Meta has drawn widespread criticism after users discovered that the company’s AI image-generation tools were being trained on, and producing synthetic portraits derived from, public Instagram profile pictures — without seeking explicit consent from account holders. The backlash spread quickly across social media platforms, with digital-rights campaigners and privacy advocates arguing that the use of publicly available profile photographs for AI training constitutes a material change to the implicit bargain users accepted when they created accounts. Meta’s position, reflected in its terms of service, is that images posted to public accounts are available for a range of platform uses including, now, the training and operation of generative AI systems. The dispute joins a growing set of legal and political confrontations over whether existing data-protection frameworks — designed primarily in the era of static data collection — are adequate for the age of generative AI, which transforms personal likenesses into raw material for novel content production at industrial scale.
The received wisdom
The standard progressive digital-rights reading of this story is that Meta’s behaviour is part of a pattern of platform extraction that prioritises shareholder value over user autonomy and dignity. The argument runs as follows: users who created Instagram accounts years ago did not — because they could not — consent to their likenesses being used to train AI systems that did not yet exist. Terms-of-service updates that retroactively expand data rights are not meaningful consent; they are take-it-or-leave-it contracts of adhesion that exploit the network lock-in effects that make it practically impossible for ordinary users to delete their accounts and migrate elsewhere. Regulation is overdue. The European Union’s GDPR framework, though imperfect, has shown that enforceable data-rights regimes can change platform behaviour; the United States has no comparable federal framework. On this reading, the solution is clear: comprehensive federal privacy legislation, opt-in rather than opt-out consent for AI training use, and meaningful penalties for non-compliance.
This framing has real force. The consent problem it identifies is genuine, and the gap between European and American regulatory environments has produced a sustained competitive disadvantage for European tech innovators that benefits American platforms.
A different read
And yet the dominant progressive reading, for all its genuine insight into platform power dynamics, tends to treat regulation as a cost-free good and to underestimate the ways in which aggressive privacy regimes create their own distortions. There is also a serious question about whether the problem being identified is actually a privacy problem in the traditional sense, or something more novel for which the existing regulatory vocabulary is inadequate.
Start with the consent question. It is true that users who posted public photos in 2015 did not consent to AI training in 2026. But it is also true that public photographs posted on public internet platforms have always been available for a wide range of downstream uses: news organisations have used them, researchers have used them, advertisers have referenced them. The question of whether AI training is categorically different from those uses — different enough to require a distinct consent regime — is more philosophically contested than the outrage cycle suggests. There is a reasonable argument that synthetic portrait generation from a public photograph involves something genuinely new: the production of a novel likeness rather than the reproduction of an existing one. But that argument requires careful legal elaboration, not just assertion.
The deeper problem is structural. BBC Business noted that the Meta backlash reflects a broader set of tensions around AI disrupting existing social contracts — the same week that Australian dock workers demanded a 28-hour work week in AI-related negotiations and Samsung’s profits jumped 1,800 percent on the back of AI chip demand. What these stories share is a common structure: AI systems are generating enormous value while the costs and disruptions of their deployment — to labour markets, to personal data, to the implicit norms of public life — are distributed broadly and often invisibly.
The regulatory response in Europe has been to build elaborate consent architectures that, in practice, produce consent-fatigue: users click through cookie banners and terms updates without reading them, and the formal consent obtained bears no meaningful relationship to genuine informed agreement. The American approach has been to allow platform self-governance, which has produced exactly the extractive dynamics critics identify. Neither model is obviously superior; both have failed in complementary ways.
What a genuinely right-of-centre response to this problem looks like is not “no regulation” — it is regulation structured around property rights rather than bureaucratic process. If your likeness has value — and AI companies’ willingness to train on it demonstrates that it does — then you should have an enforceable property right in that value. Not a right to file a complaint with a data-protection regulator and wait three years for a fine that costs the platform less than a rounding error on its quarterly revenue; but an actual right to compensation or injunction, enforceable in ordinary courts. That is a conservative framing that takes markets seriously: if AI portrait generation from your image is profitable, you should share in that profit. The mechanism is property and contract law, not a new bureaucratic consent architecture that companies will route around within months of its implementation.
The AI image story is also a preview of a harder problem. Profile photographs are only the beginning. Voice recordings, writing samples, video footage — all of these are already being used for AI training, and the synthetic outputs increasingly cannot be distinguished from the originals. The legal and social frameworks for navigating this are not ready, and the question of who owns a likeness in a world where likenesses can be manufactured at zero marginal cost is genuinely novel. Meta’s conduct here is a pressure test of existing norms, and the fact that it produces outrage without clear legal remedy is a signal that the framework needs updating.
What to watch
Watch for European regulatory action under GDPR’s “legitimate interest” provisions — regulators in Ireland (where Meta is headquartered for EU purposes) have been notably slow, but the political salience of AI-likeness cases is rising. Watch Meta’s product roadmap: if the backlash produces a meaningful opt-out mechanism, it signals that consumer pressure can still discipline platform behaviour without legislation; if Meta rides it out, the case for statutory intervention becomes harder to resist. Watch American state-level privacy legislation — California, Colorado, and Virginia have frameworks that could evolve to address AI training specifically. And watch for the first major US court ruling on whether AI portrait generation from a public photograph constitutes a violation of existing right-of-publicity law — that case, when it arrives, will clarify whether the existing legal toolkit is sufficient.
— J