Data as Likeness
ZAHRA TAKHSHID*
Artificial intelligence (AI) and data collection practices pose an ongoing
threat to consumers’ privacy. But plaintiffs have struggled to articulate pri-
vacy harms associated with data collection in a way that would give them
standing to sue. This is a particularly pressing issue given the advances in
generative AI and the unauthorized uses of individuals’ personal and bio-
metric data.
This Article revisits the privacy tort of appropriation of likeness and
argues that when data are conceptualized as likeness, this tort offers a
unique opportunity to protect against the unauthorized collection and use of
personal data. Grounding its argument in the historical evolution of the tort
of appropriation, this Article contends that an individual’s personal data
are an aspect of a person’s unique digital identity, mostly used by third par-
ties in a data-driven world, which should be covered by this tort.
Conceptualizing unauthorized personal data collection in this manner
underscores the evolving nature of the common law of torts in recognizing
new forms of harms. It offers a solution for the current gridlock on data pro-
tection measures and the unauthorized use of one’s data in emerging gener-
ative AI technologies such as deep voice. Recent Supreme Court decisions
have insisted that privacy victims must show some form of concrete harm to
achieve constitutional standing. Accordingly, employing the privacy tort of
appropriation of likeness and recognizing the concept of digital persona
allow plaintiffs to establish standing by identifying a close historical or com-
mon law analogue for their asserted privacy injury. Lastly, similar to other
privacy torts, this approach can survive First Amendment objections.
TABLE OF CONTENTS
INTRODUCTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1162
I. PRIVACY IN TORTS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1170
* Assistant Professor of Law, University of Denver Sturm College of Law, Faculty Associate at the
Berkman Klein Center for Internet and Society at Harvard University. © 2024, Zahra Takhshid. For
helpful comments and conversations, I am grateful to Intellectual Property Law Conference (IPLC)
participants at Stanford Law School (particularly Jennifer Rothman, Rebecca Tushnet, and Zahr Z.
Zaid), colleagues at Privacy Law Scholars Conference (PLSC) 2022 (special thanks to Jason Schmaltz,
Margot Kaminski, Felix Wu, and Jessica Silbey), and participants at Governance of Emerging
Technologies and Science, Arizona State University College of Law. This Article also benefited from
comments at faculty workshops at the University of Denver Sturm College of Law. Many thanks to K.
K. DuVivier, John Goldberg, Benjamin Zipursky, Nancy Leong, Laurent Sacharoff, Bernard Chao, and
Viva Moffat. Special thanks to Garrett Ian Littenberg and Hannah Le for excellent research assistance.
1161
II. THE EVOLUTION OF THE TORT OF APPROPRIATION . . . . . . . . . . . . . 1176
III. APPROPRIATION OF DIGITAL LIKENESS AND PERSONA . . . . . . . . . . . 1181
A. DATA AS LIKENESS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1181
B. WHAT TYPE OF DATA? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1188
C. CONSENT ............................................... 1191
D. STANDING . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1194
E. DATA AS LIKENESS AND THE FIRST AMENDMENT. . . . . . . . . . . . . . . . 1197
CONCLUSION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1203
INTRODUCTION
The average cell phone application (app) has six embedded trackers.
1
APPLE, A DAY IN THE LIFE OF YOUR DATA: A FATHER-DAUGHTER DAY AT THE PLAYGROUND 3
(2021), https://www.apple.com/privacy/docs/A_Day_in_the_Life_of_Your_Data.pdf [https://perma.cc/
DQS6-HDZS] (“Trackers are often embedded in third-party code that helps developers build their apps.
By including trackers, developers also allow third parties to collect and link data you have shared with
them across different apps and with other data that has been collected about you.”).
While
data-driven marketing is not a new phenomenon,
2
For instance, Facebook unveiled its ad model in 2007. See Facebook Unveils Facebook Ads, META
(Nov. 6, 2007), https://about.fb.com/news/2007/11/facebook-unveils-facebook-ads/ [https://perma.cc/
7KUG-ZPLE].
with the advent of Big Data
3
“‘Big Data’ refers to the massive amounts of digital information companies and governments
collect about human beings and our environment.” CLOUD SEC. ALL., EXPANDED TOP TEN BIG DATA
SECURITY AND PRIVACY CHALLENGES 5 (2013), https://cloudsecurityalliance.org/artifacts/expanded-top-
ten-big-data-security-and-privacy-challenges/ [https://perma.cc/2Q74-3CDP].
and generative AI,
4
4. “Generative AI refers to deep-learning models that can generate high-quality text, images, and
other content based on the data they were trained on.” Kim Martineau, What Is Generative AI?, IBM:
RSCH. BLOG (Apr. 20, 2023), https://research.ibm.com/blog/what-is-generative-AI [https://perma.cc/
ZQL6-VMHD].
the understanding of what personalization means for consumers
has rapidly and radically changed. Today, data-driven products based on individu-
als’ personal behaviors are everywhere. Some notable examples are wearable AI
devices telling you when you should see a doctor,
5
See, e.g., Bertalan Mesko, Feeling Sick? There’s an App for That! – The Big Symptom Checker
Review, MED. FUTURIST (Apr. 11, 2019), https://medicalfuturist.com/the-big-symptom-checker-review/
[https://perma.cc/XV7U-JQQY]. For more on the privacy challenges of wearable AI devices, see Zahra
Takhshid, Wearable AI, Bystander Notice, and the Question of Privacy Frictions, 104 B.U. L. REV.
(forthcoming 2024), https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4693396.
smart fridges knowing what your
next grocery shopping list should include,
6
See, e.g., Joe Fassler, Is Your Smart Fridge Spying on You?, COUNTER (Mar. 16, 2017, 7:49 PM),
https://thecounter.org/smart-fridge-spying/ [https://perma.cc/N7TJ-B7ZJ]; see also Alex J. Rouhandeh,
How Cyber Thieves Use Your Smart Fridge as Door to Your Data, NEWSWEEK (June 23, 2021, 4:00
PM), https://www.newsweek.com/how-cyber-thieves-use-your-smart-fridge-door-your-data-1603488
[https://perma.cc/6R8A-2SE7] (noting that a smart fridge is “the perfect site for [an] initial attack” by
cyber thieves).
apps on your phone collecting your snore
1.
2.
3.
5.
6.
1162 THE GEORGETOWN LAW JOURNAL [Vol. 112:1161
sounds to generate a personalized sleep cycle,
7
See, e.g., Privacy Policy, SLEEP CYCLE, https://www.sleepcycle.com/privacy-policy-2021/
[https://perma.cc/4VGX-DMG6] (last visited Mar. 13, 2024) (“When using the Sleep Cycle app . . .
some personal data will be collected through your device’s accelerometer (such as your movements),
microphone (such as snoring or other noises), camera (pulse), or device location (for weather and sleep
location statistics), and some personal data will be derived (such as sleep efficiency and sleep quality).”).
and websites that know when you
are pregnant.
8
See, e.g., Brian Contreras, How Instagram and TikTok Prey on Pregnant Women’s Worst
Fears, L.A. TIMES (May 25, 2022, 5:00 AM), https://www.latimes.com/business/technology/story/
2022-05-25/for-pregnant-women-the-internet-can-be-a-nightmare; Kashmir Hill, How Target
Figured Out a Teen Girl Was Pregnant Before Her Father Did, FORBES (Feb. 16, 2012, 11:02 AM),
https://www.forbes.com/sites/kashmirhill/2012/02/16/how-target-figured-out-a-teen-girl-was-pregnant-
before-her-father-did/?sh=1d9339d06668; NEIL RICHARDS, WHY PRIVACY MATTERS 35–37 (2021)
(discussing Target’s data-based “pregnancy marketing”).
Facial recognition technologies and revelations arising from recent litigation
involving the facial recognition company Clearview AI have further heightened
the concerns about collection of personal biometric data.
9
See Kashmir Hill, The Secretive Company That Might End Privacy as We Know It, N.Y. TIMES
(Nov. 2, 2021), https://www.nytimes.com/2020/01/18/technology/clearview-privacy-facial-recognition.
html. “Biometrics are biological measurements — or physical characteristics — that can be used to
identify individuals.” What Is Biometrics? How Is It Used in Security?, KASPERSKY, https://usa.
kaspersky.com/resource-center/definitions/biometrics [https://perma.cc/T4ZP-ALXG] (last visited Mar.
13, 2024). Personal biometric data can include “fingerprint mapping, facial recognition, and retina
scans.” Id. The ACLU settled its case with Clearview AI based on the Illinois comprehensive biometric
data law; the “settlement require[d] Clearview to maintain an opt-out request form, allowing IL
residents to upload a photo to ensure their faceprints will be blocked from appearing in their search
results, including searches by police.” ACLU (@ACLU), X (May 9, 2022, 1:12 PM), https://twitter.
com/ACLU/status/1523712577389629440 [https://perma.cc/9BRY-RCRF?type=image].
The expansion of the
metaverse
10
and creation of avatars for digital spaces have also instigated intru-
sive data collection practices.
11
See, e.g., Jesse Lake, Hey, You Stole My Avatar!: Virtual Reality and Its Risks to Identity
Protection, 69 EMORY L.J. 833, 845–48 (2020); Yvonne Lau, You’ll Soon Be Able to Put Your
Metaverse Avatar to Work—and Make Actual Money from It, FORTUNE (Feb. 7, 2022, 7:00 PM), https://
fortune.com/2022/02/07/metaverse-avatar-work-make-money-nft/.
For example, “spending 20 minutes in a VR simu-
lation leaves just under 2 million unique recordings of body language.”
12
Jeremy Bailenson, Protecting Nonverbal Data Tracked in Virtual Reality, J. AM. MED. ASS’N
PEDIATRICS, Aug. 6, 2018, at E1, E1. “VR” stands for “virtual reality.” Virtual reality is defined as “an
artificial environment which is experienced through sensory stimuli (such as sights and sounds)
provided by a computer and in which one’s actions partially determine what happens in the
environment.” Virtual Reality, MERRIAM-WEBSTER, https://www.merriam-webster.com/dictionary/
virtual%20reality [https://perma.cc/62P2-LBLC] (last visited Mar. 13, 2024).
More
recently, advances in generative AI, such as the ability to copy someone’s voice,
or create a similar version of it, have alarmed many.
13
See Pranshu Verma & Will Oremus, AI Voice Clones Mimic Politicians and Celebrities,
Reshaping Reality, WASH. POST (Oct. 15, 2023, 12:28 AM), https://www.washingtonpost.com/
technology/2023/10/13/ai-voice-cloning-deepfakes/; Tripp Mickle, Scarlett Johansson Said No, but
OpenAI’s Virtual Assistant Sounds Just Like Her, N.Y. TIMES (May 20, 2024), https://www.nytimes.
com/2024/05/20/technology/scarlett-johannson-openai-voice.html.
7.
8.
9.
10. “The metaverse is understood to be an immersive virtual world serving as the locus for all forms
of work, education, and entertainment experiences.” Jon M. Garon, Legal Implications of a Ubiquitous
Metaverse and a Web3 Future, 106 MARQ. L. REV. 163, 163 (2022).
11.
12.
13.
2024] DATA AS LIKENESS 1163
