Image, voice, and likeness are governed by a fast-moving patchwork — biometric privacy in Illinois, digital-analog statutes in California and Tennessee, the EU AI Act, a forming federal right. We're building one consent spine that designs to the strictest applicable standard, market by market, and runs the rules as gates — not a certificate in a drawer. It's being built, not finished, and it supports your counsel; it never replaces it.
Most “compliance” is a PDF in a drawer and a promise. Ours is operational: identification is never acquisition, consent is granular and revocable, and no use ships that can't trace to a complete record. The regimes below aren't a reading list — each one is a gate a deal has to pass before anything is generated. Where a market isn't cleared yet, we say so.
Where regimes overlap, we build to the toughest one and apply it everywhere. One well-built consent can clear the union, the statute, and the regulator at once — not three half-measures that each miss.
Matching a face in public is not the same event as licensing it. Acquisition needs consent — explicit, scoped, on the record. The gap between the two is absolute, and the system enforces it, not trust.
PPL turns the rules into gates: consent capture, scope enforcement, labeling, revocation, audit export. We support your medical, legal, and regulatory review — we don't replace it, and nothing here is legal advice.
Not a disclaimer wall. For each rule that governs image, voice, or likeness, here's what it asks and the control PPL runs to meet it. The patchwork moves; this map tracks the current rule, not a fixed snapshot — and flags what we're still building.
RequiresWritten, explicit consent before any biometric capture; a private right of action with statutory damages.
How PPL designs to itConsent is captured before capture and versioned; PPL stores only the verification outcome — never a biometric template, geometry, or ID image.
RequiresConsent to capture a biometric identifier; no sale of the identifier.
How PPL designs to itNo template is held or transferred — identity is verified by a processor and only the binary outcome is referenced.
RequiresGoverns biometric AI, with carve-outs for fraud prevention and processing that doesn't uniquely identify a person.
How PPL designs to itDesigned as anti-fraud and to avoid uniquely-identifying use; we treat reliance on the statute's carve-out as pending written counsel confirmation.
RequiresConsumer-health and biometric consent; an express fraud-prevention carve-out.
How PPL designs to itExplicit consent up front; biometrics used for verification only and deleted on revocation. Reliance on the fraud carve-out awaits counsel sign-off.
RequiresName, image, voice, and likeness can't be used commercially without permission; scope and post-mortem rights vary by state.
How PPL designs to itEvery use is bound to a scoped, time-boxed, renewable license on the ledger — designed to the strictest applicable state.
RequiresSpecific rules for name/image/likeness deals, athletes included.
How PPL designs to itMulti-party approval and escrow; the holder is identity-verified and paid, with every approval on the record.
RequiresA living person's digital-analog terms are void without a specific use description and professional representation.
How PPL designs to itAnalogs are built only inside a specific, documented scope — never a forever grant, never a blanket clause.
RequiresAnalogs of deceased performers require estate or heir consent; post-mortem protection runs ~70 years.
How PPL designs to itPosthumous rights are exercised only by a verified estate holder and recorded end to end.
RequiresAn individual's voice is a protected property right, enforceable civilly and criminally.
How PPL designs to itVoice is licensed by the verified person; out-of-scope use is refused at the gate, not discovered later.
RequiresClear, conspicuous, reasonably-specific consent for analogs; in active renegotiation.
How PPL designs to itConsent is specific and recorded; independently-created analogs are the native product, with labeling on by default.
RequiresA forming federal digital-replication right covering unauthorized likeness and voice analogs.
How PPL designs to itWe design to it now — consent-bound, labeled, revocable — ahead of the law landing.
RequiresEndorsement and AI-disclosure rules; material connections must be disclosed.
How PPL designs to itCompensation and material connection are captured and disclosed; AI-augmented output is labeled.
RequiresTestimonials and endorsements require disclosure of compensation and material conflicts.
How PPL designs to itDisclosure is recorded on the license and present, standardized, in the finished work.
RequiresFair balance, testimonial substantiation, and e-records integrity.
How PPL designs to itAn MLR-style review gate before anything ships, plus an exportable, time-stamped audit trail.
RequiresBiometric data is special-category: explicit consent, minimisation, erasure, and a lawful basis for transfer.
How PPL designs to itArt. 9(2)(a) consent, pairwise pseudonyms, erasure that propagates to revocation, and SCCs for cross-border issuance.
RequiresLimits on biometric scraping and transparency / labeling obligations for AI-generated media.
How PPL designs to itNo scraped likeness is ever activated; every AI-augmented output is labeled by default and can't be silently stripped.
RequiresA selective-disclosure identity direction; member-state EUDI wallets are arriving.
How PPL designs to itOn a roadmap to anchor verification to a wallet presentation and selective disclosure, outsourcing biometric risk to the wallet.
RequiresDisclosure or restriction of synthetic likeness in election, intimate, and deceptive contexts.
How PPL designs to itOutputs are labeled and traceable to a consent record; a revocation is designed to invalidate the attestation everywhere that checks.
RequiresTamper-evident provenance that travels with a piece of media.
How PPL designs to itAn optional content-credentials manifest binds the attestation; the visible proof stays the person, the seal is a footnote.
The doctrine isn't a PDF in a drawer; it's the set of gates the system runs. A stage can't advance without the prior stage's record on the ledger. Here's the lifecycle in three moves, and the regimes each move answers to.
Public signals only shortlist a candidate against a live brief. No scraped face or voice is ever stored as usable material.
Granular, explicit consent — biometric, AI-augmentation, and each license dimension — then a scoped, time-boxed, renewable license bound to it.
Usage is checked against scope, every output traces to its consent record, and a revocation stops new generation and propagates.
Designed to these regimes. Not a certification.
Tell us the market and the use. We'll show how a single consented person clears every rule that applies — and exactly where we're still building.