As Artificial Intelligence (AI) technologies become increasingly sophisticated, the ability to generate, manipulate, and replicate human likenesses, particularly faces and actions, has raised urgent legal and ethical questions.
AI tools can create hyper-realistic images and videos of individuals, often without their knowledge or consent. Recently, we have seen these tools used to:
- Generate ‘deepfake’ videos using real faces
- Clone voices or facial expressions
- Create entirely synthetic personas that resemble real people.
In New Zealand, the intersection of biometric data and AI-generated imagery with privacy and copyright law is rapidly evolving, creating implications for individuals, businesses, and regulators.
Skinny and its AI-generated brand ambassador
New Zealand telco company Skinny ran a competition within its customer base to choose a new brand ambassador. The twist – the winner would be digitally cloned with the help of AI to create the new figurehead. Earlier this year, ‘Liz’ was announced as the winner, and Skinny have already begun using Liz’s likeness in its marketing and advertising campaigns.
The digital clone looks and sounds like the real-life Liz. Skinny has claimed it is managing Liz’s data in line with its A.I. principles and privacy values, and ensuring its use and access is restricted.
The campaign and technology used is a great showcase of AI capabilities to reproduce a person’s likeness. However, as this science fiction comes to life, the legal requirements regulating the use of AI and real people’s likeness must keep up.
Copyright law and AI-generated works
Under the Copyright Act 1994, the law recognises computer-generated works and assigns authorship to the person who undertakes the arrangements necessary for the creation of the work. In the context of AI-generated images, this means:
- Copyright protection applies to the expression of ideas, not the ideas themselves.
- The person who inputs the prompts or parameters into the AI system is considered the author.
- AI systems, being non-human, cannot hold copyright under current law.
This framework allows users of generative AI tools to potentially claim copyright over the images they produce, provided those images meet the threshold of originality and are not direct copies of existing works.
Personality rights and image use
Personality rights (also known as rights of publicity) protect an individual’s control over the commercial use of their identity, including their name, likeness, voice, and other personal attributes. While New Zealand does not have a standalone statute for personality rights, these rights are recognised more broadly through common law torts such as passing off, defamation, and breach of privacy.
If an AI-generated likeness of a person is used in a way that misleads consumers into believing that the individual has endorsed or is otherwise connected with a product or service, this may amount to passing off or a breach of the Fair Trading Act. This is particularly relevant where the person’s image carries commercial value, such public figures, influencers, or brand ambassadors.
Legal protections under the Privacy Act
The New Zealand Government has released its first Strategy for AI, alongside Responsible AI Guidance for Businesses (Guidance). The Guidance highlights that AI can exacerbate privacy risks, and a privacy-by-design approach can be valuable to help build in privacy protection to business processes, products and services from the start.
One particularly vulnerable area amongst the growth of AI relates to biometric replication. Biometric replication often relies on data such as a person’s face, voice, keystroke patterns, or how they walk. In New Zealand, biometric data is considered personal information under the Privacy Act 2020, and its collection and use are subject to the Act’s Information Privacy Principles.
International corporations offering services such as fitness trackers or online dating services have recently come under criticism for including alarmingly broad terms and conditions such as the irrevocable right to right reproduce, publish or modify any submitted content from its user without liability.
While the Privacy Act does not currently distinguish “sensitive” information in the same way as overseas jurisdictions do (such as the EU), a proposed Biometric Processing Privacy Code signals a shift toward more robust protections.
Emerging challenges
One of the most pressing issues is the lack of meaningful consent in many AI applications. This raises questions about:
- Who owns the resulting image?
- Can individuals assert control over their digital likeness?
- What remedies exist if their image is misused or misrepresented?
Under current NZ law, individuals may have recourse under the Privacy Act if their personal information is collected or used unfairly. However, copyright and personality rights do not clearly extend to AI-generated representations unless a human author is involved or the image is recognisably derived from a real person.
Looking ahead
The Privacy Amendment Bill, expected to come into force in 2026, will introduce Information Privacy Principle 3A (IPP3A), requiring indirect notification when personal information is collected from third-party sources. This could have significant implications for AI developers and platforms that rely on large-scale data scraping.
New Zealand’s approach is also being shaped by international developments. Jurisdictions such as the EU and Canada are moving toward explicit regulation of biometric and synthetic data, and New Zealand is likely to follow suit.
Conclusion
The ability to replicate a person’s face or voice using AI is no longer science fiction. AI-generated images of real people sit at the crossroads of copyright and personality rights in New Zealand. As New Zealand moves toward stronger regulation of biometric data and synthetic media, individuals and organisations alike must navigate this complex terrain with care. Perhaps more importantly, as technology evolves, so too must the legal frameworks that protect both creators and individuals.
For tailored advice regarding AI, privacy, and IP compliance, our team is here to assist.
Disclaimer: The content of this article is general in nature and not intended as a substitute for specific professional advice on any matter and should not be relied upon for that purpose.
