On this page
Every few months a new trend arrives: a vintage Bollywood poster, a saree portrait, an anime version of you. You upload one clear photo of your face and get something fun back in seconds. The question to ask first is not "will it look good?" but "where does my face go now?"
What can an AI photo app do with your face?
A clear, front-facing photo is useful data. Depending on the app, an upload can be stored on its servers, seen by its staff, or used to improve its AI models.
Large companies spell some of this out. Google's Gemini Apps Privacy Hub says a subset of chats is reviewed by human reviewers, and that reviewed chats are kept for up to three years, even after you delete your activity. It asks users not to enter confidential information they wouldn't want a reviewer to see.
Smaller apps have gone further. In 2021 the US Federal Trade Commission finalised a settlement with Everalbum, maker of the photo app Ever. The FTC said the company had switched on face recognition automatically for users everywhere except three US states and the EU, and used photos uploaded by users to build face-recognition models. The order made the company delete those models and algorithms, not just photos of users who had deactivated their accounts.
What does India's data protection law say about your photos?
India's Digital Personal Data Protection Act, 2023 defines personal data as any data about an identifiable individual, so a photo of your face counts. The points that matter for an app user:
Consent must be free, specific, informed, unconditional and unambiguous, and limited to the data the stated purpose needs (Section 6).
You can withdraw consent at any time, and withdrawing must be about as easy as giving it was (Section 6).
Anyone under 18 is a child. Before processing a child's data, an app must get verifiable consent from a parent, and it may not track, behaviourally monitor or target ads at children (Section 9).
Penalties can reach ₹250 crore for failing to take reasonable security safeguards and ₹200 crore for breaking the rules on children's data (the Schedule).
One catch is worth knowing. The Act does not apply to personal data that you yourself made publicly available. A selfie you posted on a public profile may fall outside its protection.
The DPDP Rules, 2025, announced by the government on 14 November 2025, give companies an 18-month phased timeline to comply. They require standalone, clear and simple consent notices, and companies must answer requests to access, correct or erase your data within 90 days at most. For a fuller walk-through, read our explainer on what the DPDP Act means for children's data.
Is it okay to upload a friend's photo to an AI app?
Ask first. The Act is built around the consent of the person the data is about, and in a group photo that is everyone in it, not only the person holding the phone. If your friend is under 18, the Act treats them as a child whose data needs a parent's consent, so their parents get a say too. If you find a doctored picture of yourself or a friend, our guide on what to do about an AI-morphed photo lists the steps.
A five-point check before you upload
This takes a few minutes:
Who runs it? Find the developer's name and contact details on the app store listing. No name, no upload.
Does it train on uploads? Search the privacy policy for "train", "improve", "biometric" and "third parties". If uploads may train models, look for an opt-out.
Can you delete? Look for a way to delete your photos and your account. The law gives you a right to erasure; an app that hides it is a warning sign.
Whose face is it? Only yours, or a friend who said yes. Under 18? Talk to a parent first.
Which photo? Pick one with no school uniform, ID card, house number or location tag. Our post on removing location data before you post a photo shows how.
A worked example: Riya, 16, wants the vintage-portrait look. The app's policy says uploads "may be used to improve our services", there is no delete option and no developer contact. Three checks fail, so she skips it and asks a parent before trying another app.
The same habit helps when you use AI to study: crop faces, names and roll numbers out of homework photos. Fermi's AI tutor works from a topic, a problem set or a scanned assignment, so a face never needs to be in the picture.
What if you have already uploaded?
Delete the photos and your account inside the app, then write to the company's privacy or grievance contact asking for your data to be erased, and keep their reply. If a picture is misused, report it on the National Cyber Crime Reporting Portal at cybercrime.gov.in or call the national cyber crime helpline, 1930. If it leaves you anxious or low, talking helps: Tele MANAS is a free, 24/7 government helpline on 14416.
