Ship AI features using others' content without a consent crisis

A designer ships a generative feature that can borrow from other users' public content. The launch feels routine until the first complaint arrives: why was my photo used?

Meta launched Muse Image on Tuesday on meta.ai, Instagram Stories in the U.S., and WhatsApp in select international territories. It pulled Muse Image from Instagram on Friday, three days after unveiling. The default carried the risk.

The content decides the consent default

Classify the content before you choose a consent mechanism. Public text, public photos, private messages, and identifiable likenesses are not the same risk. Profile pictures carry likeness risk, public photos carry reference risk, and private messages carry a different exposure.

Ask what the system can do with the content, not just where it came from. Public text may be safe to quote. A public photo may not be safe to regenerate. A private message is a different risk. The answer changes the consent surface.

Done looks like a short table: content type, source, visibility, sensitivity, and who can be harmed. Keep the feature out of review until the table names the harm.

Affirmative opt-in is the safer default

Choose affirmative opt-in when the content is personal, identifiable, or likely to be transformed. For generative features that touch third-party content, the default must be affirmative opt-in with a visible notice at the moment of use, not a buried opt-out. Muse Image made public Instagram profiles of users over 18 available as AI references by default, requiring users to enter account settings to disable the feature. Meta did not alert users when material from their public profiles was used as a reference for Muse Image.

Creative Artists Agency (CAA) asked Meta to make protection the default and require opt-in before Muse Image could use a person's image or likeness. SAG-AFTRA said that using Instagram users' images without an explicit opt-in was unacceptable. CAA issued a follow-up statement after Friday's removal praising Meta's decision.

Opt-out assumes the user will find the setting, understand it, and act before harm. The chain is weak. Opt-in asks for a yes at the point where the yes matters. It also gives the team a clean audit trail.

A finished consent record names who can be used, how they can say yes, where the yes is stored, and how it can be withdrawn. If the answer is that they can turn it off later, stop.

Teams often treat public content as permission. Public visibility does not equal consent to be a reference, a style, a face, or a source for a new asset. The review should catch that gap before release.

The notice belongs at the moment of use

Place the notice where the user can see the consequence. A policy page is too far away. Onboarding misses the moment. A settings menu hides the choice. The prompt, the preview, or the generation screen should say what is being taken and what it will become.

The notice should name the source and the output. If the feature can use a photo, say photo. The same plain labels apply to every other source. Vague language makes the user do the product's work.

The finished notice reads plainly: This will use your public photo to create a new image. The user can proceed, decline, or adjust scope. The user should not need to hunt for the answer.

A documented default is the launch artifact

Document the default before launch. Write down the content class, the consent mechanism, the notice location, the withdrawal path, and the owner who can answer questions after release. A default is a product decision, not a legal footnote.

Include a rollback plan. If the default is wrong, the team needs a way to stop using content, remove generated outputs, and tell affected users. A default without a rollback is a promise the product cannot keep.

The launch checklist should be readable by a new engineer without asking a lawyer. It should say who is included, who is excluded, what the user sees, and what happens when they say no.

• Classify the content and name the harm.
• Choose affirmative opt-in over opt-out.
• Place a conspicuous notice at the moment of use.
• Document the default and rollback before launch.

Put the same standard in the launch checklist and make the team sign it.