Updated 23 August 2026 — this article was rewritten with primary sources added and unsupported claims removed.
Running text-to-speech on your own CPU does keep your text off somebody else’s servers. That much is straightforward. The privacy questions worth asking are the ones that survive that fact.
Does local TTS really keep my text off the internet?
Yes, for the synthesis itself. An offline engine such as Piper loads a voice model and generates audio on the device, with no request leaving the machine. Nothing you type is transcribed into a vendor’s logs, and there is no account attached to it.
The qualifier is that the engine is rarely the whole application. Whatever you have wrapped around it — a note-taking app, a browser extension, an accessibility tool — may still phone home with telemetry, crash reports or the text itself. Verify the wrapper separately from the engine; the offline claim usually belongs to only one of them.
Then where does the risk actually sit?
In the model file. Voice models are downloaded artefacts, and some machine-learning formats can execute code when loaded — Hugging Face documents this directly, warning that pickle-based files can run arbitrary code on deserialisation and maintaining scanning for exactly that reason (Hugging Face security documentation). Downloading a voice from an unfamiliar repository is closer to running an unsigned binary than to opening a media file.
This is the trade people miss. You have removed a network dependency and added a supply-chain one, and the second is the less familiar risk.
This is the same trade the package registries have been wrestling with. Provenance systems can tell you where an artefact was built without telling you what is inside it, and the xz backdoor showed how far a patient attacker gets by earning trust rather than breaking it. A voice model downloaded from a stranger sits in exactly that category.
Is cloning a voice a legal problem?
It can be. A synthetic voice resembling a real person attracts obligations that plain synthesis does not: the EU’s AI Act imposes transparency duties on systems generating synthetic audio, including that such content be disclosed as artificially generated (AI Act, Article 50). Consent from the person whose voice it is matters separately, and running the model locally does not change either point — offline processing is not a defence to impersonation.
What should I actually do?
Six checks, in the order that matters.
- Confirm the engine is genuinely offline by running it with networking disabled — not by reading the marketing.
- Audit the wrapper application separately, since telemetry usually lives there rather than in the synthesis engine.
- Download voice models only from the project’s official releases or a repository you can attribute to a named maintainer.
- Prefer safetensors or equivalent non-executable formats over pickle-based checkpoints where the project offers both.
- Check the licence on any voice you did not record yourself, including datasets such as Common Voice, which carry explicit terms.
- Get recorded consent before cloning a real person’s voice, and label the output as synthetic.
So is it safe?
Safer than a cloud service for the specific risk of your text being retained by a third party, and that is a real gain. It shifts the exposure to model provenance, which is a category NIST treats as a live adversarial-machine-learning concern rather than a solved one (NIST AI 100-2). Local is a better default. It is not the end of the question.
