Voiceprint at PostFinance: express consent is required

On 13 October 2026, the Federal Administrative Court delivered two judgments. Judgment A-4467/2025 deals with the merits. It treats the voiceprint as particularly sensitive personal data. Processing it requires express consent. This judgment may still be appealed to the Federal Supreme Court.

A second judgment deals with publication of the decision of the Federal Data Protection and Information Commissioner (FDPIC). Press releases were made public on 21 October 2026.

What PostFinance had been doing since 2018

Since September 2018, PostFinance creates a voiceprint of customers who call. The voiceprint serves to identify them afterwards.

Refusal was not the default setting. The customer had to write to customer service or change the settings on the website.

The FDPIC's decision

The FDPIC took the matter up with PostFinance in May 2019. No agreement was reached. The decision is dated 16 May 2025. It requires express consent. It orders the erasure of voiceprints that lack this consent.

PostFinance appealed on 18 June 2025. The appeal is directed against the decision. It is also directed against publication of that decision.

In March 2026, the bank informed the Federal Administrative Court. It stated that it uses, since mid-February 2026, a new solution intended to collect explicit consent.

What the Federal Administrative Court holds

The Federal Administrative Court treats the voiceprint as particularly sensitive personal data. Processing it requires express consent.

Continuing to speak is not enough. The person was informed that the conversation is recorded for voice authentication. Continuing to speak does not amount to express consent.

Without this consent, creating the voiceprint is an infringement of privacy. The Court accepts no justifying ground.

PostFinance's appeal is upheld in part.

The deadline for voiceprints already taken

For voiceprints already recorded, PostFinance has until mid-February 2027. It must obtain express consent. Failing that, the data must be erased.

Publication

The second judgment confirms that the FDPIC may publish its decision. Publishing the decision of 16 May 2025 falls within its information mission where there is a public interest.

The FDPIC will publish this decision only once the judgment on publication has entered into force.

What the judgments do not decide

Judgment A-4467/2025 is not final. It may be appealed to the Federal Supreme Court.

The Federal Administrative Court did not examine whether the mid-February 2026 solution complies. It did not validate that solution.

The deadline of mid-February 2027 concerns voiceprints already recorded at PostFinance. The judgments do not set it for other banks.

The judgments concern the creation of a voiceprint. They do not lay down a rule for every recording of a call.

Frequently asked questions

• Since when has PostFinance created a voiceprint? Since September 2018, for customers who call, in order to identify them afterwards.
• Was refusal the default setting? No. The customer had to write to customer service or change the settings on the website.
• Does continuing to speak after the information amount to express consent? No. The person was informed that the conversation is recorded for voice authentication. Continuing to speak does not amount to express consent.
• What is the deadline for voiceprints already recorded? PostFinance has until mid-February 2027 to obtain express consent. Otherwise those data must be erased. This deadline concerns PostFinance.
• Has the solution used since mid-February 2026 been held to comply? No. The Federal Administrative Court did not examine it.
• Is judgment A-4467/2025 final? No. It may be appealed to the Federal Supreme Court.
• Do the judgments cover every recording of a call? No. They concern the creation of a voiceprint.
• Has the FDPIC published the decision of 16 May 2025? It will publish that decision only once the judgment on publication has entered into force.

Avocados AI's Basic plan costs CHF 4.99 a month, the price of a coffee. It is there to organise the terms, the account settings and the writings, and to prepare the questions. It does not replace a lawyer's review of the file. The Swiss data protection guide sets out the framework of consent and sensitive data.

Sources

Federal Administrative Court, judgment A-4467/2025 of 13 October 2026. Second judgment of 13 October 2026 on publication. Public press releases of 21 October 2026. Federal Data Protection and Information Commissioner. Only the official publication is authoritative.