Does GDPR apply to AI generated people?

If you're working with European clients, you already know how seriously GDPR needs to be taken. Make a mistake related to processing or storing personal data, and you could face huge fines. But beyond just avoiding penalties, GDPR is about protecting the rights of people who trust companies with their personal data. Under GDPR, individuals have several rights—like accessing their data, correcting it if it's wrong, asking for it to be deleted ("right to be forgotten"), and even moving it to another service if they want.

But here’s where things get interesting: what happens when we’re talking about virtual influencers—those AI-generated people who don’t actually exist? Does GDPR still apply?

If the Person Isn’t Real… Who’s Going to Ask to Delete Their Data?

That’s the real question.

One of the basic principles behind GDPR is that it’s meant to protect real people. The regulation doesn’t apply to deceased individuals, as clearly stated in Recital 27 of the GDPR:

So, when it comes to AI-generated personas, it’s a similar story. These virtual characters aren’t real, so GDPR doesn’t apply to them. However, when these AI-generated personas look so realistic, it’s hard not to think of them as actual people.

But when the AI generated personas are so real, it is hard not to think they are not real people. For example, this is a man generated with https://genfluencer.ai. Looks like real.

But here’s where things get a bit more complicated. Even though an AI influencer is just a bunch of code and pixels, the models used to create these personas are often trained on data from real people. This raises an important question: Could personal data from those training sets end up being used to generate a new image?

Can AI-Generated Images Contain Personal Data?

Here’s the answer:

AI models like Stable Diffusion are trained on large datasets that may include images of real people. If these training datasets include personal data, then the use of that data for training purposes falls under GDPR. However, the images generated by the model are typically new creations, not direct copies of the training data. As a result, the AI-generated people themselves do not contain personal data in the traditional sense.

Therefore, AI generated people does not contain personal data.

But What If Someone Who Looks Like the AI-Generated Person Gets Offended?

Here’s the tricky part. If the AI was trained on data that includes real people's faces or other personal details, there's a chance that elements of those real individuals could be reflected in the AI-generated persona. This might mean that, even though the AI persona itself isn’t real, it could have characteristics similar to those of a real person.

Just as in real life, where people who look identical can live on different continents, there might be a virtual, AI-generated "twin" of someone. But if someone looks just like you, it doesn’t necessarily mean the image contains your personal data or that it belongs to you.

However, there’s one important catch when it comes to models trained on real people's data. While GDPR doesn’t directly apply to a non-existent entity like an AI influencer, it does apply to the personal data used to train the AI. If that training data includes identifiable information, and if it’s used in a way that could be traced back to an individual (even partially), there could be GDPR implications. For example, if someone sees an AI-generated face that looks like theirs or includes unique elements of their appearance, they might argue that their personal data has been used without their consent.

And it’s not just about GDPR. There’s also the issue of likeness rights. If an AI-generated face closely resembles a real person, especially without that person’s consent, it could lead to legal challenges outside of GDPR. Many places have laws protecting people’s likenesses from being used commercially without permission. So, even if the face was generated by an AI, the resemblance to a real person could still cause problems.

Wrapping It Up

So, does GDPR apply to AI-generated people? Not directly, because they’re not real. But the story doesn’t end there. If the AI models used to create these personas were trained on real people's data, there could be real GDPR implications. You should be careful about the data you use and how it's applied, especially if it’s for commercial purposes. Plus, if your AI creation looks too much like a real person, you could be stepping into legal hot water. There haven’t been any high-profile cases yet where someone sued over an AI-generated person resembling a real individual, but as AI continues to boom, it’s possible we’ll see such cases in the future.

As AI evolves, so will the rules and expectations around its use. Staying ahead of the curve isn’t just about avoiding trouble—it’s about building trust and doing right by the people whose data might be fueling these technologies. After all, how you handle these issues speaks volumes about your brand and its values.