When unauthorized AI avatars of celebrities started showing up — a cloned face selling a product the person never touched — the headlines framed it as a disclosure problem. It is not, or not only. The deeper issue is consent, and consent on an avatar is decided at a specific, earlier moment than most people realize: the moment the avatar is created, not the moment it is posted. This guide is about that creation-time gate. It defines what AI avatar likeness consent actually is, sorts avatars into the three categories that matter — your own likeness, a licensed stock performer's, and a fully-synthetic character — and explains the different consent each one carries. It walks through how the two most-used avatar platforms, HeyGen and Synthesia, actually enforce consent at creation (an on-camera statement, a live recording that must match the photo, a biometric check), and the uncomfortable detail buried in their terms: the platform gate verifies that someone consented, but the contract usually makes you, the customer, legally responsible for whether that consent was valid and in-scope. It covers why a cleared avatar is still a scoped one, why consent and disclosure are two separate obligations under rules like the EU AI Act's Article 50, and the extra wrinkle for avatars that talk back. It ends on the architecture that makes all of this manageable: building on a small set of avatars you create and own once, rather than cloning a fresh face for every piece.
An AI avatar is not a one-off clip. It is a reusable digital model of a face and voice that can be driven to say and do new things on demand — a persona you generate from repeatedly. That reusability is exactly why consent for an avatar works differently from consent for a single piece of generated media, and why most of the public conversation misreads it. When an unauthorized AI version of a celebrity surfaces selling something they never endorsed, the instinct is to call it a labeling failure: it should have said it was AI. But the labeling was never the first problem. The first problem is that a model of that person's likeness got built at all. Consent on an avatar is upstream of everything the avatar later does.
That upstream point has a precise location: the moment of creation. The question that decides whether an avatar is defensible is not 'did we disclose the finished video' — it is 'did the person whose face this is agree to a model being made of them, and on what terms.' This reframes the whole subject. If you treat avatar consent as a publish-time checkbox, you will clear every individual post and still be sitting on an avatar you had no right to create. The consent you need is a yes to the existence of the digital replica, captured before the first frame is ever generated. Everything downstream — the scope of use, the disclosure on each post — rides on that one creation-time yes being real.
Not every avatar raises a consent question, and conflating them makes the whole topic harder than it needs to be. There are three distinct categories, and the consent obligation is different for each. The first is an avatar of your own likeness — your face, your voice. The consent here is trivially satisfied because you are consenting to yourself, but the platform still makes you prove it, because its system cannot tell your face from someone else's at the point of upload. The second is an avatar of another real person — a colleague, a hired performer, a client's spokesperson. This is where real consent lives: that specific person has to agree, in a way you can prove, before their replica exists.
The third category is the one people forget carries no likeness-consent burden at all: a fully-synthetic character that is not a clone of any identifiable real individual. If the face belongs to no one — generated from a prompt, resembling no specific person — there is no one whose consent you need, because there is no real identity being used. This is not a loophole; it is the clean case the whole system is built to reward. Platforms reflect this split directly. HeyGen's documentation, for instance, requires consent only for digital twins of a real, identifiable person, and explicitly does not require it for prompt-generated characters that depict no real human. The practical takeaway is that the consent question collapses to a single test: is there a real, identifiable person behind this face? If yes, their consent is mandatory. If genuinely no, it is moot.
A fourth category sits between stock and synthetic and is worth naming because it is where consent is handled for you: licensed stock avatars. Synthesia's stock avatars are built from footage of real actors who gave explicit consent and are compensated for the license, not per video — Synthesia's actors license their likeness for a three-year term in exchange for a flat fee, and a March 2025 talent program added an equity fund granting stock options to the actors whose avatars prove most popular with customers. When you use a licensed stock avatar, the performer's consent was secured by the platform under a contract, which is why these avatars come with usage limits you do not control. That is a genuinely different consent posture from an avatar you build yourself, and it is covered in the scope section below.
The major avatar tools do not take your word for it. They interpose a consent step between 'I want to build this avatar' and 'the avatar exists,' and that gate is the single most important enforcement point in the whole chain. HeyGen's default flow for a digital twin has the avatar's subject record an on-camera consent statement — through a hosted page, or from a phone by scanning a QR code — in which the person names themselves and states that they allow their footage to be used to build the avatar. The consent recording is submitted together with the avatar footage, not separately after the fact, which is deliberate: it ties the agreement to the exact material being used. Verification is semantic rather than a strict word-for-word match, so natural variation in phrasing is fine, but recordings that are too dark, blurry, or have unclear audio are rejected.
Synthesia enforces the same principle with its own mechanics. A photo-based personal avatar requires a live consent recording that confirms identity and authorization, and that recording cannot be uploaded — it has to be captured live, specifically so a stolen clip cannot stand in for a real person agreeing in the moment. The person on camera must match the person in the uploaded photo. Its more realistic selfie-avatar flow adds a biometric consent check during creation, aimed squarely at preventing unauthorized deepfakes. The company's stated policy is that it will not create an avatar without clear consent from the person depicted, and that moderation happens before generation, so a submission that violates policy never gets built in the first place.
The common design across both is the part to internalize: consent is enforced by the depicted person doing something only they can do — recording themselves, live, naming themselves — at the moment the avatar is made. You cannot create an avatar of someone else by uploading footage of them; the system is built so the subject has to show up and agree. That is a strong gate against the most common abuse, cloning a face you have no relationship with. It is also why trying to build an avatar of a public figure you do not control simply fails at the platform level, before any question of law or disclosure arises.
Here is the detail that catches teams off guard, and it is in the terms of service, not the marketing. The platform's consent gate proves that someone recorded a consent statement. It does not prove that you had the right to build the avatar, that the person who recorded the statement was who they claimed to be, or that your eventual use stayed inside what they agreed to. The contract typically closes that gap by shifting the legal responsibility onto the customer. Third-party readings of Synthesia's terms, for example, describe the customer as contractually responsible for obtaining free and informed consent from any individual whose voice or likeness is used to create a custom avatar, and for ensuring that individual is of the applicable legal age. (That is an analysis of the terms, not a court ruling — read the current terms directly before relying on it.)
The split matters because it defines where your exposure actually sits. The platform is protecting itself and policing the obvious abuse; it is not indemnifying you. If a performer later claims they did not understand what they were agreeing to, or that the use went beyond what they intended, the platform's logged consent video is evidence but not a shield — the obligation to have secured valid, informed, in-scope consent was yours. This is the same responsibility structure that runs through the whole unauthorized-likeness problem, mapped at length in the unauthorized AI likeness ads guide. The operational consequence is simple: treat the platform gate as the floor, not the ceiling. Keep your own consent record — who agreed, to what, for how long, on what date — attached to the avatar, because when a dispute or a platform review lands, that record is what resolves it.
Consent is not a blank check, and this is where even careful teams stumble. A yes to building an avatar is a yes to a specific range of uses, not to anything the avatar could conceivably do. The clearest illustration is in the licensed-avatar rules the platforms publish for themselves: Synthesia's usage terms differ by avatar type, and for stock and synthetic avatars, uses like training videos and organic sharing are permitted while paid TV and paid social ads are not — a boundary you do not get to override because the actor's license did not cover it. The same logic governs an avatar of a real person you cleared yourself. If someone agreed to be your spokesperson for internal communications, that is not consent to run their face in a paid acquisition campaign; if they agreed to a six-month run, month seven is a new ask.
Scope is also where the celebrity cases actually go wrong, beyond the headline fact that the face was stolen. Even a licensed likeness gets abused by being stretched — a face cleared for one product appearing on another, a voice cleared for one campaign resurfacing a year later. The discipline is to treat the consent you captured as a defined envelope with edges: which uses, which platforms, how long, what tone, and to re-clear before you expand any of them rather than generating first and asking later. An avatar you own is the easy case here, because you can re-consent yourself instantly; an avatar of another person is the one that demands a live record of scope you can point to. For anyone whose own likeness is being used beyond what they agreed to, the defensive playbook is in how to protect your likeness from AI deepfakes.
The most common and most expensive confusion in this whole area is treating consent and disclosure as the same box. They are not, and satisfying one does nothing for the other. Consent answers whose likeness you used and whether they agreed. Disclosure answers whether the viewer was told the content is AI-generated. You can own an avatar completely — your own face, recorded with your own consent — and still break the rules by publishing it with no AI label. And you can label a video flawlessly while the face in it is one you had no right to use. Two boxes, both must be ticked, and they are enforced by different systems for different reasons.
The disclosure half now has hard legal teeth in some jurisdictions. The EU AI Act's Article 50 transparency obligations, which apply from August 2026, require a deployer who publishes a deepfake — AI-generated or manipulated image, audio, or video — to clearly disclose that it is artificially generated, with the disclosure reaching the viewer at the latest at first exposure. The Commission's final Article 50 guidelines, adopted July 20, 2026, read 'deepfake' broadly enough that a realistic synthetic depiction of a person who does not actually exist still counts, and the absence of any intent to deceive does not defeat the labeling duty. (The guidelines are non-binding — authoritative interpretation ultimately rests with the courts — so treat the direction as the regulator's current reading, not settled case law.) In parallel, platforms run their own labeling and detection: YouTube's and TikTok's AI-content labels and likeness-detection tooling act on their own policy timelines, well before any regulator does. The platform-side map for one of them is in YouTube's AI disclosure and likeness rules, and how to handle a claim is in responding to a YouTube AI likeness claim.
One more category is emerging fast and carries its own consent-adjacent obligation: interactive avatars — the ones a viewer can converse with in real time, not just watch. The EU AI Act's Article 50 also covers AI systems that interact with people, requiring that the system identify itself as AI, and the Commission reads this to include autonomous agentic systems. For an avatar that holds a live conversation, that means two things stack: if it is modeled on a real person, you still owe the creation-time likeness consent, and on top of that the interactive system owes the viewer an up-front 'you are talking to an AI.' A convincing conversational avatar of a real human that neither cleared the likeness nor announced itself as AI fails both tests at once. If you are building in this direction, the design patterns are discussed in interactive digital avatars.
The whole subject reduces to a short discipline you can run before you build any avatar and before you publish anything it makes. First, classify the face: is it you, another real identifiable person, a licensed stock performer, or a fully-synthetic character who is nobody? That single answer determines whether you need consent and whose. Second, if it is a real person, capture consent at creation through the platform's gate and keep your own parallel record — who, what scope, what duration, signed and dated — attached to the avatar, not buried in an inbox. Third, read the scope and stay inside it: which products, which platforms, how long, what tone, and re-clear before you widen any of them. A borrowed public face never clears any of these; it is off the list entirely, no matter how good the output looks.
Fourth, disclose independently of consent. Apply the platform's AI-generated label and meet any applicable transparency rule on every piece the avatar produces, because owning the likeness does not exempt you from telling the viewer it is synthetic. Fifth — and this is the strategic one — prefer a small set of avatars you create and own over a fresh clone for every project. An owned avatar is one you have already cleared once and can defend forever; a new clone each time is a new consent obligation and a new liability each time, and it never accrues into anything. The producers who get actioned are optimizing for whichever face converts this week. The ones who stay clear are compounding a short, cleared, owned cast — which is exactly the architecture the next section is about.
Everything above points to the same architectural move — build on a few avatars you create and own once, rather than cloning a new face per piece — and that move maps precisely onto how Kompozy is structured. Kompozy is a content generation and multi-platform publishing engine, and its persona layer is an AI Influencer pool: a defined set of avatar identities you create and control, with one designated primary. The important property for consent is that this pool is the only place a real likeness ever enters the system. There is no per-post step where you upload a face to clone; generation draws exclusively from the cast you already created. That means the creation-time consent gate this guide is built around lines up with a single, named moment in the product — adding a persona — instead of being scattered across every piece you ship.
The payoff of clearing an identity once is breadth, and this is where an owned cast stops being a compliance convenience and becomes a production multiplier. A single consented persona does not drive one video type — it drives the entire persona format family: Persona Shorts talking-head clips, longer-form Persona HeyGen scenes, Persona VFX HeyGen with a generative hook, Persona Frames composited into brand templates, plus Persona Photos, Persona Infographic posters, and Persona Tweets on the image side. One creation-time yes unlocks all of it. So the consent you capture is not for a clip; it is for a reusable cast member that then appears across a whole content system — which is also why keeping the scope honest matters, since the same cleared face can now show up in far more contexts than a one-off clone ever would. This is the avatar video model applied as infrastructure, and it is the counterpart to the identity-first argument made in full in identity-first AI video.
For teams and agencies the isolation is as important as the breadth. Each workspace holds its own persona pool, so one client's consented avatar stays scoped to that client's workspace and cannot be rendered into another's content by accident — the consent record and the cast that depends on it travel together, per account, rather than pooling into one shared library where a face could leak across engagements. The Persona Brief governs each persona's voice and framing so the avatar stays inside the tone and claims it was cleared for across all seven formats, rather than drifting into something the identity was never meant to say. And because publishing runs through the same engine, the disclosure half rides the ship step — you apply each platform's AI-generated label as part of fanning the output to the eight social platforms plus blog and email — behind a per-post review gate on Autopilot that keeps a human on the approve step. The result is the architecture this guide argues for, made operational: consent captured once at persona creation, a short owned cast instead of endless clones, scope held by the brief, and disclosure applied at publish. For the specific case of avatars standing in for named humans at work, see AI avatar videos for employee communications; for making a defensible likeness ad end to end, how to make an AI likeness ad with consent.
It's the permission a real person gives to have their face and voice turned into an AI avatar — a reusable digital model that can be made to say and do new things. Consent attaches at creation, not at posting: the question is whether the person depicted agreed to the avatar being built from their likeness at all, and on what terms. A fully-synthetic avatar that clones no real person needs no one's likeness consent, but any avatar modeled on an identifiable human does.
Yes. The major avatar platforms require the person being depicted to prove consent at creation — HeyGen and Synthesia both make the subject record an on-camera consent statement, and the person cannot be someone else standing in. Beyond the platform gate, using an identifiable person's face or voice without permission can violate the right of publicity and a growing stack of AI-specific likeness laws. A borrowed public face is never cleared, no matter how good the model.
HeyGen requires consent only for digital twins of a real, identifiable person — not for prompt-generated characters that depict no real human. The default flow has the avatar's subject record an on-camera statement, through a hosted page or a phone via QR code, naming themselves and stating they allow their footage to be used to build the avatar. The consent video is submitted together with the avatar footage. Verification is semantic, so minor wording differences are fine, but dark, blurry, or unclear recordings are rejected.
Both, at different layers. The platform enforces a consent gate at creation and can refuse or disable an avatar. But the terms of service typically shift the legal responsibility to the customer: you are usually the one contractually responsible for obtaining free, informed, in-scope consent from the person whose likeness you use, and for confirming they are of age. The platform's gate proves someone recorded a statement; it does not prove you had the right to build the avatar or to use it the way you did.
No — they are two separate obligations and meeting one does not satisfy the other. Consent is about whose likeness you used and whether they agreed. Disclosure is about telling the viewer the content is AI-generated. Under the EU AI Act's Article 50, a deployer publishing a deepfake must clearly disclose it is artificially generated, and that duty applies even to a realistic synthetic person who is nobody real and even with no intent to deceive. You can have full consent and still break disclosure rules, and vice versa.
AI avatar likeness consent is the permission a real person gives to have their face and voice turned into a reusable AI avatar — and it is decided at creation, not at posting. Platforms like HeyGen and Synthesia gate it with an on-camera consent step the depicted person must record themselves, but their terms usually make the customer legally responsible for whether that consent was valid and in-scope. Consent is also separate from disclosure: labeling a video as AI, required under rules like the EU AI Act's Article 50, does not substitute for having the right to the face in it.
Get started → · ← All guides · Compare Kompozy vs other tools