Read this before uploading photos on AI tools - Hidden risks in participating in viral trends

As the viral trend of generating AI caricatures from personal photos spreads across social media, privacy experts are urging Kenyans to understand what happens to their data once images are uploaded to artificial intelligence platforms.

Ian Olwana, a lawyer and data governance and data protection expert, says many users participate in AI image trends without fully understanding the amount of personal information embedded in a single photograph.

According to Olwana, uploading a photo not only reveals the visible image but also exposes several layers of personal data. 

"Biometric data, such as facial geometry and physical traits, creates a unique 'face print' that cannot be changed and could theoretically enable identification across platforms," Olwana explains.

In addition, photos may contain hidden EXIF metadata such as GPS coordinates, timestamps, and device information, which can reveal a person’s location, movement patterns, and even socioeconomic indicators.

If not stripped out before uploading, this invisible data can unintentionally reveal where a photo was taken or patterns about a person’s movements, creating additional privacy risks beyond the visible image itself.

Environmental details captured in backgrounds, including home layouts, personal items, or workplace environments, can also unintentionally disclose sensitive lifestyle or professional information.

Under data protection frameworks, including Kenya’s legal regime, biometric information, such as facial images, is categorised as sensitive personal data because it is permanent and cannot be altered like passwords or identification numbers.

Recent judicial decisions have reinforced this classification. In Kenya Union of Journalists v. Kenya Broadcasting Corporation, the High Court ruled that facial templates used in biometric attendance systems constitute sensitive personal data and cannot be processed without consent, transparency, and a proper Data Protection Impact Assessment.

Olwana notes that the risks linked to uploading photos are real but often misunderstood. One of the biggest concerns is the long-term governance of personal data once collected, especially where platforms use uploaded images and prompts to train AI systems or build advertising models that rely on advanced profiling and micro-targeting.

However, some fears, such as immediate identity theft from a single uploaded image, may be overstated. 

In many cases, broader account breaches involving compromised passwords or email access present a more immediate threat than a single photo upload.

Additionally, many AI-generated outputs are intentionally stylised rather than photorealistic, which reduces certain forms of misuse.

Whether uploaded images are used to train AI systems often depends on platform privacy policies and terms of service, which typically disclose how user data is processed. 

Yet, Olwana observes that many users lack the time or technical capacity to read and interpret these policies, leading to uninformed consent.

Where personal images are mishandled, individuals can file complaints with Kenya’s Office of the Data Protection Commissioner (ODPC), which has already handled numerous cases involving misuse of images and personal data.

Legal experts warn that existing regulations may not be sufficient to address the rapid expansion of AI technologies. 

Kenya currently relies largely on general data protection laws to regulate AI-related risks, but stakeholders are increasingly calling for a dedicated AI governance framework to guide data use, algorithmic accountability, and risk mitigation.

The urgency of the issue has already reached the courts. Human rights activists recently filed a petition at the High Court seeking to halt the deployment of what they describe as “high-risk artificial intelligence systems,” arguing that unregulated AI adoption could threaten constitutional rights, including privacy, equality, and freedom from discrimination. 

While the court declined to grant immediate conservatory orders, it certified the case as urgent and scheduled a full hearing for February 19, 2026.

As AI-powered image tools become more common, experts advise individuals to adopt a cautious approach when sharing photos online. Using lower-resolution or stylised images, regularly auditing one’s digital footprint, and choosing platforms with clear privacy safeguards can help reduce long-term exposure of biometric data.

Olwana emphasises that users should assume any high-quality facial image uploaded to cloud-based platforms could be permanently mapped, making informed consent and awareness increasingly important as AI-driven trends continue to grow.