Voice cloning works on two levels. For the quick version today's commercial services ask for one to two minutes of clean audio, and give you a usable, recognisable voice out of it. For a convincing clone that holds up over longer text you need half an hour or more of recording — and the more serious providers ask the speaker for voice-based verification on top of that.
The widely quoted "three seconds is enough" refers to a 2023 research model that its developer never released. From a defensive point of view that makes no difference: for an executive with a conference recording or a company video, that half hour already exists somewhere in public.
The most common misconception is that the technology is the question. It is not — that one is settled. The question is legal and ethical: is consent needed, how far does it reach, and how long does it hold. The protection of a person's likeness and voice recording is regulated member state by member state, the GDPR applies to it as well, and working from a publicly available recording is nowhere a good starting point.
Consent and the practical workflow around it are the subject of Voice Cloning: How It Works and What Is Allowed, a separate article. Directly related terms: deepfake, lipsync and AI voiceover.