Digital Likeness & AI Avatars: Legal Framework for Synthetic Identity

4–8 weeks

Typical engagement

EU · UK · US · Global

Jurisdictions covered

Platforms · Media · Brands

Who we work with

AI Avatars

Consent frameworks, B2B licensing models, and use-restriction structures for platforms that create or deploy AI avatars of real people.

View service →

AI Avatars

Legal review of avatar platforms — rights clearance, consent chain verification, and compliance assessment for investors and acquirers.

View service →

Digital Identity

Structuring and protecting digital personas as intellectual property — for creators, celebrities, brands, and estates.

View service →

Digital Identity

Legal frameworks for digital personas after death — consent structures, digital inheritance, and estate rights for AI avatar platforms.

View service →

Synthetic Media

Regulatory compliance and disclosure requirements for AI-generated video, audio, and image content across EU, UK, and US frameworks.

View service →

AI Law

License agreements for the AI models underlying avatar and synthetic media products — output ownership, training data rights, and downstream licensing.

View service →

No unified legal framework

Digital likeness rights sit at the intersection of personality rights, copyright, data protection, and publicity rights — and the applicable law varies dramatically by jurisdiction. A consent structure that works in the US may be inadequate in Germany. A licensing model valid in the UK may conflict with EU GDPR requirements. There is no single framework: you need to build one.

Consent is not a one-time event

A user who consents to their avatar being used in training videos has not consented to it appearing in political advertising or adult content. Consent for a living person does not extend beyond death. Consent given to a platform does not automatically flow to its B2B clients. Each of these distinctions requires explicit legal structuring — not just a checkbox.

The liability chain is unclear

When an AI avatar is used without proper authorisation — or used in a way the subject did not anticipate — who is liable? The platform that created it? The brand that deployed it? The model provider whose technology generated it? Without clear contractual allocation and documented consent chains, liability defaults to the party with the deepest pockets.

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

✓

Step 01

Product and rights mapping

Week 1

We map your product flows: who creates the avatar, whose likeness it uses, who deploys it, and in what contexts. We identify the rights that need to be cleared, the consents that need to be obtained, and the jurisdictions that apply.

Step 02

Framework design

Weeks 2–3

We design the legal architecture: consent structure, licensing model, liability allocation, and rights chain documentation. We tailor the framework to your specific platform model — user-generated avatars, celebrity licensing, B2B deployment, or post-mortem use cases.

Step 03

Documentation

Weeks 3–6

We draft the documents: terms of service, consent forms, B2B license agreements, celebrity licensing templates, post-mortem consent frameworks, and internal clearance procedures. We review existing documents and identify gaps.

Step 04

Compliance and training

Weeks 6–8

We review the full stack against applicable regulatory frameworks (EU AI Act, GDPR, UK Online Safety Act, US state laws). We brief your product and legal teams on what can be agreed by default and what requires individual negotiation.

AI Avatar Platform · USA

Digital likeness rights framework for a B2B avatar platform

Context

US-based platform enabling users to create photorealistic video avatars and synthetic voices for marketing and training content. B2B clients (brands, agencies) wanted broad rights including modification and sublicensing.

⏱ 4–6 weeks Outcome: legally protected three-party model

Synthetic Media · UK

Celebrity digital persona licensing for AI-generated media content

Context

UK media startup creating shows and ad campaigns with photorealistic AI avatars of celebrities and historical figures. Mix of direct celebrity agreements, heir and rights-holder arrangements, and archive-based content.

⏱ 6–8 weeks Outcome: legal framework for celebrity AI content

Post-Mortem Avatars · Germany

Post-mortem digital identity framework for a ‘digital legacy’ platform

Context

German platform allowing people to train a personal AI avatar (voice, appearance, communication style) for post-mortem interaction with family. Operating in EU and UK. Questions around lifetime consent, inheritance, and use restrictions after death.

⏱ 5–7 weeks Outcome: ethical framework, user trust, clinic partnerships

The rights vary significantly by jurisdiction. In the EU, digital likeness is protected primarily through personality rights (particularly strong in Germany and France), GDPR (which classifies facial images and voice recordings as biometric data requiring explicit consent), and general privacy law. In the UK, protection comes through privacy law, data protection, and passing off. In the US, right of publicity statutes in most states protect against commercial use of a person’s name, image, or likeness without consent. In all jurisdictions, using someone’s digital likeness commercially without their consent creates legal exposure — the legal basis just differs.

At minimum: explicit, informed consent for the collection and processing of biometric data (face, voice) — which under GDPR must be specific, freely given, and withdrawable. Beyond the legal minimum, a commercially robust consent should specify: what elements of likeness are captured (appearance, voice, mannerisms); what the avatar will be used for (specific channels, content types, audiences); the geographic scope; the duration; and what uses are prohibited. Consent to create an avatar is not the same as consent to use it in all possible ways — each material use case should be covered.

Generally no, if the avatar is recognisably based on a real person. The brand or agency needs either a direct license from the person or a sub-license from a platform that has obtained the necessary rights from the person. The sub-license must be within the scope of the original consent — a platform cannot grant rights to a brand that the person did not consent to give. This chain of rights needs to be documented and verifiable.

Post-mortem rights to digital likeness vary significantly by jurisdiction. In Germany, personality rights survive death and are managed by heirs for up to 10 years. In France, image rights can be enforced by family members. In the US, California’s ELVIS Act (2024) protects voice likenesses for 70 years post-mortem; other states have varying rules. In the UK, there is no specific post-mortem personality right, but estates may have passing off claims. For platforms offering post-mortem avatar services, this requires a carefully designed consent structure that specifies who controls the avatar after death and under what conditions it can be used, modified, or deactivated.

The EU AI Act requires that AI systems generating synthetic audio, video, image, or text of real people must disclose that the content is AI-generated, in a way that is clear and distinguishable. This applies to deepfakes, AI avatars, and synthetic voices used in public-facing content. Systems that generate content without this disclosure — or that create non-consensual intimate imagery — face regulatory enforcement. The disclosure requirement is separate from the consent requirements under GDPR and personality rights law.

The right of publicity is a US legal concept that gives individuals the exclusive right to control commercial use of their name, image, likeness, and voice. It is recognised in most US states, with varying scope and post-mortem duration. Outside the US, similar protection exists but under different legal theories: personality rights in EU civil law countries, privacy and data protection law in the UK and EU, and passing off in common law countries. The practical result is similar — you cannot commercially use someone’s recognisable likeness without their consent — but the legal basis, scope, and enforcement mechanisms differ.

Consent withdrawal is a legally recognised right under GDPR and good practice under any jurisdiction. Your platform needs a clear procedure: the avatar is deactivated for new use upon withdrawal; existing uses under previously granted B2B licenses need to be addressed (which requires a sunset clause in your B2B agreements); the underlying biometric data must be deleted in accordance with your privacy policy and GDPR obligations; and the person should receive confirmation of deactivation and deletion. Building this into your product from the start is significantly easier than retrofitting it.

No — publicly available does not mean freely usable for commercial purposes. Public availability may give you access to the material, but it does not give you the right to use someone’s biometric data to create a commercial AI avatar. Under GDPR, processing biometric data (including training AI models on facial images) requires an explicit legal basis — and for AI avatar creation, explicit consent is the only practically available basis. Using publicly available material without consent to create a commercial avatar creates both GDPR exposure and personality rights/right of publicity liability.