By: Scott Harris
I’m honestly pretty comfortable sharing my digital footprint with a handful of services I trust. What worries me is how that data could be used down the road, and how many services young people sign up for without a second thought about the consequences.
I got a lot more careful about my own kids’ apps after a work colleague told me about his son. He was in college, and investigators pulled him into a criminal case because his digital footprint showed he’d been at the party where the crime happened. He hadn’t seen anything. They still pressed him for a list of everyone else he saw there, with a timeline, and every name widened the circle and pulled more people in. To be fair, the circle eventually reached someone who could help close the case, and justice was served. But my colleague’s son ended up connected to so many friends and classmates getting dragged into it that his social life shrank almost overnight. He stopped getting invited to the parties he used to go to, wasn’t even welcome at some of them, and eventually transferred schools to start fresh.
He didn’t do anything wrong. His data did the talking.
The profile we’re all building
Deepfakes get the headlines, but the bigger shift is quieter: permanent digital identities built from everything we share and do online.
We generate data at a scale that’s hard to picture. Social media asks us to upload our photos, videos, opinions, and experiences. Our phones track where we go, what we search for, who we talk to, and increasingly our biometrics. Streaming services, retailers, and ad networks collect behavior data to predict what we’ll want next. Each piece looks harmless on its own. Put together, they form a profile detailed enough to show not just who you are, but how you think, act, and move through the world. Billions of people have one, and most of us have no real idea how big ours is.
We’ve seen where this goes
We’ve already had some hard lessons. The Cambridge Analytica scandal showed how Facebook data from millions of users was harvested and used for political ad targeting. Years earlier, Edward Snowden’s 2013 disclosures about the PRISM program showed how much of our digital communication intelligence agencies could reach. Those stories changed how a lot of people think about privacy and who owns their information.
More recently, AI and facial recognition have raised the stakes. After the January 6th Capitol riot, facial recognition was used to identify people in publicly available photos and video. Companies like Clearview AI have built enormous biometric databases by scraping billions of public images from websites and social media.
Those tools are usually sold for law enforcement and public safety, and they can serve those purposes. They also show how easily public information can be turned into a searchable biometric profile without anyone’s knowledge or consent. Even when the intent is legitimate, the potential for abuse is real. Investigations have found cases where people with access to facial recognition databases allegedly used them for unauthorized personal searches. That raises hard questions about accountability, oversight, and how much surveillance a democratic society should accept.
From identifying people to recreating them
As AI improves, the ability to identify, monitor, imitate, and even recreate people is growing fast. AI can already copy voices, build realistic avatars, predict behavior, and produce convincing simulations of real people. What used to be science fiction is quickly becoming routine.
Meanwhile, every photo we upload, every voice clip, every message, and every video adds to a growing reservoir of material that could be used to rebuild a person in digital form. That brings me to the question at the center of this post: who should have the authority to decide how your digital identity is collected, replicated, and used?
Privacy laws mostly protect specific kinds of sensitive information, like financial records, medical history, and ID numbers. There’s far less protection for your identity as a whole.
That’s the gap Digital Persona Rights would fill. They’d recognize that you should keep meaningful control over your likeness, voice, image, behavior patterns, biometric data, and any AI-generated version of you. Instead of treating your identity as scattered bits of data owned by whichever platform collected them, they’d treat it as an extension of your own autonomy and dignity.
In practice that could mean the right to consent before your likeness is used in an AI system, the right to block unauthorized digital copies, and the right to challenge deceptive or exploitative synthetic media. It may also need to reach past a person’s lifetime, so that you, or family members you choose, decide how your digital replicas, archives, and AI simulations can be used after you’re gone.
Stolen data, stolen personas
This goes beyond privacy. Employment, politics, advertising, entertainment, and even criminal cases, like the one that upended my colleague’s son’s life, will increasingly turn on who owns and controls digital identity. Soon the fights won’t only be about stolen data. They’ll be about stolen personas.
Most of the public conversation about AI focuses on misinformation, automation, jobs, or long-term safety. Underneath all of it is something that may matter just as much: how we define a human identity in the digital age. In a world where AI can convincingly recreate people, imitate their personalities, and keep digital versions of them around indefinitely, we’re going to have to answer a question no society has faced before.
Who owns the rights to a human identity? The answer will shape privacy law, civil liberties, and digital rights for decades.
Join the conversation