Your Face, Their Prompt | What Meta's Muse Image Reveals About Declining Consent Online
When your digital identity becomes raw material for someone else’s imagination, who really owns your face?
On July 7, 2026, Meta launched Muse Image, the first standalone image-generation model developed by Meta Superintelligence Labs under Alexandr Wang. Positioned as a competitor to OpenAI’s GPT Images 2.0 and Google’s Nano Banana 2, the launch highlights Meta’s growing ambitions in the generative AI race. Yet beneath the technical advancements lies a far more consequential question than what AI can create, but about who gets to decide what it creates with?
That ambition of generative AI comes with a cost, and one of Muse Image's most controversial design choices is its integration with Instagram, which allows public profiles to become creative references for AI-generated images. Users can tag public Instagram accounts in prompts and generate AI images inspired by that person’s publicly available content. Meta presents this as a new form of personalization and creativity. However, critics argue that the feature transforms years of personal photographs into a massive library of AI-ready human identities, where non-action automatically becomes permission. The concern is not just that AI can generate realistic images. The concern is that consent itself is being manipulated in a way.
The opt-out system most users never asked for
Muse Image operates through Meta AI’s integration with Instagram. A user can reference a public Instagram profile in a prompt, allowing the system to generate images influenced by that person’s existing content and likeness. Under the default arrangement, the person whose profile is being referenced may not necessarily approve the generation beforehand.
Meta does provide users with controls to restrict this functionality. The setting exists under Instagram’s “Sharing and reuse” options, where users can disable permissions related to the use of their posts and reels with Meta’s AI features. But the larger issue is the direction in which responsibility flows. Instead of requiring active permission before someone’s likeness becomes available for AI-generated content, the burden is placed on individuals to discover the feature, understand the implications, locate the setting, and disable it. In a digital environment where users already navigate endless privacy menus, cookie banners, and terms of service agreements, expecting meaningful awareness from billions of people becomes unrealistic. Consent that depends on finding the exit door is very different from consent that begins with a choice.
A guide for opting-out
One way of opting out is to have a private account. As verified, Meta does not encroach on private accounts as of now for image-generation.
But if you have a public account, here are the steps that can be followed to secure yourself from Meta’s Muse automatic consent:
On your profile, tap the menu bar which is on the top right (≡), you will enter into ‘setting and activity’, after that you will see an option of ‘sharing and refuse’ and then disable the options under it, namely- Allow people to reuse your content on Instagram and with AI features at Meta. Notably, the changes made will be only for your future content not the already existing content on your public profile.
Why “public” does not mean “available for anything”
The debate around Muse Image highlights a deeper misunderstanding at the center of modern digital platforms: the difference between visibility and reuse. When someone makes an Instagram account public, they are generally making a decision about the audience. They are allowing others to view their photos, discover their profile, or engage with their content. That decision was never traditionally understood as permission for their face, appearance, personal moments, or identity markers to become reusable components in AI-generated media. A photograph posted online has context. It represents a specific moment, purpose, relationship, or expression. Generative AI changes that equation because it separates identity from context. A person’s likeness can be extracted from its original context and placed into entirely new situations created by someone else. Muse Image does not just expand who can see your content. It expands what can be done with it. That distinction is what scales the problem for every public user on the app. The privacy implications become significantly larger because of Instagram’s global reach. With billions of users worldwide, even a small percentage of affected public accounts represents an enormous number of people. Many public profiles do not belong to celebrities, influencers, or creators who intentionally operate as public brands. They belong to students, professionals, small businesses, artists, photographers, and everyday users who simply chose visibility within a social network.
For years, platforms encouraged people to share more, build audiences, and maintain a public digital presence. Now, the meaning of that public presence is changing after the fact. The question becomes: should a decision made years ago to share photos socially automatically extend into permission for generative AI systems built years later?
There is also a catch while opting out. Changing these settings only protects your content from being used in future AI generations, it does not undo anything that has already happened. Any AI images previously created using your public profile will remain unaffected. Essentially, the opt-out works as a shield for what comes next, not a reset button for what has already been created.
A familiar pattern in the AI era
Muse Image reflects a broader pattern emerging across the technology industry. New AI capabilities are introduced at massive scale, participation becomes the default, and individual control arrives afterward through settings that many users may never find. The same debates that once surrounded targeted advertising, data collection, and algorithmic profiling are now moving into a far more personal territory, the human identity itself. Faces are not ordinary data points. Unlike a username, password, or preference setting, a person cannot simply replace their appearance once it has been widely replicated.
Technical solutions such as AI watermarking and content labels may help identify generated material, but they address authenticity after creation. They do not answer the question of whether the generation should have happened in the first place.
Innovation cannot replace consent
The technological progress behind Muse Image is significant. Better image generation, improved text rendering, and more personalized creative tools represent genuine advances in artificial intelligence. But capability alone cannot determine acceptability. The future of AI will not only depend on how realistic images become, how powerful models become, or how quickly companies can deploy new features. It will also depend on whether people feel they have meaningful control over their own digital identities. Muse Image is therefore more than another AI product launch. It represents a defining question for the next phase of the internet: Will our online presence remain something we control, or will it become something others can generate?
Related Blogs
Executive Summary:
A manipulated image showing someone making an offensive gesture towards Prime Minister Narendra Modi is circulating on social media. However, the original photo does not display any such behavior towards the Prime Minister. The CyberPeace Research Team conducted an analysis and found that the genuine image was published in a Hindustan Times article in May 2019, where no rude gesture was visible. A comparison of the viral and authentic images clearly shows the manipulation. Moreover, The Hitavada also published the same image in 2019. Further investigation revealed that ABPLive also had the image.
Claims:
A picture showing an individual making a derogatory gesture towards Prime Minister Narendra Modi is being widely shared across social media platforms.
Fact Check:
Upon receiving the news, we immediately ran a reverse search of the image and found an article by Hindustan Times, where a similar photo was posted but there was no sign of such obscene gestures shown towards PM Modi.
ABP Live and The Hitavada also have the same image published on their website in May 2019.
Comparing both the viral photo and the photo found on official news websites, we found that almost everything resembles each other except the derogatory sign claimed in the viral image.
With this, we have found that someone took the original image, published in May 2019, and edited it with a disrespectful hand gesture, and which has recently gone viral across social media and has no connection with reality.
Conclusion:
In conclusion, a manipulated picture circulating online showing someone making a rude gesture towards Prime Minister Narendra Modi has been debunked by the Cyberpeace Research team. The viral image is just an edited version of the original image published in 2019. This demonstrates the need for all social media users to check/ verify the information and facts before sharing, to prevent the spread of fake content. Hence the viral image is fake and Misleading.
- Claim: A picture shows someone making a rude gesture towards Prime Minister Narendra Modi
- Claimed on: X, Instagram
- Fact Check: Fake & Misleading
Introduction
Law grows by confronting its absences, it heals through its own gaps. States often find themselves navigating a shared frontier without a mutual guide or lines of law in an era of expanding digital boundaries and growing cyber damages. The United Nations General Assembly ratified the United Nations Convention against Cybercrime on December 24, 2024, and more than sixty governments were in attendance in the signing ceremony on 24th & 25th October this year, marking a moment of institutional regeneration and global commitment.
A new Lexicon for Global Order
The old liberal order is being strained by growing nationalism, economic fracturing, populism, and great-power competition as often emphasised in the works of scholars like G. John Iken berry and John Mearsheimer. Multilateral arrangements become more brittle in such circumstances. Therefore, the new cybercrimes convention represents not only a legal tool but also a resurgence of international promise, a significant win for collective governance in an uncertain time. It serves as a reminder that institutions can be rebuilt even after they have been damaged.
In Discussion: The Fabric of the Digital Polis
The digital sphere has become a contentious area. On the one hand, the US and its allies support stakeholder governance, robust individual rights, and open data flows. On the other hand, nations like China and Russia describe a “post-liberal cyber order” based on state mediation, heavily regulated flows, and sovereignty. Instead of focusing on ideological dichotomies, India, which is positioned as both a rising power and a voice of the Global South, has offered a viewpoint based on supply-chain security, data localisation, and capacity creation. Thus, rather than being merely a regulation, the treaty arises from a framework of strategic recalibration.
What Changed & Why it Matters
There have been regional cybercrime accords up to this point, such as the Budapest Convention. The goal of this new international convention, which is accessible to all UN members, is to standardise definitions, evidence sharing and investigation instruments. 72 states signed the Hanoi signature event in October, 2025, demonstrating an unparalleled level of scope and determination. In addition to establishing structures for cooperative investigations, extradition, and the sharing of electronic evidence, it requires signatories to criminalise acts such as fraud, unlawful access to systems, data interference, and online child exploitation.
For the first time, a legally obligatory global architecture aims to harmonise cross-border evidence flows, mutual legal assistance, and national procedural laws. Cybercrime offers genuine promise for community defence at a time when it is no longer incidental but existential, attacks on hospitals, schools and infrastructure are now common, according to the Global Observatory.
Holding the Line: India’s Deliberate Path in the Age of Cyber Multilateralism
India takes a contemplative rather than a reluctant stance towards the UN Cybercrime Treaty. Though it played an active role during the drafting sessions and lent its voice to the shaping of global cyber norms, New Delhi is yet to sign the convention. Subtle but intentional, the reluctance suggests a more comprehensive reflection, an evaluation of how international obligations correspond with domestic constitutional protections, especially the right to privacy upheld by the Supreme Court in Puttaswamy v. UOI (2017).
Prudence is the reason for this halt. Policy circles speculate that the government is still assessing the treaty’s consequences for national data protection, surveillance regimes, and territorial sovereignty. Officials have not provided explicit justifications for India’s refusal to join. India’s position has frequently been characterised by striking a careful balance between digital sovereignty and taking part in cooperative international regimes. In earlier negotiations, India had even proposed including clauses to penalise “offensive messages” on social media, echoing the erstwhile Section 66A of the IT Act, 2000, but the suggestion found little international traction.
Advocates for digital rights such as Raman Jit Singh Chima of Access Now have warned that ensuring that the treaty’s implementation upholds constitutional privacy principles may be necessary for India to eventually endorse it. He contends that the treaty’s wording might not entirely meet India’s legal requirements in the absence of such voluntary pledges.
UN Secretary-General Antonio Guterres praised the agreement as “a powerful, legally binding instrument to strengthen our collective defences against “cybercrime” during its signing in Hanoi. The issue for India is to make sure that multilateral collaboration develops in accordance with constitutional values rather than to reject that vision. Therefore, the path forward is one of assertion rather than absence, careful march towards a cyber future that protects freedom and sovereignty.
Sources:
Introduction
With the increasing frequency and severity of cyber-attacks on critical sectors, the government of India has formulated the National Cyber Security Reference Framework (NCRF) 2023, aimed to address cybersecurity concerns in India. In today’s digital age, the security of critical sectors is paramount due to the ever-evolving landscape of cyber threats. Cybersecurity measures are crucial for protecting essential sectors such as banking, energy, healthcare, telecommunications, transportation, strategic enterprises, and government enterprises. This is an essential step towards safeguarding these critical sectors and preparing for the challenges they face in the face of cyber threats. Protecting critical sectors from cyber threats is an urgent priority that requires the development of robust cybersecurity practices and the implementation of effective measures to mitigate risks.
Overview of the National Cyber Security Policy 2013
The National Cyber Security Policy of 2013 was the first attempt to address cybersecurity concerns in India. However, it had several drawbacks that limited its effectiveness in mitigating cyber risks in the contemporary digital age. The policy’s outdated guidelines, insufficient prevention and response measures, and lack of legal implications hindered its ability to protect critical sectors adequately. Moreover, the policy should have kept up with the rapidly evolving cyber threat landscape and emerging technologies, leaving organisations vulnerable to new cyber-attacks. The 2013 policy failed to address the evolving nature of cyber threats, leaving organisations needing updated guidelines to combat new and sophisticated attacks.
As a result, an updated and more comprehensive policy, the National Cyber Security Reference Framework 2023, was necessary to address emerging challenges and provide strategic guidance for protecting critical sectors against cyber threats.
Highlights of NCRF 2023
Strategic Guidance: NCRF 2023 has been developed to provide organisations with strategic guidance to address their cybersecurity concerns in a structured manner.
Common but Differentiated Responsibility (CBDR): The policy is based on a CBDR approach, recognising that different organisations have varying levels of cybersecurity needs and responsibilities.
Update of National Cyber Security Policy 2013: NCRF supersedes the National Cyber Security Policy 2013, which was due for an update to align with the evolving cyber threat landscape and emerging challenges.
Different from CERT-In Directives: NCRF is distinct from the directives issued by the Indian Computer Emergency Response Team (CERT-In) published in April 2023. It provides a comprehensive framework rather than specific directives for reporting cyber incidents.
Combination of robust strategies: National Cyber Security Reference Framework 2023 will provide strategic guidance, a revised structure, and a proactive approach to cybersecurity, enabling organisations to tackle the growing cyberattacks in India better and safeguard critical sectors. Rising incidents of malware attacks on critical sectors
In recent years, there has been a significant increase in malware attacks targeting critical sectors. These sectors, including banking, energy, healthcare, telecommunications, transportation, strategic enterprises, and government enterprises, play a crucial role in the functioning of economies and the well-being of societies. The escalating incidents of malware attacks on these sectors have raised concerns about the security and resilience of critical infrastructure.
Banking: The banking sector handles sensitive financial data and is a prime target for cybercriminals due to the potential for financial fraud and theft.
Energy: The energy sector, including power grids and oil companies, is critical for the functioning of economies, and disruptions can have severe consequences for national security and public safety.
Healthcare: The healthcare sector holds valuable patient data, and cyber-attacks can compromise patient privacy and disrupt healthcare services. Malware attacks on healthcare organisations can result in the theft of patient records, ransomware incidents that cripple healthcare operations, and compromise medical devices.
Telecommunications: Telecommunications infrastructure is vital for reliable communication, and attacks targeting this sector can lead to communication disruptions and compromise the privacy of transmitted data. The interconnectedness of telecommunications networks globally presents opportunities for cybercriminals to launch large-scale attacks, such as Distributed Denial-of-Service (DDoS) attacks.
Transportation: Malware attacks on transportation systems can lead to service disruptions, compromise control systems, and pose safety risks.
Strategic Enterprises: Strategic enterprises, including defence, aerospace, intelligence agencies, and other sectors vital to national security, face sophisticated malware attacks with potentially severe consequences. Cyber adversaries target these enterprises to gain unauthorised access to classified information, compromise critical infrastructure, or sabotage national security operations.
Government Enterprises: Government organisations hold a vast amount of sensitive data and provide essential services to citizens, making them targets for data breaches and attacks that can disrupt critical services.
Conclusion
The sectors of banking, energy, healthcare, telecommunications, transportation, strategic enterprises, and government enterprises face unique vulnerabilities and challenges in the face of cyber-attacks. By recognising the significance of safeguarding these sectors, we can emphasise the need for proactive cybersecurity measures and collaborative efforts between public and private entities. Strengthening regulatory frameworks, sharing threat intelligence, and adopting best practices are essential to ensure our critical infrastructure’s resilience and security. Through these concerted efforts, we can create a safer digital environment for these sectors, protecting vital services and preserving the integrity of our economy and society. The rising incidents of malware attacks on critical sectors emphasise the urgent need for updated cybersecurity policy, enhanced cybersecurity measures, a collaboration between public and private entities, and the development of proactive defence strategies. National Cyber Security Reference Framework 2023 will help in addressing the evolving cyber threat landscape, protect critical sectors, fill the gaps in sector-specific best practices, promote collaboration, establish a regulatory framework, and address the challenges posed by emerging technologies. By providing strategic guidance, this framework will enhance organisations’ cybersecurity posture and ensure the protection of critical infrastructure in an increasingly digitised world.
