Imagine uploading a selfie to see how a jacket looks on you before buying it. The experience saves a trip to the trial room, but it also means handing over a personal photograph to an AI tool. As virtual try-ons enter online shopping, the question is not just how realistic the preview looks, but what happens to the image behind it.
OpenAI’s shopping experience on ChatGPT allows users to upload reference photos to visualise clothing and accessories. It is not alone in offering such tools. Google Shopping lets users upload their photographs to try on clothing virtually, while L’Oréal Paris offers a virtual makeup try-on that lets consumers test different products using a selfie or live camera feed. These tools offer shoppers a more personalised way to explore products, but they also raise questions about how personal images are processed, stored and protected.
“Typically, the image is uploaded to a cloud-based system, analysed for features such as body shape, pose or facial structure, and combined with product imagery to generate the virtual result. The exact process differs by platform. The risk arises if the original image, derived data or generated output is retained longer than necessary, linked to other user information, shared with third parties or reused for model training without clear consent. Google, for example, explicitly says its try-on photos are not used for training and that it does not store biometric data for the experience,” says Yasin Hamidani, Director, Media Care Brand Solutions.
More than a shopping photograph
The risks extend beyond a potential data breach. An image obtained without permission could be used to create manipulated or sexualised visuals, impersonate someone or cause reputational damage. Photographs that users believe are temporary may also remain stored longer than expected, depending on a platform’s policies.
Akshay D’Souza, Independent Consumer Consultant, highlights the range of risks that can arise when personal photographs are inadequately protected. “Some of the key risks include unauthorised use of a person’s face in sexualised content, impersonation for fraud, harassment or reputational harm, identity-related misuse involving attributes such as ethnicity and age, and data leaks that expose images users believed were temporary. Poorly governed AI training pipelines can also reproduce real people’s images, raising privacy and likeness-rights concerns.”
For D’Souza, responsibility extends across the brand, retailer and technology provider. “It is key to ensure that the uploaded images are not used for advertising, profiling, or AI training,” he says. He recommends watermarking images to identify their sources, processing them on the user’s device rather than sending them to cloud servers where feasible, and using input and output checks to prevent harmful or sexualised content. “No model training from the images used without specific consent,” he adds.
Shrish Anand Lal, Executive Director and Chief Business Officer, New Street, the company behind MiFiX.ai, says, “The safest design brings the AI to the data, not the data to the AI, so images are processed in a controlled environment and kept only as long as needed. Consent should be specific to that one use, not buried in terms and conditions.”
Processing images directly on a device, where technically feasible, can reduce transmission risks. Other measures include encryption, restricted access, short retention periods, output moderation and clear deletion options. However, once a generated image is downloaded or shared outside the platform, controlling its further use becomes harder.
What do platforms promise?
Privacy policies differ across services. Google’s official Shopping guidance says its virtual try-on photos are not used for model training and that it does not collect or store biometric data for the experience. Google also says users can delete their images.
OpenAI’s documentation confirms that reference photos can be saved for reuse and removed through Settings. These differences underline why consumers should not assume that every virtual try-on tool follows the same retention or processing practices.
For brands, reviewing a technology partner’s privacy policy is essential. Masuma Siddique, Founder and Chief Strategist, InkCraft Communications, says, “When we advise brands on these tools, the first conversation isn’t about the technology; it’s about the photograph. A selfie is deeply personal. So, the questions we ask are very basic. Where does the image go? Is it processed on the phone or sent to a server? How long is it kept? Is it used to train the platform’s models? Is it shared with any third party?”
Consumers should look for clear answers on why their photographs are collected, how long they are retained, whether they are used for AI training, who can access them and whether both original and generated images can be deleted.
Trust cannot be an afterthought
India’s data-protection framework gives brands a reason to examine what happens to photographs collected through virtual try-on tools, but compliance alone may not address every risk. Brands need to know whether their technology partners retain images, use them to train AI models or share them with third parties, and ensure customers can understand and control how their photographs are used.
For Lal, that responsibility must be built into the experience from the outset. “Personalisation and trust are not a trade-off, but trust has to be designed first. These tools will be judged less on how realistic the preview looks and more on how responsibly the images behind it are handled. Scaling them should follow measurable outcomes, but only after consent, retention and deletion are built in from the start, because retrofitting them later is far harder.”
Virtual try-ons can help shoppers make more informed purchase decisions, but their value depends on consumers feeling comfortable enough to use them. Clear consent, limited data retention and accessible deletion controls are therefore as important to the experience as the quality of the preview.
