AI Rights Brief Daily

The fine print is becoming the workflow

Today’s briefing is unusually terms-and-infrastructure heavy, which is probably appropriate for where professional visual AI is heading. Recraft’s new developer terms take effect for existing API users on August 25 and make several production consequences explicit: API-generated assets are not used by Recraft for model training, generated assets may not themselves be used to train another AI system, provenance markings must not be removed, and developers must have consent when identifiable people appear in inputs.

Black Forest Labs has also substantially formalised the rules around FLUX. Its August terms require consent when generating identifiable people, prohibit presenting synthetic output as a photograph of a real event, prohibit intentional removal of AI transparency metadata, and allow users to opt out of future FLUX training use of their inputs and outputs, although that opt-out is prospective rather than retroactive.

In the Philippines, the National Privacy Commission has gone further on likeness, declaring that a face or likeness is personal information and that generating and circulating synthetic media of a real person is itself personal-data processing requiring a lawful basis.

A smaller but interesting commercial platform, Mirai, is showing what a consent-first synthetic-model business can look like: talent retain their likeness rights, approve individual generated assets, receive a share of licence fees and can revoke future generation. At the standards level, C2PA’s new implementation guidance shows how provenance can record far more than an AI label, including the model, prompts, reference images, parameters and the exact regions altered by AI.

Google Photos is already presenting a simpler version of that history to ordinary users, distinguishing camera capture, generative edits and non-AI edits in its 'How this was made' view. The common thread is that professional AI rights are moving out of generic policy statements and into the actual production record.

Recraft’s new API terms make the model contract part of the image-production record

Recraft’s new Developer Terms were published on August 11 and take effect for existing API users on August 25. They say users own assets generated through the API and Recraft will not use those API assets to train its own models. The terms also prohibit using generated assets to train another AI system. Developers are responsible for obtaining rights and permissions for uploaded material and must have the required consent where an input contains an identifiable person. Recraft may attach machine-readable provenance or watermarking and says developers must not remove those markings except where law permits.

Why visual creators should care

Agencies increasingly use image-generation APIs behind their own applications and production systems. That means the rights position can depend on the API contract rather than the consumer-facing terms a designer might be familiar with.

Practical takeaway

Record whether an asset came from Recraft’s API, consumer application, MCP integration or a third-party service. Those routes can carry different data and contractual rules. Preserve any provenance attached to API output and document consent where a real person appears in reference material.

What to watch next

Watch the August 25 transition for existing users and whether Recraft makes the same no-training and provenance protections standard across all of its product routes.

Sources

FLUX users can opt out of future training, but that does not rewind training that already happened

Black Forest Labs revised its FLUX terms on August 1. The company claims no ownership over user inputs or outputs but receives a broad licence to use content to provide, develop, train and improve its products. Outside certain beta or specially governed programmes, users may contact Black Forest Labs to opt out of future use of their inputs and outputs for FLUX training. The terms make clear that the opt-out is prospective: it does not undo use of material already incorporated into training. The same terms require consent when generating identifiable people and prohibit intentional removal of AI labelling or transparency metadata.

Why visual creators should care

An AI-training opt-out can sound much stronger than it actually is. For photographers and agencies, the important questions are when the opt-out begins, what happened to previously submitted material and whether beta or other product-specific terms override the normal rule.

Practical takeaway

If client images have already been used with FLUX services, record when any training opt-out was made. Do not describe a prospective opt-out as though it guarantees that older uploads were never used.

What to watch next

Watch whether Black Forest Labs moves training controls into account settings and whether enterprise or API agreements offer materially different treatment from the general FLUX terms.

Sources

The Philippines is treating a synthetic face as a personal-data issue, not just a deepfake issue

The Philippines National Privacy Commission says a person’s face and likeness are personal information and that photographic or video material can in some circumstances constitute biometric information. Its August 11 notice says generating an AI image or video from a real person’s likeness and posting or sharing it amounts to personal-data processing and therefore requires a lawful basis. The Commission says synthetic media created without a lawful basis may constitute unauthorized processing and that an affected person can seek blocking, removal or destruction of false personal data.

Why visual creators should care

This shifts the question away from whether an AI likeness is defamatory, obscene or commercially exploitative. The act of creating and circulating the synthetic depiction can itself engage privacy law because a real person’s identity is being processed.

Practical takeaway

For work involving identifiable people, do not rely only on a conventional photography release. Record the lawful basis or explicit permission for synthetic generation, transformation, publication and any commercial use separately.

What to watch next

Watch how the Commission handles complaints involving advertising, public figures and artistic work, where the notice says context, disclosure and the purpose of using a photorealistic likeness may affect the analysis.

Sources

One synthetic-model platform is treating every generated campaign image as a new likeness licence

Mirai’s current commercial model separates a talent’s underlying likeness from individual AI-generated assets. Its terms say talent retain ownership of their likeness, reference photographs are used as generation references rather than general model-training inputs, and each generated image requires the talent’s approval before a client can license it. Licences specify format, duration and territory. Talent can revoke future generation on 72 hours’ notice, although previously licensed imagery remains valid for its purchased term.

Why visual creators should care

This is a useful alternative to the idea that a model release should give a brand an unlimited right to produce future synthetic versions of somebody. Consent is attached to the generation and licence rather than disappearing into one broad release signed at the beginning.

Practical takeaway

For synthetic talent work, separate the base likeness permission from each campaign use. Record the generated asset, approval, channels, duration, territory, exclusivity and whether an endorsement is actually authorised.

What to watch next

Watch whether agencies and conventional model libraries adopt similar per-generation approvals and whether synthetic likeness licensing develops standard rate structures comparable with traditional usage licensing.

Sources

C2PA is trying to turn 'AI was used' into an actual production history

C2PA’s latest implementation guidance explains how Content Credentials can distinguish entirely generated media, AI-enhanced work, camera capture and human editing. It also describes a dedicated AI disclosure assertion capable of recording model provenance and human oversight, Regions of Interest that identify which parts of an image or video were altered, and ingredient records that can include prompts, reference images, seed values and generation parameters.

Why visual creators should care

A simple AI label cannot tell a client whether a photographer removed one object, generated half the scene or created the whole image synthetically. The newer provenance structure is much closer to a usable production record.

Practical takeaway

Where a workflow supports Content Credentials, preserve more than the final AI flag. Model, reference and action history can be much more useful if authorship, disclosure or client approval is challenged later.

What to watch next

Watch which major cameras, image editors, DAM systems and publishing platforms expose these detailed fields to ordinary creators instead of reducing them to a generic AI badge.

Sources

Google Photos is starting to show ordinary viewers where AI entered the photograph

Google Photos’ current Content Credentials support presents provenance in a 'How this was made' section on Android and iOS. Where compatible credentials exist, it can distinguish camera capture, generative-AI edits and conventional edits such as cropping. Google says editing an already credentialed image in Google Photos adds to that history, while saving a generative-AI edit can create Content Credentials even where the original image did not have them. Google also stresses that Content Credentials do not themselves determine whether a photograph is real or fake.

Why visual creators should care

This is the point where a technical provenance standard starts becoming useful to photographers’ clients and audiences. Instead of examining raw metadata, somebody can see a readable history showing that an image began with a camera and was subsequently altered.

Practical takeaway

If provenance matters, test the final delivered image on the platforms your client actually uses. Google Photos currently supports compatible embedded credentials on mobile, but not every file or C2PA implementation is recognised.

What to watch next

Watch whether comparable provenance histories become visible in web browsers, social platforms and publisher CMS systems, and whether support expands beyond the currently compatible C2PA versions.

Sources