What must be true before a real person's face and voice are recreated by a machine — and what must remain true afterwards.
Recreating someone's likeness is now trivial. Establishing that they agreed to it is not, and almost nobody is doing it. This document sets out the minimum we hold ourselves to. It is published so that others can hold themselves to it, and so that anyone buying this technology has something concrete to ask a vendor for.
It is deliberately short. A standard nobody reads protects nobody.
No likeness is generated before a consent record exists. This is enforced in software, not in policy: provisioning refuses to run without one. There is no override, and no "we'll collect it later."
Consent is given by the depicted person, actively — a checkbox that is never pre-ticked, and a typed signature. Consent given by an employer on an employee's behalf is not consent.
I authorize [Operator] to collect and use my biometric identifiers — a scan of my facial geometry (from my photo) and my voiceprint (from my voice recording) — to create and operate an AI-generated digital replica of my likeness and voice that engages consumers on my business's behalf.
Purpose & retention: these identifiers are used solely to build and run my Digital Identity. [Operator] stores them only as long as needed to provide the service, and will permanently delete them upon my request, when my account ends, or within 3 years of my last interaction — whichever comes first. Deletion covers [Operator]'s own systems and the service providers that process these identifiers on [Operator]'s behalf; copies in those providers' routine backups are removed on their own schedules. Deletion does not extend to copies of finished videos that my business, or anyone it shared them with, has downloaded or stored on its own systems.
I confirm I am the person depicted and have the right to grant this permission. I understand the videos are AI-generated and disclosed as such, and that I may revoke this authorization and request deletion of my biometric data at any time.
If I revoke: [Operator] will immediately stop creating videos of my likeness or voice and stop distributing them through [Operator]'s channels, except advertising already paid for, which may run to the end of its paid term, not to exceed 90 days. My revocation applies to [Operator] only; it does not change any separate agreement between me and my business, or my business's use of videos it already holds.
[Operator] is the organization that creates and runs the likeness. Personæ's signup form uses this text word for word, with Personæ named (its consent wording version v6-revocation-2026-09).
Autorizo a [Operador] a recopilar y usar mis identificadores biométricos — un escaneo de la geometría de mi rostro (a partir de mi foto) y mi huella de voz (a partir de mi grabación de voz) — para crear y operar una réplica digital de mi imagen y mi voz, generada por inteligencia artificial, que interactúe con consumidores en nombre de mi negocio.
Finalidad y conservación: estos identificadores se usan únicamente para crear y operar mi Identidad Digital. [Operador] los conserva solo durante el tiempo necesario para prestar el servicio, y los eliminará de forma permanente cuando yo lo solicite, cuando termine mi cuenta o dentro de los 3 años siguientes a mi última interacción, lo que ocurra primero. La eliminación abarca los sistemas propios de [Operador] y los de los proveedores de servicios que procesan estos identificadores en su nombre; las copias en los respaldos rutinarios de esos proveedores se eliminan según sus propios calendarios. La eliminación no se extiende a las copias de videos terminados que mi negocio, o cualquier persona con quien los haya compartido, haya descargado o guardado en sus propios sistemas.
Confirmo que soy la persona representada y que tengo el derecho de otorgar este permiso. Entiendo que los videos son generados por IA y se identifican como tales, y que puedo revocar esta autorización y solicitar la eliminación de mis datos biométricos en cualquier momento.
Si revoco: [Operador] dejará de inmediato de crear videos con mi imagen o mi voz y de distribuirlos a través de sus propios canales, salvo la publicidad ya pagada, que podrá continuar hasta el final de su periodo pagado, sin exceder 90 días. Mi revocación aplica únicamente a [Operador]; no modifica ningún acuerdo separado entre mi negocio y yo, ni el uso que mi negocio haga de los videos que ya tenga.
Every generated message carries a visible statement that it is AI-generated and that the depicted person consented. Not in a footer nobody reads — on the artifact itself, wherever it is played.
AI-generated message from [Name] · created with their consent.
Mensaje generado con IA de parte de [Nombre] · creado con su consentimiento.
A recipient who cannot tell they are watching a synthetic person has been deceived, whatever the paperwork says.
Consent that cannot be produced on demand did not happen. Every record is immutable and versioned, so it can be shown years later exactly as it was agreed.
| Field | Why it is captured |
|---|---|
signer_name | Typed signature, under the E-SIGN Act |
signer_email | Identifies the depicted person, not the buyer |
timestamp | Proves consent preceded creation |
ip | Corroborates the signing event |
consent_version | Proves what was agreed, not merely that something was |
scope | Bounds the permitted use |
Versioning is the clause most often skipped and the one that matters most. Without it, an organization can only say a person consented — never to what.
These are the regimes the standard is designed to satisfy. It is not legal advice, and it is not a substitute for counsel in any jurisdiction.
The pattern across all of them is the same. The line between lawful and unlawful runs through consent — obtained first, recorded properly, and disclosed at the point of delivery. Everything in this document follows from that.
This standard is free to adopt, in whole or in part, with or without attribution. Copy the clauses. Use the field list. Hold your vendors to it.
It is published by Personæ, which builds AI-generated digital identities for organizations, and which therefore has every commercial reason to want this settled rather than argued.
Patent pending: U.S. provisional applications 64/009,279 and 64/153,971. Publication of this standard is not a licence to any patented method; the consent language and record format above are offered freely and separately.