Privacy advocates called it "a recipe for disaster." That was the reaction the moment Meta announced it would use profile photos from public Instagram accounts to train its AI image-generation models. Users who didn't want to participate had to dig into the settings menu themselves and file an opt-out request. Doing nothing was treated as consent.

What makes this policy uncomfortable is the direction it runs. Consent only begins once you grant it; refusal, by contrast, has already begun unless you actively stop it. If you're a solo entrepreneur or content director who runs your brand on your own face, that difference in direction is worth thinking through carefully, at least once.

Meta Changed the Rules

Meta announced that it can use profile photos from public Instagram accounts as training data for its AI image-generation models. Here, a "public account" simply means one set so that anyone can view the profile and its posts — follower count has nothing to do with it. A small brand account with a few hundred followers and a creator account with hundreds of thousands of followers are both covered, as long as the account is set to public.

Instagram has more than 2 billion monthly active users. Industry estimates put the number of accounts registered as business accounts alone at over 200 million. Meta hasn't disclosed what share of those users are even aware of the policy change, let alone how many have completed an opt-out request. When a policy shifts without notice, most users tend to find out about it only much later.

There is a way to opt out. Users can request exclusion from this feature through Meta's settings menu. But the process isn't automatic — you first have to learn about the policy change, then find the menu, then file the request. In the meantime, the data of anyone who doesn't know about the policy, can't find the setting, or simply hasn't filed a request falls within the range Meta can use. Whether an opt-out request applies retroactively to data already used is something Meta has not specified.

Korea is no exception. Instructors, consultants, freelance designers, small business owners, and small-brand operators who run their brand through a public Instagram account are all subject to the same policy.

The Logic of "You Made It Public, So You Consented"

Meta's position, simplified, goes something like this: posting a photo on a public account amounts to distributing it publicly on the internet, and within the bounds of its terms of service, the platform is entitled to use that data to improve and operate its services. Most social media terms of service state that the platform can use user content for operations and feature improvement, and Instagram is no exception. From this also comes the argument that some degree of data use is already an accepted condition of using a free platform.

There is a view that supports this logic. AI image-generation technology requires massive training datasets, and using publicly available internet data is standard practice across the AI industry. Alongside this comes the argument that as platforms strengthen their AI features, users in turn get a better service.

The opposing view, however, takes issue with something else entirely. The strongest criticism concerns the timing and scope of consent. It's hard to argue that someone who opened an Instagram account in 2012 and agreed to its terms of service at the time also consented to having their face used, in 2026, to train an AI image-generation model. Even if the terms included language along the lines of "we may use data to improve our services," whether users genuinely understood and agreed that this meant their photos would become training data for face-generating AI is a separate question.

The opt-out structure is also contentious from a data-protection standpoint. Under the EU's General Data Protection Regulation (GDPR), the default principle is that processing personal data requires explicit consent — that is, opt-in. In parts of Europe, Meta's policy has reportedly been paused or subjected to separate review. How this policy would be interpreted under Korea's Personal Information Protection Act remains unclear.

It's difficult to say definitively which side is legally correct in this debate. But for anyone running a solo brand, one thing is practically clear: platforms can change their policies at any time, and it's hard to know in advance what the new default setting will look like once they do.

If You Run a Public Account, Here's What to Check Now

The realistic place to start is filing an opt-out request. Within Meta's "Settings and Activity" or privacy-related section, you can request exclusion from having your data used to train generative AI. The exact path can vary depending on your app version and country setting, so the fastest approach is to search directly for "AI and my information" or "generative AI" within the app.

The next thing to check is the nature of your profile photo itself. Even for a brand account, a photo of your face is different from a logo or illustration. If your account publicly displays your face alongside your name and title, it's hard to predict what context an AI-regenerated image combining those elements might end up circulating in. Consciously deciding what information your current profile photo carries is really deciding what that choice means for your branding strategy.

Taking a longer view, this episode reopens an old question about platform dependency and data ownership. When blockchain-based social platforms first emerged, the idea behind them was simple: the value created by content posted on a platform should go directly to the person who made it. That experiment still hasn't become reality on mainstream platforms, and that fact is connected to the roots of the resistance users feel toward this Meta policy change. How the ownership of data — and the revenue it generates — should be divided between the person who posts content and the platform remains, even now, unresolved.

Studies analyzing shifts in the business environment commonly point to one principle: use the platform's tools, but own your customer relationships and core assets yourself. Now is a good time to check whether you have an independent channel that keeps you connected to your customers even if your account is deleted or a policy suddenly changes, and to think about how your brand's image assets are being stored.

What makes this particular Meta policy feel especially unsettling often has less to do with data use itself and more to do with the sense that "my face could be reproduced in another context without my consent." For anyone who runs their brand through their own face, that sense is a matter of both privacy and brand trust — because the confidence that you're in control of your own self-representation in digital spaces is directly tied to how trustworthy your brand feels.

Checking one opt-out setting today, and taking one more look at what information your profile photo actually carries — that's the most practical suggestion this column can offer. The rules changed quietly, and brands are operating on top of those changed rules.