Guide
Your data rights with an AI assistant in the EU.
An AI assistant hears your voice, reads your questions and often your mail and calendar. In the EU, the GDPR gives you rights over all of it, whoever made the assistant.
In short. Any company that offers you an AI or voice assistant in the EU must, on request, give you a copy of your data, correct it, delete it, hand it over in a usable file, and stop using it for marketing. It has one month to answer. Voice gets special care: European regulators treat it as biometric data. Below: your rights in one table, a request you can copy, and the questions to ask before you buy.
Your rights, in one table
| You can ask… | GDPR | Good to know |
|---|---|---|
| for a copy of everything about you: recordings, transcripts, what it inferred, who received it, how long it is kept | Article 15 | Free of charge in most cases |
| to correct what is wrong, such as a mistaken memory about you | Article 16 | |
| to delete your data | Article 17 | Exceptions, such as data a company must keep by law |
| to pause the use of your data while a dispute is settled | Article 18 | |
| for your data in a machine-readable file, to take elsewhere | Article 20 | Covers data you gave it, under consent or a contract |
| to stop a use of your data, such as profiling | Article 21 | For direct marketing, the company must always stop |
| for a human to decide, when a fully automated decision affects you significantly | Article 22 | Rarely the case for an assistant answering questions |
| to withdraw your consent, as easily as you gave it | Article 7(3) | For example, to the use of your recordings for training |
The company must answer within one month, or tell you within that month why it needs up to two more. If it does not answer, or you disagree, you can complain to your country’s data protection authority (Article 77).
Why voice gets special care
The European Data Protection Board’s guidelines on voice assistants make three points worth knowing:
- Voice is biometric. A recording carries more than your words, such as clues to your sex or age. When it is used to recognise who is speaking, stricter rules for sensitive data apply.
- Other people get recorded too. A recording can catch the voices of people nearby, and data collected by accident should be deleted unless there is a valid reason to keep it.
- “Until you delete it” is too long. The guidelines criticise keeping recordings until the user asks for deletion: data should be kept only as long as it is needed.
The EU’s AI Act adds a rule of its own: you must be told when you are talking to an AI, unless it is obvious.
A request you can copy
Send it to the privacy contact in the company’s privacy notice, from the email address of your account, and keep a copy.
Subject: Request under Article 15 of the GDPR
Hello,
Under Article 15 of the GDPR, please send me a copy of all personal data you hold about me, including voice recordings, transcripts and anything inferred from them; the purposes; who has received it, including any AI model provider; where it is processed; and how long you keep it. Please also tell me whether my recordings or transcripts are used to train models, and how I can opt out.
My account: [email address]
I look forward to your answer within one month, as Article 12(3) requires.
[Your name]
To delete instead, change the first line to “Under Article 17 of the GDPR, please erase all personal data you hold about me, including voice recordings and transcripts, and confirm when it is done.”
Before you buy an AI assistant: five questions
- When does it listen? Always, for a wake word, or only when you press? Hold to talk versus wake words.
- Are recordings kept, and for how long?
- Where is it processed, and which other companies, such as the AI model’s maker, receive what?
- Is your data used for training, and can you say no?
- Can you see, export and delete it yourself, without writing to anyone?
Wearables that record conversations raise more questions, for you and for the people you record: recording conversations with AI wearables.
How Lychnos Ring is designed
The ring’s microphone gets power only while you hold its button. Your voice travels to our cloud in the EU, becomes text, and the clip is deleted right after. You can read, correct and delete what Lychnos remembers in the app. The product will come with its own privacy notice, listing every company that processes your data. It is in development; more in a private AI assistant, by design.
Sources, read 4 November 2026: the General Data Protection Regulation (EU) 2016/679, Articles 7, 12 and 15 to 22 and 77; European Data Protection Board, Guidelines 02/2021 on virtual voice assistants, version 2.0, 7 July 2021; the AI Act (EU) 2024/1689, Article 50; the national data protection authorities. General information, not legal advice.
Questions
Can I ask an AI assistant to delete my voice recordings?
In most cases, yes. Under Article 17 of the GDPR you can ask a company to erase your personal data, recordings and transcripts included, for example when it no longer needs them, when you withdraw your consent or when you object. There are exceptions, such as data it must keep by law.
How long does a company have to answer a data request?
One month from your request. It can extend that by two more months for complex or numerous requests, as long as it tells you within the first month and says why (GDPR Article 12(3)).