The trend of transforming photographs with AI is once again bringing a topic that usually takes a back seat to the forefront.

Photographs transformed with artificial intelligence have become a trend on social media again. This time, the fad involves taking current images and giving them an aesthetic inspired by the 1980s, a function that has gone viral rapidly and has led thousands of users to upload their photographs to AI tools.

But behind an image that seems like harmless entertainment, there is a question worth asking before hitting “upload”: what personal information does that photograph contain, and what will happen to it afterward?

Cybersecurity firm ESET warns that photographs and other personal data entered into digital platforms can, depending on the terms of each service, be stored, processed, or used for different purposes. There is also the risk that this information could be exposed if a platform or any of its storage systems suffers a breach.

A Photograph Contains More Than Just a Face

When a person uploads a photograph to the internet, they are not only handing over the image that appears on the screen. A photograph can show a person’s face, their home, family members, coworkers, approximate location, documents, vehicle license plates, or other elements of the environment.

Depending on the image and the service used, some of these elements can become relevant information from a privacy standpoint.

ESET pays special attention to data linked to facial recognition. The company reminds users that, unlike a password, biometric traits cannot be easily changed if they are compromised. Therefore, eventual exposure of this type of information could facilitate identity theft, fraud, or other forms of abuse.

Here, a clarification is necessary: not every photograph containing a face automatically constitutes a “biometric datum” in a technical or legal sense. The risk increases when an image is processed to individually identify or authenticate a person.

The Problem Doesn’t Necessarily Start with a Leak

One of the central points of ESET’s warning is that the risk is not solely about a database being hacked. The company points out that there is also concern about how the data users provide is stored, protected, and used, including the possible use of information for processes related to artificial intelligence models.

This means a person should ask themselves some questions before uploading a photograph, and not only after a security incident occurs.

“Before uploading a photo, we must ask ourselves what data we are handing over, who will have access to it, and what it will be used for,” warns Erick Argüello, manager of ESET Costa Rica.

What Should You Check Before Uploading an AI Photograph?

ESET recommends starting with something that many people overlook: reading the service’s privacy policies. This does not necessarily mean reading every term of use from beginning to end, but rather identifying basic aspects: what information the platform collects, how long it can keep it, and whether it contemplates sharing it with third parties.

It also recommends avoiding uploading personal or family images, or those containing sensitive information—for example, details related to the workplace—when there is not enough clarity about the platform’s protection measures.

A second precaution has to do with the applications or sites being used. The virality of a trend can also be exploited by criminals to create fake pages that promise to generate photographs with artificial intelligence. ESET warns that some of these platforms can be used to distribute malware or compromise the devices of those who visit them.

Therefore, a simple rule is not to download applications or use tools of dubious origin, especially when a fad goes viral and dozens of sites appear promising exactly the same result.

What Can Happen If That Information Is Exposed?

ESET mentions several risks, including fraud, identity theft, and other crimes. The impact can be especially complicated when the exposed information cannot be easily modified. A compromised password can be changed; a face cannot.

Added to this is that photographs can be part of information sets that, combined with other publicly available data, allow for building much more detailed profiles of a person.

Therefore, the security criterion should not be limited to asking if a certain photo “is important.” It is also advisable to think about what other data appears in it and what the image could reveal when combined with information available on the internet.

The Trend Is Not New

ESET’s warning comes amid another wave of images generated or transformed with artificial intelligence. The company recalls that, just over a year ago, another trend based on transforming real user photographs inspired by the aesthetic associated with the animation studio co-founded by Hayao Miyazaki also generated wide participation on digital platforms.

The pattern repeats: a simple tool, an attractive result, and a huge number of users willing to try it. Precisely for this reason, privacy can be relegated in favor of the speed and playful component of the experience.

Five Questions Before Clicking “Upload”

Before handing over a photograph to an artificial intelligence tool, the user can ask themselves five very simple questions:

What appears in the image besides me? Check for faces of other people, documents, uniforms, addresses, license plates, identifiable objects, or any other sensitive detail.

Who will receive the photograph? Look for clear information about the company or platform offering the service.

How long will they keep the image? The privacy policy should explain what happens to the files after the result is generated.

Can the information be shared with third parties? This is one of the aspects ESET recommends reviewing before using a platform.

Am I using the official site or application? This is especially important when a trend goes viral and pages start appearing that imitate legitimate services. ESET warns that some can be used to distribute malware.