Likeness, deepfakes and consent

ImageVault is a likeness custody platform for actors and other performers. It stores a performer's biometric scan packages — the photogrammetry stills, 3D meshes, textures and video captured for visual effects, digital doubles and AI work — and licenses access to productions on the performer's terms.

Every use is consented, audited and time-bound: a production requests a licence with an explicit scope and term, the performer or their representative approves it, and release requires a second factor from both sides. ImageVault also runs Deep Scan, which searches public platforms for deepfakes and unauthorised use of a performer's likeness.

Three groups. Performers — actors, stunt performers and models — who want one controlled archive of their own likeness. Representatives — agents, managers and lawyers — who manage a roster and approve licences with delegated authority. Productions, VFX vendors and game studios that need legally licensed, production-ready scan data with a clean chain of consent.

Performers' unions use it too: a union can track its members' exposure to deepfakes and receive counts of hits across its membership.

When a production scans a performer, the files usually stay on the servers of the production or its VFX vendors indefinitely, with no record of who accessed them, no control by the performer over reuse, and no proof that they were deleted. ImageVault is an independent custodian: it does not represent the performer, take a commission on their work, or sell or train AI models on their data.

The performer holds the canonical archive, decides who may use it and for what, can revoke or freeze access at any time, and has a tamper-evident record of every access. Productions get scan data with documented consent, which reduces their own liability.

Security rests on access control and evidence. Files are encrypted at rest and in transit. No file is released to a production without approval from the performer's side and a fresh two-factor confirmation from the receiving side at download time (dual custody), and download links are time-limited.

Every consent, approval, transfer and download is appended to a hash-chained ledger in which each event seals the one before it, so the record cannot be quietly rewritten. The platform mediates every transfer, which is what lets it enforce and log these rules; it is not an end-to-end-encrypted or zero-knowledge service.

Access is currently by request at imagevault.ai/register-interest. Performers who were scanned by a production that uses ImageVault can register to see and control that production's use of their data; claiming a vault to manage relicensing independently is a paid option. Deep Scan has a free public trial on the week's trending actors at imagevault.ai/try.

Searching by name finds only a fraction of it: much synthetic content is tagged with a character, a film title or a fandom's own shorthand rather than the actor, and it arrives in waves around casting announcements and trailer releases. Effective monitoring searches by name, by role and by production, follows the accounts that post it across platforms, and checks each candidate for both the person's likeness and evidence that it is AI-generated.

ImageVault's Deep Scan does this across Instagram Reels, TikTok, YouTube Shorts, X, Pinterest, Reddit, Google Images, Getty and Shutterstock, and AI-generation sites. Anyone can run a free trial on one of the week's trending actors at imagevault.ai/try.

Deep Scan is ImageVault's deepfake and unauthorised-use detection for performers. Each candidate post is scored by independent layers: identity (face matching against the performer's own reference images), synthesis (embedded provenance markers such as C2PA, then a vision model looking for generation artifacts), derivation (perceptual fingerprints that catch reposts, leaks and re-renders of the performer's source imagery), and body geometry from the performer's scan.

A likeness match alone never raises a hit, and neither does AI-generation evidence alone; only the combination does. Each hit carries a written rationale so it can support a takedown request.

Generic detection services can only compare suspect content with the same public photos a faker trained on. A performer's scan package is studio-calibrated, multi-angle imagery and geometry captured months before any of the production's material is public. Matching against it gives a stronger identity reference, catches derivatives of the scan imagery itself, and stays useful as visual generation artifacts disappear with better generators.

Record the evidence first — the URL, the account, the date and a capture of the post — because posts are deleted and reuploaded. Then report it through the platform's impersonation or synthetic-media process, and, where the use is commercial or harmful, have a representative or lawyer send a takedown or cease-and-desist letter. Not every use calls for the same response: some fan work is better answered with a licensing offer than a legal letter.

Deep Scan keeps the evidence trail for every hit, ranks the posting accounts by reach, and drafts outreach ranging from a licence offer to a formal takedown, pre-filled with the hit's evidence.

A digital replica is a computer-generated likeness of a real performer's face, body or voice, realistic enough to be recognised as them, used to show them doing or saying something they did not actually perform. The SAG-AFTRA film and television contract distinguishes an employment-based digital replica, created in connection with the performer's work on a production, from an independently created digital replica made from existing material such as footage or photographs.

Both are built from biometric capture data: photogrammetry scans, 3D meshes, motion capture and voice recordings. Who holds that data, and under what terms, is what decides whether the performer can control later uses.

Article 39 is the artificial-intelligence section of the SAG-AFTRA film and television contract. In broad terms it requires the performer's informed consent before a digital replica is created and for its uses, compensation for those uses, separate consent for alterations such as dubbing into other languages, and protections for the biometric data behind the replica, including limits on producers keeping it for unrelated purposes.

ImageVault maps these obligations onto ledger events — the licence approval is the base consent, supplementary consents are recorded separately, replica use is metered for payments — and issues a sealed compliance certificate on demand. This is a summary, not legal advice; the contract text governs.

It depends on where the use happens. In the United States: state right-of-publicity law, such as California Civil Code §3344 and New York Civil Rights Law §§50–51 (which now includes digital-replica provisions); California AB 2602 and AB 1836 (2024) on digital replicas of living and deceased performers; Tennessee's ELVIS Act (2024) covering voice and likeness; Illinois' Biometric Information Privacy Act for face geometry; and the Lanham Act §43(a) for false endorsement.

In the UK and EU, a scan used to identify a person is biometric personal data under the GDPR and UK GDPR, the EU AI Act's Article 50 adds transparency obligations for deepfakes, and the Digital Services Act and the UK Online Safety Act set platform duties for illegal content. Denmark amended its copyright law in 2025 to give individuals rights over realistic digital imitations of their likeness and voice. This is general information, not legal advice.

Yes, when it is processed to identify a person. Article 4(14) of the GDPR defines biometric data as personal data resulting from technical processing of a person's physical characteristics that allows their unique identification, including facial images, and Article 9 makes biometric data processed for that purpose a special category that needs explicit consent or another narrow exception. A performer scan is detailed enough to identify its subject, so productions and vendors holding one take on GDPR obligations for as long as they keep it.

The files are usually held by the production or its VFX vendor, and what they may do with them is set by the performer's contract, the applicable union agreement and data-protection law. Holding the files is not the same as being free to reuse them: the performer's rights in their likeness, and their consent to each use, continue after the shoot. ImageVault exists so that the performer can see who holds their data, approve or refuse each new use, and get a record of every access.

The production requests a licence choosing one of six standard types — commercial, film double, game character, AI avatar, training data or monitoring reference — with an explicit scope, territory and term. The performer or their representative approves, amends or declines it, and a PDF contract is generated from the agreed terms. At delivery the licensee confirms with two-factor authentication and receives a time-limited download; licensed assets can also flow into Unreal and Maya under signed, expiring manifests.

Use of the data for AI training is blocked unless the performer explicitly opts in. A performer can freeze use instantly at any scope, for example during a strike.

Every scan a production keeps is a liability: it is biometric data under privacy law, it is subject to union consent rules, and if it leaks or is reused without consent the production is exposed. Licensing through ImageVault gives a documented chain of consent, a tamper-evident record of who accessed the data and when, and a clean end to the production's custody when the licence expires.