If you have accessed any social media platform, you will have likely been met with a wave of caricatures generated by artificial intelligence (“AI”) tools. Whilst these caricatures are often quite accurate, cartoonish takes on our personalities and lifestyle. The question arises: “what is happening behind the scenes with my data?”

How do these AI tools generate caricatures?

A common question is “how do these AI tools generate realistic caricatures?” AI tools, such as ChatGPT/Dall-E, produce AI caricatures by interpreting the photo and data you provide in a prompt and analyse them using AI models trained on vast collections of facial features and artistic styles. These AI tools then identify key characteristics in your picture, such as facial expressions, proportions and distinctive traits and then creatively exaggerate or stylise them to generate a playful cartoonish representation of you. The caricature is further customised based on the information you provide in your prompt, such as your work and hobbies. However, while generating and sharing AI caricatures is humorous and is the latest trend on social media platforms, it is important to remember that your use of AI tools remains subject to the terms and conditions of the AI tool provider, such as OpenAI (in the case of ChatGPT/Dall-E). Below, we explore the main legal risks that arise from using AI tools in this way.

Privacy concerns

AI‑generated caricatures give rise to significant privacy concerns because they rely on highly sensitive personal information, most notably your facial imagery/biometric data and the contextual information you provide in your prompt (which often includes detailed information about your personal life, family and other personal information).

When users upload high‑resolution photographs of themselves, these images often become part of large and opaque data pools that may be stored, shared or even used to train future AI models without clear transparency regarding long‑term use of your image and personal information. Depending on the AI tool provider, your biometric data, such as facial geometry and other identifying features, may be retained and further used to train AI models.

From a data protection perspective, it is important to remember that facial imagery and biometric data constitute special personal information under the Protection of Personal Information Act, 2013 (POPIA). The processing of such data requires additional measures, including ensuring that there is general or special authorisation to process such data. Users should therefore be aware that by uploading their photographs to AI tools, they may be consenting to the processing of their special personal information, often without full transparency as to how that data will be used.

Furthermore, given that many AI tool providers are based outside of South Africa, the transfer of personal information to these foreign jurisdictions raises additional concerns regarding the adequacy of data protection standards and whether appropriate safeguards are in place for international data transfers.

While data privacy laws, such as POPIA, require that organisations that process personal information take steps to protect the security and integrity of personal information, there is always the risk that in the event of a breach sensitive personal information could be exposed or misused.

Intellectual property concerns

The Copyright Act, 1978 recognises computer-generated works and provides that ownership of copyright in such works vests in the person “by whom the arrangements necessary for the creation of the work were undertaken". This provision directly addresses works created by computer systems rather than human authors and in principle concretises that copyright does in fact come into existence. In the context of AI-generated caricatures, the question becomes: who made "the arrangements necessary for the creation of the work"? There are a few possibilities:

  • the user who inputs the prompt and photograph into the AI tool and initiates the generation of the caricature;
  • the AI tool provider (such as OpenAI or Google) who developed, trained and operates the AI model; or
  • the developers and trainers of the AI model who created the underlying system.

A persuasive argument exists that the user who provides the input photograph, crafts the specific prompt and initiates the generation process is the person who makes the "arrangements necessary" for the creation of that particular caricature. However, this interpretation has not been formally tested.

Ownership of copyright in a photograph is much clearer. It vests in the person who is responsible for the composition of the photograph (usually the photographer). There is, however, an important exception to this rule. If you commission the taking of a photograph and agree to pay for it, you will own the copyright.

However, copyright issues arise both at: (i) the input stage (training/using third‑party works); and (ii) the output stage (the caricature image). In respect of the input stage, where you upload a photograph in which you do not own copyright, to generate an AI caricature, you may be infringing the copyright owner's exclusive rights. With regard to the output stage, where an AI-generated caricature substantially reproduces elements of a copyrighted work (whether from the training data or from the input photograph itself), the output may constitute an infringing copy. This risk is particularly true where the resulting caricature is shared on social media.

It should also be noted that there is also a general risk related to the training data used to develop AI models. AI tools capable of generating caricatures are typically trained on vast datasets of images, which may include copyrighted artistic works. The use of the AI tool could give rise to an infringement claim if the training data was used without the copyright owner’s consent.

An interesting question arises where someone else creates an AI caricature of you, without your knowledge or consent. In such circumstances, you may have recourse under several overlapping legal frameworks, including copyright infringement (if you are the owner of the copyright in the photograph), data privacy (POPIA), and personality rights. South African courts have recognised that every person has a right to control the use of their own image and to prevent others from appropriating their likeness without consent. Furthermore, personality rights are recognised under South African law, which includes the right to identity, dignity and privacy. These rights protect your interest in your own likeness, name and other aspects of identity.

AI tool provider terms and conditions

The level of protection afforded to end users over their images and personal information they upload into AI tools is ultimately dictated by the specific AI tool provider’s terms and conditions. These terms determine what data/personal information is collected, how it is processed, whether it is retained and the extent to which it may be used to train or improve the platform’s underlying AI models.

A key concern is that many AI tool providers reserve broad rights to use user‑submitted data, including photographs, prompts, and other contextual information, to provide, maintain, develop and improve their AI models and services. For example, OpenAI’s “Opt Out” clause in its Terms of Use, expressly allows OpenAI to use user content for such purposes unless the user opts out. It is critical to note that this setting is turned on by default on a free ChatGPT account, enabling your content (which could include your images and personal information) to be further used to train OpenAI’s AI models.

Similarly, Google Gemini’s API Additional Terms of Service state that “when you use unpaid services, including Google AI Studio and the unpaid quota on Gemini API, Google uses the content you submit to the services and any generated responses to provide, improve and develop Google products and services.” Therefore, the data which you input could be further used to improve and develop Google’s AI products and services.

Ultimately, the degree of protection afforded to end users over their images and data inputted into AI tools is dependent on the third-party provider’s terms and conditions. Given the sensitive nature of biometric data and the increasing integration of AI into everyday tools, users and organisations must exercise diligence by reviewing these terms and conditions before inputting any personal information into an AI tool.

The main concern around uploading your picture via a prompt to generate an AI caricature is that it may result in loss of your ability to control how your image may be used in the future, i.e. AI tool providers could potentially use your image to further train or develop new AI models. It is for this reason that it is critical to always consider the applicable AI tool provider’s terms and conditions before uploading personal information (such as your image) into an AI tool.

As regulatory frameworks continue to develop in response to the rapid advancement of AI technologies, it is anticipated that greater clarity will emerge regarding the legal obligations of AI tool providers and the rights of individuals whose data is used to train and operate these systems. In the meantime, a cautious and informed approach remains the best protection.