What Counts as Biometric Data in AI Dating Headshots
Biometric data is not just a fingerprint or an iris scan. Under statutes such as the Illinois Biometric Information Privacy Act (BIPA), Texas's Capture or Use of Biometric Identifier Act (CUBI), and Washington's biometric law, a "biometric identifier" includes a scan of the geometry of your face, voiceprint recordings, and any derived mathematical template stored by a vendor. When you upload ten selfies to an AI travel or dating-profile headshot generator, that service runs your photos through a neural network, measures distances between your eyes, nose, and jawline, and stores the resulting embedding vector alongside the original images. That vector is treated as biometric data in BIPA-defended states, even though it looks like a string of numbers rather than a photograph.
Also worth reading: How Can You Protect Biometric Privacy While Traveling and Using Dating Apps? · Are Dating App Biometric Security Checks Worth It for Safer Online Dating in 2026? · Are dating photo AI permissions safe, and what should you check before uploading your face?
The companies that operate in this corner of generative AI rarely disclose what they retain. Some keep your raw uploads; others delete the images immediately and store only the vector; a few keep both indefinitely as part of a "model improvement" dataset. A deletion request, therefore, has to address three separate artifacts: the photos you uploaded, the model weights that were fine-tuned on your face, and the inferred embeddings cached for retrieval or similarity search. Most platforms will only handle the first two, which is why results vary wildly between vendors.
State law coverage matters. As of late 2026, only Illinois, Texas, and Washington give you a private right of action for misuse of biometric identifiers. California treats face geometry as sensitive personal information under the CCPA/CPRA framework but does not require the written notice and consent that BIPA mandates. Roughly 16 states now have consumer privacy statutes that mention biometric deletion, but the language is inconsistent: some require a 30-day response window, others 45, and a handful still have no enforceable rule.
Why AI Headshot Platforms Are Different From Typical Dating Apps
A standard dating app like Tinder, Bumble, or Hinge holds photos you uploaded yourself, plus behavioral metadata such as swipes and message timestamps. The deletion workflow is straightforward because the data lives in a relational database and the company has a vested interest in showing you a clean privacy dashboard to avoid churn. AI headshot services sit in a murkier spot. Your face is consumed twice: once to generate the output images, and once again during the training or evaluation of the model. The output gallery may live in cloud storage; the training contribution may have been baked into weights that are served to thousands of subsequent users.
This is why a simple account deletion is rarely enough. When you click "Delete Account" on most headshot platforms, the front-end interface goes dark but the embeddings that helped shape the diffusion model remain in the checkpoint files. Researchers have repeatedly shown that diffusion models can regurgitate training examples, which means a sufficiently motivated attacker could reconstruct your original selfies from a fine-tuned checkpoint if it has not been scrubbed.
The legal status of those checkpoints is unsettled. The 2026 California DROP (Delete Request and Opt-Out Platform) mandate, which took effect in August, requires data brokers to honor deletion requests within 30 days and carries penalties of $200 per day per record for non-compliance. The mandate covers more than 600 registered brokers, and several AI headshot vendors have registered as brokers to avoid being misclassified as something stricter. Whether that registration shields them from BIPA-style claims remains an open question as of August 2026.
Step-by-Step: Submitting a Biometric Deletion Request
Begin by inventorying every service you have used in the last 24 months. Most users try two or three headshot generators, plus a general-purpose image model that offers a "portrait" preset. For each service, locate the privacy policy and identify whether the company lists a dedicated biometric or "right to delete" contact email. Federal and state privacy statutes typically require this email to be monitored by a human, not auto-replied, especially when biometric identifiers are involved.
Draft a request that names the legal basis for deletion. If you are in Illinois, cite BIPA Section 15(b) and (d). If you are in California, cite CCPA Section 1798.105 and the DROP regulation. If you are in a state with a general privacy law such as Texas's TDPSA or Colorado's CPA, cite the right to delete and the right to correct. Include your full name, the email associated with the account, dates of upload if you remember them, and an explicit demand that the company destroy (a) original uploads, (b) any derived embeddings, and (c) any model weights fine-tuned on your images.
Send the request through a channel that creates a paper trail. Certified mail is ideal, but a support ticket with a unique reference number works for most vendors. Do not rely on in-app toggles. A checkbox that says "do not use my photos for training" is a consent preference, not a deletion. You need a separate, dated request that the company must acknowledge in writing. Under BIPA, a company has 30 days to comply or face statutory damages of $1,000 per negligent violation or $5,000 per intentional violation. Under CCPA, the window is 45 days, extendable by another 45 with notice.
If the vendor refuses, escalates, or stalls, your next move depends on jurisdiction. In Illinois you can file in state court without exhausting administrative remedies. In California you can lodge a complaint with the Attorney General or, under DROP, with the Privacy Protection Agency. Several multi-state plaintiffs' firms now run free intake portals for biometric deletion disputes because the statutory damages are high enough to justify contingency work.
Comparing the Major Headshot Platforms
The table below summarizes how the best-known AI headshot services handle biometric deletion as of August 2026. Always confirm the policy at the moment you submit your request, because vendors update their terms frequently and the data broker registry refreshes quarterly.
| Feature | HeadshotPro | Aragon AI | Try It On AI | Remini |
|---|---|---|---|---|
| Account deletion removes uploads | Yes | Yes | Yes | Partial (30-day window) |
| Removes embeddings from active model | No disclosure | Yes (opt-in) | No | No disclosure |
| Fine-tuned weights scrubbed on request | No | Yes | No | No |
| BIPA-aware response template | Yes | Yes | No | No |
| CCPA deletion portal | Available | Available | Manual email only | Manual email only |
| Average response time | 7 days | 14 days | 21 days | 45 days |
| Statutory damages if ignored | $200/day under DROP | $200/day under DROP | $200/day under DROP | $200/day under DROP |
Common Mistakes That Undermine a Deletion Request
The most common mistake is treating an "AI training opt-out" toggle as a deletion. That toggle, common since the EU AI Act's transparency requirements filtered through to U.S. vendors, only prevents future use of your data. It does not destroy what has already been collected. A second mistake is sending a request from an email the vendor does not have on file. The company is within its rights to reject the request as unverifiable, and most BIPA case law supports that posture if the company documents a reasonable verification process.
A third mistake is forgetting about derivative data. If your generated headshots were used in marketing, published on a stock photo site, or shared in a community Discord, deletion from the originating vendor does not pull those downstream copies. You have to send separate notices to every downstream recipient. A fourth mistake is assuming a single request covers every service in a corporate family. Many headshot startups are owned by larger AI groups; the parent company may run separate databases under different terms of service.
Finally, do not rely on the vendor's status page or a chatbot confirmation. Save screenshots, ticket numbers, and postal receipts. The 2026 DROP enforcement actions show that regulators are willing to impose per-day fines retroactively, but those fines are easier to recover when you can prove the date of your original request.
When Timing Matters
Statute of limitations is the constraint most users ignore. BIPA gives you ten years from the date of violation to file suit, but California's CCPA has a three-year window for administrative complaints and a one-year window for civil actions under the Private Attorneys General Act. If you uploaded photos in 2023 and only now realize a vendor sold your embeddings, you may already be outside the practical enforcement window. Delete early, delete repeatedly, and document every interaction.
There is also a competitive reason to act quickly. Several headshot vendors have been acquired in the last 18 months, and during M&A transitions, data deletion requests are often queued behind other priorities. If you know a vendor is in transition, submit your request immediately and request written confirmation. Once the data assets are transferred to a new entity, your original consent may not survive the change of control.
Costs and Practical Trade-offs
Submitting a deletion request is free. You do not need a lawyer unless the vendor refuses and you intend to litigate. Most reputable services comply within 14 days at no charge. If you use a privacy-focused intermediary such as DeleteMe, Privacy Duck, or the free EasyOptOuts tool, expect to pay between $20 and $130 per year for automated re-scans. That price is justified if you cycle through headshot platforms often or if your profession requires you to keep your face off generative AI datasets.
The hidden cost is the loss of convenience. Once you delete your biometric data from a headshot vendor, you cannot use that vendor's "refine my style" feature again without resubmitting photos, which restarts the consent and retention clock. If you depend on AI headshots for dating profiles, travel agent branding, or LinkedIn refreshes, plan to resubmit every 90 days and accept that each submission carries some risk.
What to Do If the Vendor Ignores You
Document a second request after 30 days, escalating to a certified letter. If that fails, file complaints with the state Attorney General, the FTC, and, where applicable, the state's biometric-specific regulator. Under DROP, complaints can also be filed with the California Privacy Protection Agency, which has authority to issue subpoenas and impose fines. The agency reported in July 2026 that it had processed more than 14,000 deletion complaints in its first 90 days, with a median resolution time of 41 days. Almost 12 percent of those complaints involved biometric identifiers from generative AI services.
If you are considering litigation, BIPA remains the most plaintiff-friendly statute. Settlements in 2025 and 2026 ranged from $1,200 for individuals to $92 million for class actions involving facial recognition vendors. AI headshot services have so far avoided class treatment, but several firms are actively recruiting lead plaintiffs. A single, well-documented BIPA claim can recover your statutory damages, attorney fees, and the cost of credit monitoring if you request it.
Final Checklist Before You Hit Send
Before submitting any deletion request, verify three things: the vendor's current corporate name and registered agent, the state whose law you intend to invoke, and the exact email or portal address listed in the privacy policy. Avoid generic addresses such as support@ or hello@ when a privacy@ address exists, because the latter is more likely to route to compliance staff. Send your request from the email account tied to the service so the company can verify your identity without a follow-up questionnaire. Keep a copy of every message, every attachment, and every shipping receipt. If the vendor responds that your data has already been deleted, ask for the date and method of deletion in writing. This protects you if a future breach exposes your old photos and the vendor tries to argue that you never asked for them to be removed.
In short, treating biometric deletion as a multi-step legal workflow rather than a single button click is the only reliable path to getting your face out of generative AI datasets. The law is patchy, the vendors are inconsistent, and the enforcement is uneven, but the tools exist and they work when used with precision.