the Federal Act on Data Protection (FADP).

What did the Federal Administrative Court decide?

Item	Details
Court	Federal Administrative Court, Division I
Judgment	A-4467/2025 of 13 October 2026
Parties	PostFinance AG against the FDPIC
Contested decision	FDPIC decision of 16 May 2025
Outcome	Appeal partially upheld, and only with regard to the deadline
Deadline	Retrospective explicit consent by 15 February 2027, otherwise deletion
Further appeal	Appeal to the Federal Supreme Court possible

On the merits, the Court upheld the FDPIC's position:

• Voiceprints are sensitive personal data. They are biometric data that allow unique identification or authentication (Article 5(c)(4) FADP; consid. 8.2).
• Processing them requires explicit consent under Article 6(7)(a) FADP (consid. 8.6).
• Carrying on speaking is not enough. The opt-out solution used until now constitutes an infringement of personal rights (consid. 8.9).
• There is no justification. Neither security nor efficiency outweighs the interests of the data subjects (consid. 9.8).
• Anything left without consent is deleted. For reasons of proportionality, PostFinance has until 15 February 2027 to obtain retrospective consent for existing voiceprints (consid. 10.3.4).

In a second judgment (A-6813/2025), the Court confirmed that the FDPIC may publish its decision. According to the FDPIC, it will do so as soon as that judgment becomes final.

For the sake of completeness: on one point, PostFinance was successful. In its decision, the FDPIC had not given sufficient reasons why deletion should be proportionate and whether it had considered alternatives. The Court regards this as a breach of the duty to state reasons, but cured it in the appeal proceedings (consid. 3.3 and 3.4).

What does «explicit» mean according to the judgment?

This is the core of the judgment, and the Court states it clearly:

«It follows from the above that the wording and the legislative materials as well as the purpose of the provision suggest that the ‹explicitness› of consent may be affirmed only if there is an active step by the data subject and their unequivocal agreement to a specific, sufficiently clearly defined processing of data. Merely implied or even tacit agreement is in any event not sufficient in this context.» (consid. 8.6.6)

This results in three features that must all be present:

1. An active step. The person does something. Doing nothing, remaining silent or carrying on is not enough.
2. Unequivocal agreement. The act has no other meaning than «Yes, I agree».
3. A specific, clearly defined processing operation. The person knows what they are saying yes to.

In addition, there are the requirements that apply to any consent (Article 6(6) FADP): it must be given after adequate information about the subject matter, purpose, scope and risks, and it must be voluntary. According to the judgment, voluntary means that the person has a reasonable alternative and does not suffer disproportionate disadvantages if they refuse (consid. 8.3).

The following comparison shows what this means in practice. The left-hand column reflects the examples that the judgment takes from legal literature (consid. 8.6.5) and the description in the Dispatch on the FADP, according to which consent can be given by written or spoken words or by a sign (consid. 8.6.3):

Explicit	Not explicit
Clicking a button next to the information text	Carrying on speaking after an announcement
Ticking a box	Silence or failure to object
Actively selecting certain settings	Implied (conclusive) conduct
A spoken or written «yes» to a clear question	A default setting that you have to switch off yourself

Some legal writers had argued that «explicit» refers only to the subject matter of the consent, not to the way in which it is expressed. The Court does not follow this view (consid. 8.6.5 and 8.6.6). It also refers to the European General Data Protection Regulation (GDPR), which likewise requires explicit consent for biometric data and does not accept implied conduct as sufficient (consid. 8.6.4).

One remark in the judgment deserves particular attention. The Court cites a view in legal literature according to which, based on studies, the «average addressee» behaves passively when it comes to consent. If four out of five people did in fact behave passively, an opt-out solution would produce significantly more «consents» than an opt-in solution (consid. 8.3). This is precisely the difference made by the active step that the law requires for sensitive data.

Why were security and efficiency not enough to justify it?

PostFinance had argued that voice recognition was secure and popular, saved all parties a considerable amount of time and thereby, according to its own figures, saved costs of CHF 720,000 (consid. 5.2). The Court weighed up the interests:

• Security: medium weight. The interest in protecting accounts against fraud carries great weight in principle. However, PostFinance provided no evidence that the voiceprint is more secure than alternatives such as two-factor or multi-factor authentication (consid. 9.6.1).
• Efficiency: medium weight. The Court found it plausible that the voiceprint is faster and more economical than security questions (consid. 9.6.2).
• Protection of the data subjects: very great weight. At stake are particularly sensitive data, a serious interference and a «permanent identifier» that can be used in future without the involvement of the data subjects (consid. 9.6.3).

There is also a detail from the background: in 2018, PostFinance had already used an opt-in solution for around two months and then reverted to opt-out for customers in Switzerland, even though it was aware of the higher level of protection (consid. 9.7). Customers resident abroad, by contrast, were asked actively.

Important for anyone using biometric methods: on one point, the Court disagrees with the FDPIC. A complete abandonment of biometric data cannot be demanded on the grounds that less intrusive means such as security questions exist. If the processing principles are complied with and valid explicit consent has been given, voice recognition is permissible (consid. 9.6.2). The judgment therefore does not ban the technology. It requires that the data subjects say yes beforehand.

Do old consents remain valid?

No, at least not in these circumstances. PostFinance argued that the consents obtained under the old FADP were still valid because the processing had never changed since 2018. The Court takes a different view: the voiceprints continue to be stored and used; this is an ongoing state of affairs to which the new law applies (consid. 10.2.2).

«Against this background, in particular in view of the stricter requirements of the revised law regarding the existence of legally valid consent and the continuation of the processing of the data, the agreements obtained under the regime of the old FADP are no longer valid. Rather, further processing of these data requires explicit consent with reference to the law in force today.» (consid. 10.2.2)

Our assessment: anyone who relies on consent obtained before 1 September 2023 for sensitive personal data and continues to process those data should check whether the consent meets today's requirements. If it does not, the judgment indicates that it can be obtained retrospectively; in the specific case, the Court considered retrospective explicit consent suitable for restoring a lawful state of affairs (consid. 10.3.3).

What does this mean for hotlines and voice assistants?

Two things need to be kept apart:

Recording the conversation. Under criminal law, implied agreement is sufficient here: anyone who knows that the conversation is being recorded and still carries on speaking has agreed within the meaning of Article 179ter of the Swiss Criminal Code, provided they are not compelled to speak (consid. 7.8). However, the Court stresses that not everything permitted under criminal law is also sufficient under data protection law (consid. 8.8).

The voiceprint. As soon as a biometric feature that uniquely identifies a person is derived from the voice, explicit consent is required. Whether a telephone or voice assistant does this depends on the technology. Speech recognition, which converts spoken words into text, is something different from speaker recognition, which determines who is speaking. Companies should ask their provider about this rather than assume it.

For companies that use or want to introduce voice recognition, this means in concrete terms:

1. Ask before creating the voiceprint, not afterwards. A clear question that is answered with yes or no.
2. Provide specific information: what is captured, for what purpose, for how long and with what risks.
3. Offer an alternative that is not unreasonable, such as security questions or another form of authentication.
4. Document the answer verifiably. Anyone relying on consent must be able to prove it.
5. Review existing voiceprints: where there is no explicit consent, obtain it retrospectively or delete them.

According to its own information, PostFinance has been using a voice bot since 16 February 2026 that asks, before the conversation, whether the customer consents to the voiceprint. The Court expressly did not examine whether this solution complies with data protection law (consid. 8.9).

What does the judgment mean for websites and cookie banners?

The judgment does not concern a website. However, the interpretation of «explicit» relates to Article 6(7) FADP, and this provision applies wherever explicit consent is required: for sensitive personal data (letter a) and for high-risk profiling by private persons (letter b).

As a rule, the FADP does not require consent for ordinary cookies. However, in its guidelines on cookies and online tracking, the FDPIC states that explicit consent must be obtained in advance for processing with a high intensity of interference. We explain when this is the case in our article on the FDPIC risk radar. Health services are an obvious example, as our measurement of hospital websites shows.

Where explicit consent is required, the parallel is obvious. Our assessment:

• «By continuing to use this website, you agree» is structurally the same as carrying on speaking after an announcement: information plus carrying on. After this judgment, that is unlikely to be enough.
• A banner that disappears when you scroll, or whose close button counts as consent, does not provide unequivocal agreement to a specific processing operation.
• Pre-ticked boxes are not an active step by the person. For visitors from the EU, the Court of Justice of the European Union (CJEU) already ruled on this in 2019 (Planet49 judgment, C-673/17).
• A click on «Accept» next to understandable information, with an equivalent option to decline, by contrast corresponds to the example cited in the judgment itself.

And as with PostFinance: consent is only useful if it can be proven. Aiara logs every choice made in the banner at the moment of the decision, with the time, action and selected categories, and provides the entries monthly as an archive of consents. What belongs in the log and how long it must be kept is explained in our article on the consent log.

What companies should check now

1. Where do we process sensitive personal data? Under Article 5(c) FADP, this includes data relating to health, genetic data, biometric data that uniquely identifies a person, religious or political views, administrative and criminal proceedings, and social assistance measures.
2. What do we base this on? Where it is consent, it must be explicit: an active step, unequivocal, for a specific processing operation.
3. Are there opt-out solutions? Default settings, «if you don't object, you agree», notices without a choice: replace them with a genuine question.
4. Do any consents date from before September 2023? Check whether they meet today's requirements and obtain them again if necessary.
5. Can we prove every consent? With the time, content and answer, recorded at the moment of the decision.
6. Is there still a reasonable alternative? Anyone who says no must not suffer disproportionate disadvantages.

---

Aiara is a Swiss provider of cookie banners, consent records and legal texts. This article reproduces and assesses the FDPIC's communication, the Federal Administrative Court's media release and the judgment. It is no substitute for legal advice in individual cases. Information as of 28 October 2026; the judgment can still be challenged before the Federal Supreme Court.

Sources

• FDPIC, communication of 21 October 2026: «Authentication by means of voice recognition: Federal Administrative Court upholds the FDPIC’s position on obtaining explicit consent», accessed on 28 October 2026
• Federal Administrative Court, media release of 21 October 2026: «Creation of voiceprints requires explicit consent of affected individuals»
• Federal Administrative Court, judgment A-4467/2025 of 13 October 2026 (PDF, in German)
• Federal Administrative Court, judgment A-6813/2025 concerning publication of the decision (in German)
• FDPIC, communication of 7 August 2025: «FDPIC concludes investigation into voice recognition at PostFinance»
• Federal Act on Data Protection (FADP), SR 235.1