AI photo restoration consent guidelines: what are the legal and ethical rules for colorizing someone else's photos in 2026?

Why Consent Matters in AI Photo Restoration

When someone submits a faded black-and-white photograph to an AI colorization tool, the question of consent rarely feels urgent. The image usually belongs to a family album, the face belongs to a grandparent who passed away decades ago, and the only "new" element is digital color. Yet the act of restoration touches several legal and ethical seams at once: image rights, personality rights, biometric data rules, and copyright. In 2026, those seams are pulled tighter than they were even two years ago.

Also worth reading: How do I use a diffusion model video restoration guide for colorizing and upscaling historical footage? · What are the definitive responsible AI image restoration guidelines for colorizethis.io users? · What are the ethical guidelines for restoring photographs with AI?

A useful starting point is the distinction between copyright and personal rights. Copyright in a photograph generally belongs to the photographer or their estate, and it lasts 70 years after the author's death in most jurisdictions following the Berne Convention. Restoring a copyrighted work, even with AI, can produce a derivative work whose distribution requires permission from the rights holder. Personal rights are different: they belong to identifiable people in the image and protect likeness, reputation, and dignity. Many countries outside the United States recognize personality or moral rights that follow a person beyond death, sometimes for 20 years, sometimes for 100. A restored portrait of a recognizable public figure can therefore raise both copyright and personality issues at the same time.

The 2026 environment is shaped by overlapping regulatory waves. The European Union's AI Act entered its general-purpose phase on 2 August 2026, classifying certain biometric and emotion-recognition systems as high-risk. The United Kingdom finalized voluntary guidance for facial restoration tools in late 2025 after a public consultation. In the United States, there is still no single federal photo-consent statute, but state-level biometric laws (Illinois BIPA, Texas CUBI, Washington biometric law) apply whenever a face is processed. Adobe's 2025 acquisition of Topaz Labs, which folded professional denoising and face-reconstruction models into Adobe's flagship products, also shifted how creators expect consent flows to be handled inside software.

The Four Consent Tests You Should Apply

Most platforms, including colorization services, distill the law into four operational tests. Running them before uploading a photograph takes a few seconds and avoids most downstream problems.

First, identify who holds copyright. If you took the photograph, you almost always own it. If a studio, newspaper, or government agency took it, the original rights holder may still control reproduction. Second, identify whether the subject is identifiable. A crowd shot from 1955 with a 12-pixel face raises fewer concerns than a close-up portrait. Third, identify whether the subject is alive. Many jurisdictions extend personality and publicity rights for decades after death, so a 1920 portrait of a named individual may still require the permission of heirs. Fourth, identify whether the image was shared publicly or privately. Public publication does not by itself grant a license to modify and redistribute, but a private family photograph shared only with relatives is governed by a narrower set of obligations.

These tests are not legal advice, but they track how major platforms review restoration requests internally and how data-protection authorities describe risk.

How Colorization Tools Handle Consent in Practice

Reputable AI colorization services in 2026 use three layered mechanisms. The first is a terms-of-service clause that grants a non-exclusive license to process the upload. The second is a metadata and watermark practice: tools such as MyHeritage Deep Nostalgia and Remini add invisible C2PA-style provenance tags so downstream platforms can identify an AI-touched file. The third is a refusal or review queue for sensitive categories, including minors, nudity, and identifiable public figures without permission.

The practical flow looks like this. A user uploads a scan of a 1947 wedding portrait. The service runs it through a colorization model, returns a color version, and stores the original and the output for a retention window that varies from 24 hours to 30 days depending on the tier. Free tiers usually retain images longer to support model training; paid tiers often delete within hours. A responsible provider publishes that retention window in plain language and offers an opt-out toggle for training-data use.

Where things go wrong is usually in the gap between the provider's policy and the user's obligations. A user may have legal permission to upload, but the resulting colorized file may still violate the personality rights of a surviving family member, or it may be subject to a contractual restriction if the original photo came from a licensed archive. Treat the upload step as one consent event and the share step as a second, separate consent event.

Practical Steps Before You Upload

A short pre-flight checklist keeps most users out of trouble. The order matters because each step builds on the previous one.

Begin by establishing provenance. Try to learn who took the photograph, when, and under what conditions. Family inscriptions, album dates, and reverse image searches help. If the scan came from a museum, archive, or paid stock library, read the license terms: many archives grant personal-use restoration rights but forbid redistribution of AI-derived outputs. Next, identify living subjects and ask their permission, or the permission of a direct descendant. A two-line written note or a brief recorded conversation is usually enough for informal use. For commercial use, including monetized social media, printed merchandise, or publication in a book, get a signed release that covers both the original photograph and any AI-modified version.

Then evaluate the platform. Look for an explicit retention statement, a training opt-out, a content provenance tag, and a published contact for takedown requests. Avoid platforms that require you to waive moral rights or grant a perpetual, royalty-free license to derivative works as a condition of free use; such terms can be enforceable in some jurisdictions and unenforceable in others, but they create needless ambiguity. Finally, decide on the distribution scope. A private print for a living room has a different risk profile from a public post tagged with the subject's name, and a different profile again from a paid advertisement.

Common Mistakes That Lead to Complaints

Five patterns account for the majority of consent complaints logged by colorization services and their legal teams in 2025 and 2026. They are easy to avoid once you see them.

The first mistake is assuming that a photograph shared on social media is free to modify. Public visibility is not the same as a modification license. The second is restoring images of identifiable minors without parental consent, which triggers both biometric rules in Illinois and Texas and child-protection statutes in several European countries. The third is restoring historical portraits of named public figures and presenting the result as a "photograph," which can mislead viewers and attract right-of-publicity claims from heirs or estates. The fourth is scraping photographs from obituary pages or memorial sites; the original publication is for mourning and tribute, not for AI regeneration. The fifth is restoring copyrighted studio portraits, such as 1980s prom packages, and sharing them publicly without a release from the photographer.

A subtler error is treating AI colorization as inherently transformative. U.S. courts have sometimes treated colorized versions of black-and-white films as derivative works requiring permission, while EU and UK guidance tends to focus more on data-protection impact assessments than on derivative-work analysis. Either way, colorization alone rarely converts a protected image into fair use or fair dealing, especially when the restored version competes with the original market.

Comparing the Main Approaches to Consent

Different jurisdictions and platforms take meaningfully different approaches. The table below summarizes the four most common frameworks as of September 2026. Numbers reflect publicly stated thresholds and are best-effort estimates where regulators have not published hard numbers.

The practical takeaway is that the EU and UK frameworks emphasize data-protection impact assessments, the U.S. patchwork emphasizes biometric consent, and platform terms govern the day-to-day experience. A single workflow that satisfies all four is achievable: minimize retention, default to training opt-out, document provenance, and obtain a signed release for any commercial use.

When to Act Quickly and When to Slow Down

Some situations justify acting within hours. A funeral slideshow that needs a last-minute color restoration for an in-memoria reel falls into this category; a short, private, non-commercial use with no public posting carries low risk and rarely warrants a written release. A holiday gift print for a single recipient is similar. In both cases, a brief verbal confirmation from a family member who is authorized to speak for the subject is reasonable documentation.

Other situations call for a slower, more formal approach. Any commercial use, including sponsored posts, monetized YouTube videos, museum exhibits, and printed merchandise, should pause until a signed release is on file. Restorations intended for news media, especially of identifiable public figures or victims of historical events, should also pause, because editorial standards require provenance and redactions that AI outputs cannot reliably provide. Finally, any restoration involving a minor, a sexual or intimate context, a medical image, or a photograph supplied by a third party who is not the rights holder should default to refusal or formal review.

Cost, Pricing, and the Economics of Consent

The financial side of consent is straightforward but worth stating. Most consumer colorization services charge between $0 and $20 per month for subscription access, with per-image credits ranging from $1 to $5 on pay-as-you-go tiers. Professional tools bundled with restoration suites, including the post-Adobe Topaz product line and high-end Photoshop workflows, run from $20 to $60 per month. A signed image release from a model or heir typically costs $0 if drafted in-house using published templates, or $150 to $600 if run through a lawyer for commercial campaigns.

The hidden cost is reputational. A restoration posted without consent can generate takedown requests, platform strikes, and in extreme cases litigation. Illinois BIPA carries statutory damages of $1,000 per negligent violation and $5,000 per intentional or reckless violation, and Texas CUBI allows $10,000 per violation. Although these laws target the service provider more than the end user, a user who knowingly submits another person's biometric data without consent can be named in a complaint. Building a $50 to $200 consent budget into a restoration project is a rational hedge against six-figure exposure.

Where the Rules Are Still Moving

Three areas remain unsettled. First, the interplay between copyright and AI-generated derivative works is pending in multiple court systems, and a 2026 ruling from the U.S. Supreme Court of Copyright Review could clarify whether colorization alone produces a protectable derivative. Second, the definition of "biometric identifier" in restoration workflows is contested; some commentators argue that a transient face embedding used only for color prediction is not the same as a stored faceprint, while state regulators in Illinois have signaled a broader reading. Third, cross-border data transfers continue to shift; a colorization performed on a server in Ireland using a photo uploaded from California touches GDPR, CCPA, and possibly BIPA simultaneously. Tools that publish clear transfer paths and Standard Contractual Clauses fare better than those that route uploads through opaque proxies.

For users, the practical response is to assume the strictest applicable rule, document consent in writing, prefer providers with short retention and visible provenance tags, and avoid the five common mistakes listed above. The technology is maturing faster than the law, but the consent principles that have governed photographs since the early twentieth century still apply: know who owns the image, know who is in it, and ask before you publish.