The Great Digital Harvest
Powerful AI image generators like DALL-E and Midjourney create new pictures from text prompts. To do this, they must first learn what things look like by analyzing billions of images. Tech companies and researchers collect this data by 'scraping' the public
internet—hoovering up pictures from social media sites, blogs, news articles, and photo-sharing platforms. If you have ever posted a photo to a public online space, there's a significant chance it has been swept into one of these massive datasets without you ever receiving a notification. The process is automated and vast, forming the foundation of today's generative AI boom. This large-scale data collection is often done without explicit consent for the purpose of AI training, raising significant privacy concerns.
Your Digital Twin is Born
This process does more than just teach an AI what a 'beach' looks like; it teaches the AI what you look like. When enough of your photos are in a training set, the AI can generate a 'digital likeness'—a synthetic but recognisable version of you. This isn't just a copy of a photo; it's a model that understands your facial features, expressions, and other identifiable traits. This allows the AI to create entirely new images or videos of you in situations that never happened. These AI-generated versions of people are sometimes called digital replicas or 'deepfakes'. While artists or celebrities might see this as a new way to manage their image, for the average person, it means a version of you exists that you have no control over.
The Question of Consent
The core of the problem is the gap between what we agree to and how our data is actually used. When you post a photo, you might agree to a platform's terms of service, but those agreements rarely, if ever, mention that your likeness could be used to train a commercial AI model. This has led to a fierce ethical and legal debate. AI companies argue their use is 'transformative'—that they are learning patterns, not just copying files—and therefore falls under fair use. However, privacy advocates and legal experts argue that scraping personal data on this scale violates fundamental principles of privacy, consent, and transparency. Using personal data for AI training without getting separate, explicit permission is a violation of some data protection laws.
Real-World Risks and Consequences
The creation of uncontrolled digital replicas carries serious risks. Your likeness could be used in advertisements without your permission, creating a false endorsement. More maliciously, it could be used to create convincing deepfake videos to spread misinformation or for personal harassment. The technology has been used to generate non-consensual explicit images, a problem highlighted when fake images of celebrities spread online. These dangers aren't limited to famous people; anyone with a public digital footprint is potentially vulnerable. The problem is made worse by the fact that AI models can also reflect and amplify existing societal biases found in their training data, leading to skewed or stereotypical representations.
The Law is Playing Catch-Up
Globally, regulators are struggling to keep pace with the technology. Europe's GDPR provides some protection by requiring explicit consent for data processing, but its application to AI training is still being tested in courts. In India, the Digital Personal Data Protection Act (DPDP Act) of 2023 sets new rules for how personal data can be collected and used. The act requires organisations to get clear consent for specific purposes, which presents a major challenge for AI developers who rely on vast, publicly scraped datasets. However, the DPDP Act was not designed specifically for the unique challenges of AI, and experts note there are still gaps regarding algorithmic transparency and automated decision-making. As legal challenges against AI companies mount worldwide, the rules for data scraping and digital likeness are being actively shaped right now.
