Her face is selling the new range. Nobody asked her.

What the report says, and what we have not published

The report arrived on 20 October 2026. It names the label. It names the owner. It describes an AI content generator being used to produce campaign and product imagery of a model for the label's next range, says the model and her agency did not agree to it, and says the images are now circulating among the wholesale agents who place the label's stock with retailers. It records the matter as ongoing. The person who lodged it did not consent to being contacted.

We have not been able to verify the account independently, and we are not naming the business. We have also stripped out every detail that could narrow it down. What remains is enough to understand the problem, and the problem is bigger than one label. The report flags four of Australia's eight AI Ethics Principles: reliability and safety, transparency and explainability, privacy protection and security, and human-centred values. Reading it, you could add fairness and accountability without much argument.

Fashion got here first

A deepfake is any image, video or audio of a real person that has been synthesised or altered with AI so that they appear to do or say something they did not. The word arrived in 2017 attached to pornography, and most of the law written since has followed it there. But the commercial version has been building quietly for three years, and fashion has been the test bed.

In March 2023, Levi's announced a partnership with the Dutch studio Lalaland.ai to “supplement human models” with AI-generated ones, framed partly as a way to show more body types. The reaction was immediate and the company clarified within a week that the pilot was not “a means to advance diversity” and “should not have been portrayed as such.” In March 2025, H&M said it would create digital twins of 30 of its models, with their agencies, under terms that let the models keep the rights to their twins and be paid each time one is used, with a watermark on the AI images. The Model Alliance, the New York advocacy group for models, said it had serious concerns about digital replicas without meaningful protections.

In the August 2025 issue of American Vogue, a Guess advertisement featured two models who do not exist, created by a London AI agency, with a disclosure in small print that most readers missed. A TikTok video calling it out drew more than two million views. Guess called it a creative experiment. Then, in May 2026, a model named Francheska Pujols sued the US retailer Rainbow in the New York Supreme Court, alleging that after her photo shoot the company used AI to generate entirely new images of her in poses and settings she never agreed to. Rainbow denies wrongdoing and the case is at an early stage. It is, on its face, the same allegation the Australian report describes, five months earlier and on the other side of the world.

The pattern across all four is the same. The technology makes a new image of a person cheap. The question of whether the person agreed to it is treated as an afterthought, and then as a crisis.

Is it illegal in Australia?

Start with what most people assume is true and is not. Australia has no right to your own face. There is no “right of publicity” of the kind that exists in New York or California, and no personality right of the kind courts in China and India have applied to AI voice clones. The Arts Law Centre of Australia puts it plainly: Australia has no specific law aimed at preventing the unauthorised use of your image. What exists instead is a patchwork, and each piece was cut for a different problem.

Consumer law and passing off

The most useful piece is the Australian Consumer Law, which prohibits misleading or deceptive conduct and false representations about sponsorship or approval. Australian courts have applied its predecessor to images for sixty years. In 1960, two ballroom dancers whose photograph was used without permission on a record cover won a passing off case against the record company in Henderson v Radio Corporation, a decision still cited today. In 1989, the Full Federal Court upheld a finding that a shoe advertisement parodying the knife scene from Crocodile Dundee misled the public into thinking Paul Hogan endorsed the product. In 1997, Queensland's Court of Appeal found Telstra had misled the public with advertising that implied the swimmer Kieren Perkins preferred it to a rival.

The limit is the word “misled.” In 1990, the long jumper Gary Honey lost his case over a poster that used his photograph, because the poster did not suggest he endorsed anything. Consumer law protects the public from being deceived, and it protects a person's image only as a by-product. A working model who is recognisable to buyers but is not a household name may find that a court sees no deception in her face on a lookbook, because nobody assumes a catalogue model personally endorses the dress. Treasury reviewed whether the Consumer Law needs rewriting for AI and concluded in 2025 that it can generally handle AI products and services as it stands.

Contract and copyright

The strongest claim in a case like the one reported is probably the least glamorous. Models are booked under usage terms that specify what the images can be used for, where, in which media and for how long. A new set of images generated from an old shoot is a new use, and a competent agency will argue it was never licensed. Copyright points the same way. In Australia the photographer, not the brand and not the model, usually owns copyright in commercial shoot images, and a brand holds a licence with edges. Feeding those images into a generator to manufacture new ones is a reproduction and an adaptation that the licence almost certainly did not contemplate. The Federal Government reinforced that posture in October 2025 when the Attorney-General ruled out a text and data mining exception that would have let AI systems ingest copyrighted material without a licence.

These are real claims, but they are private ones. They depend on a model, an agency or a photographer with the money and the appetite to sue a small business, and they protect the paperwork around the person rather than the person.

The new privacy tort

Since 10 June 2025, Australians have been able to sue for a serious invasion of privacy, under a statutory tort added to the Privacy Act. It is broader than the rest of that Act and can reach small businesses that the Privacy Act's $3 million turnover exemption otherwise leaves alone. Its first outing came on 7 October 2025 in the District Court of New South Wales, where a judge granted an interim injunction to stop the misuse of private wedding photographs. But the tort requires a reasonable expectation of privacy, intentional or reckless conduct, and an invasion serious enough to clear a high bar. A professional model's face, photographed for publication, is a difficult place to locate an expectation of privacy. The tort was built for the wedding album, not the lookbook.

Criminal law stops at sex

The Commonwealth criminalised the sharing of non-consensual sexual deepfakes in September 2024, with penalties of up to six years, or seven where the person also created the material. The first prosecution under the law, of a South Australian man, reached court this year. New South Wales followed with its own offences from 16 February 2026, carrying up to three years, and South Australia moved earlier. None of these laws touches a deepfake that puts someone in a blazer rather than a bed. The eSafety Commissioner told the federal parliament's AI inquiry this month that a non-sexual deepfake can cause serious distress and that her office may be unable to have it removed unless it meets the threshold for serious adult cyber abuse, a threshold a manipulated video of two teachers kissing did not clear.

The bill that would fix it is stuck

The closest Australia has come to a general answer is a private senator's bill. The Online Safety and Other Legislation Amendment (My Face, My Rights) Bill 2025, introduced by the independent senator David Pocock on 24 November 2025, would prohibit the use of digitally altered or AI-generated content depicting a person's face or voice without their consent, create a complaints scheme with eSafety removal notices, and add a cause of action under the Privacy Act. It was debated at second reading on 25 June 2026. It remains before the Senate, without the support of either major party.

Advertising self-regulation offers little more. Ad Standards has said there is no blanket rule requiring disclosure of AI in advertisements, only that the usual rules apply regardless of how an ad was made. The industry body that writes those rules, the Australian Association of National Advertisers, is reviewing its Code of Ethics and has asked whether a specific AI rule is needed. An updated code is expected later in 2026.

Where the law has already moved

Other jurisdictions have decided not to wait for a case to come along. Four developments show what an answer looks like.

• New York, since 19 June 2025. The Fashion Workers Act requires clear and conspicuous prior written consent before a client creates or uses a model's digital replica, and the consent must spell out the scope, purpose, rate of pay and duration of the use. Agencies need separate written consent from the model before altering a replica with AI. Routine retouching is excluded.
• New York, since 9 June 2026. A separate law requires advertisers to disclose conspicuously when an ad uses an AI-generated “synthetic performer.” The first complaints to the state attorney-general about undisclosed AI models in apparel advertising followed within weeks.
• European Union, since 2 August 2026. Under Article 50 of the AI Act, anyone who deploys a deepfake must disclose that the content was artificially generated or manipulated. Breaches carry fines of up to 15 million euros or three per cent of worldwide turnover.
• Denmark, tabled 8 October 2026. A bill before the Folketing would make it unlawful to publish a realistic digital imitation of a person's appearance, voice or movements without consent, with the burden of proving consent on the publisher, courts able to order removal, and protection lasting 50 years after death. The target start date is 1 January 2027.

None of these is perfect, and the New York law in particular leaves open what happens to replicas created before it took effect. But each one answers the question Australia cannot. In those places, the label in the report would already be in breach, and the model would not need to prove that a buyer was deceived to say so.

What the numbers say about Australia

The gap between how Australians feel about this and how often it has happened to them is wide, which is exactly the condition under which a quiet commercial practice spreads.

• Fear is mainstream. The Australian Institute of Criminology reported in February 2026 that around half of Australians worry about being harmed by AI or becoming a victim of AI-enabled crime, and more than three in ten specifically fear deepfakes or impersonation. The figures draw on more than 10,000 respondents to the 2024 Australian Cybercrime Survey and a further AI questionnaire of more than 5,300.
• Experience is still rare, and under-counted. In the same research, fewer than one per cent said someone had created fake videos or photos of them in the previous year, while 14 per cent knew of someone impersonating them. A 2019 Monash University study across Australia, New Zealand and the United Kingdom found 14.6 per cent of 6,109 respondents had a sexualised digitally altered image made of them without consent. A model whose likeness is reused in a wholesale lookbook may never find out.
• Businesses are already targets. Research commissioned by Mastercard in 2024 found 36 per cent of Australian consumers and 20 per cent of businesses had been targeted by a deepfake scam in the previous year, and that only 12 per cent of people were confident they could spot one.
• Trust is the scarce asset. KPMG and the University of Melbourne found in 2025 that just 36 per cent of Australians are willing to trust AI, and 78 per cent are concerned about negative outcomes. The Office of the Australian Information Commissioner's 2026 community attitudes survey found only four per cent of Australians trust AI companies with their personal information.
• The workforce at stake is large and mostly women. The Australian Fashion Council's economic study with EY put the sector's contribution at $27.2 billion and 489,000 jobs, 77 per cent of them held by women. Models, photographers, stylists, hair and makeup artists sit at the end of that chain, and they are the jobs a synthetic shoot removes first.

The ethical problem is not subtle

Strip away the legal uncertainty and what is left is a short list of plain wrongs, which is probably why the person who lodged the report felt the need to.

Consent is the whole point. A model's face is her livelihood and her identity at once. She licenses it by the shoot, the season and the market, and the licence is the business. Generating new images from old ones takes the asset and leaves the person. That H&M, whatever else one thinks of its program, built it on consent, ownership and pay per use, shows that the alternative is not expensive or exotic. It is simply a conversation the label chose not to have.

The buyer is being told something untrue. A wholesale buyer looking at a lookbook is deciding how a garment hangs, moves and fits on a body, and ordering stock on that basis. An image of a garment nobody has worn conveys none of that, while appearing to convey all of it. If the buyer is not told, the image is a representation about the product that the label knows to be false. That is where consumer law may yet bite, and where retailers, who are placing orders on these images, have their own reason to ask questions.

Control is lost the moment the file is sent. The report's most troubling line is that the images are being shared on by the wholesale agents who received them. A synthetic image of a real person, once in circulation, cannot be recalled. It can be cropped, re-captioned, and re-used in contexts the label never intended and the model never imagined. Every downstream copy is a new potential harm that no one is accountable for.

Perfection is a product too. The criticism that followed the Guess campaign was not only about jobs. It was that a model who does not exist can have a body that does not exist, and that a generation of shoppers will measure themselves against it. Put a real woman's face on that body and the harm acquires a victim with a name.

The person who speaks up is the one at risk. The report records that the owner was told and continued. Someone inside or around that business made a judgement that this was wrong and said so, and then, when it did not stop, said so to us. Nothing in Australian law protects that person for doing it. That is the quiet second failure in this story, and it is why the incident channel accepts anonymous reports and why we have published nothing that could identify this one.

What a label should do instead

None of this is an argument against AI in fashion imagery. It is an argument for doing it the way a business would do anything else that involves another person's property. The practices below are the ones the New York law now requires, the ones H&M adopted voluntarily, and the ones the lawyers advising brands after the Rainbow case are recommending.

• Ask first, in writing, separately. Consent to be photographed is not consent to be synthesised. Get a standalone written agreement with the model and the agency that names the scope, the purpose, the pay and how long the images may be used.
• Check the photographer's licence. If the generator is being fed shoot images, the copyright owner has to agree. Most existing licences do not cover it.
• Tell the buyer. Label synthetic imagery as synthetic, in the lookbook and in the line sheet. Use content credentials where the tools support them so the disclosure travels with the file.
• Keep a human in the frame. Where fit and drape matter to a purchase decision, which in fashion is always, show the garment on a person who wore it.
• Write it down. A one-page policy on when the business uses generative AI, what it will never generate, and who signs off. Responsible AI Australia's free policy template covers it in an afternoon.
• Listen when staff raise it. The cheapest incident response is the conversation before the images go out.

What happens next

The federal legislative calendar for AI is now crowded. The Government has said it will introduce its Australian Standards for AI legislation by the end of 2026 and pass it in early 2027, though as consulted the standards are aimed at frontier model developers and data centres rather than at the businesses that deploy AI. The Joint Select Committee on Artificial Intelligence reports by 30 November 2026 with the adequacy of existing law in its terms of reference. An exposure draft of a digital duty of care bill was released in September. The My Face, My Rights Bill waits in the Senate. The advertising code is due for its five-yearly rewrite. Any one of them could close the gap this report fell through. None of them has yet.

Until then, the record is being kept the way it was in this case: by people who see something wrong and report it. Responsible AI Australia operates Australia's public AI incident reporting channel. Reports are accepted anonymously, published only in de-identified form, and used to inform our certification criteria and our submissions to government. If you are a model, an agency, a photographer or a buyer who has seen a likeness used this way, that is where to start. If you are a label considering it, the section above is where to start instead.

Questions people ask