Meta's New AI Tool Can Generate Photos of Instagram Users Without Telling Them

Key points

• Meta released its Muse Image AI tool on Tuesday, making it available to Instagram users by default.
• The tool lets any user tag a public Instagram profile and generate artificial images that draw on that person's face from their posts.
• People whose images are used receive no notification from Meta that this has happened.
• Privacy advocates are calling on users to review their Instagram privacy settings immediately.
• No regulator has yet publicly opened an investigation, though the tool's reach touches users under ICO (UK), the European Data Protection Board, and FTC (US) jurisdiction.

Meta, the company that owns Instagram and Facebook, launched a new artificial intelligence image generator called Muse Image AI on Tuesday. The tool is described by Meta as its "most advanced image generation model yet."

Here is the part that worries privacy advocates. Anyone can type an Instagram username, or tag a public profile, and the tool will produce made-up photos that incorporate the face of whoever runs that account. The person whose likeness is used gets no alert, no email, and no in-app notification.

The feature is switched on by default for every public Instagram account.

Does this affect ordinary Instagram users?

Yes, if your Instagram account is set to public, it affects you right now. You do not have to have heard of Muse Image AI for someone else to have already used your face in it.

The Guardian Technology first reported the blowback from privacy advocates, who noted that Meta's own description of the tool makes no mention of consent from the people whose faces feed into the generated images.

What makes this different from, say, a stranger screenshotting your photo is scale and automation. An AI image generator can combine thousands of posts into a convincing new image in seconds. That is a fundamentally different capability than someone saving a single picture.

Privacy law across several jurisdictions treats facial images as biometric data, meaning information that can uniquely identify a person by their physical characteristics. Under the UK's GDPR framework, enforced by the ICO (the Information Commissioner's Office, the UK's data protection regulator), processing biometric data without a clear legal basis is restricted. The European Data Protection Board applies similar rules across EU member states. In the United States, the FTC (Federal Trade Commission, the federal consumer protection agency) has authority over unfair or deceptive data practices, though the US has no single federal biometric privacy law.

Meta has not yet responded publicly to requests for comment on the legal basis for using public post data in this way.

What affected users should do

First, decide whether your Instagram account needs to be public. Switching to a private account means your posts are only visible to people you approve. Open the Instagram app, go to Settings, then Account Privacy, and turn on Private Account.

Second, audit which posts contain clear images of your face and consider removing any you are not comfortable having used in this way.

Third, watch for any images of yourself circulating online that you did not create. Reverse image search tools let you upload a photo and find where it appears across the web.

Meta has not confirmed whether an opt-out will be added. Check your account settings regularly.