If you make a purchase after clicking on links within this article, Conley Media may earn a commission. The news and editorial departments had no role in the creation of this content. The short version AI headshot tools sit near a body of law written for fingerprint scanners and facial recognition, and the fit is imperfect. Illinois, Texas, Washington, Colorado and the EU all regulate biometric data, but define and enforce it differently, and none were drafted with generative models in mind. Whether generating a new image from a selfie involves a "scan of face geometry" is genuinely unsettled. Some rulings suggest data derived from photographs can qualify; others dismissed claims where the plaintiff could not show the system identified anyone. | Question legal will ask | Why it matters | What you need ready | | Does this collect biometric identifiers? | Determines whether BIPA-style consent rules apply | A technical description of what the vendor stores | | How do we get consent, and is it valid? | Employer-employee consent is scrutinized, especially in the EU | A consent flow and a documented opt-out | | Where is data processed, and by whom? | Drives GDPR transfer analysis and subprocessor review | Vendor DPA, subprocessor list, hosting regions | | Are our people's likenesses training your models? | The most common blocker in security review | A contractual "no training on customer data" commitment | | What happens when someone leaves? | Retention and likeness rights outlive employment | A deletion SLA and an offboarding policy | The one thing to know: the answer is not to avoid the category, but to arrive with documented answers. Teams stall in legal review not because the tool was unusable, but because nobody could answer the fourth question above. This is