The 80s AI Photo Trend Is Quietly Training AI on Your Face

Read the story for free, here.

I keep asking people why they uploaded their face to an AI model after admitting they knew the risks, and the answer is always some version of "it's just for fun," as if fun and biometric data were mutually exclusive.

Everyone in my WhatsApp and Facebook groups has done it.

Open an app, drag in a selfie, type a prompt, and thirty seconds later you're a feathered-hair, neon-lit version of yourself standing in front of a fake shopping centre or an 1980s street.

The 80s AI photo trend is currently through Instagram and WhatsApp in India this year, and the barrier to entry is almost zero.

You don't need to know anything about AI. You just need a face.

That's exactly the problem.

This isn't really an article about whether the filter itself is dangerous. It's about something quieter: the AI selfie trend privacy risk that comes from the upload itself, not the output.

What you're handing over is a permanent biometric transfer, and the consent you're giving for it is opt-out by design, not opt-in.

By the end of this piece, you'll know what ChatGPT and Gemini actually do with an uploaded selfie, how to turn off training on both, and where Indian law does and doesn't protect you right now.

Before we get into settings and toggles, sit with this for a second.

Uploading your selfie to an AI platform for a stylized portrait is a lot like handing a spare key to your house over to a photo booth attendant, just so you can get a souvenir picture. You'll probably get the photo back fine. But you've also just handed a stranger something that opens a door you can't easily change the lock on.

What Actually Happens When You Upload a Selfie to ChatGPT or Gemini

Is It Safe to Upload My Selfie to ChatGPT for the 1980s Photo Trend?

Not entirely, and the risk isn't the filter, it's what happens after you hit upload.

Your selfie isn't treated as "just a photo" by these platforms.

It's biometric data, your facial geometry and features, and the default setting on most consumer AI tools typically permits that data to be used for model training unless you go looking for the switch that turns it off.

ChatGPT and Gemini handle this slightly differently, but the pattern underneath is the same.

ChatGPT has an "Improve the model for everyone" toggle. Gemini calls its version "Keep Activity."

Both start on. Both require you to find them before you upload anything, not after.

Turning the toggle off doesn't get you to zero, either.

Google puts a number on it: a 72-hour retention window for safety review, even after you turn training off.

OpenAI's policy doesn't offer an equivalent ceiling. It retains your data for as long as it decides it needs to, and even after you delete something yourself, removal can take up to 30 days to complete, longer if it's flagged for safety, fraud, or legal reasons.

There's also a routing problem most people never think about. Platforms don't always process everything in-house.

Data can move to contracted reviewers or infrastructure partners you've never heard of and never agreed to individually. You consented to the platform's policy. You didn't consent to every vendor downstream of it.

I never uploaded a photo for the 1980s retro trend.

I didn't touch the Studio Ghibli avatar craze either, back when it took over everyone's profile picture. Consumer AI wasn't nearly as sophisticated then as it is now, but the underlying risk hasn't really changed. The technology just caught up to the danger.

Reading privacy policies before linking my data or testing a new chatbot is an unconventional habit of mine, but it's paid off.

What I found across almost every mainstream generative AI platform is a consistent, quiet trap.

Model training is rarely opt-in.

It's almost universally opt-out, so the platform defaults to consuming your inputs, and even when you track down the buried toggle to switch training off, your raw photo doesn't vanish immediately. It sits in a retention buffer for days under a safety review label.

I am simply not comfortable donating my biometric profile to an iterative neural network.

Your face isn't just a mood board anymore. It's the master key to your phone, your identity verification, and increasingly your financial life.

Feeding it into an opaque training pipeline just to see what you'd look like in washed-out neon denim is a bad trade.

What Is the AI Selfie Trend Privacy Risk, Exactly?

A biometric facial identifier is a digital measurement of your unique facial features, the same kind used to unlock your phone or verify your identity at a bank.

Once you upload a selfie to an AI platform, that measurement can be stored, analyzed, and in many cases used to train future versions of the platform's AI models, unless you've explicitly opted out.

The phrase "opt-out" does a lot of quiet work in every privacy policy you'll never read in full.

Opt-out means the default state is yes, use my data, unless you actively find and flip a switch somewhere in a settings menu three taps deep. Opt-in would mean nothing happens with your face until you actively say yes.

That distinction is the whole crux of this article.

Most people assume silence means privacy.

It doesn't.

Silence, in the world of consumer AI platforms, usually means consent has already been assumed on your behalf.

Why a Static Selfie Is the Easiest Biometric to Weaponize

The 80s photo trend uses one kind of biometric input: a still, static image of your face.

That happens to be the weakest kind of biometric data you can hand over.

According to a Microsoft-affiliated benchmark test cited in current deepfake research, AI-generated deepfake attacks successfully bypassed a commercial facial recognition system 78% of the time.

Voice authentication doesn't fare much better, with recent research putting spoof-acceptance rates for voice systems between 80 and 90%, despite most people trusting a voice call as somehow more secure than a photo.

Static images are structurally weaker than dynamic biometrics like eye movement or micro-expressions, which is exactly why researchers studying identity deepfake threats are now pushing toward dynamic signals for authentication.

A still photo has no motion to verify against. It's a fixed target, and generative models are extremely good at hitting fixed targets.

And yet static facial recognition remains the default on most phones and banking apps in India and everywhere else. The vulnerability is public, published, and known. Deployment simply hasn't caught up to it.

If static facial recognition is this demonstrably fragile against modern generative models, why do consumer banks and smartphone brands keep rolling it out?

The plain answer is friction, or more precisely, the industry's obsession with eliminating it. In product design, convenience beats security until a costly failure forces a redesign.

A simple 2D camera capture needs no depth sensor, no infrared dot projector, and no patience from the user. It takes half a second, feels effortless, and drives onboarding numbers up.

Financial and consumer tech companies have quietly shifted the systemic risk onto the customer.

When an AI-generated synthesis fools an authentication flow, the corporate response usually treats it as an edge case or user negligence, not as a structural failure of using static photos as biometric passwords.

Static face matching sticks around because upgrading to dynamic, liveness-verified biometrics costs hardware margin and introduces customer drop-off.

Convenience sells subscriptions. Rigorous biometric security just slows people down.

When Consent Fails: OkCupid, Meta, and What "No Recourse" Actually Looks Like

Two cases show what happens when this kind of consent gap plays out in the real world, and neither ends the way you'd hope.

OkCupid shared roughly 3 million user photos with the AI company Clarifai to help build facial recognition software, without asking users first. The FTC settled with Clarifai in March 2026. There was no financial penalty, and nobody affected was required to be notified.

Meta is facing a separate, unresolved situation. A federal lawsuit filed in September 2026 alleges that Facebook and Instagram photos were used to train both a facial-recognition tool called NameTag and generative image models including Emu and Muse Image, again without consent. This is still an allegation working through the courts, not a settled fact, and it's worth being precise about that.

The pattern across both cases is the same one that matters for the 80s photo trend. The platform you uploaded to isn't necessarily the one that leaks or misuses your data. A vendor, a partner, or a training pipeline downstream can, and your recourse against that third party is close to nonexistent.

When you read the details of the OkCupid and Clarifai settlement, the modern data pipeline stops looking like abstract tech and starts looking like an unregulated one.

Millions of people uploaded casual headshots simply looking for a romantic connection.

Years later, Clarifai secretly repurposed those private profile photos to train commercial surveillance-grade facial recognition models. Even after the FTC stepped in, the outcome was telling: the agency didn't levy a financial fine, Clarifai simply agreed to delete the data, and not a single affected user received a notification that their face had been harvested.

Knowing that changes the whole conversation when a colleague or friend laughs about an AI photo trend at lunch.

People assume that if a platform commits a breach or exploits their images, there will be accountability: a consumer alert, an opt-out notification, or a legal remedy.

There isn't.

Once an image slips past the front end into subprocessor networks, model weights, and vendor testing pipelines, control evaporates.

My advice to friends now isn't "be careful what you post."

It's simpler.

Never feed an authentication asset into an entertainment engine.

What Does India's DPDP Act Say About Biometric Data Like Face Photos in AI Apps?

Right now, not much you can actually use. India's Digital Personal Data Protection Act received presidential assent in 2023, but full substantive enforcement, including penalties that can reach ₹250 crore, doesn't take effect until May 13, 2027.

There's a sharper point buried under that timeline. Unlike the GDPR in Europe, the DPDP Act doesn't carve out a separate "sensitive personal data" category for biometrics. Your face is treated the same as your name or your pin code under Indian law, not as something requiring extra protection.

Until 2027, an Indian user whose selfie gets misused has very limited statutory teeth to lean on. That's the accountability gap this whole article keeps circling back to, and it isn't a someday problem. It's live, right now, during the exact window this trend is happening in.

The Actual Steps to Protect Yourself (Without Giving Up the Trend)

Does Google Gemini Use My Uploaded Photos to Train AI, and How Do I Turn That Off?

Yes, by default.

Gemini's Apps Activity setting, sometimes labeled "Keep Activity," is on unless you switch it off yourself.

Turning it off stops your uploads from being used in future model training, though it doesn't delete anything already collected and doesn't override the 72-hour safety review window.

Because I refuse to upload real selfies to consumer generative engines, I don't have a retro prompt of my own to share. But watching colleagues take part in the trend showed me exactly how badly the interface works against basic data hygiene.

Almost everyone followed the same routine: open the app, drag in a high-resolution selfie, paste a viral prompt, download the result, post it, close the tab. Not one person checked the data settings first.

If you're going to take part anyway, treat the platform's settings as your main line of defense, not an afterthought:

1. In Google Gemini, open settings, find Gemini Apps Activity (often listed as Keep Activity), and switch it off before your photo ever touches the prompt box. Google still keeps an operational retention window of up to 72 hours for safety review, even with the toggle off.

2. In ChatGPT, open Settings, go to Data Controls, and turn off "Improve the model for everyone."

Delete past activity manually wherever the option exists. It won't undo a model that's already trained on your old photos, but it limits what's exposed going forward.

Here's the honest limitation: none of this is full protection. It reduces your exposure. It doesn't eliminate it. Flipping those toggles helps, but it doesn't buy you total anonymity.

The only certain way to keep your biometric template off an AI server is to never hit upload in the first place.

The AI Selfie Trend Privacy Risk That Outlasts the Trend

Treat every AI photo trend the way you'd treat handing over a physical ID: check the opt-out before you upload, not after. The trend will still be there in five minutes once you've adjusted the setting.

As more platforms bundle photo uploads into casual, viral features, the gap between "fun trend" and "biometric data collection" keeps shrinking. And until India's DPDP Act becomes fully enforceable in 2027, the responsibility for that gap sits almost entirely with the user, not the platform.

That's not a comfortable place to land, but it's the accurate one.