Generated people and GDPR
Generated models are the most commercially attractive use of this technology in apparel and the one with the most unresolved edges. The questions are about whose face it is, and whose data went into making it.
This area is genuinely unsettled and varies by member state. Treat this as a map of the questions to ask counsel, not as answers.
A generated face is not automatically anonymous
GDPR applies to information relating to an identified or identifiable natural person. A synthetic face that resembles nobody in particular is generally not personal data. A synthetic face that is recognisably a specific person, because the model reproduced someone from its training data closely enough, may be, and the fact that it was generated is not a defence.
Likeness rights are separate from data protection
Most European jurisdictions protect a person’s image and likeness independently of GDPR, and the protection is generally strongest in commercial use. Generating an image that evokes a recognisable individual, whether an actor, a model or an influencer, and using it to sell a product is a likeness problem in nearly every market you sell in.
Using your own models
Training or conditioning on photographs of a real model you hired is a different arrangement, and a cleaner one, provided the contract covers it. What the old model release almost certainly does not cover is generating new images of that person, in new scenes, indefinitely, without a further session.
- Does the release cover synthetic derivation, not just use of the photographs?
- For how long, in which markets, and on which channels?
- Can the person withdraw, and what happens to published assets if they do?
- Who holds the trained artefact, and what stops it being used elsewhere?
Practical risk reduction
- Prefer product-only imagery where the model adds nothing commercially.
- Where people are needed, use hired models with contracts written for synthetic derivation.
- Avoid prompting toward named or describable real individuals, including "in the style of" a specific person.
- Review generated faces for accidental resemblance before publishing at scale.
- Keep the AI Act disclosure in place: a generated person in a realistic scene is the clearest case for it.
The narrow safe path
For most catalogues the low-risk position is straightforward: generate scenes, surfaces and light; photograph products; and use real, contracted people where people are required. It gives up some flexibility and it removes the entire category of problem this article describes.