Nevertheless, the litigation highlights an emerging area of risk for organizations developing, licensing, or incorporating generative AI applications into their operations.
Traditional software agreements may not adequately describe how AI applications analyze uploaded images or what data they generate from those images.
Where regulated biometric processing occurs, assess whether the organization's disclosures, releases, retention policies, and deletion procedures satisfy applicable legal requirements.
The outcome of these cases could help clarify the circumstances under which generative AI image processing constitutes biometric collection.
For businesses, understanding how AI applications process personal information is becoming as important as understanding what those applications can do.