Default-On Consent Isn't a PR Risk. It's a Compliance Case Study.
If your team is watching the AI image-generation consent fight play out and calling it a consumer problem, not yours, look closer. The consent design is what's worth studying.
Default-on, opt-out use of someone's likeness isn't a PR problem. It's exactly the kind of thing that lands on a risk register the moment a product touches someone's face, voice, or image without them actively saying yes first. Here's how I'd walk a client through it.
Start with the biometric statutes
They have the sharpest teeth. If any part of the pipeline extracts or matches facial geometry — not just displays a photo — Illinois BIPA, Texas CUBI, and Washington's biometric privacy law all require notice, and BIPA wants written consent before capture. "It was a public photo" doesn't get you out of that. Go find out what the model actually does with the input before anyone writes this off the risk register.
GDPR is right behind it
A facial image used to identify someone is special category data under Article 9, and legitimate interest won't cover you. You need an explicit lawful basis — and at scale, you're very likely triggering a DPIA under Article 35 whether you want one or not.
Minors need their own lane entirely
If a tagged or referenced account belongs to someone under 18, COPPA and a growing list of state minor-safety-by-design laws don't accept "there's an opt-out in settings somewhere" as good enough. That's a dedicated gate, not a shared toggle.
State AI law is the one I'd stop leaning on
Colorado's original AI Act would have required impact assessments for exactly this kind of automated processing. Then SB 189, signed May 14, gutted that in favor of a lighter disclosure and human-review framework that doesn't even start until January 2027 — and applies only to automated decision-making in employment, education, lending, insurance, healthcare, housing, and government services.
The real exposure sits in biometric and kids' privacy law, not general AI law. Most teams have that backwards.
The fix isn't complicated, even if the legal mapping is
- Default to opt-in.
- Get consent before generation, not after.
- Build provenance in at the point of creation, instead of bolting on a lookup tool once someone's already upset.
If you're building or buying anything with this architecture, run the DPIA before the sprint starts — not after the headline.