ZYMBOS INTELLIGENCE · SPECIAL ALERT: Your face is now an AI prompt. Meta never asked.

Buried in Meta's launch of its new image model, Muse Image, on 7 July is a setting that is switched on by default. Anyone can type an Instagram username into a Meta AI prompt, and the model will pull that account's public photos to generate new images. Your photos. Your face. Your brand. And if your organisation runs a public account, the faces of the people who work for you.

No consent request. No notification. Meta's own help material confirms you will not be told when your content is used this way.

Only two kinds of account are excluded automatically: private accounts, and accounts belonging to under-18s. Every other public account is opted in.

The fix takes about two minutes, and the exact steps are further down. First, what has changed and what it means, because the setting is only half the story.

Does this affect you?

If your Instagram account is public and it carries images of you, yes. Three groups in particular:

• Personal accounts that are public, where your face is the content.
• Business and creator accounts that are public, where your product shots, brand imagery, or founder photos are on display.
• Organisations whose public accounts feature staff: team pages, event coverage, day-in-the-life reels. The account's default setting has opted those employees into artificial intelligence (AI) reuse, and nobody asked them.

If you run a public account to be found, and most businesses do, you are in scope. The reach you built for marketing is the same reach that makes your images available to a stranger with a prompt.

For organisations, treat this as a privacy question, not just a marketing one. The toggle sits with whoever manages the account. The risk sits with every person pictured. Your employees did not choose your Instagram settings, but their faces now depend on them.

What it actually means

Being public was always an invitation to view your photos. It was never an invitation to regenerate them. That is the shift. Your likeness becomes an input. Someone can produce an image that looks like you, or trades on your brand, in a context you never chose. Fake endorsements, impersonation, and worse all get cheaper to attempt.

One detail matters most. The off switch is not retroactive. Turning it off stops future generations. Anything already made from your content stays. So the sooner you switch it off, the less there is to make.

A note on where you are. Meta is rolling Muse Image out country by country and widening it over time. Its status in the United Kingdom and European Union is less settled, for reasons in the legal section below. The opt-out toggle, though, is already in the app. Set it now, wherever you are.

Can this be challenged? The legal picture

Meta will argue it is on solid ground. The content is public, its terms permit reuse, and there is an opt-out. That is the legal floor. Whether it clears the bar in Europe is a different question.

Under the General Data Protection Regulation (GDPR), "public" does not automatically mean "free to reuse for AI". Three pressure points stand out. Consent, because no permission is sought from the person in the photo and a username is enough. Purpose limitation, because photos posted to be seen are now feeding a generative model, arguably a different purpose from the one they were shared for. And transparency, because a feature that by design does not tell you sits awkwardly with rules that require people to be informed.

This is not theoretical. In 2024 Meta paused plans to train its AI on European users' public posts after pushback from the Irish Data Protection Commission and the privacy group noyb, then resumed only with an opt-out. Meta already holds record GDPR fines in Ireland. Commentators covering Muse Image expect the same scrutiny, with added questions about biometric data, and doubt the opt-out model will hold up in the EU. Separately, the EU AI Act's transparency rules, which start applying from August 2026, will require AI images that resemble real people to be clearly labelled as artificial.

The short version. It can be challenged. Privacy regulators and campaigners are the likely challengers. Europe is where it is most exposed. None of that removes your content from the model today, which is why the setting matters now.

That is general information, not legal advice. If you are weighing a formal complaint, get advice specific to your situation.

Even if it is legal, was it right?

As a Certified AI Ethicist (CAIE, Oxethica), the question I keep returning to is not whether Meta can do this. It is whether Meta should have done it this way.

Strip away the technology and Muse Image comes down to four design decisions. Participation is assumed rather than asked for. You are never told when your content is used. The off switch sits several taps deep. And turning it off undoes nothing already made. Every one of those levers could have been set the other way. Meta set all four in its own favour.

Defaults decide outcomes. Most people never change settings, and platform designers know it. "On by default" is not a neutral starting point. It is the decision.

Meta's answer is that you have control, with an easy setting to turn the feature off. But control you do not know you need is not control. You cannot object to a use you are never told about. The missing notification is what keeps the "you are in control" claim standing.

The toggle also has a blind spot worth naming: it protects your account, not you. Photos contain people; settings cover accounts. If your face appears on a friend's public profile, a wedding album, a conference feed, your employer's team page, a parent's family account, your opt-out does nothing there. A child on a parent's public account never had a choice at all.

To be fair to Meta: only public content is used, private and under-18 accounts are excluded, and safeguards exist. All true. And none of it touches the design. A product can sit comfortably inside the terms of service and still be built so that consent is assumed, notice is absent, and the cleanup is yours.

Legality is a floor. This feature meets the floor and stops there.

Three things to remember. This fixes your account, not photos of you posted by other people, so it is worth telling anyone whose public account features you. It is not retroactive, so do it today. And if you manage your organisation's account, run the same four steps there, then tell the people who appear in your content that you have.

Know someone with a public account? A creator, a founder, a friend whose face is their feed? Forward this to them. It is the fastest way to protect them before something is made.