Privacy

Your Photos in AI Training Data: Did You Consent?

KnytX builds privacy and security tools — data broker removal, dark-web monitoring, and scam defence. · What is KnytX?

··7 min read

Priya photographed weddings for eleven years. Her portfolio — thousands of images posted across Instagram, her personal website, and photography forums — represented a decade of work. In 2023, a client showed her something strange: a Midjourney prompt had produced an image whose composition, lighting, and even the drape of a sari looked unmistakably like her style. Not identical. Close enough to be unsettling.

Priya hadn’t licensed anything to Midjourney. She hadn’t agreed to anything. Nobody had asked.

This is not a story about one photographer. It’s a story about billions of images and a set of decisions AI companies made without the people in those images.

The short answer: If your photos are anywhere public — Instagram, Facebook, X, a personal site, or a photography forum — assume some are in AI training data. Most image models were built on LAION-5B, a dataset of billions of images scraped from the open web without consent. You can check using Have I Been Trained (haveibeentrained.com) and Spawning.ai’s “Did I Consent?” tool. You cannot pull images out of models already trained. You can make accounts private, register with Spawning’s opt-out list, and block scrapers going forward.

The dataset that started it all

To understand how AI image models work, you have to understand one dataset: LAION-5B.

LAION — the Large-scale Artificial Intelligence Open Network — is a German nonprofit that assembled 5.85 billion image-text pairs scraped from the public web. Images pulled from websites, paired with nearby text. The result became the foundational training set for Stable Diffusion and many models that followed.

The images were not licensed. They were not collected with the knowledge or consent of the photographers, artists, or individuals who appear in them. The legal argument runs roughly: if you posted it publicly, you assumed the risk.

In 2023, researchers discovered LAION-5B contained child sexual abuse material — thousands of images of real children being abused. The dataset was taken offline temporarily. It came back. The models trained on the original version were not retrained.

Who is in the data

Stability AI built Stable Diffusion on LAION-5B. In 2023, Getty Images sued Stability AI for scraping 12 million licensed photographs, watermarks and all. The case was a test of whether mass scraping constituted copyright infringement at industrial scale.

Three artists — Sarah Andersen, Kelly McKernan, and Karla Ortiz — filed a class action against Stability AI, Midjourney, and DeviantArt in the same year. Their argument: these companies ingested the work of millions of artists, built commercial products from it, and paid nothing. The case is ongoing.

Meta presents a different version of the same problem. The company trained its image generation models on public posts from Instagram and Facebook. Have you ever posted a photo with a public account on either platform? A photo of your children, your vacation, your art? That image may have been used. Meta updated its terms of service in 2023 to make this explicit. The training had already happened.

The companies that did it differently — and why

Adobe Firefly gets cited as the ethical alternative. The distinction is real but narrower than Adobe’s marketing implies. Adobe trained Firefly on licensed Adobe Stock images and public domain content — “We have rights to what we trained on.” That is meaningfully better than scraping. It is not a statement about consent in any broader sense. Adobe Stock contributors opted into a licensing framework, and their images ended up in an AI training set as a result. Some are not pleased.

OpenAI has claimed improvements in consent practices for DALL-E 3 but has not published a dataset card the public can verify. Google’s Imagen and DeepMind’s Flamingo were trained on web-scraped data. Google says its datasets are filtered. The documentation to confirm that is not public.

What this means if you live in India

The AI training data conversation plays out in American and European courts. That framing obscures something important: the scraping was global.

Indian wedding photographers, Bollywood stills, street photography from Mumbai and Delhi, Madhubani paintings posted to craft blogs: all of it was on the public web, and all of it was scraped. LAION-5B did not filter by geography. The web was the source, and the web includes everything Indian creators have posted online for two decades.

India’s Copyright Act 1957 protects photographs. But bringing a claim against a company headquartered in San Francisco, in courts that may lack jurisdiction, over images in a dataset assembled in Germany, is practically very difficult. The DPDPA addresses personal data processing but does not clearly cover publicly posted images used in AI training. The law was not written with this use case in mind.

Indian creators are in the same position as creators everywhere: exposed, largely without remedy, dependent on lawsuits filed in foreign courts to set any precedent that might eventually apply here.

How to check if your images were used

Two tools are worth knowing.

Have I Been Trained (haveibeentrained.com) lets you search the LAION dataset by URL or by uploading an image. The LAION dataset was used so widely that it’s the most important starting point — not perfect, not comprehensive, but direct.

Spawning.ai’s “Did I Consent?” tool runs a similar check and maintains an opt-out registry that some trainers respect.

If you have ever posted photos publicly on Instagram, Facebook, or X, the simpler answer is: assume your images are in at least one training dataset. All three platforms have terms permitting the use of content for AI training. Instagram updated its terms explicitly in 2023. The training had already been happening.

Opting out — what’s actually possible

Spawning.ai maintains an opt-out registry. Some AI companies — a minority — have agreed to honor it for future training runs. This does nothing about historical training. If your images were already in a dataset when a model was trained, opt-out doesn’t undo that.

Making your Instagram account private stops future scraping. It doesn’t remove images already collected. Midjourney offers a removal request for specific content but no comprehensive opt-out for historical data.

Shutterstock entered licensing agreements with AI companies and created a compensation fund for contributing photographers. Most report receiving a few dollars.

The robots.txt web standard tells crawlers not to index a site. Many AI scrapers ignore it. Stability AI’s scrapers ignored robots.txt directives on sites they crawled. Until compliance is legally mandated, it’s a request, not a barrier.

For the platform-level settings — turning off AI training on Instagram, LinkedIn, Adobe, and the rest — see our full guide to opting out of AI training. This post covers the image-specific tools; that one covers every major company’s account setting.

The honest summary

Billions of images were taken from the web and used to train commercial AI products. The people who created those images were not asked. The companies made enormous amounts of money. The legal cases proceed slowly in courts far from most affected creators. The opt-out tools are partial. The historical data is not coming out of the models.

Priya’s wedding photographs are almost certainly in a training dataset somewhere. In all probability, so are yours.

What you can do right now

Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.

Share